Privacy Policy

1. Who we are

INNOVACE (Pty) Ltd ("INNOVACE", "we", "us") provides an all-in-one HR, payroll, attendance and recruitment platform for South African organisations. Registration number 2025/316516/07. Registered address: 22 Umhlanga Boulevard, Umhlanga, 4321.

This policy explains what we do with personal information where INNOVACE itself is the Responsible Party: chiefly enquiries made through this website and the accounts of our customers. It does not describe what our customers do with their own people's data (see the note above).

2. What we collect, and why

When you contact us through this website

Our contact form asks for your name, work email address, company name, company size and, optionally, your phone number and a message. We also automatically record your IP address and browser user-agent with the submission.

We use this to respond to your enquiry, to prepare for a conversation about your organisation's needs, and to keep an internal record of the enquiry. Submitting the form triggers an automated acknowledgement email to you, and a notification to our team. Providing this information is voluntary, but without at least a name and email address we can't reply to you.

When you become a customer

We hold the account details of the people who administer your workspace: name, work email address, a securely hashed password, and records of sign-ins and actions taken in the system (audit logs). We use these to provide the service, secure the account, support you, and bill you.

Data we process on our customers' behalf

Our customers use INNOVACE to process personal information about their own employees, job applicants and referred candidates. We process that data only as an Operator, on their instructions and under a written agreement, and we do not use it for our own purposes.

Technical information

Our servers keep standard logs (IP address, request time, pages requested) for security and troubleshooting. This website sets a single, strictly necessary session cookie used to protect forms against cross-site request forgery. We do not currently run third-party advertising or analytics trackers on this site.

3. On what basis we process it

Depending on the situation, we rely on your consent (for example, when you tick the box on a form), on the performance of a contract with you or your employer, on compliance with a legal obligation, or on our legitimate interests in operating, securing and improving our business, balanced against your rights.

4. Who we share it with

We do not sell your personal information. We share it only with service providers who help us run INNOVACE, each of whom is bound to protect it and use it only for the purpose we've engaged them for:

• Hosting: our application and databases run on servers hosted in South Africa.
• Email: Google Workspace, for our own mailboxes, and a third-party SMTP relay used to deliver outbound system email.

We may also disclose information where the law requires it, or to establish, exercise or defend a legal claim.

Information leaving South Africa

Some of these providers, notably Google, may store or process information outside South Africa. Where that happens, we take reasonable steps to ensure the recipient is subject to laws, binding rules or contractual terms that provide an adequate level of protection, as POPIA requires.

5. How long we keep it

We keep enquiry and customer information only for as long as it's needed for the purpose it was collected for, or for as long as the law requires us to. When it's no longer needed, we delete it or de-identify it. Data we hold as an Operator is retained according to our customer's instructions and their own retention policy.

6. How we protect it

We use encrypted connections (HTTPS/TLS), hashed passwords, role-based access controls, audit logging, and access restrictions so that staff only reach information they need. No system is perfectly secure, but if a breach affects your personal information we will notify you and the Information Regulator as POPIA requires.

7. Your rights

Under POPIA you have the right to:

• ask what personal information we hold about you, and request a copy;
• ask us to correct or delete information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or unlawfully obtained;
• object to our processing of your information on reasonable grounds;
• withdraw consent you've given us (this doesn't affect processing already carried out);
• complain to the Information Regulator.

To exercise any of these, write to our Information Officer at privacy@innovace.co.za. We may need to verify your identity before we act, and we'll respond within a reasonable time.

8. Complaining to the Regulator

If you're unhappy with how we've handled your information, you can lodge a complaint with:

The Information Regulator (South Africa)
JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001
Complaints: complaints.IR@justice.gov.za
General enquiries: enquiries.IR@justice.gov.za
inforegulator.org.za

9. Access to information (PAIA)

You also have rights of access to records under the Promotion of Access to Information Act. Requests can be sent to our Information Officer at the address below.

10. Changes to this policy

We may update this policy from time to time. The date at the top of this page shows when it was last changed, and material changes will be communicated to customers directly.

11. Contact us

Information Officer
INNOVACE (Pty) Ltd
privacy@innovace.co.za
22 Umhlanga Boulevard, Umhlanga, 4321
South Africa