1. About this policy
Employer of Record SA is an independent research and comparison website for businesses employing people in South Africa.
- Based in: South Africa
- Email: enquiries@employerofrecordsa.co.za
- Effective date: 14 October 2026
In this policy, "we", "us" and "our" mean the people who run Employer of Record SA.
This policy covers visitors to employerofrecordsa.co.za, businesses that use our matching tool or contact us, and people at the providers we review. Sections 2 to 10 apply to everyone. Then:
- Part A explains your rights under the UK GDPR and the EU GDPR.
- Part B explains your rights under South Africa's Protection of Personal Information Act (POPIA).
Where both laws apply to the same information, you can use the rights in either part.
2. Information we collect
| Who you are | Information we collect |
|---|---|
| Website visitor | IP address, device and browser type, pages visited, and how you use the site, including session recordings and heatmaps if you accept analytics cookies. If you use the hiring cost tool, we record what you enter. |
| Business using the matching tool | Your answers to the tool's questions: where your company is based, whether you have a candidate in mind, whether you use an EOR elsewhere, and the needs you choose. To show your matches, we ask for your full name, company, work email and mobile number. We also record your consent choices. |
| Anyone who emails us | Your name, email address and whatever you include in your message. |
| People at providers we review | Information providers publish about themselves, which can include named contacts, and details you send us when you ask to be listed or request a correction. |
We do not collect CVs or candidate information. The matching tool is for businesses, and you don't have to use it to read the site.
3. How we use it and our legal basis
The law requires a legal basis for each use of personal information. These bases appear in Article 6 of the UK and EU GDPR and section 11 of POPIA.
| What we use it for | Legal basis |
|---|---|
| Showing your matches in the comparison tool | Taking the steps you asked for |
| Passing your details to EOR providers so they can contact you (section 4) | Your consent, given in the matching tool |
| Contacting you ourselves about your results (section 7) | Your consent, given by ticking the opt-in box |
| Answering emails, listing requests and corrections | Our legitimate interest in responding to people who contact us |
| Researching and reviewing providers from their published material | Our legitimate interest in publishing independent research |
| Keeping records of referrals and referral fees | Our legitimate interest in running the site, and any legal obligations such as tax |
| Website analytics and advertising | Your consent, given through our cookie banner |
| Protecting our legal rights and preventing misuse of the site | Our legitimate interest |
Where we rely on legitimate interests, we have weighed them against your rights. Where we rely on consent, you can withdraw it at any time; this doesn't affect anything we did before.
4. Sharing your details with EOR providers
We pass your details to EOR providers only if you complete the matching tool and agree to it. Your results show which providers will receive your details.
- What we share: your name, company, work email, mobile number and your answers in the matching tool, so the provider can contact you about a quote.
- Referral fees: some providers pay us a fee when we pass on a request. Fees don't affect what we share or with whom, and our methodology explains how we're funded.
- Once they have your details: each provider is responsible for how it uses your information, under its own privacy policy. We ask providers to use your details only to respond to your request.
You can withdraw your consent at any time by emailing us. We'll stop sharing your details with any further providers. To stop a provider that already has your details from contacting you, contact that provider as well.
5. Other recipients
We never sell personal information. Apart from the providers in section 4, we share it only with:
- service providers that host the website, run our email, store form submissions, manage cookie consent and provide website analytics and advertising, under agreements that require them to protect it;
- professional advisers, such as lawyers and accountants; and
- authorities, where the law requires it.
6. International transfers
We are based in South Africa, and most of our users are in the UK. When you use the site or the matching tool, your information goes to us in South Africa and is protected under POPIA. Neither the UK nor the EU recognises South Africa as providing adequate data protection, so we apply the safeguards in this policy to all information we hold. Your information may also be sent elsewhere:
- the EOR providers that receive your details may be based outside your country, including outside the UK, the EU and South Africa; and
- some of our service providers, including Google, Meta and Microsoft, store data in the United States.
Where UK or EU information goes to a country without adequate protection, we rely on approved contract terms or, for the transfer to providers, the consent you give in the matching tool. Under section 72 of POPIA, we transfer information from South Africa only where the recipient is bound to protect it adequately, you consent, or the transfer is needed to carry out your request.
7. Follow-up from us
We contact you about your results only if you tick the opt-in box in the matching tool. The box is not ticked in advance, and you can use the matching tool without ticking it. Every message includes a simple way to opt out, and you can ask us to stop at any time. We keep a note of opt-outs so we don't contact you again.
8. Cookies
Our website uses cookies and similar technologies, managed through our CookieYes cookie banner. Necessary cookies keep the site working and are always on. Everything else is used only if you accept it, and you can accept analytics without advertising.
- Analytics: we use Microsoft Clarity to see how visitors use the site, such as clicks and scrolling, through behavioural metrics, heatmaps and session recordings. We use this to improve the site and for security and fraud prevention.
- Advertising: we use the Meta Pixel and Microsoft Advertising to measure and improve our advertising, including showing ads to people who have visited the site.
Google Tag Manager loads these tools according to your choices. To learn how Microsoft and Meta use this data, see the Microsoft Privacy Statement and Meta Privacy Policy. You can change your choices at any time using the cookie settings link on our website.
9. How long we keep it
We keep personal information only as long as we need it, then delete it or anonymise it.
- Matching tool submissions: as long as needed to deliver your results and handle any follow-up you agreed to, then for as long as we need records of referrals and referral fees.
- Consent records and opt-outs: as long as we need to show what you agreed to, and to make sure we don't contact you again after you opt out.
- Emails and correction requests: until the matter is closed, and longer only where a correction record supports what we publish.
- Website data: as set out in our cookie banner.
10. Security, the matching tool and under-18s
We protect personal information with reasonable technical and organisational measures, including access controls and agreements with our service providers. No system is completely secure. If a breach puts your information at risk, we will notify the relevant regulator and, where the law requires, tell you.
The matching tool filters providers against the needs you choose. It makes no decision about you, and no decision with legal or similar effects on you is made by automated means.
The site is for businesses. We do not knowingly collect information about anyone under 18.
Part A: UK and EU (GDPR)
This part applies to people in the UK under the UK GDPR and the Data Protection Act 2018, and to people in the EU under the EU GDPR. Although we're based outside the UK, the UK GDPR applies to us because we offer our service to UK businesses and monitor how visitors use our site.
Who is responsible. Employer of Record SA is the controller of your personal information. Contact us at enquiries@employerofrecordsa.co.za.
Your rights. You have the right to:
- get a copy of your personal information;
- have inaccurate information corrected;
- have your information deleted;
- restrict how we use your information;
- receive information you gave us in a portable format;
- object to our use of your information where we rely on legitimate interests;
- withdraw your consent at any time where we rely on it; and
- not be subject to decisions made solely by automated means that significantly affect you.
To use your rights, email us. It's usually free, and we will respond within one month, or tell you if we need longer for a complex request.
Complaints. Please contact us first so we can try to put things right; we'll acknowledge your complaint within 30 days. You can also complain to the Information Commissioner's Office (ICO) at ico.org.uk or on 0303 123 1113. If you are in the EU, you can complain to the data protection authority in your country.
Part B: South Africa (POPIA)
This part applies under the Protection of Personal Information Act 4 of 2013 (POPIA). We are based in South Africa, so POPIA applies to all the personal information we process, wherever you are. Where this part differs from the rest of this policy, this part applies.
For POPIA purposes, terms used elsewhere in this policy have these meanings: "controller" means "responsible party"; service providers that process information on our behalf are "operators"; and "personal data" means "personal information". Under POPIA, personal information also includes information about companies, so this part covers the businesses that use the site and the providers we review.
Who is responsible. Employer of Record SA is the responsible party and Information Officer.
Your rights. You have the right to:
- ask whether we hold personal information about you, free of charge, and request a copy of it;
- ask us to correct or delete information that is inaccurate, out of date, incomplete, excessive or unlawfully obtained;
- object to our use of your information where we rely on legitimate interests, and object to direct marketing at any time;
- withdraw your consent where we rely on it;
- not be subject to decisions made solely by automated means; and
- complain to the Information Regulator.
To use your rights, email us. You can also use the Information Regulator's official forms: Form 1 to object to processing, and Form 2 to ask for correction or deletion. We will confirm your identity before acting on a request.
Complaints. Please contact us first. You can also complain to the Information Regulator, using its complaint form (Form 5):
- Address: Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191
- Phone: 010 023 5200
- General enquiries: enquiries@inforegulator.org.za
- POPIA complaints: POPIAComplaints@inforegulator.org.za
- Website: inforegulator.org.za
Changes and contact
Links to other websites. Our site links to provider websites and others. We aren't responsible for their privacy practices.
Changes to this policy. We may update this policy from time to time. We'll post the new version on this page with a new effective date.
Contact us. For any question about this policy, email enquiries@employerofrecordsa.co.za.