Privacy Notice

1. Who we are

SMJobs is operated by [LEGAL ENTITY NAME] ("we", "our", "us"), a company registered in South Africa with registration number [CIPC REGISTRATION NUMBER], of [REGISTERED STREET ADDRESS] (VAT number [VAT NUMBER]). We are the responsible party for the personal information described in this notice.

This notice applies to smjobs.co.za and to the pages linked from it. It covers the Platform itself; it does not cover a third-party site that you reach by following a link from ours.

2. Our Information Officer

POPIA requires a responsible party to appoint an Information Officer (section 55). Ours is [INFORMATION OFFICER NAME AND ROLE], and you can reach them at info@smjobs.co.za or on +27 788 770 744. The Information Officer handles questions about this notice, requests for your personal information, and complaints about how it is handled.

3. What personal information is

"Personal information" has the meaning given in the Protection of Personal Information Act 4 of 2013 ("POPIA"): any information relating to an existing person, whether alone or with other information, that identifies or can reasonably be linked to that person.

In practice, the personal information we hold about you can be:

Identity and contact details — your first and last name, email address, phone number, and the profile photograph you upload.
Professional information — your headline, location, skills, years of experience, LinkedIn profile URL, and your CV (which may include your employment history, qualifications and contact details).
Application information — the name, email address, phone number and covering letter you give when you apply for a job, and the CV you attach to that application.
Account and security information — your password (stored only as an irreversible hash), the date you signed in, and the date your email address was verified.
Technical information — your IP address, the browser and device you are using, and the pages you request. The IP address is recorded on each application so that we can limit abuse of the application form.
Your consent decisions — what you agreed to, when, from which version of our notice, and the consent records we keep (see section 13).

We do not ask for and do not want special personal information — the categories POPIA treats as more sensitive under section 26, such as health, biometric, racial or ethnic origin, religious or philosophical belief, or union membership. If you put that kind of information in your CV or covering letter, you are sharing it with the employer anyway. We do not profile you on it.

4. Where the information comes from

Directly from you — when you register, fill in your profile, upload a CV or profile photo, apply for a job, post a job, or contact us.
From your device — the cookies and local storage listed in the Cookie Policy, which tell us what you have already agreed to and which jobs you have saved.
From Google — if you sign in with Google, we receive your name, email address and profile picture from Google, and we mark the account as verified by Google. We do not receive your contacts or your Google password.
From the server — your IP address, browser and device type are read from the request each time you use the Platform.

We do not buy contact lists, and we do not accept third-party data about job seekers from anyone.

5. Why we are allowed to process it

Under POPIA section 9 we may only process your personal information lawfully, and in a reasonable manner that does not infringe your privacy. Section 11 sets out the grounds on which we are allowed to do so. We rely on the following:

Consent (section 11(1)(a)) — for optional cookies, for appearing in the talent directory, for sharing your CV and covering letter with an employer when you apply, and for accepting these terms. You can withdraw consent at any time, and withdrawing it does not affect processing that already happened lawfully.
Performance of a contract (section 11(1)(b)) — to run your account, show you the jobs you search for, take your applications, let employers post and manage their vacancies, and send the emails the Platform has promised you, such as a password reset link or an application receipt.
Legitimate interests (section 11(1)(f)) — to keep the Platform secure, to limit abuse of the application form, to answer support requests, and to keep a record of what you agreed to.
Legal obligation (section 11(1)(c)) — to meet tax, accounting and other legal duties, and to comply with lawful requests from law enforcement or a court.

Where we rely on consent, you get a free and separate choice for each purpose. Declining never stops you from using the parts of the Platform that do not need that consent.

6. What we do with your information

We use your personal information to:

Create and maintain your account, and keep you signed in.
Show you job listings, and let you save and manage the ones you are interested in.
Pass your CV and covering letter to the employer you applied to, and let that employer manage your application — shortlist, decline, or contact you.
Show your profile to recruiters in the talent directory, but only once you have switched that on yourself (see section 7).
Send you your application receipt and, where you have asked us to, updates about an application.
Verify your email address, and verify an employer's details before their postings go live.
Send a password reset link, and an email verification link, when you ask for one.
Protect the Platform: limiting how many applications one network can send, blocking obvious automated submissions, and keeping audit records of administrative actions.
Comply with our legal and tax obligations, and answer requests from the Information Regulator.

We do not sell your information and we do not make automated decisions that have a legal effect on you. We do not build an advertising profile from your account or application data. If you allow Advertising, Google AdSense may use cookie and device information to show and measure ads, as explained in the Cookie Policy. Our recruiters see candidate profiles in an ordinary search list, and a human being reads and decides.

7. The talent directory

The Platform lets employers search a directory of job seekers. You are not in that directory by default. When you register, the setting is off, and your profile, CV and details are not returned to any employer search.

You switch it on yourself, on the "Talent Directory" panel on your account page. From that moment, and until you switch it off again, employers who search the directory can see your name, headline, location, years of experience, skills, LinkedIn profile URL, CV, email address and phone number. The switch can be turned off at any time, and turning it off takes effect immediately: your details stop being returned to searches and the CV can no longer be fetched, even by a direct link.

Turning it on is recorded as a distinct decision in our consent ledger, and turning it off is recorded as the withdrawal of that decision.

8. Who we share it with

We do not sell your personal information. We share it only in these cases:

Employers you apply to — the name, email address, phone number, covering letter and CV on that application, and your application status. They see these details because you applied to them.
Employers that search the talent directory — the details listed in section 7, and only if you have switched the directory on.
Our hosting and email providers — the hosting provider that stores the database and uploaded files, and the provider that delivers our emails. They act on our instructions and may not use your information for their own purposes.
Google — if you use Google sign-in, Google authenticates you and gives us your name, email address and picture. Google also applies its own policies to that interaction. If you allow Advertising, Google AdSense loads on the pages the administrator selects and may set advertising cookies to show and measure ads. Google acts as an independent controller for that advertising data; see the Cookie Policy for the cookies involved and how to withdraw.
Law enforcement, a court, or the Information Regulator — where the law requires it, or where we need to protect the Platform and its users from harm.
A buyer or successor — if the Platform is sold or merged, your information may transfer to the new owner, who must honour this notice.

9. Cookies and local storage

We use a small number of cookies and local storage entries. They keep you signed in, remember the jobs you have saved, and record the cookie choices you make. Optional technologies only work if you have agreed to them.

Every item we use, what it does and how long it lasts is set out in the Cookie Policy. You can change your mind at any time using the "Cookie settings" button in the footer of any page. We do not run a third-party analytics tracker. Google AdSense advertising is optional, off until you agree to the Advertising category, and can be switched off again at any time.

10. How we keep it safe

We apply the safeguards POPIA expects of a responsible party under section 19, and we keep them proportionate to the risk:

Access control. CVs, profile photographs and application files are never served directly from a public folder. Every request goes through a script that checks who is asking and what they are entitled to, and refuses the request otherwise.
Passwords. Passwords are stored only as irreversible one-way hashes. We never store, log or email your password, and staff cannot read it.
Staff accounts. Administrative accounts are kept separate from public accounts, so a public account can never be promoted to staff. Staff sessions are protected against cross-site request forgery, and administrative actions are written to an audit log.
Encryption in transit. The site is served over HTTPS, and cookies are marked so that they are not sent over an unencrypted connection.
Minimisation. We do not collect information we have no use for. The application form is protected against automated abuse, and the IP address recorded with an application is used for that purpose and for rate limiting only.
Testing. We review access to personal information periodically, and the administration panel is tested with an automated suite before every change.

No system is perfectly secure. Where there are reasonable grounds to believe that your personal information has been accessed or acquired by someone who should not have had it, we notify the Information Regulator, and we notify you as well unless we cannot establish who you are, as POPIA section 22 requires. We will tell you what happened, what the possible consequences are, and what you can do to protect yourself.

11. How long we keep it

We keep personal information only for as long as we need it for the purpose it was collected, and then we delete it. The periods that apply are:

Your account and profile — while your account is active. When you ask us to delete your account, we remove the profile, the CV file, the profile photograph, your applications, your saved jobs, your consent records and your reset tokens, all at once.
Applications — for 24 months from the date you applied. After that, the application row and its CV file are deleted.
CV files on disk — removed with the account, or with the application, whichever applies.
Consent records — for 5 years from the last activity, so that we can show what you agreed to and when. If you ask us to delete your account, or ask us in writing to delete your consent records, they go too — your request to delete overrides our need to keep the evidence.
The administrative audit log — for 24 months.
Password reset tokens — for 1 hour, after which they cannot be used. Unused tokens are cleared out after 7 days.
Emails we have sent you — for as long as your account exists.

Where the law requires us to keep something for longer — for example a record required for tax purposes — we keep only that and we restrict it.

12. Your rights

POPIA gives you rights over your personal information. You can exercise them at any time, and you do not need to give a reason:

Access (section 23) — ask us for a copy of the personal information we hold about you, and for information about how it was collected, the purpose of processing, and the recipients or categories of recipients.
Correction, destruction and deletion (section 24) — ask us to correct personal information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or was obtained unlawfully, or to destroy or delete a record we are no longer authorised to retain.
Objection (section 11(3)) — object to the processing of your information on reasonable grounds relating to your particular situation, or to processing for direct marketing, and we will stop unless there is a legal ground that overrides your objection.
Withdrawal of consent (section 11) — withdraw any consent you gave, at any time, on the same form or a later one. It has no effect on processing that was lawful before you withdrew it.
Erasure — ask us to delete your information where the grounds in section 24 apply, for example where you have withdrawn consent and there is no other lawful basis, or where the information has served its purpose and cannot lawfully be kept under section 14.
Complaint (section 74) — complain to the Information Regulator of South Africa about our handling of your information. You do not have to complain to us first, and you may also institute civil proceedings under section 99.

To exercise any of these, email info@smjobs.co.za or use the "Delete my account" control on your account page. We aim to respond within 30 days, and we will tell you if we need more time and why.

13. The consent ledger

When you agree to something, we write it down. Each consent record holds the categories you agreed to, the version of this notice in force at the time, the date and time, your IP address, your browser's user-agent string, and — if you are signed in — a link to your account.

We keep these records for 5 years. You can ask for a copy of the record that relates to you, and you can ask us to delete it. We do not sell them and we do not use them to make decisions about you.

The full processing register — what we collect, why, who it goes to and how long we keep it — is published in the PAIA & POPIA Compliance Manual, along with the procedures we follow for your rights, for a security compromise, and for the reviews we commit to.

14. Direct marketing

Every email the Platform sends you is transactional: a password reset, an email verification, a notice that an employer received your application, an update on the status of an application, or a message about a job you have asked to hear about. We do not send advertising newsletters, and we do not sell or share your contact details with anyone for marketing.

If we ever introduce marketing messages, they will be separate from the service messages, they will require your consent, and every one of them will carry a way to stop them.

15. Children

The Platform is a job platform for adults. You must be at least 18 years old to create an account. We do not knowingly collect personal information from children, and if we learn that we have, we delete it.

16. Where your information is processed

Our Platform is hosted with a service provider outside South Africa, so your information is processed on servers that may be located outside the Republic. POPIA section 72 governs transfers of personal information outside the Republic: the hosting provider acts on our instructions, and we have taken reasonable steps to ensure your information is protected to the standard POPIA requires. If you would like to know where the data is stored, contact us.

17. Changes to this notice

We may update this notice as the Platform changes or the law changes. We will update the "Last updated" date and version number at the top of this page, and we will ask you again for consent before any change that introduces a new use for your information.

18. Contact and complaints

For any question about this notice, or to exercise a right described in section 12:

Email: info@smjobs.co.za
Phone: +27 788 770 744
Information Officer: [INFORMATION OFFICER NAME AND ROLE]

If you are not satisfied with how we have handled your information, you have the right to lodge a complaint with the Information Regulator of South Africa, established under the Protection of Personal Information Act 4 of 2013. We would rather you raised it with us first, so that we can put it right, but you are not required to do so.

Read our Cookie Policy and Terms & Conditions as well — they form part of this notice. The PAIA & POPIA Compliance Manual sets out the same obligations in full: the processing register, our rights-handling procedure, our breach procedure and our compliance calendar.