Privacy Policy

1.1. The terms set out below are the terms and conditions regarding your privacy (“Policy”) under which we or any of our Affiliates do business with, may do business with, or may otherwise interact with you, including clients, employees, service providers and others.

1.2. The Policy sets out:

• the types of Personal Information we collect from you;
• the circumstances under which we collect and process it;
• how we treat your Personal Information;
• who we share it with; and
• where your information will be stored.

1.3. By entering into a business or other relationship with us or otherwise engaging with us, you agree that we may collect, store, share and otherwise Process your Personal Information on the terms and conditions set out in this Policy.

2.1. Important information about WorkWide is set out below:

• Physical address: 2nd Floor, Silky Oak Building, Ballyoaks Office Park, 35 Ballyclare Drive, Bryanston, Gauteng, 2021, South Africa
• Postal address: P.O. Box 7080, Bryanston, 2021
• Information Officer: Devlin Padayachee — devlin.padayachee@workwidemobile.com
• Deputy Information Officer: Nick Cawood — nick.cawood@workwidemobile.com
• Website: https://workwidemobile.com/

3.1. “Affiliate” means an entity that is controlling, controlled by or under common control of WorkWide. For the purposes of this definition, “control” means the direct or indirect ownership of fifty per cent (50%) or more of the equity interest in an entity, or the ability to control the decisions of such entity through the exercise of voting rights.

3.2. “Connected Persons” means persons who are related, connected or linked to you, including your key controllers, persons whose information is provided for client identification purposes, and your Affiliates.

3.3. “Data Subject” means the person to whom Personal Information relates.

3.4. “DIO” means the Deputy Information Officer as defined under POPIA, being the person reflected in clause 2.1 above.

3.5. “Direct Marketing” bears the meaning ascribed to that term in POPIA from time to time, which currently means to approach a person, either in person or by mail or electronic communication, for the direct or indirect purpose of (a) promoting or offering to supply, in the ordinary course of business, any goods or services to the person; or (b) requesting the person to make a donation of any kind for any reason.

3.6. “Information” means Personal Information and/or Special Personal Information about you.

3.7. “Information Regulator” means the Information Regulator appointed under POPIA.

3.8. “Information Regulator Website” means the official website of the Information Regulator located at https://inforegulator.org.za.

3.9. “IO” means the Information Officer as defined under POPIA, being the person reflected in clause 2.1 above.

3.10. “Person” means a natural person or a juristic person.

3.11. “Personal Information” bears the meaning ascribed to this term in POPIA from time to time, which currently means information relating to an identifiable, living, natural person and, where applicable, an identifiable, existing juristic person, including:

• information relating to the race, gender, sex, pregnancy, marital status, national, ethnic or social origin, colour, sexual orientation, age, physical or mental health, well-being, disability, religion, conscience, belief, culture, language and birth of the person;
• information relating to the education or the medical, financial, criminal or employment history of the person;
• any identifying number, symbol, e-mail address, physical address, telephone number or other particular assignment to the person;
• the blood type or any other biometric information of the person;
• the personal opinions, views or preferences of the person;
• correspondence sent by the person that is implicitly or explicitly of a private or confidential nature, or further correspondence that would reveal the contents of the original correspondence;
• the views or opinions of another individual about the person; and
• the name of the person if it appears with other Personal Information relating to the person or if the disclosure of the name itself would reveal information about the person.

3.12. “POPIA” means the Protection of Personal Information Act No. 4 of 2013.

3.13. “Processing” bears the meaning ascribed to this term under POPIA from time to time, which currently means any operation or activity or any set of operations, whether or not by automatic means, concerning Personal Information, including:

• the collection, receipt, recording, organisation, collation, storage, updating or modification, retrieval, alteration, consultation or use;
• dissemination by means of transmission, distribution or making available in any other form; or
• merging, linking, as well as blocking, degradation, erasure or destruction of information.

3.14. “Purposes” means the purposes for which we will collect, store, share and otherwise Process Personal Information about you as set out in clause 7 below.

3.15. “Representatives” means the directors, employees and/or consultants of WorkWide or its Affiliates.

3.16. “Regulator” means any entity or body, whether governmental or otherwise, which has regulatory authority over WorkWide or its business or operations, in any relevant jurisdiction.

3.17. “Regulations” means the Regulations Relating to the Protection of Personal Information, 2017 promulgated under POPIA.

3.18. “Special Personal Information” bears the meaning ascribed to that term in POPIA, which currently means:

• the religious or philosophical beliefs, race or ethnic origin, trade union membership, political persuasion, health or sex life or biometric information of a data subject; or
• the criminal behaviour of a Data Subject to the extent that such information relates to the alleged commission by a Data Subject of any offence; or
• any proceedings in respect of any offence allegedly committed by a Data Subject or the disposal of such proceedings.

3.19. “Third Parties” means any Person that provides services and/or products to WorkWide or its Affiliates from time to time.

3.20. “we”, “our” or “us” means WorkWide and its Affiliates from time to time.

3.21. “you”, “your” means any Person or Connected Person whose Information may be Processed by us from time to time.

4.1. You or your relevant Connected Persons, as Data Subjects, have rights to the protection of your Information, including:

• the right to the lawful Processing of your Information;
• the right not to receive unsolicited direct electronic marketing unless certain conditions are met;
• the right to have your Information collected directly from you unless indirect collection is specifically permitted by applicable laws;
• the right to be notified in advance of the reason for the collection and processing of your Information (unless otherwise provided by applicable laws), if your Information has been accessed or acquired by an unauthorised third party, and if your Information has been shared with a third party (unless otherwise provided by applicable laws);
• the right to submit a complaint to the Information Regulator regarding the protection of your Information under POPIA, and to institute civil proceedings regarding the protection of your Information;
• the right to request the deletion of some or all of your Information stored by us; confirmation of what Information is being held about you or by one of our third parties; access to your Information held by us; an amendment to the Information we hold about you; and information about what Information we collect about you;
• the right to object to the unlawful processing of your Information and to direct marketing; and
• the right to withdraw or change your consent to direct marketing preferences at any point in time.

5.1. We may collect Information about you from time to time for the Purposes.

5.2. The Information we collect about you will at all times be collected in accordance with POPIA and we will collect only relevant Information necessary for the relevant Purpose.

5.3. We may collect Information in various ways, including:

• directly from you;
• legal bodies or professionals (such as courts or attorneys);
• debt collection agencies;
• publicly available sources (e.g. companies registries);
• previous employers;
• credit reference agencies;
• providers of marketing lists and other personal information;
• suppliers and service providers;
• third parties.

6.1. Where we Process Information about you, we will do so in accordance with POPIA and only to the extent necessary for the Purposes.

6.2. The types of Information we may Process are:

• names and contact details;
• addresses;
• payment details;
• account history information;
• purchase or service history;
• video recordings of public areas;
• audio recordings of public areas;
• video recordings of private or staff-only areas;
• audio recordings of private or staff-only areas;
• tax information (for instance, your VAT number if you are a corporate, or your tax file number if you are an employee or consultant);
• call recordings;
• dashcam footage — outside vehicle (for instance for the safety and security of our drivers and delivery staff);
• dashcam footage — inside vehicle (for instance for the safety and security of our drivers and delivery staff);
• witness statements and contact details where applicable (for instance when defending or enforcing our rights);
• photographs (for instance photographs taken at staff functions, photographs of invitees to our business premises, photographs for purposes of client identification);
• customer or client accounts and records (for instance if you use our Job Management Software for the scheduling and dispatch of your jobs);
• financial information (for instance financial information relating to payments you are required to make to us, credit assurance, and through the generation and storage of board packs if you use our Job Management Solution, our Workforce Management Solution and/or our Optical Character Recognition software);
• information relating to health and safety (including incident investigation details and reports and accident book records);
• telematics data and connected car information (for instance in connection with the safety of our drivers and delivery staff and for tracking and asset protection purposes);
• website usage;
• account usage;
• IP addresses (for instance when you visit our website or when configuring software products sold to you);
• location and GPS data (for instance to maintain a real-time view of your mobile workforce where our Mapping and GPS services are used) — see clause 7A below for full details of how location data is collected, used, shared and retained;
• details of your assets (for instance the licence discs of your fleet if you use our Field Service Management Software);
• details of your education and job experience (for instance in respect of job applicants and existing staff and consultants);
• biometric information.

7.1. While we have outlined some examples of the situations where we will Process your Information in clause 6.2 above, we will generally lawfully Process your Information for the following purposes:

• for the proper performance of any contract or agreement we may have with you;
• for conducting background or credit checks;
• to provide and improve our products and services;
• for information updates or marketing purposes;
• for research or archiving purposes;
• to comply with legal requirements (for instance compliance with any anti-money laundering, anti-bribery and corruption, or counter-terrorist financing laws);
• to protect client welfare;
• for dealing with queries, complaints or claims;
• to protect and defend our legal rights and pursue our legitimate interests;
• for credit assurance purposes;
• for marketing purposes;
• for quality assurance purposes.

7.2. Where we Process your Information, we will at all times do so in accordance with POPIA.

WorkWide collects location data to support your organisation’s workforce-management processes.

What we collect. Precise location (GPS) and approximate location, together with timestamps. Location is collected while you use the app for work activities and — where your organisation uses this feature — in the background during your active work session, including when the app is closed or not in use. On Android, background collection always runs with a visible, persistent notification on your device (“Location Tracking Active”), and location updates are captured at intervals of approximately five minutes or when you move a significant distance (about 500 metres).

Why we collect it. Location data is used solely for workforce-management purposes on behalf of your employer or the organisation that provides your WorkWide account: confirming attendance and job-site presence, supporting worker safety, and maintaining operational records. We do not use location data for advertising, and we do not sell it. The app contains no advertising SDKs.

Who it is shared with. Your location data is transmitted to WorkWide’s servers and made available to your employer or organisation, which controls how it is used within their workforce-management account. We do not share it with any other third party except as required to operate the service or by law.

Retention and deletion. Location data is retained for as long as is necessary for the workforce-management purposes described above and for the retention period agreed in your organisation’s contract with WorkWide, after which it is deleted or de-identified. It can also be deleted on request. Contact devlin.padayachee@workwidemobile.com or your organisation’s administrator to request deletion.

Your choices. You can withdraw location permission at any time in your device settings (Settings → Apps → WorkWide → Permissions → Location). Background collection additionally requires the separate “Allow all the time” permission, which you can decline or revoke; doing so may limit features your organisation requires for your role.

We will, from time to time, and to the extent necessary for the Purposes, share your Information with third parties, including:

• our Affiliates;
• our Representatives or the Representatives of our Affiliates;
• Third Parties including but not limited to debt collection agencies, payroll service companies, client identification and verification agencies, credit reference agencies, cloud providers, IT service providers, and entities performing billing services on our behalf;
• our professional advisers and the professional advisers of our Affiliates, including but not limited to tax, legal, accounting, financial and compliance advisers;
• Regulators;
• Persons who wish to acquire a stake in our business.

9.1. POPIA regulates Direct Marketing.

9.2. You have the right to choose whether you wish to receive direct marketing. You will be given the opportunity to choose on your first engagement with us, when you sign up for your contract.

9.3. Alternatively, if you are making use of our software, we will afford you the opportunity to choose not to receive Direct Marketing information when you activate any of our software.

9.4. We will also provide you with the option to opt out of receiving Direct Marketing messages, according to the category of Direct Marketing you have selected.

9.5. Should you opt in to receiving any direct marketing and you subsequently change your mind at any time, you are able to opt out of a specific category by clicking on the “OPT-OUT” link on the Direct Marketing message.

9.6. Where you opt into or out of Direct Marketing, we will request that you complete Form 4, or documentation substantially in the form of Form 4, as prescribed by Regulation 6 of the Regulations.

Should we further process your Information, we will ask you for your consent, unless it is compatible with the Purpose for which we originally collected it or with the Purposes outlined in clause 7 above.

11.1. We may, from time to time, Process your Information in accordance with POPIA by transferring your Information to jurisdictions outside South Africa, such as to cloud providers, Third Parties and other service providers located offshore, and Affiliates located offshore.

11.2. The jurisdictions outside South Africa where we Process your Information include Europe.

11.3. At the current time, there is no global list of jurisdictions recognised by the Information Regulator as being equivalent to South Africa. Accordingly, some of the foreign jurisdictions in which we Process your Information may not have data protection legislation which is comparable to South Africa. However, in all instances where we Process your Information offshore, the Persons who Process your Information will be subject to laws or binding obligations which protect the confidentiality of your Information.

12.1. In all instances where we Process your Information, we will secure the integrity of such Information in accordance with POPIA.

13.1. You have a right under POPIA to object to the Processing of your Information and that of your Connected Persons in terms of section 11(3) of POPIA.

13.2. If you wish to object to the Processing of your Information, you will need to complete and submit to us Form 1 as required under Regulation 2(1), together with all affidavits and other documentary evidence in support of your objection.

13.3. A copy of Form 1 can be obtained from our IO or DIO or from the Information Regulator Website.

13.4. You can request guidance from our IO or DIO on how to complete Form 1.

13.5. Please note that if you object to the Processing of your Information, we may not be able to provide services to you or fulfil our contracts with you.

14.1. You have the right under POPIA to request corrections to your Information stored or held by us.

14.2. If you wish to correct any of your Information you will need to complete and submit to us Form 2 as required under Regulation 3(2) of the Regulations, together with all affidavits and other documentary evidence in support of your request.

14.3. A copy of Form 2 can be obtained from our IO or DIO or the Information Regulator Website, who can provide guidance on how to complete the form.

14.4. Please be aware that even after your request for a change is processed, we may retain residual information about you in the form of a backup and/or archival copies in our database for compliance or internal reasons.

15.1. You may request that we delete and/or destroy any of your Information in our possession or control, including any Information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading, or obtained unlawfully, regardless of the status of your relationship with us.

15.2. We will, however, retain your Information for as long as is necessary to comply with our legal and legitimate business obligations, to resolve disputes and/or to enforce our legal rights under this Policy.

15.3. We may refuse your request to delete records containing your Information in our possession or control where we need to keep it for the following reasons:

• retention is required or authorised by law;
• we require it for a lawful purpose related to our business activities; or
• it is required by a contract between us.

16.1. Under POPIA, you or any of your Connected Persons are entitled to submit a complaint (contemplated in section 74(1) of POPIA) to the Information Regulator.

16.2. If you or your relevant Connected Person wishes to submit such a complaint, you must submit such complaint to the Information Regulator by completing and submitting Form 5, together with all affidavits and other documentary evidence in support of your complaint.

16.3. You, as data subject, must complete Part I of Form 5.

16.4. We, as responsible party, must complete Part II of Form 5.

16.5. A copy of Form 5 can be obtained from our IO or DIO or the Information Regulator Website, who can provide guidance on how to complete the form.

To the extent legally permissible and to the extent practicable, we will destroy, de-identify or expunge your Information as soon as reasonably practicable after we are no longer authorised to keep it.

Information Regulator details

• Physical address: JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001
• Telephone (general enquiries): 010 023 5200
• Website: https://inforegulator.org.za
• Email: PAIAComplaints@inforegulator.org.za

We reserve the right to amend this Policy at any time by posting the amended Policy on our website. Unless otherwise stated, the current version will apply each time you access this website.