IR Buddy Privacy Policy

1. Who We Are

IR Buddy is an industrial relations case management platform operated by IR Buddy (Pty) Ltd. We provide digital tools that connect client company representatives with industrial relations consultants to manage employee-related matters.

For the purposes of the Protection of Personal Information Act 4 of 2013 (POPIA), IR Buddy acts as the Responsible Party in respect of personal information collected through this platform.

Contact: admin@irbuddy.co.za | irbuddy.co.za

2. Scope of This Policy

This policy applies to all personal information processed through the IR Buddy web and mobile application, including information about:

• Clients — employees or representatives of registered client companies who use the platform to submit and manage IR-related service requests.
• Consultants — individuals contracted to or employed by IR Buddy who handle client requests.
• Operations Managers — IR Buddy staff who administer the platform.
• Company Contacts — representatives of companies that register with IR Buddy.

3. Personal Information We Collect

Clients (additional): company affiliation, service request history including intake questionnaire answers, chat messages, attached documents, voice messages, and feedback submitted about consultants.

Consultants (additional): professional résumé, short biography, areas of specialisation, performance ratings and written feedback received from clients, assignment and caseload history.

Company contacts: company name, staff size, contact person name/email/phone/title, registration questionnaire responses, approval status and, where applicable, reasons for rejection or deactivation.

Automatically generated: request and message timestamps, file upload metadata, assignment change records, status change audit trail.

4. How We Collect Personal Information

• Directly from you when you register, complete your profile, submit a service request, or send messages on the platform.
• From your employer when a company administrator registers your account on your behalf (in which case your employer is responsible for having the authority to share your information with us).
• Automatically as you use the platform (message timestamps, file metadata, activity records).

5. Why We Process Your Personal Information

We do not use your personal information for unsolicited marketing without your explicit consent.

6. Third-Party Service Providers

We share personal information only with the following trusted sub-processors, solely to the extent necessary to deliver our service:

All providers are required to process personal information only on our documented instructions and to maintain appropriate security measures. We do not sell, rent, or trade personal information to any third party.

7. File Storage and Document Handling

Documents, images, and voice messages uploaded to the platform are stored in Cloudflare R2 secure object storage. Access to stored files is granted via time-limited signed URLs that expire after one hour. Documents are organised by user ID and request ID; only authenticated users with a legitimate connection to the relevant matter can access them.

8. Retention of Personal Information

When personal information is no longer required, we will delete or anonymise it securely.

9. Security Measures

Despite these measures, no transmission over the internet or electronic storage is completely secure. We encourage you to use a strong, unique password and to contact us immediately if you suspect unauthorised access to your account.

• Passwords are stored using bcrypt hashing and are never stored or transmitted in plaintext.
• All API communication is protected via JWT authentication with role-based access controls.
• File access requires authentication and uses expiring signed URLs.
• Environment credentials (API keys, database URLs, signing secrets) are stored in environment variables, not in source code.
• Access to the platform is restricted by user role (client, consultant, operations manager).

10. Your Rights Under POPIA

As a data subject, you have the right to:

1. Access — request a copy of the personal information we hold about you.
2. Correction — request that inaccurate or incomplete information be corrected.
3. Deletion — request that your personal information be deleted, subject to our legal retention obligations. Note: where you request account deletion, your account and personal details will be deleted. However, certain communication records may be retained for a limited period for safety, moderation, and dispute resolution purposes, as outlined in Section 8.
4. Objection — object to the processing of your personal information in certain circumstances.
5. Complaints — lodge a complaint with the Information Regulator of South Africa if you believe we have violated your rights.

Information Regulator: JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001 | complaints.IR@inforegulator.org.za

To exercise any of the above rights, contact us at admin@irbuddy.co.za.

11. Cookies and Tracking

The IR Buddy platform uses JWT-based authentication tokens stored client-side to maintain your session. We do not currently use advertising cookies or third-party tracking technologies.

12. Children's Privacy

The IR Buddy platform is intended for use by working professionals in an employment context. We do not knowingly collect personal information from individuals under the age of 18. If you believe a minor's information has been submitted to us, please contact us so we can remove it.

13. Changes to This Policy

We may update this policy from time to time. When we do, we will update the 'Last updated' date at the top of this page and, where the changes are material, notify registered users by email. Continued use of the platform after notification constitutes acceptance of the revised policy.

14. Contact Us

For any privacy-related queries, requests, or concerns:

• IR Buddy
• Email: admin@irbuddy.co.za
• Website: irbuddy.co.za