Summary:We collect only what we need to run your recruitment platform. We never sell your data or candidates' data. Candidate data is deleted 30 days after your subscription ends. You can request a copy or deletion of your data at any time.
1. Who We Are
Kaya Recruit is operated by Job Holdings (Pty) Ltd, a company registered in South Africa ("we", "us", "our"). We are the Operator under the Protection of Personal Information Act 4 of 2013 ("POPIA") in respect of candidate data processed on behalf of our agency clients, and the Responsible Party in respect of data collected directly from agencies and users of our platform. Our information officer can be contacted at support@kayarecruit.co.za.
2. What Information We Collect
We collect: (a) Agency & account data — company name, contact name, email address, billing details, and subscription information provided at signup; (b) Candidate data — CVs, contact details, work history, and application information uploaded by agencies through the platform; (c) Usage data — feature interactions, AI usage counts, login timestamps, and IP addresses for security and billing purposes; (d) Payment data — PayFast transaction references and subscription identifiers (we do not store card numbers or banking details); (e) Support communications — emails and messages sent to support@kayarecruit.co.za.
3. How We Use Your Information
We use agency and account data to: provide and operate the Kaya Recruit platform; process subscription payments via PayFast; send transactional emails (account confirmations, payment receipts, trial notifications); provide customer support; and improve our services. We use candidate data solely to provide the recruitment management features selected by the agency. We do not use candidate data to train AI models, sell data to third parties, or contact candidates directly.
4. Candidate Data and POPIA
Agencies using Kaya Recruit are the Responsible Party under POPIA for all candidate personal information they upload or process. Agencies must ensure they have obtained valid POPIA-compliant consent from each candidate before uploading their data. Kaya Recruit acts as an Operator: we process candidate data only on your documented instructions. Candidate data is stored for the duration of your subscription plus 30 days after cancellation or trial expiry, after which it is permanently deleted. Our built-in consent logging tool records consent actions to assist agencies with POPIA compliance — this does not replace the agency's own consent obligations.
5. AI Processing
AI features (CV screening, job description generation, interview questions, candidate summaries) are powered by Anthropic's Claude API. CV text and job descriptions submitted to AI features are sent to Anthropic's API for processing. Anthropic's API is used in compliance with their data processing terms. We do not use your data or candidates' data to train AI models. AI-generated outputs are decision-support tools only and should be reviewed by a human before use in employment decisions.
6. Sharing of Information
We do not sell personal information. We share data only with: (a) Anthropic — for AI processing of content you submit to AI features; (b) PayFast — for payment processing (governed by PayFast's privacy policy); (c) Resend — for transactional email delivery; (d) Railway — our cloud hosting provider (data stored in their infrastructure); (e) Law enforcement — where required by South African law or valid court order. All third-party providers are bound by data processing agreements.
7. Data Security
We implement industry-standard security measures including: HTTPS encryption for all data in transit; hashed password storage; JWT-based authentication with secure HTTP-only cookies; rate limiting on public endpoints; and access controls limiting data access to authorised personnel. While we take reasonable steps to protect your data, no internet transmission is completely secure. You are responsible for maintaining the confidentiality of your account credentials.
8. Data Retention
Agency account data is retained for the duration of the subscription. On account deletion, agency data is removed within 30 days. Candidate data is retained for the duration of your active subscription plus 30 days, then permanently deleted. Payment transaction records are retained for 5 years as required by South African tax law. Support emails are retained for 2 years. You may request deletion of your data at any time by emailing support@kayarecruit.co.za.
9. Your Rights Under POPIA
As a data subject, you have the right to: access the personal information we hold about you; request correction of inaccurate information; request deletion of your information (subject to legal retention obligations); object to the processing of your information; and lodge a complaint with the Information Regulator of South Africa (inforegulator.org.za). To exercise any of these rights, contact us at support@kayarecruit.co.za. We will respond within 30 days.
10. Cookies
We use a single authentication cookie (hf_token) to keep you logged in to the platform. This is a functional cookie necessary for the service to operate — it is not used for tracking or advertising. We do not use analytics cookies, third-party tracking pixels, or advertising networks.
11. Changes to This Policy
We may update this Privacy Policy from time to time. Material changes will be notified by email to the registered agency contact address. Continued use of the Service after notification constitutes acceptance of the updated policy. The current version is always available at kayarecruit.co.za/privacy.
12. Contact
For privacy questions, data access requests, or complaints: support@kayarecruit.co.za · Job Holdings (Pty) Ltd, South Africa · Information Officer: support@kayarecruit.co.za