HirePro Legal
Privacy Policy
This policy explains how HirePro collects, uses, shares, protects and retains personal information, and the rights you have over it, in accordance with the Protection of Personal Information Act 4 of 2013 (POPIA). It covers staff members, Talent Pool candidates, establishment contacts, job applicants and website visitors. If you only remember three things: we tell you exactly who can see your profile; your contact details are only ever released with your consent; and you can object, correct or ask us to delete.
Version 2.2 · Last updated 2 August 2026 · Effective on publication
1. Who we are and who this covers
HirePro (Pty) Ltd (“HirePro”, “we”) is the responsible party for the processing described in this policy. Our physical and postal address, registration details and telephone number appear in section 16 of the Terms of Service and in our PAIA Manual. Our Information Officeris the head of the company and can be reached at info@hireprostaff.co.za (subject line “Privacy”). Under section 56(1) of POPIA the head of a private body is its Information Officer by operation of law; registration with the Information Regulator is in progress.
This policy covers everyone whose personal information we process: (a) Staff members who work shifts through the platform; (b) Talent Pool candidates seeking permanent roles; (c) establishment contacts (owners, managers and billing contacts of client businesses); (d) job applicants using our application forms or job board; and (e) website visitors. Where an establishment receives personal information from us (for example a booked staff member's profile, or an unlocked CV), that establishment is a separate responsible party for its own use of that information.
2. The information we collect
2.1 Staff members
- Identity and contact: name, photo, phone number (used for WhatsApp), email address, suburb and city;
- Vetting: identity document, work-authorisation documents where applicable, CV, qualifications, work history and the referees you provide (we collect reference information from those referees — a source other than you, which we disclose here as POPIA requires);
- Work profile: roles and skill level, skills, certifications, bio, availability declarations and morning confirmations;
- Shift records: bookings, confirmations, declines, cancellations, check-in and check-out timestamps;
- Performance: employer ratings and written reviews, and the calculated reliability, on-time and completed-shift metrics described in section 6;
- Financial: earnings ledger, payout records and, when payouts go live via bank transfer, your bank account details.
2.2 Talent Pool candidates
- Profile and CV: name, photo, role, work history (including employer names and dates), skills, certifications, education, salary expectations, location and relocation preference;
- Reference verification: the outcome of our checks with the employers you listed (verified role and dates), displayed as described in section 5;
- Contact details and CV file — released to an establishment only through a paid unlock with your consent (section 5).
2.3 Establishment contacts
- Contact person's name, email, phone and role; establishment name, type, address, public website or social listing, and any VAT number later added to the account; booking, invoice, credit and payment records. Card details are entered on Yoco's hosted checkout and never reach HirePro — we hold only a payment reference and the outcome.
- Application acceptance evidence: the accepting person's name and email, server-recorded time and request IP address, and the exact Terms and Privacy Policy versions shown at submission.
2.4 Job applicants and website visitors
- Application forms: name, contact details, roles applied for, citizenship/permit status, CV and supporting documents, cover letters;
- Contact and lead forms: name, contact details and your message;
- Technical: first-party authentication cookies and cookieless aggregate analytics only — see the Cookie Policy. Our infrastructure providers log IP addresses transiently for security and delivery.
Providing the information marked as required during signup or application is necessary to provide the service — without it we cannot vet you, list you, book you or pay you. Everything else is voluntary and marked as such where collected.
3. Why we process it and on what legal basis
| Purpose | Legal basis (POPIA s11) |
|---|---|
| Creating and managing accounts; vetting; matching; booking, confirming and managing shifts; check-in records; paying staff; invoicing establishments | Performance of a contract with you |
| Showing staff work profiles to registered establishments for booking (section 4) | Performance of a contract + your consent at signup |
| Releasing a candidate's contact details and CV via a paid unlock (section 5) | Your explicit, specific consent |
| Ratings, reviews, reliability and on-time metrics (section 6) | Legitimate interests of HirePro, establishments and staff in a trustworthy marketplace, with the safeguards in section 6 |
| Service notifications (shift offers, confirmations, payout notices) by in-app, email and WhatsApp | Performance of a contract (these are not marketing) |
| Marketing communications | Your opt-in consent (section 9) |
| Tax, employment-record, accounting and other legal compliance; fraud prevention; establishing or defending legal claims | Compliance with a legal obligation / legitimate interests |
| Recording who accepted the establishment Terms, when, from which request IP address, and which document versions applied | Performance of a contract / legitimate interests in maintaining reliable transaction evidence |
4. Who can see your profile
4.1 Staff members
- Registered, signed-in establishments see your working profile: first name and surname initial, photo, roles and skill level, skills, bio, suburb, ratings and reviews, reliability metrics and availability. They do not see your surname, phone number, email address, identity or permit documents, or banking details — ever.
- An establishment that books you sees what it needs to run the shift; you see the establishment's identity and address only after you confirm the shift.
- Your check-in and check-out times are visible to the establishment you are working for and to HirePro, and to no one else.
- Your profile is not published on the public internet, is not indexed by search engines, and is never shown to anyone who is not a vetted, registered platform user.
4.2 Candidates
Registered establishments browsing the Talent Pool see your first name and surname initial, photo, role, headline, work history, verified references, skills, education, salary band and location — but not your surname, phone number, email address or CV file. Those are released only through the consent-based unlock described in section 5.
5. The Talent Pool unlock — how your details are shared
How your contact details are released — and your control over it
When you join the Talent Pool you give us specific consent to release your full name, phone number, email address and CV to a registered establishment that pays the once-off unlock fee for your profile. We log every unlock — you may ask us at any time which establishments have received your details (section 12). You may withdraw this consent whenever you like: withdrawal takes your profile out of the Talent Pool and stops all future unlocks immediately. Details already released to an establishment before withdrawal remain with that establishment, which is legally responsible for its own use of them; on request we will notify unlocking establishments of your withdrawal or of corrections to your information.
Establishments receiving unlocked details are contractually bound to use them only to recruit for their own business, to keep them confidential, to honour any request from you to stop contact, and never to resell or use them for marketing. We never include your identity number or documents, work-permit documents, banking details or precise home address in an unlock.
“Verified” reference entries mean our team contacted that employer and confirmed your role and dates; we record who verified it and when. You are entitled to see your own profile exactly as establishments see it, and to have inaccurate entries corrected (section 12).
6. Ratings, reliability and on-time scores
After each completed shift, the establishment may rate the staff member (1–5 stars, with an optional written review published on the profile). The platform also calculates: a reliability score (which decreases when you cancel a confirmed shift), an on-time score (based on check-in times relative to shift starts), and a completed-shifts count. These metrics are shown to establishments and influence matching and visibility.
POPIA gives you safeguards where profiling affects you (section 71). Ours are: (a) no account is deactivated solely by an automated score — a person reviews the facts and you receive an opportunity to respond before deactivation becomes final, as set out in the Terms of Service; (b) the logic is disclosed here: the inputs are employer ratings, confirmed-shift cancellations, no-shows and check-in punctuality — nothing else; (c) you may dispute any rating or metric you believe is inaccurate, abusive or retaliatory by contacting info@hireprostaff.co.za, and we will review it, correct or remove entries that violate our review rules, and record your objection.
8. Where your information is stored (cross-border transfers)
Our primary database and document storage are hosted in the European Union (Ireland), where data protection law (the GDPR) provides protection substantially similar to POPIA. Message delivery, email and hosting providers process limited personal information in the United States. All cross-border processing occurs under each provider's data-processing terms, which impose confidentiality, security and onward-transfer obligations substantially similar to POPIA's conditions, as contemplated by section 72(1)(a) of POPIA, and is in any event necessary to perform our contract with you (section 72(1)(c)).
9. Marketing and communications
Service messages— shift offers and confirmations, booking updates, payout notices, security alerts — are part of the service and are sent to you by in-app notification and, as those channels are activated on your account, by email and WhatsApp, while your account is active. You can switch email and WhatsApp delivery on or off in your profile settings; in-app notifications always run because the platform's countdowns depend on them.
Marketing messages are sent only with your opt-in consent, which we request once, in the prescribed manner, and record. Every marketing message identifies us and contains a working unsubscribe. Opting out of marketing never affects service messages. We do not share your details with third parties for their marketing. Establishments who receive unlocked candidate details are prohibited from using them for marketing.
10. Security and breach notification
We secure personal information with appropriate, generally accepted measures under section 19 of POPIA, including: encryption in transit (TLS) and at rest; row-level security so each account can only read its own records; role-based access for administrators; access logging; segregated storage for sensitive documents; and operator terms obliging each provider to equivalent measures and to notify us of any suspected compromise. Banking details are stored encrypted, are never displayed to establishments, and access to them is logged.
If we have reasonable grounds to believe your personal information has been accessed or acquired by an unauthorised person, we will notify the Information Regulator and affected people as soon as reasonably possible in accordance with section 22 of POPIA, in writing, with enough information for you to protect yourself, a description of the possible consequences, the measures we have taken, and our recommendations.
11. How long we keep information
We keep personal information only as long as needed for the purposes above or as the law requires, then delete or de-identify it. Our schedule:
| Record | Retention period |
|---|---|
| Active staff/candidate profile and CV | Life of the account, reviewed annually |
| Inactive or unsuccessful applications and profiles | Deleted or de-identified 12 months after last activity (we warn you before) |
| Account information after a deletion request | Purged within 30 days, except the records below that we must keep |
| Identity and work-authorisation verification records | 3 years after the last engagement (employment record-keeping laws) |
| Shift, check-in and pay-related records | 3 years from last entry; 5 years where they support tax records |
| Invoices, payouts, credits and other financial records | 5 years (Tax Administration Act); accounting records up to 7 years (Companies Act) |
| Ratings, scores and decision logs | Account life + 3 years (claims prescription), then de-identified |
| Consent records (signup, unlock, marketing) | Duration of the relationship + 3 years |
| Security and access logs | Up to 3 years |
12. Your rights and how to use them
- Access — ask whether we hold your information (free) and request a copy, including which establishments have unlocked your details;
- Correction and deletion — ask us to correct, update or delete information that is inaccurate, excessive, out of date or unlawfully held; where we have shared it, we will notify recipients of material corrections where reasonably practicable;
- Objection — object to processing based on legitimate interests, on reasonable grounds relating to your situation;
- Consent withdrawal — withdraw any consent (including Talent Pool participation and marketing) at any time, without affecting processing already done;
- Profile self-service — most information can be viewed and edited directly in your account.
Send requests to info@hireprostaff.co.za(subject “Privacy request”). You may, but do not have to, use the Information Regulator's Form 1 (objection) or Form 2 (correction/deletion). We respond within 30 days. We may need to verify your identity before acting. Some requests are limited by law — for example, we cannot delete financial records we are required to keep, but we will tell you exactly what is retained and why.
If you are not satisfied with our response you may complain to the Information Regulator (South Africa): JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001; POPIAComplaints@inforegulator.org.za; inforegulator.org.za.
13. Children
The platform is not for anyone under 18. We do not knowingly process children's personal information; registration requires confirmation that you are 18 or older, and we delete any under-18 account we become aware of.
14. Changes, contact and complaints
We update this policy as the platform and the law evolve. Material changes are notified by email or in-app at least 14 days before they take effect, and the version and date at the top identify the current edition. Historical versions are available on request. Questions, requests and complaints: info@hireprostaff.co.za (Information Officer). Access-to-information requests are handled under our PAIA Manual. Cookie details are in the Cookie Policy.
HirePro legal documents
