Privacy Policy

1. Who we are

WorkTag (Pty) Ltd ("WorkTag", "we", "us") operates the WorkTag platform at worktag.co.za. We are the Responsible Party under POPIA for personal information processed on this platform.

2. What information we collect

Information you provide directly

Name, email address, phone number, South African ID number, gender, date of birth, citizenship status, physical address, work history, skills, and a profile selfie (for Face Match verification).

Collected automatically

IP address, browser type, pages visited, and session data for security and analytics purposes.

From third-party sources

Verification results from LabourID (which in turn sources from Home Affairs, credit bureaus, and CIPC) — including identity confirmation, biometric match results, and trust scores.

3. How we use your information

We use your personal information to: provide and improve the Service; verify your identity via LabourID; display your profile to employers (with your consent and subject to your visibility setting); process payments via PayFast; send transactional emails (verification codes, receipts); comply with legal obligations.

4. Lawful basis for processing

We process your personal information on the following bases: contractual necessity (to provide the Service you signed up for); consent (for profile visibility and marketing); legal obligation (for tax and regulatory compliance); legitimate interest (for fraud prevention and platform security).

5. When we share your information

LabourID (Pty) Ltd — to perform identity and biometric verification on your behalf. PayFast (Pty) Ltd — to process payments. Employers — your profile is shared only when your visibility is set to public and an employer has paid to unlock it. We do not sell your data to third parties.

6. Data retention

We retain your profile data for as long as your account is active. If you delete your account, your personal information is removed within 30 days, except where retention is required by law (e.g., payment records are kept for 5 years). Verification results are retained as long as needed to support your profile.

7. Security measures

We use HTTPS, bcrypt-hashed passwords, encrypted session cookies, rate limiting, and server-side API key management. Selfie images are transmitted securely and are not stored by WorkTag beyond the verification call.

8. Your rights under POPIA

You have the right to: access your personal information; correct inaccurate or incomplete information; request deletion (subject to lawful retention requirements); object to processing; lodge a complaint with the Information Regulator. See our POPIA & PAIA Manual for how to exercise these rights.

9. International transfers

Your data may be processed on servers outside South Africa (e.g., cloud hosting). We ensure any cross-border transfer complies with POPIA section 72 and that the receiving party applies equivalent protection.

10. Children's privacy

The Service is not directed at persons under 18. We do not knowingly collect personal information from minors. If you believe a minor has registered, please contact us so we can remove their data.

11. Cookies

We use a single session cookie (HttpOnly, Secure, SameSite=Strict) for authentication. We do not use advertising or tracking cookies.

12. Changes to this policy

We may update this policy from time to time. We will notify you of material changes by email or in-app notice. Continued use of the Service after changes constitutes acceptance.

13. Contact & complaints

Privacy queries: privacy@worktag.co.za
Information Regulator (South Africa): www.inforegulator.org.za