Privacy policy
1. Who we are
1.1 Recruit 360 is operated by Idealweb (Pty) Ltd, registration number 2015/054112/07, of 87 Marjoram Avenue, Sinoville, Pretoria, 0129.
1.2 Our Information Officer, appointed under section 55 of the Protection of Personal Information Act 4 of 2013 (POPIA), is Louis Coetzee, contactable at [email protected].
2. Two different roles, and which one applies
2.1 This is the point most software privacy policies blur, so we will be plain about it.
| Whose information | Who decides how it is used | Which document governs it |
|---|---|---|
| Your staff — the people who sign in to a workspace — for their accounts, sign-in and security, billing, support and our own announcements; the security and operational logs we keep to secure and run the service; and our billing contacts, website visitors and people who send us an enquiry | We are the responsible party | This policy |
| Candidates, client contacts and everyone else recorded inside a customer’s workspace, including the mail, calendar entries and messages its users bring in by connecting an account, and what your staff write or do in the workspace — their notes, the messages they send and the actions its audit trail records | The customer is the responsible party; we are its operator | The data processing addendum |
| Candidates who apply or register through a customer’s door (its careers page, plugin, website, or the page and adverts we host for it) | The customer is the responsible party; we are its operator | The job-seeker notice shown at that door |
2.2 A candidate who applies or registers through a customer’s door accepts, at that form, the job-seeker terms and privacy notice we publish for the doors we run. The notice tells the candidate that the customer whose door they use receives what they send and is the responsible party for it, what it is used for, that we run the door as the customer’s operator, and where to send a request. What the customer then does with its copy of the candidate’s information is the customer’s decision, not ours, and the customer’s own privacy terms govern it (terms clause 6A.4). Where the door is a page or advert we host for the customer, the person also has a sign-in with us so they can see and withdraw their own applications and keep their profile up to date. For that sign-in we are the responsible party, as the job-seeker notice says, and through it the person’s profile reaches no other customer unless they apply to or register with that customer themselves. People who register on our job portal, IdealJobs, are covered by its own privacy notice, and there they choose whether agencies and employers may find their profile.
3. What we process about you
- Account information — name, work email address, job title, profile photograph if you upload one, your role in the workspace, and your notification and display preferences.
- Authentication information — a hashed password, second-factor enrolment, session and device records, and the record of your acceptance of our terms, which includes the version, time, IP address and browser user agent.
- Usage and security records — sign-in and session events, the record of who opened which record, IP addresses, and error and performance logs, which we keep to secure and run the service. The workspace’s audit trail of changes, including the actions it attributes to you, is one of the workspace’s records (section 2).
- Billing information — the organisation’s billing contact, invoices, subscription history, and the last four digits and expiry of a card. We never see or store a full card number; it is tokenised by our payment gateway.
- Support correspondence — what you tell us when you ask for help, and our replies.
- Enquiries — where you ask for a demonstration or a quote, request a workspace or write to us before becoming a customer: your name, work email address, telephone number if you give us one, organisation and its website, what you asked, the answers you give about your business (such as how many recruiters need a seat, the system you use today, the data you would bring and the job portals you post to), whether you confirmed a personal email address or told us you are looking for a job, and the network address the message came from. The form marks the fields we need in order to answer. Without them we cannot reply or prepare a quote.
- Accounts you connect — where you connect a mailbox, calendar or WhatsApp account to the workspace: the connection itself — the account’s address or number, the credentials that let the service reach it, and when it was connected — which we hold to keep the connection working and secure. The mail, calendar entries and conversations the connection brings into the workspace are the workspace’s records: the customer is the responsible party for them, and we process them as its operator under the data processing addendum. For mail, the workspace shows metadata about your messages and events in context; a message’s body and attachments are fetched from your provider when you open it. The body of a message that has been opened is kept in the workspace so that it opens again, and an attachment is stored when you file it to a record. WhatsApp conversations mirror where the other person is already recorded in the workspace, or where you add them by hand, and unlinking the account deletes the mirror and the files with it.
- Voice notes you dictate — where you speak to the assistant instead of typing, the recording is turned into text by a transcription service (section 6), and the text is what we store.
3A. A Google account you connect
3A.1 Where you connect a Google account to the workspace, the service reaches your Gmail mailbox and your Google Calendar through Google’s programming interfaces, with the permissions Google shows you when you connect. This section says what is done with the information received from Google; the rest of this policy applies to it as well.
3A.2 What is accessed, and why:
- The account’s email address — to identify the connection.
- Your Gmail messages — who a message is from and to, its subject, date and folder, and a short preview; and its body and attachments when you open it — so that you can read, search and answer your mail in the workspace, beside the candidates, clients and vacancies it concerns.
- Sending and changes — the service sends the messages you write in the workspace from your address, and tells Gmail what you do with a message there: marking it read, starring it, or moving it to another folder or to Trash.
- Your Google Calendar — the list of your calendars and the events in them, read when you look at the workspace calendar so that they show beside it; and your reply, when you answer an invitation from the workspace.
3A.3 What is stored, and how it is protected. The credentials Google issues for the connection are stored encrypted. The workspace keeps an index of your messages holding the details listed in 3A.2; the body of a message once it has been opened, so that it opens again without another request to Google; an attachment, when you file it to a record; and what the service produced when you asked it to read a message or an attachment, so that the same text is not read twice. Events in your Google Calendar are read when they are shown and are not copied into the workspace. What is stored is protected as section 8 describes: traffic to and from the service is encrypted in transit, each workspace’s data is kept apart from other workspaces’ data by access controls, and our staff’s access to a workspace is limited, time-bound and logged.
3A.4 What it is used for. To provide these features to you and your workspace, and to keep them working and secure. Where you ask the service to read a message, an attachment or your calendar for you — for example to create a candidate, a client or a vacancy from an email, or to ask the assistant about your week — the text is processed for that task by the providers behind our artificial-intelligence features (section 6). We do not use information received from Google for advertising. We do not use it, or anything derived from it, to develop, improve or train generalised artificial-intelligence or machine-learning models; the permission in clause 4.2 of the data processing addendum to build the service’s own models from de-identified data does not extend to it.
3A.5 Who receives it. The providers that host the service and process for us (section 5). A candidate’s or a client’s record shows that a message was exchanged with them, without its subject or content, and what you create or file from a message becomes part of the record; colleagues who can see the record see both. We do not sell information received from Google, or pass it to advertisers or data brokers. Beyond that it is passed on where that is needed for security or where a law requires it.
3A.6 Our staff do not read the content of your Google mail or calendar unless you ask us to — for example to look into a problem with a particular message — or where that is needed for security or to comply with a law.
3A.7 How long it is kept, and ending the connection. What the connection brings into the workspace is kept among the workspace’s records (section 2) for as long as the workspace exists. After a subscription ends the workspace is kept read-only for 30 days and then deleted, as section 7 sets out, and backups are overwritten or expire on a cycle of no more than 35 days. You can delete a message from the workspace sooner, or ask us to delete it, as section 9 describes. You can disconnect the account in the workspace’s settings at any time, which destroys the credentials we hold, and you can withdraw the permission in your Google account; what the connection has already brought into the workspace stays there until it is deleted.
3A.8 Our use of information received from Google’s APIs, and any transfer of it to another application, adheres to the Google API Services User Data Policy, including the Limited Use requirements.
4. Why we process it, and on what basis
| Purpose | Lawful basis under POPIA |
|---|---|
| Setting up and running your account, and providing the service your organisation subscribed to | Where you are the customer, or accept our terms on its behalf, performance of that contract (section 11(1)(b)). For every other user, our legitimate interests and the customer’s in providing the service it subscribed to for its staff (section 11(1)(f)). |
| Billing, invoicing and collecting payment | Performance of the contract with the customer (section 11(1)(b)), and our legitimate interests in being paid (section 11(1)(f)) |
| Security, fraud prevention, security logs and tenant isolation | Our legitimate interests (section 11(1)(f)), and the duty section 19 places on us to secure what we hold (section 11(1)(c)) |
| Support and service notices | As for running your account: the contract where you are the customer, and otherwise our legitimate interests and the customer’s (section 11(1)(b) or (f)) |
| Keeping records the law requires us to keep | Legal obligation (section 11(1)(c)) |
| Product announcements, which you can switch off | Your consent (section 69(1)(a)): the monthly product digest is emailed only to a user who switches it on, and every one carries a way to stop it. Where we write to you as our customer about our own similar services without that consent, we rely on section 69(1)(b) and (3): we use the details you gave us when you subscribed, we do so only where you were given the chance to object, free of charge, when we collected them, and every message gives you the chance to object again |
| Answering an enquiry, arranging a demonstration and preparing a quote | Steps you ask us to take before a contract (section 11(1)(b)), and our legitimate interests in responding (section 11(1)(f)) |
| Seeing how our website is used and which adverts bring people to us, and showing our adverts to people who have visited (section 10) | Our legitimate interests (section 11(1)(f)). You can object at any time by switching it off under “Cookie settings”; in the EEA, the UK and Switzerland it runs only if you choose “Accept all” |
| Telling Google which of our adverts led to an enquiry or a demonstration (section 10.4) | Our legitimate interests in knowing which adverts work (section 11(1)(f)). You can object by writing to us (section 11(3)); the cookie switch does not control this |
4.1 We do not sell personal information. We do not use personal information in a workspace to train models, and we do not pool workspace data with other customers’ data: no record in a customer’s workspace is searchable by, or copied to, another customer. We do derive aggregated, de-identified statistics from use of the service to operate, improve and benchmark it, and we may de-identify documents and records processed in the service — removing names, contact details, identity numbers and other details that identify a person — to build and improve the service’s own models, including the models that read CVs. Neither can reasonably identify you, your organisation or a candidate; we do not try to re-identify them, and we do not share them.
4.2 Every product announcement we send carries a link that stops them. Service and billing notices are not marketing and continue while you hold an account.
5. Who we share it with
5.1 We use a small number of service providers. Most process only on our instructions. A few act for themselves under their own published terms: the web-search, address-suggestion and place-lookup (geocoding) services, which receive the text of a search or of an address or location field from our servers, and Google when it measures and shows our adverts (section 10). What each does for us, the country it processes in, and the basis it is engaged on is set out by function, for the providers that handle information inside a workspace, in Annexure A of the data processing addendum, which we keep current; the providers behind our own website are described in section 10.
5.2 Beyond those providers, we share personal information only with professional advisers under duties of confidence, with an acquirer if our business is sold (on notice, and subject to this policy), and where a law, a court order or a regulator compels it.
5.3 The service links to systems the Customer connects and to job boards and websites we do not run. This policy does not cover them; their own notices do.
6. Sending information outside South Africa
6.1 Some of our providers operate outside South Africa. We send only what a task needs. The terms we accept from those providers limit what they may do with it, and a provider that processes information for us may not use it to train a model. The providers that process text, images and audio for our artificial-intelligence features do so on terms that limit how they may use it and do not allow it to be used to train models. Google’s advertising services are different: Google also uses what it receives for its own purposes, under its own terms (section 10).
6.2 The country in which each function is processed, and the terms each provider is engaged on, are listed in Annexure A of the data processing addendum.
7. How long we keep it
7.1 This is our one retention schedule. Clause 12 of the terms of service and clause 9 of the data processing addendum refer to it for everything other than the workspace itself.
| What | How long |
|---|---|
| Your user account | For as long as your account is active in a workspace. |
| A workspace’s records and files — the records and the documents, CVs and other files stored with them | For as long as the workspace exists, subject to the retention rules the customer sets. After a subscription ends the workspace stays read-only for 30 days and is then deleted, once the notice of the deletion date has been sent (terms clause 12.3). Of the workspace we keep only the account record in the next row. |
| The account record of a deleted workspace — the organisation name, the billing contact, the subscription dates and the fact of deletion | Seven years after the workspace is deleted, with our billing and tax records. |
| Backups | Overwritten or expired on an ordinary cycle not exceeding 35 days. If we ever restore from one, then before the restored information is used we re-apply the deletions we hold a record of having made since it was taken, and run once the deletions the service makes on a schedule. |
| Billing and tax records | Seven years, as required by the Companies Act 71 of 2008 (the Tax Administration Act 28 of 2011 requires five). |
| Terms acceptances | For as long as we keep the account record they belong to (terms clause 17.3): while the workspace exists and for seven years after it is deleted, because a signature you can no longer produce is not evidence of anything. |
| Security logs | 12 months for the record of who viewed what, unless a specific incident requires longer. |
| The audit trail of changes made in a workspace | For as long as the workspace exists, because it is the record of what was done to a person’s information. |
| Support requests | Requests raised in the service are kept with the workspace and deleted with it. Correspondence by email is kept for up to two years after our last exchange. |
| Enquiries that do not become a workspace | 12 months after our last contact, then deleted. An enquiry our filters set aside, because it came from a job seeker or looked automated, is deleted after 90 days unless we find it was genuine and answer it. |
| Email delivery records | Addresses that bounced, reported our mail as spam or unsubscribed are kept, with the reason and the dates, for as long as we send mail, so that we do not write to them again. The delivery report that caused it is kept for 12 months and then removed. The record of each message sent — address, subject, date and whether it was delivered — is kept for 12 months, and a workspace’s records are deleted with the workspace. |
| Anything under a legal hold | Information may be kept for longer where a law requires it or where it is needed for a legal claim that has been made or is reasonably expected, but only for as long as that reason lasts and for no other purpose. |
8. How we protect it
8.1 Each workspace’s data is kept apart from other workspaces’ data by access controls in the database and in the application.
8.2 Traffic to and from the service is encrypted in transit, off-site backups are encrypted where they are stored, and the credentials that connect a mailbox or calendar are encrypted as well. The service runs on servers in a South African data centre with physical and network access controls. Our staff’s access to a customer’s workspace for support is limited, time-bound and logged, and administrative access to the servers is restricted to the staff who run them. We may replace or update these measures, but not so as to reduce the overall protection they give.
8.3 Where there are reasonable grounds to believe that personal information we hold as responsible party has been accessed or acquired by an unauthorised person, section 22 of POPIA requires us to notify the Information Regulator and the people affected. We will do so as soon as reasonably possible after we discover it, taking the time the Act allows to work out what happened and to secure the system, and we will say what was affected, what we are doing about it and what you can do. Our first notice may come before every fact is known, and we will update it as we learn more. Where the information belongs to a customer’s workspace the customer is the responsible party, and section 21 requires us to tell the customer immediately where there are reasonable grounds to believe the information was accessed or acquired without authority, so that it can notify.
9. Your rights
9.1 Under POPIA you may:
- ask what personal information we hold about you and get a copy;
- ask us to correct or delete information that is wrong, misleading, excessive or no longer needed;
- object to processing based on legitimate interests;
- withdraw consent where consent is the basis, without affecting what was done before;
- complain to the Information Regulator (South Africa) at inforegulator.org.za.
9.2 Write to [email protected]. We will respond within 30 days. We may ask you to verify your identity, and we will say so if a request cannot be met in full and why.
9.3 If your request concerns a candidate record inside a customer’s workspace, we will refer you to that customer, who is the responsible party for it, and we will assist them to answer you.
10. Cookies and tracking
10.1 We set cookies to keep you signed in and to keep your session secure. They are necessary for the service to work and cannot be switched off while you use it.
10.2 In the application we do not use advertising cookies, third-party analytics trackers or cross-site tracking pixels.
10.3 On our public pages (recruit360.co.za and its landing pages) we use Google Analytics to see how the pages are used, Google Ads conversion measurement to see which adverts bring people to us, and Google Ads remarketing, which lets us show a Recruit 360 advert on other Google sites and apps to someone who has visited ours. All three run unless you switch them off: use “Manage” in the cookie notice, or “Cookie settings” at the foot of the page at any time, and they stop, and the Google cookies set on our website are deleted from your browser. Cookies Google keeps on its own websites, which remarketing can use, are not ours to delete; your Google account’s ad settings control them. If you are visiting from the European Economic Area, the United Kingdom or Switzerland, they stay off unless you choose “Accept all”. Google processes this data in the United States: for Analytics under its data-processing terms, as a service to us, and for conversion measurement and remarketing also for its own purposes, under its own terms and privacy policy.
10.4 If you reach us from a Google advert, the advert’s click identifier and the campaign labels in the page address are kept with the enquiry you send us, not in a cookie, so they are kept whatever you chose in the cookie notice. The click identifier may be used to tell Google that the enquiry — and, later, whether it led to a demonstration — came from that advert, in a report made later from our own record of the enquiry. Where there is no click identifier we may report the outcome to Google as a hashed form of the email address you gave us, which Google can only match against an address it already holds; a hashed address is still personal information, and Google may recognise whose it is. We do this on our legitimate interest in knowing which adverts work, and the line beside each enquiry form says so. You can object by writing to the Information Officer, and we will not report your enquiry. The click identifier and the campaign labels are deleted with the enquiry (section 7).
11. Children
11.1 The service is for workplace use by adults. We do not knowingly create accounts for children, and a customer must not record a child’s personal information in a workspace except where the law permits and its own notice covers it.
12. Changes
12.1 We may update this policy. Where a change materially affects how we use your personal information we will tell workspace owners in advance and, where required, ask for renewed acceptance on sign-in.
12.2 For website visitors and people who have sent us an enquiry, the version on this page is the one in force.