Comprehensive Privacy Policy

1. Executive Summary & Responsible Party

This Privacy Policy governs the collection, processing, safeguarding, and storage of personal information across the Be Right Back (BRB) Enterprise Workforce & Leave Management Suite, including the Web Progressive Web Application (PWA), macOS Desktop build, Windows Desktop build, and mobile applications (collectively, the "Platform").

The Platform is operated by Be Right Back Systems (Pty) Ltd and WOLFF Cloud Technologies (Pty) Ltd (herein referred to as "Be Right Back", "we", "us", or "our"), incorporated under the laws of the Republic of South Africa.

2. Categories of Personal Information Collected

We process only personal data strictly necessary to fulfill human resources, leave accrual, attendance, asset custody, and statutory payroll workflows under South African and international labor frameworks:

A. Employee Identity & Contact Records

• Identity Data: Full legal name, preferred name, South African National ID Number or Foreign Passport Number, Date of Birth, gender, and demographic race (collected solely for Employment Equity Act compliance).
• Contact Details: Corporate work email, personal email address, residential physical address (for FICA validation), and emergency contact telephone numbers.
• Corporate Authentication: Work role title, assigned reporting manager, department/business unit, employee ID code, encrypted password hashes, and biometric token references if enabled on native mobile devices.

B. Statutory Leave & Health Absence Documentation

• Leave Applications: Dates, duration, category (Annual, Sick, Family Responsibility, Study, Maternity, Unpaid), approval status, and manager commentary.
• Medical Certificates: Digital copies of medical notes submitted for sick absence exceeding 2 consecutive days, processed with strict confidentiality as Special Personal Information under POPIA Section 26.

C. Financial & Tax Identifiers

• SARS & Payroll Records: SARS Tax Reference Number, voluntary tax withholding rates, gross salary, daily rate calculation multipliers, and banking particulars (bank name, account number, branch code) for statutory reimbursement disbursements.
• Expense Claims: Digital receipts, amounts, vendor descriptions, and merchant timestamps.

D. IT Hardware & Logistics Custody

• Asset Binding: Serial numbers, hardware models, asset tags, assignment dates, and digital acknowledgment signatures for corporate equipment.

3. Purpose Specification & Legal Grounds for Processing

In accordance with Section 11 of POPIA and Article 6 of the GDPR, personal data is collected and processed under the following lawful bases:

4. Protection of Children & Strict Age-Gating (COPPA & POPIA s34)

Be Right Back is an enterprise business application intended exclusively for authorized corporate personnel of legal working age.

5. Security Safeguards & Technical Measures (POPIA s19)

We maintain multi-tier technical and organizational controls to protect against unauthorized access, loss, destruction, or disclosure:

• Cryptographic Data in Transit: All HTTP traffic is secured via Transport Layer Security (TLS 1.3) with HSTS enforcement.
• Data at Rest Isolation: Multi-tenant isolation guarantees each organization's database records are segregated into dedicated, directory-traversal protected vaults with server-level access prevention (`.htaccess Deny from all`).
• Cryptographic Session Integrity: User authentication utilizes HMAC-SHA256 signed session tokens with automatic session timeouts.
• Immutable Audit Logging: Leave balance adjustments, manager overrides, disciplinary hearing notices, and data changes create immutable, timestamped audit log events.

6. Data Retention Schedule & Statutory Preservation

Personal information is preserved strictly for the duration required by applicable statutory labor regulations:

7. Data Subject Rights & Self-Service Purge (POPIA s24 / GDPR Art 17)

As a data subject under POPIA and GDPR, you possess guaranteed legal rights regarding your personal information:

• Right of Access (Section 23): You may inspect and request confirmation of the personal records we hold for your identity.
• Right to Rectification (Section 24): You can edit inaccurate details directly via the Staff Self-Service Portal or request correction.
• Right to Erasure ("Right to be Forgotten"): You may submit an official Account Purge or Data Deletion request through our automated portal:

8. Lodging Complaints with the Information Regulator

If you believe that your personal data has been processed unlawfully or that your privacy rights have been infringed, you have the right to lodge a complaint directly with the national statutory supervisory authority: