Privacy Policy

Who We Are

Vertrou EOR (Pty) Ltd ("Vertrou", "we", "us") is a South African outsourcing and Employer of Record company based in Cape Town, and a sister brand of Kayman Recruitment Group. Our website is vertrou.co.

We are the responsible party under the Protection of Personal Information Act 4 of 2013 (POPIA) for the personal information described in this policy.

Company: Vertrou EOR (Pty) Ltd, Reg. No. 2026/572319/07
Address: 2 Passerina Road, Sandown Road, Cape Town, Western Cape, 7441
Information Officer: Elliott Joseph Manning, admin@vertrou.co

This policy covers visitors to our website, people who contact us or book a call with us, job candidates, and our clients' people who use our onboarding and client portal. If you are employed through Vertrou, our Employee Privacy Notice applies to you instead, and the portal shows it to you when you join.

Data We Collect

We collect data in five categories:

Website enquiries

• Name
• Email address
• Company
• Message

The short enquiry form on some pages asks for your email address only.

Emails and calls

What you choose to tell us when you email or phone us, with your contact details.

Booking a call

If you book a call through our Calendly link, Calendly collects your name, email address, the time you choose and any answers you give on the booking page, and passes them to us.

Candidates

If you are looking for work, or we think a role may suit you, we hold:

• Your name and contact details
• Your CV, work history, qualifications and skills
• The roles you are interested in, your salary expectations and notice period
• Your right to work in South Africa
• Our notes from conversations and interviews, and references you agree we may take

We get this from you, and also from job boards, professional networking sites such as LinkedIn, and people who refer you to us. Where we get it from someone other than you, we tell you when we first contact you.

Technical

Our hosting and security providers process your IP address and browser details to deliver the website and to block automated attacks. The salary calculator runs in your browser: the figures you enter are not sent to us.

Client Onboarding and the Client Portal

When a business becomes our client, we invite a contact there to complete its onboarding in our portal at clients.vertrou.co. The people the client names then use the client portal to follow their employees' onboarding, approve or decline leave requests and expense claims, sign and read their agreements with us, ask us questions about them, see their invoices, and read our employment guides.

What we collect

• Company details: registered name, registration and VAT numbers, address, the bank account we refund to, and company documents such as the registration certificate and a bank confirmation letter
• The people the client names: the contact we invite; the accounts contact's name, email address and phone number; the payroll approvals contact's name and email address; and the authorised signatory's name, title and email address
• For portal users: your name, email address and role, the decisions you make on leave requests and expense claims with any reasons you give, the questions you ask us, and a record of when you sign in and what you view and change in the portal

Most of this comes from the contact who completes the onboarding, so if someone named you, the information about you came from them.

Why we use it

To conclude and perform our contract with the client: to set up the service, have the agreement signed, invoice the client, pass its leave and claim decisions to payroll, and show its people their employees. This is necessary for the contract, and in our and the client's legitimate interest in working together. The record of portal activity is kept to keep the portal secure and to show who saw, decided or changed what, in our legitimate interest and to meet our duties under section 19 of POPIA.

Is it required

The company details, contacts and documents the onboarding marks as required are needed to contract with and invoice the client. Without them we cannot provide our services.

Who processes it

The portal is run for us by Xethos, our operator, under a written agreement. Its hosting, document storage, email and error-monitoring providers keep the data in the EU (mainly Germany and Ireland); our email provider also keeps account records in the USA. Error monitoring never receives the contents of the forms. If you sign in with Google or Microsoft, they confirm your identity to us and share your name and email address. We also send:

• the company's details and billing email to Xero, our accounting system, which also supplies the invoices you see in the portal, [[LOCATION: confirm where Xero holds the data]]
• the signatory's name, title and email address, and the company details the agreement needs, including its notice address and email, to Signable, to sign the agreement, [[LOCATION: confirm where Signable holds the data]]
• the outcome of leave and claim decisions to PaySpace, our payroll system, [[LOCATION: confirm where PaySpace holds the data]]

Do You Have to Give Us Your Data?

On our website, no: everything you give us is voluntary. Without your contact details we cannot reply to your enquiry, and without your CV and contact details we cannot consider you for a role.

How We Use Your Data

• Enquiries and bookings: to reply to you, give you a quote and, if you go ahead, set up our services. This is necessary to take the steps you ask for before a contract, and in our legitimate interest in answering people who contact us.
• Candidates: to find roles that suit you and contact you about them. We share your profile with a client only after we have discussed the role with you. This is in your legitimate interest and ours in matching candidates to roles.
• Technical data: to keep the website running and secure, in our legitimate interest in protecting it.
• Legal duties: to keep records and answer lawful requests where the law requires it.

We do not use your data for automated decision-making or profiling, and we do not send marketing emails from website enquiries. If that changes, we will ask for your consent first, as section 69 of POPIA requires.

Third Parties

We share data with the following service providers only, each bound to keep it confidential and secure:

• Lovable - hosts our website and handles the enquiry forms, [[LOCATION: confirm where Lovable holds the data]].
• Cloudflare - network delivery and protection against automated attacks, global.
• Google Fonts - your browser loads our fonts from Google, which receives your IP address, USA.
• Calendly - call booking, if you choose to book, USA.
• RecruiterFlow - our candidate database, [[LOCATION: confirm where RecruiterFlow holds the data]].
• Microsoft 365 - our email, where enquiries arrive.
• Kayman Recruitment Services Limited - our group company in the United Kingdom, whose team answers enquiries and works with us on recruitment.
• [[CONFIRM: Vertrou Holdings SA (Pty) Ltd, our group company in South Africa. Keep this line only if it sees enquiries or candidates, otherwise delete it.]]

We also share candidate profiles with clients, many of whom are in the United Kingdom and Europe, as described above, and data with our auditors, attorneys and regulators where they need it or the law requires it.

The client portal's own providers are listed under "Client Onboarding and the Client Portal" above.

We do not sell, trade, or rent your personal information to anyone.

Sending Data Outside South Africa

Some of the providers above, our group company in the United Kingdom, and many of our clients are outside South Africa. We send personal information across a border only as section 72 of POPIA allows: the recipient is bound by a law, binding corporate rules or an agreement that gives protection substantially similar to POPIA, including rules on onward transfer, or the transfer is necessary to answer your request or perform a contract with you, or you have agreed to it.

When we put a candidate forward to a client outside South Africa, we do so because you have agreed to be put forward for that role.

Cookies

__cf_bm - Set by Cloudflare to tell people from automated traffic. Strictly necessary. Expires after 30 minutes.

The client portal sets only the cookies it needs to keep you signed in, which end when you sign out or your session expires, and Cloudflare's __cf_bm above. All are strictly necessary.

We do not use analytics, advertising or tracking cookies, so we do not ask for cookie consent. If we add any, we will update this policy and ask for your consent before they are set. You can manage cookies through your browser settings.

Data Retention

• Enquiries and bookings: kept while we deal with your enquiry and any follow-up, then deleted within 24 months of our last contact, unless you become a client.
• Candidates: kept for twelve months after our last contact with you, unless you ask us to keep your details for future roles. If you are placed in a role, our Employee Privacy Notice sets how long your records are kept.
• Client onboarding records: an onboarding that is cancelled is deleted after 30 days, one never started after 90 days, and one left unfinished after 180 days. A completed onboarding is kept for five years after the last employment we run for that client ends.
• Portal accounts: a portal user's account is deleted one year after their access ends.
• Portal activity records: kept for five years from each entry.
• Technical data: kept by our hosting and security providers for the short periods their services need.

Once a period ends, we delete or de-identify the data unless the law, or a live dispute, requires us to keep it.

How We Protect Your Data

We restrict access to the people who need it for their work, use providers that secure the data they hold for us, and require confidentiality from our staff and providers, as section 19 of POPIA requires. If we believe your personal information has been accessed by someone not authorised to, we will notify the Information Regulator and, where required, you, as section 22 of POPIA requires.

Your Rights Under POPIA

If you are a South African visitor or data subject, you have the following rights:

• Right to access your personal information, as set out in our PAIA manual
• Right to correct or delete inaccurate, out of date, excessive or unlawfully obtained information (Form 2)
• Right to object to processing on reasonable grounds (Form 1)
• Right to object to direct marketing at any time
• Right to withdraw your consent, where we rely on it
• Right to lodge a complaint with the Information Regulator

The Information Regulator: Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191. Telephone 010 023 5200, toll free 0800 017 160. POPIA complaints: POPIAComplaints@inforegulator.org.za, or through its eServices portal at eservices.inforegulator.org.za.

Your Rights Under GDPR

If you are in the EU or UK and the GDPR or UK GDPR applies to our processing, you have all the rights listed above, plus:

• Right to data portability
• Right to restrict processing
• Right to lodge a complaint with your local data protection authority (in the UK, the Information Commissioner's Office)

How to Exercise Your Rights

Contact our Information Officer at admin@vertrou.co. We will respond within 30 days. To verify your identity, we may ask you to confirm details associated with your enquiry. Our PAIA manual, which explains how to request records, is available on request.

Changes to This Policy

We may update this policy from time to time. Changes will be posted on this page with an updated "Last updated" date. We encourage you to review this page periodically.

Contact

If you have questions about this policy, please get in touch: Elliott Joseph Manning, Information Officer, admin@vertrou.co.