5-point verification
Chapter 14 · Privacy Policy

What we know, what we keep, and why.

Verification is a privacy business before it is a trust one. This policy describes — in full — what we collect, how we use it, and the rights you hold over it under POPIA.

Last updated · May 2026
Hustla · Volume IV — LegalPOPIA · GDPR-aligned
Preamble

A verification platform asks workers to hand over their most sensitive information — their ID number, their criminal history, their fingerprints in everything but name. This document is the promise we make in return.

Reading time
~9 minutes
Sections
12 · numbered 01–12
Governing law
Republic of South Africa
01
Section 01

Who we are

This policy is published by Thought Into Reality (Pty) Ltd, a company registered in the Republic of South Africa with the Companies and Intellectual Property Commission (CIPC), trading as Hustla. Hustla is a verification publisher and platform operating in South Africa, with technical operations supported by our parent company, iDeployed UG (haftungsbeschränkt), based in Leipzig, Germany.

When this policy refers to "we", "us" or "Hustla", it refers to Thought Into Reality (Pty) Ltd in its capacity as the responsible party under the Protection of Personal Information Act, 2013 ("POPIA"). iDeployed UG acts as an operator on our behalf for hosting, security and engineering services, and is bound to us by a written processing agreement.

Responsible party
Trading name
Hustla
Legal entity
Thought Into Reality (Pty) Ltd
Registration
CIPC, Republic of South Africa
Registered address
Atrium on 5th, 9th Floor, 5th Street, Sandton, Johannesburg, 2196
Parent company
iDeployed UG (haftungsbeschränkt), Leipzig, Germany
Information Officer
[email protected]
02
Section 02

Information we collect

We collect only what is needed to verify a worker, match them with an employer, and keep a defensible record of the relationship. The categories below are exhaustive — if a category is not listed here, we do not collect it.

Categories collected
Identity
Full name, South African ID number or work-permit number, nationality, date of birth, and a recent profile photograph.
Contact
Phone number, email address, city of residence, and (where required for verification) a confirmed home address.
Verification
Criminal-record check results obtained via the South African Police Service (SAPS), ID and work-permit confirmation from the Department of Home Affairs (DHA), background-check results from MIE or an equivalent accredited provider, and signed references from previous employers.
Work history
Previous employers, dates of service, job categories, languages spoken, and any relevant certifications.
Account & device
Login credentials (hashed), session metadata, device type, browser, IP address and approximate location at sign-in, and cookies (see Section 09).
Communications
Messages you send to us via email, contact forms, or in-platform support, and our replies.

We do not collect biometric data beyond the profile photograph required for ID matching, and we do not collect special personal information about religion, political opinion, sexual orientation or health under any circumstances.

03
Section 03

Why we collect it

Every piece of information we hold corresponds to a specific, lawful purpose under section 11 of POPIA. We collect personal information for one or more of the following reasons:

Lawful purposes
Verification
To run the five-point check — SAPS criminal record, DHA identity and work-permit, PSiRA status (where relevant), references, and right-to-work — and produce the signed verification file we issue to the worker.
Matching
To make a worker's profile findable by employers looking for that category of work, in that location, in the language they speak.
Account integrity
To keep accounts secure, prevent fraudulent verifications, and ensure that the person logging in is the person who registered.
Legal obligation
To comply with POPIA, the Private Security Industry Regulation Act, the Financial Intelligence Centre Act, and any lawful request from a regulator or court of competent jurisdiction.
Legitimate interest
To improve our service, debug errors, and run aggregated, anonymous analytics — always with the minimum information needed, and never to make automated decisions about individuals.
04
Section 04

How we use your information

A worker's verified file is held by the worker. We act as a custodian: we issue it, we store the canonical copy, and we present it to an employer only when the worker explicitly grants access for a specific hiring engagement.

Employers see a worker's name, photograph, work category, languages, verified-by-Hustla badge, and the date their last check cleared. They do not see the underlying check documents unless the worker chooses to share them, and even then access is logged, time-limited, and revocable.

We use aggregated, anonymous statistics — for example, the total number of workers verified in a given quarter — in our public reporting and in this policy. Aggregate figures cannot be traced back to any individual.

We do not sell personal information. We do not run third-party advertising on the platform. We do not pass worker data to recruiters, insurance underwriters or credit bureaus under any circumstances.

We do not subject any data subject to automated decision-making that has legal or similarly significant consequences. Every verification outcome is reviewable by a human analyst, and every dispute is handled by a human.

05
Section 05

Who we share it with

Sharing happens only where the law allows it and the purpose requires it. The list below is exhaustive.

Recipients
SAPS
The South African Police Service, for criminal-record checks. We submit the minimum personal information required and receive a result.
DHA
The Department of Home Affairs, for identity and work-permit verification.
MIE (or equivalent)
Managed Integrity Evaluation, or an equivalent accredited background-check provider, for the integrated five-point screening. Provider is disclosed on the worker's verification file.
Employers
When a worker grants explicit, revocable access for a hiring engagement. We log the access, notify the worker, and the worker may withdraw consent at any time.
Resend
Our transactional email delivery provider, for account, verification and support emails. Resend processes message content and recipient address only.
Google Cloud Platform
Our infrastructure provider, for hosting, storage, and platform telemetry. GCP processes data on our written instructions only.
iDeployed UG
Our parent company in Leipzig, Germany, acting as an operator for engineering and security services under a written processing agreement.
Regulators & courts
The Information Regulator, PSiRA, SARS and any court of competent jurisdiction, where required by a lawful order or statutory duty.
Successors
In the event of a sale, merger or restructure of Hustla, the new responsible party — and only on the same terms as this policy.

iDeployed UG is located in Germany, a jurisdiction recognised by the Information Regulator as providing an adequate level of data protection. Transfers to iDeployed UG, and to Google Cloud Platform regions outside South Africa, are governed by standard contractual clauses and a written processing agreement that binds the operator to POPIA-equivalent obligations.

06
Section 06

How long we keep it

Personal information is retained only for as long as is required for the purpose it was collected, or as required by law. The schedule below sets out the periods we apply.

Retention schedule
Active worker profile
For the duration of the account. Deleted within 30 days of account closure (see "Deleted accounts" below), subject to the verification-record hold.
Verification records
Five years from the date of the check, in line with PSiRA record-keeping rules and the Private Security Industry Regulation Act.
Contact messages
Two years from the date of the message.
Audit logs
Seven years, for POPIA compliance, fraud prevention, and dispute resolution.
Deleted accounts
Held in a restricted, isolated environment for 30 days following the deletion request, then purged irrevocably. Verification records subject to the five-year hold are minimised but retained until the hold falls away.
Marketing consents
Until withdrawn, plus a record of the withdrawal kept for three years.

Where we are obliged to keep information beyond the active life of an account — for instance, under a regulatory or tax hold — we restrict access to it, isolate it from production systems, and delete it as soon as the obligation falls away.

07
Section 07

Your rights under POPIA

The Protection of Personal Information Act gives every data subject a defined set of rights. We are obliged to respect them, and we do.

Your rights
Right of access
You may ask for a copy of the personal information we hold about you, free of charge for the first request in any twelve-month period.
Right to correct or update
You may correct any information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or unlawfully obtained.
Right to delete (right to erasure)
You may ask us to delete information that we are no longer obliged to keep. Where a legal hold applies, we will tell you which information is held and delete the rest.
Right to object to processing
You may object, on reasonable grounds, to the processing of your personal information for any purpose other than a statutory one.
Right to withdraw consent
Where processing relies on your consent, you may withdraw it at any time. Withdrawal does not affect the lawfulness of processing that took place before it.
Right to lodge a complaint
You may complain to the Information Regulator of South Africa at any time, with or without first contacting us — see Section 12.

To exercise any of these rights, write to [email protected] with the subject line "POPIA request". We respond within 30 calendar days. If we need longer — for instance, because the request is complex or involves third parties — we will tell you why and how long it will take.

08
Section 08

Data security

Verification only matters if the underlying record is secure. We apply technical, organisational and procedural safeguards that meet or exceed POPIA section 19 requirements.

Safeguards
Encryption
All personal information is encrypted in transit (TLS 1.3) and at rest (AES-256). Verification documents are stored in an isolated bucket with restricted access keys, separate from the application database.
Access control
Production systems are accessible only via single sign-on with hardware-key second factor. Access is granted on a least-privilege basis and reviewed quarterly.
Audit logging
Every read of a verification file is logged with the operator's identity, the time, the IP address and the business reason. Logs are immutable and retained for 24 months in addition to the seven-year audit-log schedule in Section 06.
Incident response
We test our breach-response plan twice a year. In the event of a compromise affecting personal information, we will notify the Information Regulator and any affected data subjects without undue delay, as required by POPIA section 22.
Third-party review
Our security posture is independently reviewed annually, and the summary report is published in our transparency note.
09
Section 09

Cookies

We use cookies sparingly, and only where they have a clear functional purpose. We do not use third-party advertising cookies, we do not run cross-site trackers, and we do not share cookie data with marketing networks.

Cookies we set
Strictly necessary
Authentication, session, CSRF protection. Expire when you log out or close the browser. Cannot be disabled — the platform does not function without them.
Preferences
Language, region, accessibility settings. Expire after 12 months. Can be cleared in your account settings at any time.
Analytics (first-party)
Privacy-preserving usage statistics, aggregated server-side. No third-party trackers, no advertising identifiers. Expire after 12 months.

You may refuse non-essential cookies via the banner shown on your first visit, or change your choice in account settings at any time. Disabling preferences cookies will not stop you from using the platform; it will simply reset your settings on each visit.

10
Section 10

Children’s privacy

Hustla is not for children. We do not knowingly collect personal information from anyone under the age of 18, and we do not permit registration as a worker or as an employer by anyone under 18.

If we learn that we have inadvertently collected personal information about a person under 18, we delete it immediately and notify the responsible adult where one can be identified. If you believe a minor has registered, write to [email protected] and we will act on the same day.

11
Section 11

Changes to this policy

We update this policy when our practices change, when the law changes, or when we improve a description we think is unclear. Every change is dated, and the previous version is archived and available on request.

Material changes — a new purpose, a new recipient, or a meaningful shift in retention — are communicated in advance by email to all registered users, at least 30 days before they take effect. Trivial wording changes are not communicated individually; the "Last updated" stamp at the top of this page is the canonical record.

12
Section 12

Contact & complaints

If you have a question about this policy, or you want to exercise a right under POPIA, write to our Information Officer.

Information Officer
Postal
Atrium on 5th, 9th Floor, 5th Street, Sandton, Johannesburg, 2196
Responsible party
Thought Into Reality (Pty) Ltd
Reference
Privacy / POPIA query

If you are not satisfied with our response, or you believe we have processed your personal information unlawfully, you may lodge a complaint with the Information Regulator of South Africa at any time, with or without first contacting us.

Information Regulator (South Africa)
Website
www.inforegulator.org.za
Telephone
010 023 5207
— Thought Into Reality (Pty) Ltd|Information Officer · Sandton, May 2026End of chapter 14