How Hustla meets its obligations under the Protection of Personal Information Act (Act 4 of 2013). A standing statement of the conditions, safeguards and rights that govern every record we hold.
Verification is, by its nature, a high-trust act. To do it well, we hold information that most platforms will never touch — South African ID numbers, criminal-record clearances, immigration status, biometric photographs. This statement sets out, in plain English, how we comply with the Protection of Personal Information Act and the Promotion of Access to Information Act when handling that information. It is reviewed annually, and at any time the law or our practices materially change.
Hustla processes special and sensitive personal information as a routine part of its business. South African ID numbers, criminal-record results returned by SAPS, work-permit and immigration status returned by the Department of Home Affairs, and biometric facial photographs all pass through our systems. Without that information we cannot verify a worker; with it, we accept obligations that go beyond those of an ordinary platform.
We treat POPIA not as a paperwork exercise but as the governing framework for the entire product. Every collection point, every storage decision, every access by an operator and every transfer outside South Africa is mapped against the Act before it is permitted. This statement is the public version of that internal mapping.
This statement is reviewed and republished at least once every twelve months, and immediately on any material change in the law, our processing, or our sub-processor arrangements. The "Last updated" stamp at the top of the page is the canonical record of the current version.
Under Section 1 of POPIA, the responsible party is the person or entity that, alone or in conjunction with others, determines the purpose of and means for processing personal information. For everything Hustla does, that is Thought Into Reality (Pty) Ltd.
iDeployed UG (haftungsbeschränkt), the parent company of Thought Into Reality and based in Leipzig, Germany, acts as an operator on our behalf. It provides engineering, hosting orchestration and security services and processes personal information only on documented instructions from us. The relationship is governed by a written data processing agreement that satisfies Section 21 of POPIA and the requirements of the EU General Data Protection Regulation. The agreement is available on request to the Information Officer.
The Information Officer is presently held on an interim basis by the founding team and reachable at the address above. A permanent appointment, registered with the Information Regulator under Section 55 of POPIA, will be announced on this page when it takes effect.
Sections 8 to 25 of POPIA set out eight conditions that all processing of personal information in South Africa must satisfy. Each one places a specific duty on the responsible party. This section explains how Hustla meets each condition in practice — not by quoting the Act, but by describing the controls we apply.
Section 26 of POPIA prohibits the processing of special personal information except where one of the grounds in Section 27 applies. Hustla relies on Section 27 to process the categories below — each one is essential to verification and cannot be replaced by a less sensitive alternative.
No special personal information is processed without one of the grounds in Section 27 being recorded against it in our internal compliance register. We do not process religious or philosophical beliefs, race, political persuasion, trade-union membership, health, sex life or sexual orientation under any circumstances.
Section 72 of POPIA restricts the transfer of personal information outside South Africa. A transfer is only lawful where the recipient is subject to a law, binding corporate rules or binding agreement that provides an adequate level of protection, where the data subject has consented, or where one of the other grounds in Section 72 applies. Every transfer Hustla makes is mapped against that test.
No personal information is transferred outside South Africa other than as set out above. Each recipient is bound by a written agreement that obliges it to process the information only on our instructions, to apply controls equivalent to ours, and to return or destroy the information at the end of the engagement. The full agreements are available to the Information Regulator on request.
Section 19 of POPIA requires the responsible party to secure the integrity and confidentiality of personal information by taking appropriate, reasonable technical and organisational measures. The measures we apply are set out below. They are reviewed at least annually and are subject to an independent third-party assessment.
POPIA grants every data subject a defined set of rights over their personal information. Hustla is obliged to give effect to those rights, and the procedure below sets out exactly how to exercise them.
To submit any of the above, write to [email protected] with the subject line "POPIA Request" and tell us which right you wish to exercise and what information the request relates to. We will acknowledge your request within five business days and respond in full within 30 calendar days. Where a request is unusually complex, we will tell you within the same 30 days why a longer period is needed and how long it will take.
Section 14 of POPIA prohibits the retention of personal information for longer than is necessary for the purpose for which it was collected, unless retention is required by law, reasonably required for a lawful purpose related to a function or activity, or agreed to by the data subject. The schedule below sets out the periods we apply, and our destruction process.
Destruction is by secure cryptographic purge: the encryption keys protecting the information are destroyed, rendering the underlying data unrecoverable, and the storage location is then overwritten. Destruction is logged with the time, the operator and the basis for the action. Where the law obliges us to keep information beyond the active life of an account, we restrict access to it, isolate it from production systems, and delete it as soon as the obligation falls away.
The Promotion of Access to Information Act (Act 2 of 2000) gives every person the right to request access to records held by a private body where the record is required for the exercise or protection of a right. Section 51 of PAIA requires Hustla to publish a manual describing the records we hold and the procedure for requesting access to them.
Hustla’s PAIA Manual is available free of charge on request to the Information Officer. The manual sets out the categories of records we hold, the subjects on which we hold them, the prescribed request form, the fees that apply, and the grounds on which we may refuse a request.
All POPIA correspondence — requests, complaints, notifications, queries — should be addressed to the Information Officer at the details below. We acknowledge every message within five business days and resolve substantive matters within 30 calendar days.
If you are not satisfied with our response, or you believe we have processed your personal information unlawfully, you have the right under Section 74 of POPIA to lodge a complaint with the Information Regulator of South Africa.
A complaint to the Regulator should set out the conduct complained of, the personal information affected, the steps already taken with the responsible party, and the outcome the complainant seeks. The Regulator will assess the complaint, may conduct an investigation, and may issue an enforcement notice under Section 95 of POPIA where it finds interference with the protection of personal information.