Privacy Policy (POPIA)

Last updated: 22 October 2026

1. Who we are

ICT Recruit (Pty) Ltd (“ICT Recruit”, “we”, “us”) is a recruitment agency and the responsible party for the personal information described in this policy, as defined in the Protection of Personal Information Act 4 of 2013 (POPIA).

• Address: 2nd Floor Tugela House, Riverside Office Park, 1303 Heuwel Road, Centurion, Gauteng, South Africa
• Email: [email protected]
• Phone: +27 12 004 0004
• Information Officer: contact via [email protected]

We are a member of APSO (the Association of Personnel Service Organisations) and follow its code of conduct.

2. Who this policy covers

• Candidates: people who send us a CV, contact us about a role, or whom we approach about an opportunity
• Clients: contact people at companies that hire through us
• Referees: people a candidate names as a reference
• Website visitors: anyone who uses ictrecruit.co.za or contacts us through it (email, WhatsApp, phone)

3. What personal information we collect

• Candidates: name, contact details, ID or passport number (when needed for an offer or checks), CV, qualifications, employment history, skills, current and expected salary, notice period, work authorisation, interview notes, references and check results
• Clients: name, job title, company, work contact details, role requirements and correspondence
• Referees: name, contact details and the reference they give
• Website visitors: IP address, browser and device details, pages visited, and messages you send us

Special personal information. We only process race (for employment equity reporting by clients), health or disability, or criminal record information when the law allows it and, where required, with your explicit consent. Please do not include this information in your CV unless a role asks for it.

4. How we collect it

• From you: when you email or WhatsApp us, send a CV, speak to a recruiter or attend an interview
• From public professional sources: such as LinkedIn and job boards, when we approach you about a role you may suit
• From others, with your knowledge: referees, previous employers and verification providers when you agree to checks; clients who share role details
• Automatically on our website: technical data collected by our hosting, security and analytics tools (see section 10)

When we collect information about you from a public source, we tell you at our first contact and explain how to opt out.

5. Why we use it

We only use personal information for the purposes below, and only where POPIA gives us a lawful basis (section 11).

• Matching candidates to roles and putting them forward to clients: your consent, given per role before we share your CV
• Arranging interviews, offers and placements: steps towards a contract you are party to
• Qualification, criminal record, credit and reference checks: your consent
• Managing our relationship with clients: contract and our legitimate interest
• Keeping records, invoicing and meeting legal duties (tax, labour, employment equity): legal obligation
• Keeping our website secure and understanding how it is used: our legitimate interest
• Telling you about new roles or services: your consent, or as an existing contact (section 69); you can opt out at any time

You may withdraw consent at any time. This does not affect anything we did before you withdrew it.

6. Who we share it with

We never sell personal information. We share it only as follows:

• Prospective employers: your CV and relevant details go to a client only after you have agreed to be put forward for that specific role
• Verification providers: for the qualification, criminal record, credit and reference checks you have agreed to
• Service providers who process information for us, under written agreements that require them to keep it secure and confidential (POPIA section 21): Amazon Web Services (website hosting); Cloudflare (website security, performance and email-address protection); Microsoft 365 (email and documents); Google (website analytics through Google Analytics / Site Kit); Meta (WhatsApp, when you message us there); LinkedIn (finding and contacting candidates, and our company page)
• Authorities: where the law requires it

7. Information sent outside South Africa

Some of the providers above store or process information outside South Africa: our website is hosted in the United Kingdom (AWS, London), and Microsoft, Google, Cloudflare, Meta and LinkedIn operate data centres in several countries. We only use providers bound by laws, binding corporate rules or agreements that give protection substantially similar to POPIA, as section 72 requires. Clients outside South Africa only receive your details with your consent for that role.

8. How long we keep it

We keep personal information only as long as we need it for the purposes above or the law requires (POPIA section 14), then delete or de-identify it.

• Candidate CV and profile, if not placed: 2 years after our last contact, unless you ask us to delete it sooner
• Records of placed candidates: 5 years after the placement ends (tax and labour records)
• Client contact and contract records: 5 years after the relationship ends
• Website security and server logs: 90 days

We will contact you before the end of the candidate period if we would like to keep your CV on file.

9. How we protect it

We take reasonable technical and organisational measures to keep personal information safe (POPIA section 19), including encrypted connections (HTTPS) on our website, a web application firewall, access limited to staff who need it, multi-factor sign-in on our email and systems, and confidentiality obligations on our staff and service providers.

If we believe your personal information has been accessed by someone unauthorised, we will notify you and the Information Regulator as soon as reasonably possible, as section 22 requires.

10. Cookies and website analytics

• __cf_bm (Cloudflare): tells people apart from bots, to protect the site; expires after 30 minutes
• _ga, _ga_* (Google Analytics via Site Kit): counts visits and shows how pages are used, without identifying you by name
• wordpress_*, wfwaf-authcookie-* (WordPress, Wordfence): only for our staff when signed in to manage the site

You can block or delete cookies in your browser settings; the site still works without analytics cookies. Our hosting and security tools also log IP addresses and request details to detect attacks.

11. Your rights

Under POPIA you have the right to:

• Know whether we hold personal information about you, and get a copy of it (section 23)
• Correct information that is wrong, out of date or incomplete, or ask us to delete it (section 24)
• Object to us using it for our legitimate interests or for direct marketing (section 11(3))
• Withdraw your consent, for example to stop us putting you forward for roles
• Complain to the Information Regulator

To use any of these rights, email our Information Officer at [email protected]. We will confirm your identity and respond within a reasonable time, normally 30 days.

If you are unhappy with our response, you can lodge a complaint with the Information Regulator through its eService Portal. Contact details: Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191; [email protected]; 010 023 5200; toll-free 0800 017 160.

12. Other points

Direct marketing. We only send you role alerts or service updates if you agreed to receive them or are an existing candidate or client contact (POPIA section 69). Every message tells you how to opt out, and opting out is free.

Children. Our services are for people aged 18 and over. We do not knowingly collect information about children.

Changes. We may update this policy; the date at the top shows the latest version. Significant changes will be highlighted on our website.

Contact. Questions about this policy: [email protected] or +27 12 004 0004.