PRIVACY POLICY
1. INTRODUCTION AND SCOPE
M3 Human Capital Management (Pty) Ltd ("M3HCM", "we", "us" or "the Company") is committed to protecting the privacy and
Personal Information of individuals who interact with us.
This Privacy Policy applies to visitors to our website, clients, prospective customers, user/s, job applicants, candidates, prospective candidates, research or survey participants, referees, suppliers and other individuals who provide
Personal Information to us through our website or in connection with our services.
It explains how we collect, process, share, store, retain and safeguard Personal Information in accordance with the Protection of Personal Information Act, 4 of 2013 (POPIA), including information submitted through our online job applications or recruitment links that provide access to this policy.
By using our website or submitting information to us, you acknowledge that you have been given access to this Privacy Policy. This acknowledgement does not constitute consent to processing where POPIA requires a separate or specific consent.
2. KEY DEFINITIONS USED IN THIS POLICY
Candidate: means a person who applies for, is considered for or engages with us regarding an employment opportunity, whether or not that person applied through our website.
Customer or User: means any person who visits or uses our website, enquires about or uses our services, or otherwise interacts with us.
Data Subject: means the natural or juristic person to whom Personal Information relates.
De-identify: means removing information that identifies a Data Subject, can reasonably be used to identify the Data Subject, or can reasonably be linked to other information that identifies the Data Subject.
GDPR: means the European Union General Data Protection Regulation, where it applies to our processing activities.
Information Officer: means the person designated and registered, where required, to oversee our compliance with POPIA.
Information Regulator: means the Information Regulator established in terms of POPIA.
Operator: means a person or organisation that processes Personal Information for us under a contract or mandate.
PAIA Manual: means our manual prepared in terms of the Promotion of Access to Information Act 2 of 2000.
Personal Information: means information relating to an identifiable, living natural person and, where applicable, an identifiable, existing juristic person, as contemplated in POPIA.
POPIA: means the Protection of Personal Information Act 4 of 2013 of the Republic of South Africa.
Processing: includes collecting, receiving, recording, organising, storing, updating, retrieving, using, sharing, restricting, deleting or destroying Personal Information.
Responsible Party: means the person or organisation that determines the purpose and means of processing Personal Information. M3HCM will ordinarily be the Responsible Party for information collected for its own website, recruitment, research and service activities.
3. LAWFUL BASIS AND PURPOSE OF PROCESSING
We process Personal Information only for a specific, explicitly defined and lawful purpose related to our activities, and only where the information is adequate, relevant and not excessive for that purpose.
Depending on the circumstances, we may process Personal Information where:
- you have consented to the processing;
- processing is necessary to take steps at your request before entering into a contract or to perform a contract with you;
- processing is required to comply with a legal obligation;
- processing protects your legitimate interests or
- processing is necessary to pursue our legitimate interests, or those of a client or another third party, provided that your privacy rights and interests do not override those interests.
Where we rely on consent, it must be voluntary, specific and informed. You may withdraw consent, subject to legal or contractual limitations, without affecting processing that was lawful before the withdrawal.
4. COMPLIANCE WITH POPIA AND THE GDPR
Our processing of Personal Information is subject to POPIA and other applicable South African laws.
Where the GDPR applies to a particular processing activity, we will comply with its applicable requirements. A reference to the GDPR in this policy does not mean that the GDPR applies to every interaction with us.
5. PRIVACY AND SECURITY OF INFORMATION
We implement reasonable and appropriate technical and organisational safeguards to protect the integrity and confidentiality of Personal Information against loss, damage, unauthorised destruction, unlawful access or unlawful processing.
These safeguards may include access controls, password protection, secure storage, backups, staff confidentiality obligations and appropriate agreements with Operators. No security system is completely risk-free, but we will take reasonable steps required by applicable law to manage identified risks.
We will not disclose Personal Information except as described in this policy, with your permission, or where disclosure is authorised or required by law. Where we are legally required to disclose information, we may notify you unless the law prohibits us from doing so or notice would prejudice the lawful purpose of the disclosure.
6. INFORMATION WE COLLECT
6.1 Website and technical information
When you visit our website, we or our service providers may collect technical information such as:
- Internet Protocol (IP) address;
- device, operating system and browser type;
- pages visited, dates, times and referring pages;
- approximate location derived from technical information; and
- cookie and similar technology information.
We may use cookies and similar technologies for essential website functionality, security, analytics and, where applicable, preference or marketing purposes. Where consent is required for non-essential cookies, we will request it separately.
6.2 Personal Information provided to us
The categories of Personal Information we collect depend on how you interact with us and may include:
| Category | Examples |
|---|---|
| Contact information | Email address, telephone or cell phone number, and physical or postal address |
| Identification information | Name, surname, identity or passport details, nationality and online identifiers |
| Recruitment information | Applications, screening responses, interview notes, assessments, reference information, availability, location preferences and information about suitability for a role |
| Remuneration information | Current or expected remuneration, salary structure, benefits, incentives and notice period |
| Demographic information | Age, gender, race or other demographic information where lawfully collected |
| Financial information | Banking, billing or payment information where required for a service or contractual relationship |
| Communications | E-mails, messages, telephone notes, enquiries, complaints and other correspondence |
| Service and survey information | Information supplied when using our services, participating in a survey, attending an event or responding to research |
Some recruitment information may constitute special Personal Information, including information about race or ethnic origin, health, disability, criminal behaviour or biometric information. We will process such information only where POPIA or another law permits it and where appropriate safeguards are in place.
7. HOW WE USE PERSONAL INFORMATION
7.1 General uses
We may use Personal Information to:
- operate, maintain and secure our website;
- respond to enquiries and provide information about our services;
- deliver consulting, recruitment, assessment, research and related services;
- manage customer, supplier and other business relationships;
- administer accounts, payments and records;
- comply with legal, regulatory, professional and contractual obligations;
- establish, exercise or defend legal rights;
- conduct research, analysis, benchmarking, surveys and statistical activities, including for the development and improvement of our services, methodologies and industry insights, subject to applicable data protection requirements;
- improve our website, services, processes and user experience; and
- send marketing communications where permitted by law and, where required, with your consent.
7.2 Recruitment and candidate information
Where you apply for or are considered for an employment opportunity, we may use your information to:
- receive, administer and assess your application;
- communicate with you about the recruitment process;
- evaluate your experience, qualifications and suitability for a role;
- conduct interviews, assessments, reference checks and other lawful verification, where applicable;
- introduce or submit to the potential employer for the specific opportunity being considered;
- consider you for other suitable opportunities where you have agreed to this or where another lawful basis applies;
- maintain appropriate records of recruitment decisions and
- meet legal, professional and client-related recruitment obligations.
Providing information needed to assess an application is generally voluntary, but we may be unable to consider you for a role if you do not provide information reasonably required for the recruitment process.
7.3 Research, benchmarking and statistical analysis
We may use certain information provided during recruitment or through our services, including role type, occupational level, industry, location, qualifications, experience, current or expected remuneration, benefits and recruitment outcomes, for statistical research, remuneration benchmarking and recruitment or labour-market trend analysis.
Information used for these purposes will be placed in a separate research dataset only after direct identifiers have been removed and reasonable measures have been taken to prevent a person, employer or client from being identified through the combination of data fields.
Research findings may be used internally, shared with clients, or included in reports and insights made available by us. Findings will only be shared or published in aggregated or de-identified form and will not identify a candidate, employer or client.
This research use will not influence the outcome of a candidate's application. We will not disclose identifiable candidate information for research or benchmarking purposes unless we have separate lawful basis to do so.
We will apply reasonable safeguards against re-identification, including grouping or suppressing results where a category is too small or distinctive to protect confidentiality.
8. SHARING PERSONAL INFORMATION
We will share Personal Information only where this is reasonably necessary, lawful and not excessive in relation to the relevant purpose.
8.1 Service providers and Operators
We may share information with Operators and service providers that support our website and services, including hosting, communications, data storage, backups, security, recruitment platforms, assessment providers, background-screening providers, billing and payment services.
Where POPIA requires it, we enter into written agreements requiring Operators to maintain appropriate confidentiality and security safeguards and to notify us of security compromises.
8.2 Employers and recruitment clients
Information submitted for a specific employment opportunity may be shared with the employer or client for whom we are conducting that recruitment process.
We will not submit your identifiable information to a different employer merely because we believe that employer may be interested in hiring you. We will obtain your permission before introducing or submitting you for a different opportunity, unless another lawful basis clearly permits the disclosure.
8.3 Other disclosures
We may disclose information to professional advisers, regulators, courts, law-enforcement bodies, public authorities, a purchaser or successor to our business, or another person where the disclosure is authorised or required by law and appropriate safeguards are applied.
We will not share your contact information with third parties for their own direct marketing unless you have specifically authorised us to do so.
8.4 Cross-border transfers
Personal Information may be stored or processed outside South Africa by an Operator or service provider. We will make such transfers only where permitted by POPIA, including where the recipient is subject to an adequate law, binding agreement, binding corporate rules, consent or another lawful transfer mechanism.
9. RETENTION AND DELETION
We retain identifiable Personal Information only for as long as reasonably necessary to achieve the purpose for which it was collected or subsequently lawfully processed, or for a longer period where retention is required or authorised by law, contract, consent or a lawful business purpose.
Candidate information relating to a particular recruitment process will be retained for the period reasonably required to complete the process, maintain appropriate decision records, respond to queries and manage potential legal or contractual matters.
Where you agree to remain in our candidate network or talent pool, we may ordinarily retain your identifiable candidate profile for up to 60 months after our most recent meaningful contact with you. We may contact you to update your details or seek permission for continued retention. A longer period may apply where you renew your permission or another lawful basis applies.
Identifiable information retained solely for historical, statistical or research purposes will be subject to appropriate safeguards against use for other purposes. Where the information is no longer required in identifiable form, we will delete, destroy or de-identify it as soon as reasonably practicable.
De-identified research and statistical information that cannot reasonably be re-identified may be retained for a longer period.
10. SECURITY COMPROMISES
If we have reasonable grounds to believe that Personal Information has been accessed or acquired by an unauthorised person, we will investigate and take appropriate steps to contain and mitigate the incident.
We will notify the Information Regulator and affected Data Subjects as soon as reasonably possible after discovering the compromise, subject to any lawful delay or exception, and in the manner required by POPIA.
11. YOUR RIGHTS
Subject to POPIA and other applicable law, you may:
- ask whether we hold Personal Information about you and request access to it;
- ask us to correct or update inaccurate, incomplete, misleading or outdated information;
- request deletion or destruction of information that we are no longer authorised to retain;
- object, on reasonable grounds, to processing based on legitimate interests;
- withdraw consent where processing is based on consent;
- object to direct marketing and
- lodge a complaint with the Information Regulator.
A request to delete information is not absolute. We may retain information where required or authorised by law, for evidentiary purposes, to exercise or defend legal rights, or for another lawful purpose.
You may exercise these rights by contacting us at info@m3online.co.za. We may require reasonable information to verify your identity before acting on a request.
12. INFORMATION OFFICER AND CONTACT DETAILS
Our Information Officer is responsible for overseeing our POPIA compliance and handling requests relating to Personal Information.
M3 Human Capital Management (Pty) Ltd
Email: info@m3online.co.za
Physical address: 2 Turk Street, Paarl, 7624
Our PAIA Manual, where applicable, provides further information about requesting access to records.
13. INFORMATION ABOUT OTHER PEOPLE AND CHILDREN
If you provide us with Personal Information about another person, including a referee, employee, family member or child, you must be authorised to provide that information and must ensure that the person has been appropriately informed where required.
Our website and recruitment services are not directed at children. We do not knowingly collect Personal Information from a child (below the age of 15 or a child below the applicable minimum school leaving age) without the consent of a competent person or another lawful basis. If we become aware that child information has been collected unlawfully, we will take reasonable steps to delete it or otherwise address the matter.
14. THIRD-PARTY WEBSITES AND PUBLIC INFORMATION
Our website may contain links to third-party websites. We do not control and are not responsible for the privacy practices or content of those websites. You should review their privacy notices before providing Personal Information.
Information you intentionally post in a public forum or other publicly accessible part of a website may be visible to others. You should avoid posting information that you do not wish to make public.
15. COMPLAINTS
If you have concerns about how we process Personal Information, please contact our Information Officer first so that we can try to resolve the matter.
You also have the right to lodge a complaint with the Information Regulator of South Africa. Current complaint procedures and contact details are available at https://inforegulator.org.za/complaints/.
16. AMENDMENTS TO THIS POLICY
We may amend this Privacy Policy from time to time by publishing the updated version on our website. The updated policy will state its effective date. Where a change materially affects how we use Personal Information already collected, we will take reasonable steps to notify affected persons or obtain consent where required by law.
Effective date: August 2026