Privacy notice

1The short version

The rest of this page is the detail, written out properly, because “we care about your privacy” is not information and this is your pay we are talking about.

2Who is responsible for your information

Holela is the responsible party for the information described here, in the sense the Protection of Personal Information Act (POPIA) uses that term. Your employer is separately responsible for the payroll records they hold about you.

Our Information Officer can be reached at privacy@holela.co.za.

3What we hold

About you as a person:

• your name and surname;
• your cellphone number — this is also how you sign in, so we always have it;
• a one-way fingerprint of your ID number, plus its last four digits (see section 6);
• your employee number and your employer.

About your work and pay:

• your pay cycle, payday and salary or wage rate;
• your start date and whether your employment is active;
• days worked or shifts recorded in the current cycle;
• the bank account your employer pays your salary into, held in encrypted form (see section 6).

About your use of the service:

• each draw: the amount, the access fee, the date, and the consent you gave for the deduction;
• whether each payment reached you, and when;
• messages you send us on WhatsApp, USSD or email when you ask for help;
• basic technical records — sign-in times, device type, and the network address a request came from — which we keep to detect somebody trying to get into your account.

4Where it comes from

Almost all of it comes from your employer’s payroll, either as a file they send us or through a direct connection to their payroll system. We do not go looking for information about you anywhere else.

The rest comes from you — what you tell us when you ask for help — and from the payment provider that tells us whether a payment arrived.

5Why we are allowed to hold it

Under POPIA we need a lawful ground for each use. Ours are:

• To do what you asked. We cannot tell you what you have earned, or pay you, without your pay and employment information.
• Your written consent. The deduction from your next pay happens only because you consented to that specific amount, and we keep the record of it.
• Because the law requires it. Records of money paid and recovered must be kept, and we may have to produce them to a regulator or a court.
• To stop fraud. Checking that the person signing in is the person on the payroll record protects your wages, and it is why we keep the technical records above.

We do not use your information to decide what to advertise to you, and we do not build a profile of you to sell.

6Your ID number and bank account

Your ID number. We keep a one-way cryptographic fingerprint of it — enough to recognise the same person twice, not enough to reconstruct the number — together with the last four digits so support staff can confirm they are talking to the right person. The full number is never written to our records and never appears on a screen.

Your bank account. The account number comes from your employer’s payroll record and is stored encrypted. It is decrypted only at the moment a payment is made, and only by the part of the system that makes payments. No one at Holela can browse it, and neither the app nor support can show it to you in full.

You cannot change it here, and that is deliberate. Money goes only to the account your employer already pays your salary into. If we let anyone add a destination account, then anyone who got hold of your phone could send your wages to their own. If your account changes, change it with your employer.

7Who else sees it

We share only what each party needs to do its job:

• Your employer’s payroll. The deduction schedule — who drew, how much, the access fee, the total to deduct.
• Payment providers. Your name, the destination account and the amount, so the payment can be made.
• Messaging providers. Your cellphone number, to send you a sign-in code or a notification.
• Our technology suppliers. Hosting and database providers, who hold the information on our behalf under contract and may not use it for anything of their own.
• Regulators, auditors and courts. Where we are legally required to produce records.

That is the complete list. We do not sell your information, we do not share it with marketers, and we do not pass it to anyone else without telling you.

8What your employer can and cannot see

Your employer sees that you used the service, the amounts, and what to deduct on payday. They have to: they are the ones running the deduction, and they need your consent on record.

Your employer does not see why you drew, what you said to us when you asked for help, or anything you did not put in front of them yourself. Nobody at Holela will discuss an individual employee’s reasons with their employer.

9Where it is kept

Our systems are currently hosted in the European Union. That makes storing your information a cross-border transfer under POPIA, which is permitted where the receiving country’s law protects your information at a comparable standard — and EU data protection law does.

We are evaluating a move to South African hosting. If we move, this notice will be updated before the move happens, not after.

10How long we keep it

• Records of money and consent — five years after the last draw, because financial and consent records have to be producible for that long.
• Your employment and pay information — while you are enrolled, and then for as long as any money question about your account is still open.
• Support conversations — two years.
• Technical sign-in records — twelve months.

After that we delete it, or we strip out everything that identifies you so that what remains cannot be traced back to you.

11How we protect it

• Everything is encrypted in transit and at rest, with bank account numbers separately encrypted on top of that.
• Every employer’s data is isolated at the database level, so one employer cannot see another’s people even by accident. That isolation is verified by automated tests on every change.
• Your colleagues cannot see your salary or your draws. Access to an employee record is limited to that employee and to authorised staff at their employer.
• Staff accounts are invite-only and require a second factor. Every action taken on a record is written to an audit log with who did it and when.
• If your information is ever compromised in a way that puts you at risk, we will tell you and the Information Regulator, as POPIA requires.

12Your rights

Under POPIA you can ask us to:

• tell you what we hold about you, and give you a copy;
• correct anything that is wrong or out of date;
• delete information we no longer have a reason to keep — bearing in mind the retention periods above, which we cannot shorten;
• stop using your information for a particular purpose;
• explain a decision the system made about you, such as why your available amount is what it is.

Write to privacy@holela.co.za and we will answer within 30 days. It costs you nothing to ask. If the information came from your employer’s payroll, we may need to send you to them to have it corrected at source — otherwise the next sync would simply overwrite our correction.

13Complaints

Tell us first — privacy@holela.co.za — and we will look into it properly.

If you are not satisfied, you can complain to the Information Regulator of South Africa, which oversees POPIA. You do not need our permission and you do not need to go through us first.

14Changes to this notice

When this notice changes we update the date at the top. If a change affects what we do with your information in a way that matters to you, we will tell you directly rather than quietly editing the page.