Last Updated: 2025-10-27
Effective date: 27 October 2025 Legal entity: Worksy (Pty) Ltd. Website: www.worksynow.com Postal address: 18 Klaasenbosch Drive, Constantia, Cape Town, South Africa, 7800 Primary contact: Gysbert Kappers — Gys@worksynow.com Data Protection Officer (DPO): Mr. Ferdinand Steenkamp — Ferdi@worksynow.com EU/UK Representative: Not appointed (not required at this time; this page will be updated if that changes).
This Privacy Policy explains how Worksy (Pty) Ltd. (“Worksy”, “we”, “us”, “our”) processes personal information when we provide our Worksy WhatsApp/SAP application and related services (the “Services”), and when you visit www.worksynow.com.
What we do: Worksy relays HR information from SAP to an employee’s personal WhatsApp on their personal mobile phone at the direction of our business customer (the employer). Typical use cases are payslip delivery and leave processing. Worksy does not conduct marketing, advertising, or profiling via the Services, and does not sell or share personal information for cross‑context behavioral advertising.
Role: For HR data we transmit on behalf of an employer, the employer is the Controller/Responsible Party and Worksy is a Processor/Operator under a written data processing agreement. For our website, support, security and service logs, Worksy acts as the Controller/Responsible Party.
Because Worksy processes at the employer’s instruction, exact fields depend on the employer’s SAP configuration and the specific HR workflow. Typical categories include:
We do not intentionally collect precise geolocation, advertising identifiers, behavioral profiles, or unrelated analytics via the Service. We do not record audio/visual content and do not conduct automated decision‑making that produces legal or similarly significant effects.
Special/sensitive data: Payslips or HR updates may include sensitive elements (e.g., government ID, bank account fragments, union dues), provided by the employer. Where such data is present, we process it solely to transmit it as instructed and apply heightened safeguards.
Service delivery (core): receive HR payloads from the employer’s SAP and deliver securely to the employee’s WhatsApp, process leave flows, and provide confirmations/status to the employer.
Support, security & compliance: logging, fraud/abuse prevention, incident response, audits, and legal compliance.
No marketing: We do not send marketing via the Service, and we do not run advertising or analytics that profile workers.
Scope boundary: HR data stored on the employee’s personal device/cloud is outside Worksy’s control. We relay content securely; storage thereafter is governed by the user’s device/app settings and WhatsApp’s policies.
We do not sell or share personal information for cross‑context behavioral advertising.
Under POPIA (South Africa): If personal information is transferred outside South Africa, Worksy (as operator) supports the employer (responsible party) to ensure a lawful mechanism under POPIA s72 (e.g., adequate protection in the recipient country, contractual safeguards, or data subject consent).
Under GDPR/UK GDPR: Where EU/UK data are processed in or accessed from South Africa or the United States, Worksy uses the European Commission Standard Contractual Clauses (SCCs) (and the UK Addendum/IDTA) plus appropriate supplementary measures.
Where law requires longer retention (e.g., tax/audit) we keep only what’s necessary, then delete or properly anonymize.
We implement administrative, technical, and physical safeguards appropriate to the risks, including encryption in transit, hardened infrastructure, access controls (least privilege), monitoring, and employee training. No method is 100% secure; customers should maintain appropriate HR security policies and employee guidance (e.g., WhatsApp backup encryption, device locks).
Our Service (WhatsApp workflows) does not use advertising cookies. Our website may use strictly necessary and limited analytics cookies to operate and understand site performance. Where required by law (e.g., EU/UK), we obtain consent through a cookie banner before setting non‑essential cookies.
South Africa (POPIA): Data subjects have rights to be informed, access, correct, object to processing, and request deletion (subject to legal limitations). You may also lodge a complaint with the Information Regulator (South Africa):
Information Regulator (South Africa)
Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191
General enquiries: enquiries@inforegulator.org.za | 010 023 5200 POPIA complaints: POPIAComplaints@inforegulator.org.za EEA/UK (GDPR/UK GDPR): Depending on your location, you may have rights to access, rectify, erase, restrict, port, and object, and withdraw consent where processing is based on consent. You may lodge a complaint with your local supervisory authority.
United States (state privacy laws): If/when Worksy becomes subject to relevant U.S. state privacy laws, residents may have rights to access, delete, correct, and opt out of certain processing. We do not sell or share personal information, and we do not use personal information for targeted advertising.
How to exercise rights (all regions): Email Ferdi@worksynow.com (DPO) or Gys@worksynow.com with your request. If your request pertains to data that your employer controls, we will notify and assist your employer, who will respond as the Controller/Responsible Party.
The Services are for workplace communications with employed individuals and are not directed to children.
When Worksy receives HR data from an employer’s SAP environment (“Customer Data”), we act solely on written instructions under our Data Processing Addendum (DPA) and customer agreement. The employer is responsible for the lawful basis, notices to employees, and data subject rights. Worksy:
Worksy uses vetted vendors (hosting, logging, and communications providers such as messaging platforms/carriers) that act as processors/service providers under written terms. A current list of subprocessors is available from our DPO upon request. We require contractual SCCs/UK Addendum or equivalent safeguards for international transfers, where applicable.
WhatsApp note: WhatsApp provides end‑to‑end encrypted message delivery, but users should enable end‑to‑end encrypted backups to protect cloud backups.
For website visitors in jurisdictions recognizing Global Privacy Control (GPC) signals, we treat a valid GPC signal as an opt‑out of sale/share/targeted advertising (we don’t do these, but we honor the signal for compatibility).
We may update this Policy to reflect changes to our Services or legal requirements. We will post updates here and revise the Effective date above. If changes materially affect how we process your information, we will provide additional notice.
Worksy (Pty) Ltd. 18 Klaasenbosch Drive, Constantia, Cape Town, South Africa, 7800 Primary contact: Gysbert Kappers — Gys@worksynow.com DPO: Mr. Ferdinand Steenkamp — Ferdi@worksynow.com
To complain in South Africa: Contact the Information Regulator (SA), Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191; POPIAComplaints@inforegulator.org.za; 010 023 5200.