GamHR Privacy Policy
This Privacy Policy describes how GamHR collects, uses, stores, and protects personal information in compliance with the Protection of Personal Information Act 4 of 2013 (POPIA).
1. Information We Collect
GamHR processes the following categories of personal information:
- Identity: Full name, SA ID number/passport, date of birth, gender, nationality
- Contact: Email address, phone number, physical address
- Employment: Job title, department, employment dates, contracts
- Financial: Bank account details, tax reference number, salary information
- Leave & Attendance: Leave balances, clock-in/out records, timesheets
- System Usage: Login timestamps, IP addresses, user agent strings
- Trial registration notifications: Name, work email, company name, company size, reopening-notice request, and an optional product-updates choice
- Optional marketing measurement: Consent choice, public page viewed, advertising click identifiers, and a completed-trial event
2. Purpose of Processing
Personal information is processed for the following lawful purposes (POPIA Section 11):
- Contract performance: Administering employment contracts, calculating and paying salaries
- Legal obligation: SARS tax filings (EMP201, EMP501, IRP5), BCEA compliance
- Legitimate interest: Workforce analytics, risk management, audit compliance
- Requested notification: Contacting prospective customers once trial registration reopens
- Optional marketing consent: Sending product updates only when the person separately chooses to receive them
3. Data Storage and Security
- Data is stored in Google Cloud Firestore (africa-south1 region) within South Africa
- Application hosted on Azure Container Apps (South Africa North)
- Sensitive fields (SA ID, tax reference, bank account) are encrypted with AES-256-GCM
- Access controlled via Firebase Authentication with MFA on privileged operations
- Hash-chained audit trail ensures tamper-evident record keeping
4. Data Sharing
- SARS: Tax filing data as required by the Income Tax Act
- Service providers: Google Cloud (hosting), Microsoft Azure (hosting) - bound by Data Processing Agreements
- Google Ads measurement: Currently disabled while paid advertising is paused. If re-enabled, it is used only after you allow optional measurement. GamHR does not send employee, payroll, or workspace data to Google Ads.
- No third-party sale: Personal information is never sold to third parties
5. Cookies and Advertising Measurement
Paid advertising and Google Ads measurement are currently paused. GamHR does not load the Google measurement tag or show a measurement-choice prompt while this setting is disabled. If measurement is re-enabled later, public pages will require an allow-or-decline decision before optional measurement runs.
Declining optional measurement does not affect pricing, signup, login, tutorials, or use of a GamHR workspace.
6. Your Rights Under POPIA
As a data subject, you have the right to:
- Access your personal information (Section 23)
- Correct inaccurate information (Section 24)
- Object to processing in certain circumstances (Section 11(3))
- Lodge a complaint with the Information Regulator
To exercise these rights, submit a request through the System or contact your employer's HR administrator.
7. Data Retention
- Payroll records: 3 years (BCEA Section 31)
- General employee records: 5 years (POPIA Section 14)
- Audit trail: 7 years
- Trial notification details: retained until the reopening notice is sent and for a limited follow-up period, or removed earlier on request
- Data beyond retention periods is anonymised or deleted
8. Breach Notification
In the event of a data breach, we will notify the Information Regulator and affected data subjects within 72 hours as required by POPIA Section 22.
9. Contact
Information Officer: your employer's designated privacy or HR contact
Information Regulator: POPIAComplaints@inforegulator.org.za