Privacy Policy

1. Who we are

Xinnace (Pty) Ltd ("Xinnace", "we", "us") provides an all-in-one HR, payroll, attendance and recruitment platform for South African organisations. Registration number 2025/316516/07. Registered address: 22 Umhlanga Boulevard, Umhlanga, 4321.

This policy explains what we do with personal information where Xinnace itself is the Responsible Party: chiefly enquiries made through this website and the accounts of our customers. It does not describe what our customers do with their own people's data (see the note above).

2. What we collect, and why

When you contact us through this website

Our contact form asks for your name, work email address, company name, company size and, optionally, your phone number and a message. We also automatically record your IP address and browser user-agent with the submission.

We use this to respond to your enquiry, to prepare for a conversation about your organisation's needs, and to keep an internal record of the enquiry. Submitting the form triggers an automated acknowledgement email to you, and a notification to our team. Providing this information is voluntary, but without at least a name and email address we can't reply to you.

When you become a customer

We hold the account details of the people who administer your workspace: name, work email address, a securely hashed password, and records of sign-ins and actions taken in the system (audit logs). We use these to provide the service, secure the account, support you, and bill you.

Data we process on our customers' behalf

Our customers use Xinnace to process personal information about their own employees, job applicants and referred candidates, typically including:

• full name and surname, employee code or staff number;
• contact details;
• gender and race, collected for employment equity and transformation reporting;
• South African ID number (or equivalent identification number);
• disability status;
• education and qualification records;
• performance management records, ratings and coaching notes;
• payment and remuneration information, including banking details where processed for payroll.

We process that data only as an Operator, on their instructions and under a written agreement, and we do not use it for our own purposes.

Technical information

Our servers keep standard logs (IP address, request time, pages requested) for security and troubleshooting. This website sets a single, strictly necessary session cookie used to protect forms against cross-site request forgery. We do not currently run third-party advertising or analytics trackers on this site.

3. Special personal information

Race, disability status and, in some contexts, ID numbers are treated as special personal information under POPIA, which may only be processed where a specific justification applies. For data we process on a customer's behalf, that justification is generally:

• compliance with the Employment Equity Act and the reporting obligations it places on employers;
• reasonable accommodation and workplace support relating to disability;
• the data subject's consent, obtained by the employer; or
• establishing, exercising or defending a right in law.

We process this information strictly as instructed by the relevant customer, and never for a purpose of our own.

4. On what basis we process it

We process personal information to provide and maintain the platform, help customers meet their statutory HR, payroll, employment equity and skills development reporting obligations, administer accounts and access, communicate about the service, keep it secure and auditable, respond to enquiries, and meet our own legal obligations.

Depending on the situation, we rely on your consent (for example, when you tick the box on a form), on the performance of a contract with you or your employer, on compliance with a legal obligation, or on our legitimate interests in operating, securing and improving our business, balanced against your rights. Throughout, we follow POPIA's eight conditions for lawful processing: accountability, processing limitation, purpose specification, further processing limitation, information quality, openness, security safeguards and data subject participation.

5. Who we share it with

We do not sell your personal information. We share it only with:

• your employer, who determines how your information on the platform is used;
• hosting: our application and databases run on servers hosted in South Africa;
• email: Google Workspace, for our own mailboxes, and a third-party SMTP relay used to deliver outbound system email;
• professional advisors: our lawyers, auditors and accountants, where necessary, each bound to confidentiality;
• regulators or law enforcement, where the law requires it.

Each service provider is bound to protect your information and use it only for the purpose we've engaged them for. We may also disclose information to establish, exercise or defend a legal claim.

Information leaving South Africa

Some of these providers, notably Google, may store or process information outside South Africa. Where that happens, we take reasonable steps to ensure the recipient is subject to laws, binding rules or contractual terms that provide an adequate level of protection, as POPIA requires.

6. How long we keep it

We keep enquiry and customer information only for as long as it's needed for the purpose it was collected for, or for as long as the law requires us to. When it's no longer needed, we delete it or de-identify it. Data we hold as an Operator is retained according to our customer's instructions and their own retention policy.

7. How we protect it

We use encrypted connections (HTTPS/TLS), hashed passwords, role-based access controls, audit logging, and access restrictions so that staff only reach information they need. No system is perfectly secure, but if a breach affects your personal information we will notify you and the Information Regulator as POPIA requires.

8. Your rights

Under POPIA you have the right to:

• be notified that your personal information is being collected;
• ask what personal information we hold about you, and request a copy;
• ask us to correct or delete information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or unlawfully obtained;
• object to our processing of your information on reasonable grounds;
• withdraw consent you've given us (this doesn't affect processing already carried out);
• complain to the Information Regulator.

To exercise any of these, write to our Information Officer at privacy@xinnace.co.za. We may need to verify your identity before we act, and we'll respond within a reasonable time.

9. Complaining to the Regulator

If you're unhappy with how we've handled your information, you can lodge a complaint with:

The Information Regulator (South Africa)
JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001
POPIA complaints: POPIAComplaints@inforegulator.org.za
General enquiries: enquiries.IR@justice.gov.za
inforegulator.org.za

10. Access to information (PAIA)

You also have rights of access to records under the Promotion of Access to Information Act. Requests can be sent to our Information Officer at the address below.

11. Changes to this policy

We may update this policy from time to time. The date at the top of this page shows when it was last changed, and material changes will be communicated to customers directly.

12. Contact us

Information Officer
Xinnace (Pty) Ltd
privacy@xinnace.co.za
22 Umhlanga Boulevard, Umhlanga, 4321
South Africa