Privacy Policy

1. Introduction

Nettly ("we", "our", or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our payroll management platform (the "Service").

We are committed to complying with the Protection of Personal Information Act (POPIA) in South Africa and the General Data Protection Regulation (GDPR) in the European Union.

2. Information We Collect

2.1 Personal Information

We collect the following types of personal information:

• Account Information: Name, email address, password, company name
• Employee Data: Full names, ID numbers, addresses, contact details, bank account information, tax numbers, employment details, salary information
• Payment Information: Payment card details (processed securely via PayFast), billing addresses
• Usage Data: IP addresses, browser type, pages visited, time spent on pages
• Communication Data: Support requests, feedback, email correspondence

2.2 Automatically Collected Information

We automatically collect certain information when you visit our Service, including IP addresses, browser type, operating system, referring URLs, and usage patterns through cookies and similar technologies.

3. How We Use Your Information

We use your information for the following purposes:

• Service Provision: To process payroll, generate payslips, calculate taxes (PAYE, UIF, SDL)
• Account Management: To create and manage your account, authenticate users
• Payment Processing: To process subscription payments and maintain billing records
• Compliance: To comply with SARS reporting requirements (EMP201, IRP5)
• Communication: To send service updates, payment receipts, support responses
• Improvement: To analyze usage patterns and improve our Service
• Legal Obligations: To comply with applicable laws and regulations

4. Legal Basis for Processing (GDPR/POPIA)

We process your personal information based on:

• Consent: You have given explicit consent for processing
• Contract Performance: Processing is necessary to perform our Service
• Legal Obligation: Processing is required to comply with tax and employment law
• Legitimate Interests: To improve our Service and prevent fraud

5. Data Sharing and Disclosure

We may share your information with:

• Service Providers: PayFast (payments), cloud hosting providers (Vercel, Neon), email service providers
• Government Authorities: SARS (South African Revenue Service) for tax reporting
• Legal Requirements: When required by law or to protect our rights

6. Data Security

We implement industry-standard security measures to protect your data:

• TLS/SSL encryption for data in transit
• Password hashing using bcrypt (cost factor 12)
• Row-Level Security (RLS) in our database
• JWT authentication with 7-day expiry
• Regular security updates and monitoring
• Access controls and audit logging

However, no method of transmission over the internet is 100% secure. While we strive to protect your information, we cannot guarantee absolute security.

7. Data Retention

We retain your personal information for:

• Payroll Records: 7 years (as required by South African tax law)
• Account Data: Duration of your active subscription plus 90 days
• Audit Logs: 7 years for compliance purposes
• Marketing Data: Until you unsubscribe or request deletion

8. Your Rights

Under POPIA and GDPR, you have the right to:

• Access: Request copies of your personal information
• Rectification: Request correction of inaccurate data
• Erasure: Request deletion of your data (subject to legal retention requirements)
• Restriction: Request limitation of processing
• Data Portability: Request transfer of your data in a structured format
• Object: Object to processing based on legitimate interests
• Withdraw Consent: Withdraw consent at any time

To exercise these rights, contact us at privacy@nettlyhr.co.za

9. Cookies and Tracking Technologies

We use cookies and similar technologies to enhance user experience, remember preferences, and analyze usage. See our Cookie Policy for more details.

You can control cookies through your browser settings.

10. International Data Transfers

Your data is primarily stored in South Africa. If we transfer data internationally, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses approved by the EU Commission.

11. Children's Privacy

Our Service is not intended for individuals under 18 years of age. We do not knowingly collect personal information from children.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or through a prominent notice on our Service. The "Last Updated" date at the top indicates when the policy was last revised.

13. Contact Us

14. South African Information Regulator

Nettly's Information Officer is registered with the Information Regulator of South Africa (Registration No. 2026-066255), as required under Section 55 of POPIA.

If you are not satisfied with our response to your privacy concerns, you may lodge a complaint with the Information Regulator of South Africa:

• Website: www.justice.gov.za/inforeg
• Email: inforeg@justice.gov.za

15. Related Policies