Privacy Policy

WhatsApp Communications:

We may communicate with you via WhatsApp for business purposes related to your application, employment, or our services. When we contact you via WhatsApp, the platform may collect personal information about you, including phone number, device ID, location, transaction data and user identifiers. By using WhatsApp, users agree to WhatsApp's privacy policy and Meta's data processing practices. You may opt out of WhatsApp communications at any time by informing us via WhatsApp, email, or using the "Stop promotions" button on WhatsApp.

​

Opting Out: You can opt out of all marketing communications at any time by:

• Clicking the unsubscribe link in any marketing email

• Replying "STOP" to WhatsApp messages

• Emailing us at info@bo-smart.com

• Contacting our Information Officer

​

Note that opting out of marketing does not affect our processing of your data for other purposes, such as providing recruitment services or fulfilling contractual obligations.

 

Special Personal Information / Sensitive Data

​

Under POPIA, special personal information includes information about race, ethnic origin, religious or philosophical beliefs, trade union membership, political opinions, health, sex life, biometric information, and criminal behaviour.

​

Under UK GDPR, special categories of personal data include similar information (racial or ethnic origin, political opinions, religious beliefs, trade union membership, genetic data, biometric data, health data, sex life, or sexual orientation).

​

Our Approach: We do not request and do not aim to collect special personal information or sensitive data about you, except in the following limited circumstances:

• Health Information: We only collect health information where necessary for employment law purposes, specifically when you provide a doctor's note for extended sick leave. This is processed with your explicit consent and in accordance with employment law requirements under both POPIA (Section 32) and UK GDPR (Article 9(2)(b)).

• Background Checks: We only verify references you voluntarily provide from past employers. We do not conduct criminal background checks or collect information about criminal history unless legally required or with your explicit consent for a specific role.

• Race: South Africa has laws requiring companies to report employees' race in certain circumstances. While your race has no impact on your application or hiring, we may collect this information (on a voluntary disclosure basis) if South African authorities require us to report it for Employment Equity Act compliance. This information will NOT be shared with clients, will NOT affect your employment or job placement, and is kept strictly confidential within BO-SMART's HR function.
   

We do not aim to collect information about children and cannot provide services to children under 18 years of age.

 

How We Secure Your Information

​

We take the security of your personal information seriously and have implemented comprehensive technical and organisational measures to protect your data from unauthorised access, accidental loss, alteration, or disclosure.

​

Our security measures include:

• Encryption: All data is encrypted during transmission using SSL/TLS protocols (for website and email communications) and when stored in our databases and file storage systems.

• Access Controls: Role-based access controls ensure only authorised personnel with a legitimate business need can access your data; all users must authenticate with strong passwords and, where applicable, multi-factor authentication.

• Secure Systems: Our in-house CRM and applicant tracking system employs user role management to control data access based on job function.

• Staff Training: All employees receive annual data protection and security awareness training.

• Vendor Management: We maintain data processing agreements with all third parties who process data on our behalf, including KarbonPay (our payroll provider) and our accountants.

• Physical Security: Secure access controls protect physical locations where data is processed or stored.

• Backup and Recovery: Regular encrypted backups ensure data can be restored in a timely manner following any physical or technical incident.

• Security Audits: We conduct regular security assessments to identify and address vulnerabilities.

• Incident Response: We have documented breach notification procedures to ensure compliance with legal requirements.

​

Data Breach Notification: If a data breach occurs that poses a risk to your rights and freedoms, we will notify you and the relevant supervisory authorities (the South African Information Regulator and/or the UK Information Commissioner's Office) within 72 hours of becoming aware of the breach, as required by POPIA and UK GDPR.

We limit access to your personal data to only those employees, agents, contractors, and third parties who have a legitimate business need to access it for delivering our services or supporting our systems. All such individuals and organisations are bound by strict confidentiality obligations.

 

How We Share Your Data

​

To provide our recruitment and business outsourcing services effectively, we share your data with carefully selected third parties. We only share data necessary for the specified purposes and ensure that all third parties are contractually bound to protect your information.

Categories of Third Parties

​

UK and US Client Companies

When we place you in a role, we share relevant information with the client company for whom you will work. This includes:

• Your name, contact details, and CV

• Information necessary for you to perform your role effectively

• Payroll-related information, if required by the client for their internal processes

• Work performance information as needed

We transfer this data securely and only share what is necessary. We do not share sensitive health information with clients unless absolutely required and with your explicit consent.

​

Payroll Service Providers

We use KarbonPay to process payroll for our employees and contractors. We share necessary information, including names, bank details, salary information and tax details to facilitate accurate and timely payment processing. KarbonPay is bound by strict data processing agreements and security requirements.

​

Accountants and Professional Advisors

We share relevant financial and payroll data with our accountants for accounting, tax compliance, auditing, and advisory purposes. Our accountants are bound by professional confidentiality obligations.

​

Tax Authorities

We are legally required to share tax-related information with:

• South African Revenue Service (SARS) for South African tax compliance

• HM Revenue & Customs (HMRC) for UK tax obligations, where applicable

Government and Regulatory Bodies

We may be required to share personal information with government regulators, courts, or law enforcement agencies in South Africa, the UK, or other relevant jurisdictions when legally obligated to do so.

​

Service Providers

We work with service providers who process data on our behalf, including:

• IT and system administration service providers

• Cloud storage providers (for secure data storage)

• Email service providers

• Website hosting providers

• Banking and insurance service providers

All service providers are carefully selected and bound by data processing agreements requiring them to protect your data and process it only for specified purposes with our explicit permission.

​

Business Transfers

If BO-SMART or any part of our business is sold, merged, or transferred to another entity, your personal information may be transferred to the new owner as part of the transaction. We will notify you of any such change and ensure the new owner is bound by obligations equivalent to those in this Privacy Policy.

​

Safeguards for Third-Party Data Sharing

​

• All third parties are required to respect your personal data and keep it secure

• We maintain written data processing agreements with all third parties

• Third parties may only process your data for specified purposes and with our explicit permission

• We conduct due diligence on third parties to ensure they have adequate security measures

• We regularly review our third-party relationships to ensure ongoing compliance

 

International Data Transfers

​

Given that BO-SMART operates across South Africa and the UK, and serves clients in the UK and potentially the US, some of your personal information may be transferred internationally.

​

Transfers from South Africa to the UK

​

The UK has been recognised by the South African Information Regulator as providing adequate data protection, facilitating data transfers between our South African and UK entities.

​

Transfers from the UK to South Africa

​

Under UK GDPR, South Africa does not currently have an adequacy decision from the UK government. However, South Africa's POPIA is recognised as providing strong data protection standards. For transfers from the UK to South Africa, we rely on appropriate safeguards, including:

• Standard Contractual Clauses or the UK International Data Transfer Agreement (IDTA)

• Intra-group data processing agreements between BO-SMART (Pty) Ltd and BO-SMART Ltd

• Ensuring our South African operations maintain security standards equivalent to UK GDPR requirements

​

Transfers to the United States (If Applicable)

​

The United States does not have adequacy status under POPIA or UK GDPR. If we engage with US clients in the future, we will only transfer the minimum necessary personal data required for you to perform your role. This will typically include contact information, CV, and work-related communications, but will exclude sensitive health information.

For US transfers, we will implement appropriate safeguards, including:

• Standard Contractual Clauses or UK International Data Transfer Agreement (IDTA)

• Contractual commitments from US clients to protect personal data

• Data encryption for all transfers (DMARC, DKIM, SPF for email; secure digital signature platforms for contracts)

• Limiting transfers to what is strictly necessary

Data Protection Test: Under the Data (Use and Access) Act 2025, we ensure that the level of protection provided after international transfer is "not materially lower" than the protection under UK law. We conduct assessments of third countries and implement additional safeguards where necessary.

​

Your Rights Regarding International Transfers

You have the right to:

• Be informed about international transfers of your data (as set out in this Policy)

• Object to international transfers in certain circumstances

• Request information about the safeguards we have in place for international transfers

If you have concerns about international transfers of your data, please contact our Information Officer at info@bo-smart.com.

 

Data Retention - How Long We Keep Your Information

We only retain your personal data for as long as necessary to fulfill the purposes for which it was collected, comply with legal obligations, resolve disputes, and enforce our agreements.

​

Rights Under POPIA (South African Residents)

​

If you are a South African resident, you have the following rights under POPIA: