Loading...
Effective date: 1 July 2026 Version: 1.0
ShyftWize Africa (Pty) Ltd ("ShyftWize", "we", "us", "our") is the responsible party for the personal information described in this policy, except where we act as an operator on behalf of a customer (see clause 3).
This policy is issued in accordance with the Protection of Personal Information Act 4 of 2013 ("POPIA").
This policy explains how we collect, use, share, store, and protect personal information (as defined in POPIA) when you:
3.1 As responsible party. For the personal information of our own customers, account holders, website visitors, and contacts (for example account and billing details), ShyftWize is the responsible party and this policy applies directly.
3.2 As operator. When a customer organisation uses the ShyftWize platform to process the personal information of its own employees or personnel (for example attendance records, clock-in photographs, GPS location, leave, and pay-rate data), that customer is the responsible party and ShyftWize acts only as an operator (processor) on the customer's behalf and on its documented instructions. In that role, the customer's own privacy notice governs how that information is used, and we process it only to provide the service, keep it secure, and comply with the law.
4.1 Information you give us (as responsible party):
4.2 Information we collect automatically (as responsible party):
4.3 Customer-uploaded information (as operator):
We process personal information on one or more of the lawful bases recognised under POPIA, including:
6.1 We do not sell personal information. We share it only as needed to provide the service and run our business, with the following categories of recipients, each under appropriate contractual safeguards:
| Recipient | Purpose |
|---|---|
| Cloudflare | Website/application hosting, content delivery, and file storage (Cloudflare R2). |
| PayFast | Processing of subscription payments. |
| Resend | Sending transactional email (for example account and notification emails). |
| Host Africa | Server hosting (bare-metal infrastructure in Midrand, South Africa) for the application and database. |
6.2 We may also disclose personal information where required by law, to protect our rights, or in connection with a corporate transaction (such as a merger or sale of assets), subject to this policy.
Some of our service providers (for example Cloudflare) operate infrastructure in data centres that may be located outside South Africa. Where personal information is transferred across borders, we take steps consistent with POPIA to ensure it is afforded an adequate level of protection, including through contractual safeguards with the relevant providers.
We apply appropriate, reasonable technical and organisational measures to protect personal information, including:
No method of transmission or storage is completely secure, but we work to protect personal information and to respond appropriately to any security incident.
We keep personal information only for as long as necessary for the purposes described in this policy or as required by law. For data held in the platform, the following retention periods apply (customers may configure stricter periods):
| Data | Retention |
|---|---|
| Attendance records | 5 years (labour-law record-keeping) |
| Pay and hours records | 7 years (tax record-keeping) |
| Clock-in photographs | 90 days |
| GPS location data | 90 days |
| Device information | 90 days |
| Audit logs | 3 years |
Account and billing records are retained for the duration of the customer relationship and for a reasonable period afterwards to meet legal and accounting obligations.
Subject to POPIA, you have the right to:
To exercise these rights, contact our Information Officer at support@shyftwize.com. If you are an employee of a ShyftWize customer, please direct requests about your workforce data to your employer (the responsible party), who can action them in the platform; we will assist our customer as their operator.
Our website and application use only strictly necessary cookies and similar technologies required to operate the service, keep you signed in, and keep the service secure. We do not use advertising or third-party marketing cookies.
If you have a concern about how we handle personal information, please contact our Information Officer first at support@shyftwize.com so we can try to resolve it. You also have the right to lodge a complaint with:
Information Regulator (South Africa) — https://inforegulator.org.za
The service is intended for use by businesses and their personnel and is not directed at children under 18. We do not knowingly collect personal information from children except where an employer lawfully processes information about personnel who are minors in compliance with applicable labour law.
We may update this policy from time to time. Where changes are material, we will provide notice by email or through the service. The "Effective date" above shows when the policy was last revised.
ShyftWize Africa (Pty) Ltd Information Officer: Jarod Graham Email: support@shyftwize.com Telephone: +27 76 054 5020 Address: 14 Engelbrecht Street, Glen Marais, Kempton Park, Gauteng, 1619, South Africa
ShyftWize Africa (Pty) Ltd — Privacy Policy, Version 1.0, effective 1 July 2026.