Privacy Policy

1. Introduction

1.1 True Cloud ERP (Pty) Ltd (“Company,” “we,” “us”) respects your privacy and is committed to protecting the Personal Information of everyone who uses the [PLATFORM NAME] recruitment platform (the “Platform”), whether as a Candidate, Employer, Recruiter, or general visitor.

1.2 This Privacy Policy explains what Personal Information we collect, why and how we use it, who we share it with, how long we keep it, how we protect it, and what rights you have. Our primary compliance frameworks are the South African Protection of Personal Information Act 4 of 2013 (“POPIA”) and the EU General Data Protection Regulation (“EU GDPR”)/UK GDPR and Data Protection Act 2018, which this Privacy Policy is designed to meet. The Platform is available internationally, and where the mandatory data protection or consumer-protection law of another country in which you are located imposes a specific requirement that cannot lawfully be excluded by agreement, that mandatory local requirement will apply to that specific point, in addition to this Privacy Policy. This is not, however, a representation that we have independently assessed or fully implemented the specific data protection regime of every country from which the Platform may be accessed; we will adopt jurisdiction-specific supplements to this Privacy Policy as our user base in a given country and our legal advice warrant and will publish any such supplement alongside this Privacy Policy when adopted.

1.3 This Privacy Policy should be read together with our Cookie Policy (which covers cookies and similar tracking technologies) and our POPIA/GDPR Data Processing Notice (which provides additional technical and legal detail on lawful bases, cross-border transfers, controller/processor roles, and breach notification), both of which are incorporated by reference.

1.4 Capitalised terms not defined in this Privacy Policy have the meaning given in the Platform General Terms & Conditions.

1.5 How we collect your consent. Where this Privacy Policy indicates that a purpose relies on your consent, that consent is collected through a specific, unbundled, opt-in control that is never pre-ticked and is kept separate from your acceptance of our contractual terms, as described in clause 1.4 of the Platform General Terms & Conditions. You may withdraw any such consent at any time, at least as easily as you gave it, through your Account settings or by contacting the privacy officer without affecting the lawfulness of processing carried out before withdrawal.

2. Scope

2.1 This Privacy Policy applies to Personal Information we collect through: the Platform website and mobile applications; the Odoo-based candidate, employer, and recruiter portals; customer support interactions; marketing communications and events; and any other interaction you have with us in connection with the Platform.

2.2 It does not apply to third-party websites or services that may be linked from the Platform, which have their own privacy policies.

3. Information We Collect

3.1 Information you provide to us directly:

1. Account and identity information - name, email address, phone number, physical/postal address, date of birth, gender, country of residence, and where you choose to provide it or it is required for verification, a copy of an identity document or passport;
2. Candidate-specific information - CV/résumé, employment and education history, qualifications and certifications, skills, salary expectations, references and reference contact details (see clause 3.5 below), work-authorisation/visa status, professional licences, portfolio material, video introductions, and, only where you voluntarily disclose it or it is lawfully requested for equal-opportunity monitoring, information about race/ethnicity, disability status, or similar equity-related information;
3. Employer-specific information - company name, registration number, VAT/tax number, industry, company size, billing and contact details, and job-posting content;
4. Recruiter-specific information - agency name, license/registration numbers, professional accreditation, billing and contact details, and mandate/client information relevant to a specific vacancy;
5. Communications - messages exchanged through the Platform’s messaging features, support tickets, survey responses, and feedback/reviews;
6. Payment information - billing name and address, and limited payment-method details (full card numbers are processed by our third-party payment processor and are not stored by us);
7. Interview and assessment information - where used and disclosed to you before the relevant step, video or audio recordings of interviews, interview transcripts, and the results of online or psychometric assessments, as further described in clause 3.6 and the Candidate Terms & Conditions.

3.2 Information we collect automatically:

1. Usage and device data - IP address, browser type and version, device identifiers, operating system, referring/exit pages, pages viewed, time spent, and click patterns;
2. Cookies and similar technologies - as described in our Cookie Policy;
3. Location data - general location inferred from IP address, or precise location if you grant permission through a device setting.

3.3 Information from third parties, including indirect sourcing of Candidates:

1. information from Employers or Recruiters about a Candidate they interact with, or from Candidates about a prior Employer or Recruiter (for example, feedback or references);
2. information from background-check, reference-check, identity-verification, or credit-reference providers engaged with your consent;
3. information from social or professional networks if you choose to sign in using, or import a profile from, such a service;
4. publicly available information (for example, from a professional networking profile you have made public) where you have made this available and it is reasonable and lawful for us or another user to consider it in a recruitment context;
5. information a Recruiter imports about a Candidate it represents, an Employer uploads about a Candidate it has sourced independently (for example, from a prior application received outside the Platform), or a person provides about another individual as a referral;
6. information migrated from an Employer’s or Recruiter’s own legacy recruitment database when it first began using the Platform.

3.4 Candidates whose profile was not created by them personally. Where a Candidate’s Personal Information is added to the Platform by an Employer, a Recruiter, another individual (a referral), or is imported from a public professional network or a legacy database, rather than being submitted by the Candidate directly, the following additional safeguards apply:

1. Source disclosure. We (or, where the profile was created by an Employer or Recruiter, that Employer or Recruiter, who is responsible for this notification) will tell the Candidate, at the point of first contact, who supplied their information and, where known, how it was obtained (for example, “imported from your public LinkedIn profile by [Recruiter name],” “referred by [name],” or “migrated from [Employer]’s previous recruitment system”).
2. Timing of notification. Consistent with GDPR Article 14 and the equivalent POPIA notification requirements for information not collected directly from the data subject, the Candidate will be notified within a reasonable period after the information is obtained and, in any event, at the earlier of: one month after the information is obtained; the time of first communication with the Candidate, if used to communicate with them; or before the information is disclosed to another recipient (for example, before an Employer views a profile a Recruiter has imported), unless an exemption applies (for example, because the Candidate already has the information, notification proves impossible or would involve disproportionate effort, or a legal obligation requires the data to remain confidential).
3. Visibility before the profile is claimed. An “unclaimed” profile (one created by an Employer, Recruiter, or referral, and not yet logged into or confirmed by the Candidate) is not made searchable or visible to other Employers or Recruiters generally; it may only be visible to the specific Employer or Recruiter who created it and, where applicable, its own team, for the specific mandate or purpose disclosed to the Candidate, until the Candidate claims the profile and makes their own visibility choices under clause 7.4 of the Candidate Terms & Conditions.
4. Retention of unclaimed profiles. An unclaimed profile that the Candidate has not logged into, confirmed, or objected to within 4 months of creation will be deleted or anonymised, unless the Candidate has separately engaged with the relevant Employer or Recruiter outside that period in a way that provides a continued lawful basis for retention.
5. Objection and deletion. A Candidate may object to, or request deletion of, an unclaimed or indirectly sourced profile at any time by contacting the privacy officer or the Employer/Recruiter who created it, without needing to create an Account, and we (or the relevant Employer/Recruiter) will action that request in accordance with clause 8.
6. Lawful authority. A Recruiter or Employer that imports, uploads, or refers a Candidate’s Personal Information must, under clause 4 of the Recruiter Terms & Conditions or clause 3 of the Employer Terms & Conditions (as applicable), hold a lawful basis for doing so (for example, the Candidate’s own prior consent to that Recruiter, a legitimate interest properly balanced against the Candidate’s rights, or another applicable exemption), and must be able to demonstrate that lawful basis to us or a regulator on request. Disclosure of an indirectly sourced Candidate’s profile to a specific Employer beyond the Recruiter or Employer who first obtained it requires the Candidate’s own consent, obtained directly from the Candidate, as described in clause 4 of the Candidate Terms & Conditions.

3.5 Referee information. Where you provide us with the name, telephone number, email address, or other contact details of a referee: (a) the information is collected directly from you (the Candidate) rather than from the referee, and is used solely to contact the referee to verify your employment history, qualifications, or character in connection with a specific recruitment process, at the request of, and disclosed only to, the Employer or Recruiter conducting that process; (b) it is retained only for the duration of the relevant recruitment process and a short period thereafter consistent with clause 7; (c) the referee, as a data subject in their own right, has the same rights described in clause 8 of this Privacy Policy in respect of their own contact details and any response they provide, and may contact the privacy officer to exercise them; and (d) by providing a referee’s details, you confirm, as set out in clause 4 of the Candidate Terms & Conditions, that you have informed that referee that their contact details will be provided through the Platform for this purpose and that you are authorised to provide those details.

3.6 Interviews, recordings, and assessments. Where the Platform, an Employer, or a Recruiter uses video or audio recording of interviews, interview transcription, online or psychometric assessments, technical assessments, or remote proctoring/identity-verification tools in connection with a specific recruitment process, this will be disclosed to the Candidate before the relevant step, is subject to the Candidate’s separate consent as described in clause 3.6 of the Candidate Terms & Conditions (which is not satisfied merely by consenting to a background check under clause 5.1 of the Candidate Terms & Conditions), and is retained only for the duration of that recruitment process and a limited period thereafter as disclosed at the time.

3.7 We do not intentionally collect more Personal Information, or more sensitive categories of Personal Information, than is reasonably necessary for the recruitment and platform-operation purposes described in this Privacy Policy.

4. How and Why, We Use Your Information (Purposes and Lawful Bases)

4.1 We use Personal Information for the following purposes, relying on the lawful bases indicated (mapped to POPIA’s conditions for lawful processing and, in parallel, the EU/UK GDPR Article 6 legal bases - see the POPIA/GDPR Data Processing Notice for the detailed side-by-side mapping):

4.2 Where we rely on consent, you may withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal. Where we rely on legitimate interest, we have assessed that our interest is not overridden by your rights and interests, and you may object as described in clause 8.

5. How We Share Your Information

5.1 We share Personal Information with:

1. Other Platform users, strictly as necessary for the recruitment purpose - for example, sharing a Candidate’s profile and CV with an Employer or Recruiter to whom the Candidate has applied, or making a Candidate’s profile visible to Employers/Recruiters where the Candidate has opted into searchable visibility;
2. Service providers and processors who perform services on our behalf under written data-processing agreements, including cloud hosting, the Odoo platform infrastructure, email/SMS/WhatsApp delivery, payment processing, identity verification, background-check facilitation, video-interview/meeting hosting, CV-parsing or other AI providers, customer support tooling, and analytics providers, each as identified in our published Subprocessor List;
3. Professional advisers such as lawyers, auditors, and insurers, where reasonably necessary;
4. Regulators, courts, and law-enforcement authorities, where required by law, to establish or defend legal claims, or to protect the safety of any person;
5. A buyer or successor entity in connection with a merger, acquisition, financing, or sale of assets, subject to that party being bound by materially equivalent privacy protections; and
6. Any other party, with your consent, or as otherwise described at the point of collection.

5.2 We do not sell Personal Information to third parties for their own independent marketing purposes, and we do not permit Employers or Recruiters to use Candidate data obtained through the Platform for purposes other than the recruitment purposes described in the Employer Terms and Recruiter Terms.

5.3 Employers’ and Recruiters’ own transparency obligations. Once an Employer or Recruiter receives, downloads, or accesses a Candidate’s application, it typically becomes an independent responsible party/controller of that Candidate’s Personal Information for its own recruitment purposes (see clause 2 of the POPIA/GDPR Data Processing Notice). This Privacy Policy describes our own processing as the Platform operator; it does not, and cannot, substitute for the separate privacy notice each Employer and each Recruiter is independently required to provide to Candidates about its own processing, as described in clause 3 of the Employer Terms & Conditions and clause 4 of the Recruiter Terms & Conditions.

6. International Transfers of Personal Information

6.1 Because the Platform serves users internationally, Personal Information may be transferred to, stored in, and processed in South Africa and other countries — including countries that may not have data protection laws equivalent to your home jurisdiction — where our servers, service providers, or the Employer/Recruiter you are interacting with are located.

6.2 Where we transfer Personal Information originating from the European Union, United Kingdom, or another jurisdiction with cross-border transfer restrictions to a country not deemed to provide an adequate level of protection, we will rely on an appropriate safeguard recognised under Applicable Data Protection Law, such as the European Commission’s Standard Contractual Clauses, the UK International Data Transfer Addendum, an adequacy decision, or another lawful transfer mechanism, and, where applicable under POPIA section 72, we will ensure the recipient is subject to a law, binding corporate rules, or agreement providing an adequate level of protection substantially similar to POPIA, or that you have consented to the transfer, or that the transfer is necessary for the performance of a contract with you.

6.3 Further detail on our cross-border transfer mechanisms, including the specific transfer routes and safeguards used, are set out in Schedule D to the Data Processing Agreement and clause 5 of the POPIA/GDPR Data Processing Notice.

7. Data Retention

7.1 We retain Personal Information only for as long as necessary to fulfil the purposes described in this Privacy Policy, including to comply with legal, accounting, or reporting obligations, resolving disputes, and enforcing our agreements. Indicative retention periods are:

1. Active Candidate profiles: retained while your Account is active and for a reasonable period after your last activity to allow re-engagement, after which we will prompt you to confirm continued interest or delete/anonymise inactive profiles, and in any event no longer than 24 months of inactivity unless you re-engage or applicable law requires longer retention;
2. Unclaimed profiles created by an Employer, Recruiter, or referral: retained as described in clause 3.4(d), currently no longer than 6 months without Candidate engagement;
3. Application records (a specific application to a specific role): retained for the duration of the recruitment process and for a limited period thereafter (for example, to respond to equal-opportunity or unfair-dismissal claims) in line with limitation periods under applicable law, typically 6-12 months after the role is filled or withdrawn;
4. Referee information and interview/assessment recordings: retained only for the duration of the specific recruitment process and a short period thereafter, typically no longer than 6 months after the role is filled or withdrawn, unless a longer period is disclosed to the Candidate and referee at the time;
5. Employer and Recruiter account and billing information: retained for the duration of the commercial relationship and thereafter for the period required by applicable tax and company law (typically five to seven years);
6. Marketing consents and preferences: retained until you withdraw consent or unsubscribe, plus a short period to record the withdrawal itself; and
7. Security and access logs: retained for a limited period sufficient for security and fraud-investigation purposes, typically no more than 12 months.

7.2 When Personal Information is no longer needed, we will securely delete, destroy, or anonymise it, save where retention is required by law (for example, tax or employment-equity record-keeping obligations) or to establish, exercise, or defend legal claims.

8. Your Rights

8.1 Subject to applicable law and any exceptions that apply, you have the right to:

1. be informed about how your Personal Information is processed (as set out in this Privacy Policy), including, if you did not provide your information to us directly, who supplied it and when, as described in clause 3.4;
2. access a copy of the Personal Information we hold about you;
3. correct/rectify inaccurate or incomplete Personal Information;
4. delete/erase your Personal Information (“right to be forgotten”), subject to our legitimate need to retain certain records as described in clause 7;
5. restrict or object to processing, including objecting to processing based on legitimate interest, to an unclaimed or indirectly sourced profile, or to direct marketing at any time;
6. data portability - receive certain Personal Information you provided to us in a structured, commonly used, machine-readable format, and have it transmitted to another controller where technically feasible;
7. withdraw consent at any time, without affecting the lawfulness of processing before withdrawal;
8. not be subject to a decision based solely on automated processing, including profiling or automated shortlisting/rejection, that produces legal or similarly significant effects on you, without appropriate human review, unless an exception applies, as further described in clause 13; and
9. lodge a complaint with the relevant supervisory authority - in South Africa, the Information Regulator (contact details below), or in the European Union/UK, the data protection supervisory authority of your country or region of residence.

8.2 To exercise any of these rights, contact our Information Officer. We will respond within the time required by applicable law (for example, “as soon as reasonably practicable” under POPIA, or one month, extendable by two further months for complex requests, under the GDPR) and may need to verify your identity before actioning a request. If we refuse a request, in whole or in part, we will explain why and how you may appeal against that decision or complain to a supervisory authority.

8.3 South African Information Regulator contact details: JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001; PO Box 31533, Braamfontein, 2017; email: complaints.IR@justice.gov.za / enquiries@inforegulator.org.za; website: www.inforegulator.org.za. (Please verify current contact details on the Information Regulator’s official website, as these may change.)

9. Security

9.1 We implement technical and organisational measures designed to protect Personal Information against loss, misuse, unauthorised access, disclosure, alteration, and destruction, consistent with the measures described in Schedule B to the Data Processing Agreement.

9.2 No system is completely secure, and we cannot guarantee absolute security. If we become aware of a security compromise affecting your Personal Information, we will notify you and, where required, the relevant regulator, in accordance with clause 10 and the POPIA/GDPR Data Processing Notice.

10. Data Breach Notification

10.1 In the event of a security compromise that has compromised the confidentiality, integrity, or availability of Personal Information, we will assess the risk and, where required by Applicable Data Protection Law, notify the relevant supervisory authority (including the South African Information Regulator, and where relevant an EU/UK supervisory authority) and affected individuals without undue delay, in accordance with the timelines and thresholds set out in the POPIA/GDPR Data Processing Notice.

11. Children’s Information

11.1 The Platform is not directed at, and we do not knowingly collect Personal Information from, individuals under the age of 18. If we become aware that we have collected Personal Information from someone under 18 without appropriate consent, we will take steps to delete it. If you believe a minor has provided us with Personal Information, please contact the privacy officer.

12. Employers’ and Recruiters’ Own Candidate Privacy Notices

12.1 As described in clause 5.3, each Employer and each Recruiter is independently responsible for providing its own Candidates with a privacy notice covering its own processing once it holds their information as a responsible party/controller in its own right, including its own retention periods, its background-check providers, its own use of automated hiring practices, how it responds to Candidate rights requests, whether it retains Candidates for future roles, and where it separately requires consent. Employers and Recruiters must comply with clause 3.6 (Employer Terms & Conditions) and clause 4.6 (Recruiter Terms & Conditions) in this regard.

13. Automated Matching, Profiling, and AI

13.1 Current use. The Platform’s current automated features are limited to keyword- and criteria-based matching of Candidate profiles to job requirements, intended to help surface relevant opportunities and Candidates. This clause must accurately reflect whether the Platform uses, or will use, any of the following, and must be updated accordingly before launch or before any such feature is enabled: CV parsing; candidate ranking or matching-percentage scores; automatic shortlisting; knockout questions; automatic rejection; AI-generated job descriptions or Candidate summaries; interview transcription; video or voice analysis; skills inference; fraud-detection scoring; chatbots; or use of an external, third-party AI provider or model.

13.2 Where any automated feature listed in clause 13.1 is enabled, we will update this Privacy Policy (or publish a dedicated Automated Matching and AI Notice, referenced here) to disclose, at a minimum: what automation is used and by whom (the Company, an Employer, or a third-party provider); the factors or data considered; whether protected characteristics (such as race, gender, age, disability, or similar grounds prohibited by applicable equality law) are excluded from scoring; whether a score or ranking affects a Candidate’s visibility to Employers/Recruiters; whether an Employer is permitted to configure automatic rejection based solely on an automated score, and if so, the safeguards that apply; whether Candidate data is used to train an AI model, and, if so, on what basis; whether data is sent to an external AI provider, and under what safeguards; how a Candidate can request human review of an automated outcome; how a Candidate can challenge or correct an inaccurate automated output; and how we monitor for bias or discriminatory outcomes in any such feature.

13.3 We will only state that no hiring decision is made solely through automated means if that is technically enforced across the Platform, including in respect of any Employer-configurable automated-rejection or auto-shortlisting feature; where an Employer’s own configuration permits a decision to be made without human review, this Privacy Policy and the relevant Employer’s own Candidate privacy notice (clause 12) will disclose that clearly, and the Employer remains responsible for ensuring such a feature complies with Applicable Data Protection Law and applicable equality law.

14. Changes to this Privacy Policy

14.1 We may update this Privacy Policy from time to time as described in clause 18 of the Platform General Terms & Conditions. We will indicate the date this Privacy Policy was last updated, and, for material changes, provide additional notice as described there.

15. Contact Us

General enquiries: support@talendoo.io

Information Officer / Data Protection queries: support@talendoo.io