Privacy and personal information notice

Information we collect

Candidates: name, email address, mobile number, suburb, province, SA ID number (stored as a salted hash), work experience, salary expectations, transport and availability, skills and systems used, assessment attempts and results, consent records, and introduction activity.

Employers: company name, contact person, email address, account credentials, introduction requests, prior-contact declarations and payment records.

Automatically collected: session identifiers, IP addresses, browser type, pages visited and timestamps for security and platform integrity.

Purpose and lawful basis

We process personal information for the following purposes, each supported by a lawful basis under POPIA section 11:

Consent (s11(1)(a)): creating your account, releasing your identity to a specific employer during an introduction, and sending communications about your account.

Contract (s11(1)(b)): providing the hiring introduction service, processing Talza Coin transactions, and managing employer accounts.

Legitimate interest (s11(1)(f)): preventing fraud, maintaining assessment integrity, operating audit trails and improving the platform.

Legal obligation (s11(1)(c)): complying with applicable South African law, including tax and financial reporting requirements.

Your rights under POPIA

As a data subject, you have the right to:

Access: request confirmation of what personal information we hold about you.

Correction: request that inaccurate or incomplete information be updated.

Deletion: request that your personal information be deleted, subject to any legal retention obligations.

Objection: object to the processing of your personal information on reasonable grounds.

Withdraw consent: withdraw any previously granted consent at any time through the consent centre or by contacting us. Withdrawal takes effect immediately.

Complaint: lodge a complaint with the Information Regulator of South Africa at inforegulator.org.za if you believe your information has been mishandled.

To exercise any of these rights, email contact@talza.co.za. We will respond within a reasonable time, and no later than the timeframes prescribed by POPIA.

Who sees your information

Anonymous browsing: employers can browse anonymised candidate cards showing role, province, salary range, availability, skills and assessment results. Names, contact details, ID numbers and exact addresses are never shown during browsing.

Registered employers: see additional detail including suburb-level location, but still no identifying information.

After introduction: your name and contact details are shared with a specific employer only after you explicitly accept that employer's introduction request and the employer completes a prior-contact declaration. This is a consent-gated process that you control.

No bulk sharing: TALZA does not sell, rent or provide candidate data in bulk to any third party.

Data retention

We retain your personal information only for as long as necessary to fulfil the purposes described in this notice, or as required by law. Active candidate profiles are retained for the duration of account activity. If you deactivate your account or request deletion, your personal information will be removed from active systems within 30 days, except where retention is required for legal, audit or dispute-resolution purposes. Audit trail records are retained for a minimum of three years. Anonymised and aggregated data that cannot identify you may be retained indefinitely for platform improvement.

Cookies and session data

TALZA uses session cookies to maintain your login state and ensure platform security. Session data is stored securely and expires when you log out or after a period of inactivity. Cloudflare may set security-related cookies as part of its edge protection services.

Analytics: we use Google Analytics to understand how the platform is used. It is not loaded, and no analytics cookie is set, until you accept the cookie banner shown on your first visit — declining or ignoring it means Google Analytics never runs. You can change your choice at any time by clearing the "talza-analytics-consent" entry from your browser's local storage for this site. We do not use third-party advertising cookies.

Cross-border data processing

TALZA's infrastructure is hosted on the Cloudflare global network. This means your data may be processed on Cloudflare edge servers located outside South Africa as part of normal platform operations, including content delivery, security protection and performance optimisation. Cloudflare processes data in accordance with its privacy and data protection commitments. We take reasonable steps to ensure that any cross-border processing meets the requirements of POPIA section 72.

Updates to this notice

We may update this privacy notice from time to time to reflect changes in our practices, legal requirements or platform features. Material changes will be communicated via the platform or by email. The effective date at the top of this notice indicates when it was last updated. Continued use of the platform after an update constitutes acceptance of the revised notice.