Privacy policy

Elderbirch (Pty) Ltd, trading as ElderBirch Consulting & Services (“ElderBirch”, “we”, “us”), runs a recruitment agency and the website www.elderbirch.co.za. This policy explains what personal information we collect, why, who can see it, how long we keep it and what your rights are. It is our notice under section 18 of the Protection of Personal Information Act 4 of 2013 (POPIA) and applies to job seekers, employers and their users, and anyone who contacts us.

1. Who is responsible for your information

Responsible party

Elderbirch (Pty) Ltd t/a ElderBirch Consulting & Services

Where we are

Johannesburg South, Gauteng, South Africa. Our physical address is available on request (see the legal notice).

Information officer

Shanita Kriel

Email

elderbirch@outlook.com

Phone

067 031 2470

2. What we collect

Job seekers (candidates)

• Account and contact details: first name, surname, email address, password (stored only as a one-way hash), mobile and WhatsApp numbers, an alternative number and how you prefer to be contacted.
• Identity: South African ID number or passport number, date of birth, gender, citizenship, nationality and, if relevant, your work permit or visa type, number and expiry date.
• Location and mobility: province, town and suburb; optionally your street address; areas where you would like to work; whether you would relocate or work outside South Africa; transport, driver's licence code and professional driving permit (PrDP).
• Work: the industry and job types you are looking for, current or most recent job and employer, employment status and the reason, notice period, experience, preferred employment types and arrangements, expected salary and, optionally, your current package.
• Education and skills: matric, qualifications, institutions, skills, languages, a summary about yourself and your work history.
• Files: a profile photo (optional), your CV and any certificates you upload.
• Optional sensitive information: population group and disability for employment equity, and answers to integrity questions about credit and criminal records — see section 5.
• Activity: your applications and screening answers, saved jobs, messages with employers, availability, job-alert settings, and records of the consents you gave or withdrew.

Employers and their users

• Company details: name, trading name, registration and VAT numbers, industry, size, location, website, description and logo.
• Users: name, position, email address and phone number of each person with a login.
• Subscription and payments: plan, billing dates, amounts, invoices and the PayFast payment and subscription references. We never receive or store card numbers — PayFast processes card details.
• Use of candidate information: which profiles were viewed, which contact details were revealed and which CVs were downloaded, with dates. We keep this to apply the fair-use limit, to protect candidates and to identify introductions for which a fee applies.
• Vacancies, applicant notes, ratings and messages with candidates.

Everyone

• What you send us through the contact form, the recruitment request form or a report about a listing.
• Technical information: your IP address and browser type, used for security, rate limits, consent records and the activity log; and the cookies described in our cookie policy.

3. Why we use it, and on what basis

POPIA allows processing only for a lawful reason (section 11). We use personal information for these purposes:

We do not use your information for anything that is not compatible with these purposes, and we do not make decisions about you based only on automated processing (section 71). Automatic checks — such as holding a vacancy that contains scam words, or matching job alerts — are always followed by a person's decision where it matters.

4. What you must give us, and what is optional

On every form, required fields are marked with an asterisk (*). Everything else is voluntary.

• Job seekers must give their name, contact details, an ID or passport number, date of birth, gender (“Prefer not to say” is an option), citizenship, where they live and the kind of work they want, and must accept the terms and this policy. Without this we cannot verify you, list you or contact you about work.
• Employers must give the company name, a contact person and their contact details. Without this we cannot open an account or bill a subscription.
• Optional information (a photo, salary expectations, employment equity details, integrity answers and so on) helps employers consider you, but leaving it out never stops you from registering or applying.

Collecting a CV and work history is not required by law. Some employers are required by law to verify qualifications, permits or criminal records for certain jobs; they will ask for your consent when they do.

5. Special personal information

Race and ethnic origin, health (including disability) and criminal behaviour are special personal information under POPIA (section 26). Credit history is also sensitive. We treat all of these the same way:

• They are optional, and we only collect them with your explicit consent.
• They are never public and never displayed to employers.
• If you give separate employment equity consent, subscribed employers may filter the register by population group, gender or disability for employment equity purposes. They see which candidates match, never the values themselves. Candidates without that consent never appear in such a filter.
• Answers to the credit and criminal record questions are seen only by ElderBirch, to prepare you for roles that require those checks.
• You can withdraw this consent at any time in Settings & privacy. When you do, we delete the information.

We do not register anyone under 18, and we do not knowingly process information about children.

6. Who can see your information

* Employers with a paid Employer Access subscription, and client companies whose recruitment ElderBirch manages.

You always see your own full profile; your ID number is shown to you masked.

Other people who receive information

• Employers you apply to receive your application, the CV you applied with and your answers to their screening questions. For vacancies ElderBirch posts for a confidential client, ElderBirch receives them and decides what to share.
• Employers you accept a connection request from can message you in your dashboard.
• Candidates see an employer's company profile and vacancies, and the name of the person who messages them.
• Our service providers (operators): website hosting, email delivery and PayFast for payments. They may use the information only on our instructions and must keep it secure (sections 20 and 21).
• Authorities, when the law requires it — for example the South African Police Service, the Department of Employment and Labour, the South African Revenue Service or the Information Regulator.

We never sell, rent or trade personal information.

7. ID and passport numbers

We ask for your ID or passport number once, at registration, to confirm who you are and to stop duplicate or fake profiles. It is encrypted before it is stored, only ElderBirch staff can view it, and employers never receive it. To detect duplicate registrations without decrypting anything, we also keep a one-way fingerprint (a keyed hash) of the number. We do not ask for a copy of your ID document — your new employer asks for that after you accept a written offer.

8. How long we keep information

• Job seeker profiles are kept while your account is open. You can pause your profile (“Off the market”) or delete it at any time. Deleting removes your profile, photo, CV, documents, applications, messages and consent records.
• The Employment Services Act (section 16) requires us to keep a minimal register for three years: your reference number, full name, email address, phone number, the ID fingerprint, the date you registered and any placements. It is deleted after three years.
• Employer accounts are kept while the account is open. Invoices and payment records are kept for five years, as tax law requires.
• Enquiries, recruitment requests and reports are kept for as long as we need them to deal with the matter and any resulting recruitment assignment.
• Security records (rate-limit entries) are deleted after a day; the activity log is kept only as long as needed for security and accountability.

9. Your rights

Under POPIA you may:

• ask whether we hold information about you and request a copy of it (section 23);
• ask us to correct or delete information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or unlawfully obtained (section 24);
• object to processing based on legitimate interests (section 11(3)), and to direct marketing at any time (section 69);
• withdraw a consent you gave (section 11(2)(b)) — this does not affect processing that already happened;
• complain to the Information Regulator (section 74).

How: most of this you can do yourself. Job seekers: My profile to correct details, and Settings & privacy to download your data, change consents, switch off alerts or delete your account. Employers: Company profile and Settings. Otherwise, email elderbirch@outlook.com. We may ask you to confirm your identity first. Confirming whether we hold your information is free; for copies of other records see our PAIA page.

10. Job alerts and marketing

We email job alerts only if they are switched on in your settings, and news or marketing only if you opted in. Every email explains how to stop it, and you can change your choice in your dashboard at any time. When ElderBirch phones or WhatsApps you, it is about a specific vacancy or your profile, not marketing.

11. Information sent outside South Africa

Our hosting and email providers may store or process information on servers outside South Africa, and our website fonts are loaded from Google's servers. We only use providers that are subject to data protection laws, binding corporate rules or agreements that give a level of protection substantially similar to POPIA, as section 72 requires. Card payments are processed by PayFast in South Africa.

12. Cookies

We use one essential session cookie to keep you logged in and protect forms, and a preference cookie if you switch on Data saver. We do not use advertising or tracking cookies. Details are in our cookie policy.

13. How we protect information

We take appropriate, reasonable technical and organisational measures to prevent loss, damage and unlawful access (section 19), including:

• encrypted connections (HTTPS) and passwords stored only as strong one-way hashes;
• encryption of ID and passport numbers, which only ElderBirch staff can view;
• CVs and documents stored outside the public part of the website and released only after an access check for each download;
• photos and logos re-processed on upload, which removes hidden location (GPS) data;
• a daily limit on contact reveals and CV downloads per company, and a record of who viewed contact details;
• limits on login and form attempts, protection against forged form submissions, and an activity log;
• access to sensitive fields limited to ElderBirch staff who need it, who are bound to confidentiality.

No system is completely secure. Please use a strong password that you don't use anywhere else, and never share your login.

14. If a security compromise happens

If we have reasonable grounds to believe that personal information has been accessed or acquired by an unauthorised person, we will notify the Information Regulator and the people affected as soon as reasonably possible, with enough information for them to protect themselves (section 22). Employers who receive candidate information must tell us within 72 hours if it is compromised (see the employer terms).

15. Questions and complaints

Please contact our information officer, Shanita Kriel, at elderbirch@outlook.com first — we would like the chance to put things right. You also have the right to lodge a complaint with the Information Regulator:

Regulator

The Information Regulator (South Africa)

Address

Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191

Complaints

POPIAComplaints@inforegulator.org.za

Phone

010 023 5200

Website

inforegulator.org.za

16. Changes to this policy

This is version 2026-10 of our privacy policy. If we change it in a way that affects how we use your information, we will tell registered users by email or in their dashboard before the change applies and, where the law requires it, ask for your consent again.