Privacy Notice

Processing of personal information under the Protection of Personal Information Act, 4 of 2013 (POPIA).

1. Who we are

The Staff Hut Pty Ltd ("we", "the Company") is the responsible party for the personal information processed in the PEPIE HR system.

2. What information we process

To administer your employment we process, among other things:

• Identity & contact details (name, ID number, date of birth, address, phone, email);
• Employment details (job title, department, start date, status, salary);
• Financial details (bank account, tax number) for payroll and statutory purposes;
• Emergency contact and next-of-kin details;
• Documents you sign electronically, and records of those signatures;
• Performance reviews, leave, disciplinary and training records.

Some of this is special personal information under POPIA — for example race (for Employment Equity reporting), health information (sick leave and injury-on-duty records) and, where applicable, criminal-history disclosures. We process this only where the law permits, such as to comply with employment and equity legislation or with your consent.

3. Why we process it

• To perform and administer your contract of employment;
• To comply with legal obligations (e.g. the BCEA, Employment Equity Act, SARS and SDL requirements);
• To manage payroll, performance, leave, health & safety and disciplinary processes.

4. Who we share it with

Your information is stored within the PEPIE system and is accessible only to authorised HR staff, your line manager and management on a need-to-know basis. We do not sell your information. Where we are legally required to, we share information with authorities such as SARS or the Department of Labour.

5. How we protect it

Access is role-based and restricted; sensitive files are access-controlled and logged; connections are encrypted (HTTPS); credentials are stored securely; and the system is backed up regularly.

6. How long we keep it

We keep your information for the duration of your employment and thereafter only for as long as the law requires (for example, tax and basic-conditions records for the statutory retention periods), after which it is deleted or de-identified.

7. Your rights

• Access a copy of the personal information we hold about you — signed-in employees can download this from My Account → Download my data;
• Request that we correct or delete information that is inaccurate or no longer needed;
• Object to processing, or withdraw consent where processing is based on consent;
• Complain to the Information Regulator.

To exercise any of these rights, contact the Information Officer above.

8. The Information Regulator

Information Regulator (South Africa) — JD House, 27 Stiemens Street, Braamfontein, Johannesburg. Email: enquiries@inforegulator.org.za / POPIAComplaints@inforegulator.org.za.

This notice is provided in terms of section 18 of POPIA and may be updated from time to time.