This Privacy Policy explains how The HR Insights Co. collects, uses, stores, and protects personal information when we provide employee engagement surveys and related workforce research services to our clients.
We are committed to protecting the personal information entrusted to us and complying with the Protection of Personal Information Act, 4 of 2013 (POPIA). This policy applies to all personal information we process, including information collected through our website (thehrinsightsco.co.za), through surveys we conduct on behalf of our clients, and through any other interaction with our business.
If you have questions about this policy or how we handle personal information, contact our Information Officer using the details in section 13.
The HR Insights Co. is a South African business that designs and delivers employee engagement surveys on behalf of client organisations.
Under POPIA, we typically act in one of two roles depending on the context:
As an Operator: When we process employee personal information on behalf of a client organisation (for example, when running an engagement survey for that client's staff), the client is the Responsible Party. We act as the Operator and process personal information only on the client's documented instructions and under a written agreement.
As a Responsible Party: When we collect information directly from you (for example, when you contact us via our website, email, or WhatsApp), we are the Responsible Party for that information.
This policy explains how we handle information in both roles.
The categories of personal information we collect depend on how you interact with us.
When we run a survey on behalf of a client, we receive the following information about that client's employees from the client:
- Employee identifier or number
- First name and surname
- Contact details (mobile phone number, email address)
- Job-related information (department, direct manager, site or location, job title, employment type)
- Demographic information (gender, race, age) where the client has chosen to include this for segmentation purposes
In addition, when an employee participates in a survey, we collect:
- Survey responses (which are pseudonymous during the active survey period — responses are associated internally with a unique, randomly generated identifier, never with a respondent's name, phone number, or email address — and are reported only at group level, making them effectively anonymous in all outputs delivered to the client)
- Technical metadata related to survey completion (timestamps, device type, completion status)
When you visit thehrinsightsco.co.za, we may collect:
- Information you voluntarily provide via contact forms (name, email, phone number, message content)
- Standard server log information (IP address, browser type, pages visited, referring URL, date and time of access)
When we send messages to survey participants via WhatsApp, we process:
- Mobile phone numbers (provided by the client)
- Message delivery status (delivered, read, opt-out)
- Inbound replies (if the recipient replies to our messages)
We do not collect WhatsApp profile information beyond the phone number used for delivery.
If you email, call, or otherwise contact us, we collect the information you provide in that communication.
When we run an engagement survey on behalf of a client, personal information flows through a purpose-built survey platform hosted on Vercel (EU region) and backed by a Supabase Postgres database (EU West region). The following describes how personal information is handled at each stage of the survey lifecycle.
The client provides a staff list containing employee number, first name, WhatsApp number, email address, and any segmentation fields (such as department, site, manager, job title, or employment type). This information is uploaded to the platform by The HR Insights Co. administrator. Personal contact details — first name, WhatsApp number, and email address — are stored in dedicated, clearly separated database columns. All segmentation fields are stored separately and are never concatenated with or embedded alongside contact information. At the same time, the platform generates a unique, single-use access token for each staff member. This token is used to create the individual's personalised survey link. Tokens are randomly generated and are not derived from any personal information.
When a survey is launched, the platform sends each staff member their unique survey link via WhatsApp (through Twilio) or email (through Resend), depending on which contact details are available. The message uses the staff member's first name in the greeting only. No other personal information is included in the message content. Message delivery status is recorded against each staff member record for operational purposes, including sending reminders to non-responders.
The survey form is token-gated. A respondent's link resolves to their unique token; the platform validates the token before displaying the form and marks it as used only after a successful submission, preventing duplicate responses. Survey responses are never stored alongside the respondent's name, phone number, or email address. Responses are stored with a snapshot of the respondent's segmentation metadata (for example, their department and site) taken at the time of submission. The only internal link between a response record and an identifiable individual is a database row identifier used to enforce single-use token logic and to track response rates; this identifier is never exposed in any report or export delivered to the client.
When a survey is formally closed, the administrator initiates a PII strip. This process sets the first name, WhatsApp number, and email address fields to null across all staff records for that survey. The PII strip event is recorded with a timestamp in the platform's audit log. The PII strip can only be performed once a survey is closed and cannot be applied to an active survey. Two export types are available, accessible only to The HR Insights Co. administrator and only after a survey is closed. The internal export contains employee numbers, all question responses, submission timestamps, and segmentation metadata; it is used for The HR Insights Co.'s analysis only and is never shared with the client. The client-safe export contains only anonymous response data: each respondent is assigned a fresh random identifier generated at export time that bears no relationship to any internal record, and no employee number, name, phone number, or email address is included. Suppression is applied automatically — any segmentation segment with fewer than five respondents is excluded from the export entirely and recorded in a separate suppression log included in the file delivered to the client. All export events are recorded in the audit log with the export type, row count, and timestamp.
All data is transmitted over HTTPS/TLS. Data at rest is encrypted by the database provider. Access to the administrator panel requires authenticated login; all administrator API routes verify the session on every request. Service credentials are stored as server-side environment variables and are never exposed to the browser or included in client-side code. The survey platform is hosted on Vercel (EU region) and Supabase (EU West); sub-operator details for both providers are listed in section 7.2 of this policy.
We collect personal information in the following ways:
- From our clients: Client organisations provide us with employee contact and demographic data so that we can administer surveys on their behalf. We rely on our clients to ensure they have a lawful basis under POPIA to share this information with us and that their employees have been appropriately informed.
- Directly from individuals: When you submit information via our website contact form, email us, or respond to a survey we administer.
- Through automated means: Standard analytics and server logs when you visit our website. We also receive automated delivery and engagement data from WhatsApp and our messaging infrastructure providers.
We process personal information for the following purposes, relying on the lawful processing grounds set out in section 11 of POPIA:
| Purpose | Lawful basis |
|---|---|
| Delivering employee engagement surveys on behalf of clients | Performance of a contract with the client; legitimate interest of the client employer in understanding workforce sentiment |
| Producing anonymous, group-level analytical reports for clients | Same as above |
| Communicating with survey participants (invitations, reminders, thank-you messages) | Legitimate interest of the client employer, with employee participation being voluntary |
| Responding to enquiries received via our website, email, or telephone | Legitimate interest in operating our business; consent where applicable |
| Improving our services and survey methodology | Legitimate interest, using aggregated and anonymised data only |
| Complying with legal and regulatory obligations | Compliance with law |
Survey participation is always voluntary. Employees may decline to participate or withdraw at any time without consequence.
We use the WhatsApp Business Platform (operated by Meta Platforms Inc.) to deliver survey invitations, reminders, and thank-you messages to participating employees.
- Opt-in: Your employer has provided your phone number to us specifically for the purpose of this survey. Your employer is responsible for informing you in advance that you may receive a WhatsApp from us.
- Opt-out: You may opt out of receiving WhatsApp messages from us at any time by replying "STOP" to any message we send. Once you opt out, we will not send you further messages from that sender. Your opt-out is recorded immediately and permanently.
- Anonymity: Although we know your phone number (because your employer provided it), your survey responses remain anonymous. The link between your phone number and your responses is never shared with your employer or any third party. Responses are reported only at group level.
- What Meta sees: Meta processes the technical delivery of WhatsApp messages and necessarily sees the phone numbers, message content, and delivery status. Meta's handling of this data is governed by its own privacy terms, available at whatsapp.com/legal.
- What our messaging provider sees: We use Twilio Inc. as our messaging infrastructure provider. Twilio processes phone numbers and message metadata to deliver messages. Twilio acts as a sub-operator and is contractually bound to process personal information only on our documented instructions.
If you do not wish to receive WhatsApp messages from us at all, you can advise your employer and we will exclude your number from future sends.
We do not sell personal information. We share personal information only in the limited circumstances set out below.
For survey engagements, we share aggregated, anonymous results with the client employer. We never share individual responses or any data that could identify an individual respondent. To protect anonymity further, we suppress results for any segment with fewer than five responses.
We use the following third parties to deliver our services. Each is contractually bound to process personal information only on our instructions and to apply appropriate security measures:
| Sub-operator | Service | Information processed | Location |
|---|---|---|---|
| Meta Platforms Inc. (WhatsApp Business Platform) | Messaging delivery to participants | Phone numbers, message content, delivery metadata | United States, with global infrastructure |
| Twilio Inc. | Messaging infrastructure and API | Phone numbers, message metadata | United States |
| Vercel Inc. | Website hosting; survey platform application hosting (EU deployment) | Website visitor information; staff contact data, survey responses, segmentation metadata, access tokens, audit logs (EU deployment only) | United States (website); European Union (survey platform) |
| Supabase Inc. | Survey database (Postgres) — stores staff records, responses, tokens, and audit logs | Staff contact data (pre-PII strip), survey responses, segmentation metadata, access tokens, audit logs | European Union (EU West region) |
| Resend Inc. | Email delivery for survey invitations and reminders | Email addresses, first names, message content | United States |
| Microsoft Corporation (M365) | Email, file storage, productivity | Communications, client files | Various, incl. South Africa region |
Some of these sub-operators are located outside South Africa. Where personal information is transferred outside South Africa, we ensure that the receiving party is subject to laws, binding rules, or contractual arrangements that provide an adequate level of protection, as required by section 72 of POPIA.
We may disclose personal information if required by law, court order, or a legitimate request from a regulatory authority, including the Information Regulator of South Africa.
If our business is sold, merged, or restructured, personal information may be transferred to the acquiring or successor entity. We will notify affected individuals where required by law.
We retain personal information only for as long as necessary to fulfil the purposes for which it was collected, subject to any legal retention requirements.
| Category | Retention period |
|---|---|
| Client-supplied employee contact data (for survey delivery) | Deleted on written request once the final report has been delivered to the client; otherwise retained for the duration of the engagement and for up to 90 days thereafter for query-resolution purposes |
| Survey responses (anonymised) | Retained in anonymised form for up to 24 months for benchmarking and methodology improvement, then deleted or further anonymised |
| Website contact form submissions | Retained for 24 months from last contact, then deleted |
| Business communications (emails, contracts) | Retained for 7 years for tax, audit, and contractual record-keeping purposes, as required by South African law |
| WhatsApp opt-out records | Retained indefinitely to honour opt-out requests permanently |
| Server logs | Retained for 12 months for security and operational purposes |
We review retained personal information periodically and delete or anonymise information that is no longer needed.
We apply reasonable technical and organisational security measures to protect personal information against loss, unauthorised access, alteration, disclosure, or destruction. These measures include:
- Encrypted transmission of personal information (HTTPS for our website, TLS for email, end-to-end encryption for WhatsApp messages where applicable)
- Encrypted storage of personal information at rest
- Access controls limiting access to personal information to authorised personnel only
- Use of reputable cloud service providers with recognised security certifications
- Written agreements with all sub-operators requiring equivalent security measures
- Regular review of our security practices and incident response procedures
- A documented breach response plan that includes notification of the Information Regulator and affected data subjects within 72 hours of becoming aware of a security compromise, as required by POPIA
Despite our best efforts, no system is completely secure. If you have reason to believe that your personal information has been compromised, please contact our Information Officer immediately.
POPIA gives you the following rights in relation to your personal information. You may exercise these rights free of charge by contacting our Information Officer using the details in section 13. We will respond within a reasonable time and, in any event, within the time periods required by law.
- Right to be notified: that personal information about you is being collected, and notified if it is subject to unauthorised access.
- Right of access: to confirm whether we hold personal information about you, and to receive a copy of that information.
- Right to correction or deletion: of personal information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading, or obtained unlawfully.
- Right to object: to the processing of personal information, on reasonable grounds.
- Right to withdraw consent: where processing is based on consent.
- Right to lodge a complaint: with the Information Regulator (see section 14).
To exercise any of these rights, send a written request to our Information Officer. We may need to verify your identity before processing your request.
If you are participating in a survey we are running on behalf of your employer, please be aware that your employer is the Responsible Party for your information. We will assist with rights requests but may need to coordinate with your employer.
Our services are not directed at children under the age of 18. We do not knowingly collect personal information from children. If you believe we have inadvertently collected information about a child, contact our Information Officer and we will delete it promptly.
Our website uses minimal cookies necessary for basic functionality. We do not currently use advertising or marketing cookies. If we add additional cookies in future, we will update this policy and, where required, request your consent.
You can configure your browser to refuse cookies or alert you when cookies are being sent. Some parts of our website may not function correctly if cookies are disabled.
Our Information Officer is registered with the Information Regulator of South Africa.
| Information Officer | B Janse van Vuuren |
| Registered organisation | HR Analytics (Pty) Ltd, trading as The HR Insights Co. |
| Information Regulator registration number | 2026-018806 |
| Registration date | 23 May 2026 |
| info@thehrinsightsco.co.za | |
| Website | thehrinsightsco.co.za |
We aim to respond to all privacy-related communications within 5 business days, and to formal POPIA requests within the timeframes required by law (typically 30 days, extendable in defined circumstances).
If you are not satisfied with how we have handled your personal information or a privacy-related complaint, you have the right to lodge a complaint with the Information Regulator of South Africa.
We encourage you to contact us first so that we can attempt to resolve any concerns directly.
We may update this Privacy Policy from time to time to reflect changes in our practices, services, or legal requirements. When we make material changes, we will update the "Last updated" date at the top of this policy and, where appropriate, notify affected individuals through our website or by direct communication.
We encourage you to review this policy periodically.
This policy is governed by the laws of the Republic of South Africa. Any disputes arising from this policy or our processing of personal information will be subject to the jurisdiction of the South African courts.