Data Protection Statement

The eight conditions for lawful processing

References are to sections of POPIA.

1. Accountability

Section 8

An Information Officer is appointed and is the point of contact for all data protection matters. Suspected data incidents are escalated immediately to Humantix Risk and Compliance, which is overseen by the Chief Executive Officer.

2. Processing limitation

Sections 9 to 12

Personal information is processed only to deliver the contracted services. Customers undertake to obtain employees’ consent before adding their personal information. Non-essential cookies are set only after a user opts in; continued browsing is not treated as consent.

3. Purpose specification

Sections 13 and 14

Purposes are defined in the Privacy Policy: payroll, leave, loans, contracts, statutory PAYE and UIF calculations, employee access and service communications. Records are retained for the period of employment and, for payroll, tax and leave records, for seven years afterwards. That is longer than the five years the Tax Administration Act requires, because payroll records are also accounting records.

4. Further processing limitation

Section 15

Personal information is not sold and is not used for marketing. Humantix does not send marketing emails to employees; communications are limited to service and account messages. AI-assisted features send personal information to Google’s Gemini service only when a customer uses a feature that needs it, such as drafting or reviewing a contract, reading a bank confirmation letter or a receipt, or improving a CV, and only for that request. Features that need none, such as job descriptions and labour law questions, send none. Humantix does not write those prompts or responses to its logs.

5. Information quality

Section 16

Customers are responsible for the accuracy of the employee information they capture, and the platform highlights incomplete records for correction. Employees and employers may request correction at any time.

6. Openness

Sections 17 and 18

The Privacy Policy, Cookie Policy and Terms of Service are published on humantix.co.za. The Cookie Policy identifies each cookie by category, provider, purpose and retention period.

7. Security safeguards

Sections 19 to 22

Data is hosted in South Africa and encrypted in transit and at rest. Access is authenticated, restricted by role and segregated by customer. Technical and organisational controls are listed below.

8. Data subject participation

Sections 23 to 25

Data subjects may request access to, correction or deletion of, and object to the processing of their personal information. Requests are made to the Information Officer and answered within 30 days.

Technical and organisational security measures

Hosting and residency

Platform data is hosted in South Africa, in the Amazon Web Services Cape Town region.

Encryption

Data is encrypted in transit and at rest.

Authentication

All access is authenticated, sessions use short-lived tokens, and access is restricted by role. Customers are responsible for safeguarding their own credentials.

Access control

Access to sensitive data is restricted by role. Each customer’s data is logically segregated, and employees can view only their own records.

Consent records

Each cookie consent decision is logged with the categories selected, the policy version presented, the time and browser type. IP addresses are stored only as a one-way hash.

Personnel and partners

Humantix staff and certified implementation partners may not remove customer data from the platform by export, screenshot or spreadsheet. Partners cannot see an individual employee’s Earned Wage Access activity unless the customer grants them access for support.

Incident management

Suspected security compromises are escalated immediately to Risk and Compliance. Notification of the Information Regulator and affected parties follows section 22 of POPIA.

Governing documents

• Privacy Policy

  humantix.co.za/privacy

• Cookie Policy

  humantix.co.za/cookies

• Terms of Service

  humantix.co.za/terms