How CVDesk complies with the Protection of Personal Information Act, Act 4 of 2013.
Last updated: 28 June 2026
The Protection of Personal Information Act (POPIA) is South Africa's primary data protection legislation. It regulates how organisations collect, store, use and share personal information. CVDesk takes POPIA compliance seriously and has built the platform with privacy and data protection at its core.
POPIA sets out 8 conditions that must be met for the lawful processing of personal information. Here is how CVDesk meets each one:
CVDesk SA (Pty) Ltd is the responsible party for all personal information processed on the platform. Our Information Officer is responsible for ensuring compliance with POPIA. Contact us at privacy@cvdesksa.co.za.
We only collect personal information that is necessary for the purpose of connecting candidates with recruiters. We do not collect excessive or irrelevant information. Candidates choose what to include in their profiles.
Personal information is collected for a specific purpose — to enable job seekers to be discovered by verified South African recruiters. We clearly disclose this purpose at the point of registration and do not use information for any other purpose without consent.
We do not process personal information in ways that are incompatible with the original purpose of collection. We do not sell personal information to third parties or use it for advertising purposes without explicit consent.
Candidates are responsible for ensuring their profile information is accurate. We provide tools to update and correct information at any time through the profile editor. We encourage candidates to keep their information current.
We are transparent about what information we collect and how we use it. This POPIA compliance page, our privacy policy and our registration consent form all clearly explain our data processing practices.
We implement appropriate technical and organisational measures to protect personal information. This includes HTTPS encryption, bcrypt password hashing, private CV storage, rate limiting and full audit trails of all data access.
Data subjects have the right to access, correct and delete their personal information. Candidates can update their profiles at any time and may request account deletion by contacting us. We respond to all requests within 7 business days.
You can request a copy of all personal information we hold about you at any time.
You can update your profile information at any time through your account dashboard.
You can request that we delete all your personal information by contacting our privacy team.
You can withdraw consent for marketing communications at any time without affecting your account.
You have the right to lodge a complaint with the Information Regulator of South Africa at inforeg.org.za.
You can hide your profile from all recruiter searches at any time using the open to work toggle.
We obtain explicit, informed consent from all candidates at the point of registration. Our consent form clearly explains what information will be collected, how it will be used, and who will have access to it. Consent is recorded with a timestamp and IP address. Candidates may withdraw consent at any time by deleting their account.
Our primary servers are located in South Africa. We do not transfer personal information outside of South Africa without consent except where required by law or for payment processing through Stripe which operates under equivalent data protection standards.
The Information Regulator of South Africa oversees compliance with POPIA. If you believe your rights have been violated you may lodge a complaint at www.inforeg.org.za.
For any POPIA related queries, data access requests or complaints contact us directly.
privacy@cvdesksa.co.za