Privacy notice

1The short version

The rest of this page is the detail, written out properly, because “we care about your privacy” is not information and this is your pay we are talking about.

2Who is responsible for your information

Holela is the responsible party for the information described here, in the sense the Protection of Personal Information Act (POPIA) uses that term. Your employer is separately responsible for the payroll records they hold about you.

Our Information Officer can be reached at privacy@holela.co.za.

3What we hold

About you as a person:

• your name and surname;
• your cellphone number — this is also how you sign in, so we always have it;
• a one-way fingerprint of your ID number, plus its last four digits (see section 6);
• your employee number and your employer.

About your work and pay:

• your pay cycle, payday and salary or wage rate;
• your start date and whether your employment is active;
• days worked or shifts recorded in the current cycle;
• the bank account your employer pays your salary into, held encrypted and used only to send you money (see section 6).

About your use of the service:

• each draw: the amount, the access fee, the date, and the consent you gave for the deduction;
• whether each payment reached you, and when;
• messages you send us on WhatsApp, USSD or email when you ask for help;
• basic technical records — sign-in times, device type, and the network address a request came from — which we keep to detect somebody trying to get into your account.

4Where it comes from

Almost all of it comes from your employer’s payroll, either as a file they send us or through a direct connection to their payroll system. We do not go looking for information about you anywhere else.

The rest comes from you — what you tell us when you ask for help — and from the payment provider that tells us whether a payment arrived.

5Why we are allowed to hold it

Under POPIA we need a lawful ground for each use. Ours are:

• To do what you asked. We cannot tell you what you have earned, or pay you, without your pay and employment information.
• Your written consent. The deduction from your next pay happens only because you consented to that specific amount, and we keep the record of it.
• Because the law requires it. Records of money paid and recovered must be kept, and we may have to produce them to a regulator or a court.
• To stop fraud. Checking that the person signing in is the person on the payroll record protects your wages, and it is why we keep the technical records above.

We do not use your information to decide what to advertise to you, and we do not build a profile of you to sell.

6Your ID number and bank account

Your ID number. We keep a one-way cryptographic fingerprint of it — enough to recognise the same person twice, not enough to reconstruct the number — together with the last four digits so support staff can confirm they are talking to the right person. The full number is never written to our records and never appears on a screen.

Your bank account. The account number comes from your employer’s payroll record and is stored encrypted, with the key held outside the database — so a copy of the database on its own is unreadable. It is decrypted at one point in the system and one only: the moment a payment is sent to you. No screen in the product shows it — not to you, not to your employer, and not to our support staff, who see the last four digits and nothing more.

You cannot change it here, and that is deliberate. Money goes only to the account your employer already pays your salary into. If we let anyone add a destination account, then anyone who got hold of your phone could send your wages to their own. If your account changes, change it with your employer.

7Who else sees it

We share only what each party needs to do its job:

• Your employer’s payroll. The deduction schedule — who drew, how much, the access fee, the total to deduct.
• Payment providers. Your name, the destination account and the amount, so the payment can be made.
• Messaging providers. Your cellphone number, to send you a sign-in code or a notification.
• Our technology suppliers. Hosting and database providers, who hold the information on our behalf under contract and may not use it for anything of their own.
• Regulators, auditors and courts. Where we are legally required to produce records.

That is the complete list. We do not sell your information, we do not share it with marketers, and we do not pass it to anyone else without telling you.

8What your employer can and cannot see

Your employer sees that you used the service, the amounts, and what to deduct on payday. They have to: they are the ones running the deduction, and they need your consent on record.

Your employer does not see why you drew, what you said to us when you asked for help, or anything you did not put in front of them yourself. Nobody at Holela will discuss an individual employee’s reasons with their employer.

9Where it is kept

Your information leaves South Africa in two ways, and we would rather name both than mention only the larger one.

• Our systems are hosted in the European Union. That is where your record lives. POPIA permits storing information abroad where the receiving country protects it at a standard comparable to ours, and we rely on European data protection law for that. We are having that position confirmed by our attorneys, and if they tell us it needs to change, we will change it and say so here.
• Text messages are sent through a provider that processes them outside South Africa, at present in the United States. What reaches them is your phone number and the words of the message — which include your first name and a rand amount. It does not include your identity number or your bank account number, and it never will: those are never sent in a message.

We are working on moving both closer to home — South African hosting, and a South African messaging provider. If either moves, this notice will be updated before it happens, not after.

10How long we keep it

• Records of money and consent — five years after the last draw, because financial and consent records have to be producible for that long.
• Your employment and pay information — while you are enrolled, and then for as long as any money question about your account is still open.
• Support conversations — two years.
• Technical sign-in records — twelve months.

After that we delete it, or we strip out everything that identifies you so that what remains cannot be traced back to you.

Which of the two depends on the record. Your bank account details are deleted outright — once you are gone, nothing needs them. Records that prove money was handled lawfully, such as the permission you gave for a deduction, are kept but stripped of anything that identifies you. We are required to be able to produce those, and keeping them without your name attached is how we do both things at once.

Holela has not been running long enough for anything to have reached these periods yet. We are saying now what will happen when it does.

11How we protect it

• Everything is encrypted in transit and at rest.
• Every employer’s data is isolated at the database level, so one employer cannot see another’s people even by accident. That isolation is verified by automated tests on every change.
• Your colleagues cannot see your salary or your draws. Access to an employee record is limited to that employee and to authorised staff at their employer.
• Staff accounts are invite-only and require a second factor. Every action taken on a record is written to an audit log with who did it and when.
• If your information is ever compromised in a way that puts you at risk, we will tell you and the Information Regulator, as POPIA requires.

12Who is responsible for your information

Mostly your employer, and that is not us avoiding responsibility — it is how the law divides it up.

Your employer decides that you are employed, what you are paid and which bank account it goes to. Under POPIA they are the responsible party for that information, and we process it on their instruction as an operator. It means a correction to your name, your pay or your bank details has to be made with them — if we changed it here, their next payroll file would simply overwrite it.

For some things we are responsible in our own right: the record of what you agreed to and when, our own financial records of each draw, and our security logs. Those are ours, and the rights below apply to us directly.

13Your rights

Under POPIA you can ask us to:

• tell you what we hold about you, and give you a copy. You do not have to ask for this one: if you have an account, it is a button in your settings and the file downloads immediately;
• correct anything that is wrong or out of date;
• delete information we no longer have a reason to keep. Where the law requires us to keep a record — the permission you gave for a deduction is the main one — we remove your name and details from it rather than destroy it, so that nothing left points to you;
• stop using your information for a particular purpose;
• explain a decision the system made about you, such as why your available amount is what it is.

Write to privacy@holela.co.za and we will answer within 30 days. It costs you nothing to ask. If the information came from your employer’s payroll, we may need to send you to them to have it corrected at source — otherwise the next sync would simply overwrite our correction.

14Complaints

Tell us first — privacy@holela.co.za — and we will look into it properly.

If you are not satisfied, you can complain to the Information Regulator of South Africa, which oversees POPIA. You do not need our permission and you do not need to go through us first.

14Changes to this notice

When this notice changes we update the date at the top. If a change affects what we do with your information in a way that matters to you, we will tell you directly rather than quietly editing the page.