1. Who We Are
LabourID (Pty) Ltd ("LabourID", "we", "us", "our") is a South African company that provides workforce identity verification services to workers, employers, and businesses. We are the responsible party in terms of the Protection of Personal Information Act 4 of 2013 ("POPIA") for personal information we process in connection with our platform.
Our verification checks are powered by licensed data verification providers who act as operators/data processors on our instruction.
Registered address: 1 Innovation Hub, Tech Park, Johannesburg, Gauteng, 2000, South Africa
Email: privacy@labourid.com
2. What Information We Collect
Information you provide directly
- Full name, email address, phone number, and password when you register
- South African ID number, date of birth, and trade/profession for verification
- Company registration number and director details for business verifications
- Payment information (handled by PayFast — we do not store card details)
- Communications you send us via email or support channels
Information collected automatically
- IP address, browser type, device identifiers, and session data
- Pages visited, features used, and time spent on our platform
- Cookies and similar tracking technologies (see Section 11)
Information from third-party sources
- Identity data returned from the Department of Home Affairs
- Company data from the Companies and Intellectual Property Commission (CIPC)
- Credit bureau, employment, and AML/PEP screening data from licensed providers
We process biometric data (facial images and liveness detection results) only with your explicit consent, and only for the duration required to complete your verification. Biometric data is deleted upon successful completion of the check.
3. How We Use Your Information
- Service delivery: Processing your verification requests and maintaining your LabourID profile
- Account management: Creating and managing your account, authenticating your identity
- Payment processing: Completing transactions via PayFast
- Fraud prevention: Detecting and preventing unauthorised access and fraudulent activity
- Legal compliance: Meeting obligations under POPIA, FICA, the NCA, and other applicable laws
- Communications: Sending verification results, receipts, and important service updates
- Platform improvement: Analysing usage to improve features and user experience
- Marketing: Sending promotional communications where you have consented or where permitted under POPIA
4. Lawful Basis for Processing
We rely on the following lawful bases under POPIA:
- Contractual necessity: Processing required to deliver the verification services you have purchased
- Legal obligation: Processing required to comply with FICA, the NCA, and other legislation
- Legitimate interests: Fraud detection, platform security, and service improvement — balanced against your rights
- Consent: For biometric data, marketing communications, and optional analytics cookies
Consent is one lawful basis, but not the only one. You may withdraw consent for consent-based processing at any time without affecting the lawfulness of prior processing.
5. When We Share Your Information
We share personal information only in the following circumstances:
- Licensed data providers (operators): To process your verification checks on our behalf, bound by a Data Processing Agreement
- PayFast (payment processor): To securely process card and EFT payments
- Government sources: We query the Department of Home Affairs and CIPC directly; we do not receive bulk transfers from them
- Legal requirements: When required by court order, subpoena, or applicable law
- Business transfers: In the event of a merger, acquisition, or sale of assets, subject to confidentiality obligations
We do not sell, rent, or trade your personal information to third parties for their own marketing purposes.
6. Data Retention
- Verification results: Full reports are not stored after delivery. Audit metadata (timestamp, check type, reference) is retained for 7 years for compliance and dispute purposes
- Account data: Retained for the life of your account plus 2 years after closure
- Biometric data: Deleted immediately after successful verification completion
- Financial records: Retained for 5 years as required by tax and financial legislation
- Audit logs: Retained for 7 years
7. Security Measures
- All data in transit is encrypted using TLS 1.3
- Data at rest is encrypted using AES-256
- API access is secured with unique key authentication
- Administrative access requires multi-factor authentication
- Role-based access controls and least-privilege principles are applied
- Web Application Firewall and DDoS protection are in place
- Regular penetration testing and vulnerability assessments are conducted
- Security incidents are notified to affected parties within 48 hours of confirmation
8. Your Rights Under POPIA
As a data subject under POPIA, you have the right to:
- Access: Request a copy of the personal information we hold about you
- Correction: Request correction of inaccurate or incomplete information
- Deletion: Request deletion of your personal information (subject to legal retention requirements)
- Objection: Object to processing based on legitimate interests
- Restriction: Request that we restrict processing in certain circumstances
- Portability: Receive your data in a structured, machine-readable format
- Withdraw consent: Withdraw consent at any time without penalty
- Opt out of marketing: Unsubscribe from marketing communications at any time
To exercise any of these rights, email privacy@labourid.com. We will respond within 30 days.
9. International Data Transfers
We primarily store and process data within South Africa. Where data is transferred internationally (for example, to cloud infrastructure providers), we ensure adequate safeguards are in place, including contractual clauses equivalent to those required under POPIA and GDPR.
10. Children's Privacy
Our services are intended for persons aged 18 and over. We do not knowingly collect personal information from minors. If we become aware that a child under 18 has provided personal information, we will delete it immediately. If you believe a minor has registered on our platform, please contact us at privacy@labourid.com.
11. Cookies
We use the following categories of cookies:
- Strictly necessary: Session management, authentication, and security — cannot be disabled
- Functional: Remembering your preferences and settings
- Analytics: Understanding how you use our platform to improve it (requires consent)
- Marketing: Delivering relevant advertising (requires explicit consent)
You can manage cookie preferences through your browser settings or by contacting us. See our Cookie Policy for full details.
12. Changes to This Policy
We may update this Privacy Policy from time to time. Material changes will be communicated by email or via a prominent notice on our platform. The date at the top of this page indicates when the policy was last revised. Continued use of our services after changes constitutes acceptance of the updated policy.