Privacy policy

Who we are

VerityPay is a South African payroll and workforce administration service based in Cape Town. In this policy, “VerityPay”, “we”, “us” and “our” refer to the VerityPay contracting entity identified in the applicable quotation, order form or tax invoice.

This policy explains our processing as both a Responsible Party and an Operator under the Protection of Personal Information Act 4 of 2013 (POPIA). It does not replace an organisation's duties to its employees, applicants, contractors or other data subjects.

Our roles under POPIA

For employee, payroll, leave, performance, disciplinary, safety and similar workforce information entered by a customer, the customer is normally the Responsible Party and VerityPay is its Operator. We process that information to provide the service, on the customer's documented instructions and subject to our agreement with the customer.

VerityPay is a Responsible Party for information used for our own legitimate business purposes, including account administration, contracting, billing, security, support, service improvement and permitted communications. A person can therefore have rights against their employer, VerityPay, or both, depending on the information and purpose concerned.

Information we process

The exact information depends on the features a customer uses and the information it chooses or is required to record.

• Organisation information, including legal and trading names, registration details, addresses, payroll frequency, contacts, bank profile and SARS, UIF and SDL reference numbers.
• User and access information, including name, email address, organisation membership, role, authentication records, session information and security or audit events.
• Employee and applicant information, including names, identity or passport details, contact details, address, employment dates, position, remuneration, tax number, bank details and emergency or beneficiary information where supplied.
• Payroll and statutory information, including earnings, deductions, benefits, leave, time, expenses, loans, garnishees, tax directives, payslips, year-to-date values and submission or reconciliation records.
• HR records used by the customer, which may include onboarding, documents, employment letters, performance, disciplinary, training, employment-equity and occupational health and safety information.
• Billing, support and technical information, including subscription status, payment references, correspondence, device and browser information, IP address, diagnostic logs and integration activity.

Special personal information

Some payroll and HR functions may involve special personal information, including health information, trade union membership, race or ethnic origin, disability information or biometric information if a customer chooses to integrate it. Criminal-behaviour information may also appear in a lawful disciplinary or screening process.

Customers must have a lawful basis and any required authorisation before entering this information. VerityPay limits its processing to the contracted service, authorised support, security and legal compliance, and applies access controls appropriate to the sensitivity of the record.

Where information comes from

We receive information directly from customers, authorised users, employees using the portal, prospective customers, payment and identity providers, connected services and the devices used to access VerityPay. We may derive payroll totals, tax values, balances, alerts and audit records from information already held in the platform.

Customers are responsible for giving their data subjects an appropriate notice and for ensuring that information supplied to VerityPay is accurate, relevant, not excessive and lawfully obtained.

Why we process information

We process personal information only for identified and compatible purposes connected with operating VerityPay and the customer's lawful use of it.

• Providing payroll calculations, payslips, payment files, statutory outputs, employee self-service and the HR workflows selected by the customer.
• Creating accounts, authenticating users, enforcing role-based access, preventing abuse and maintaining an audit trail.
• Managing subscriptions, billing, customer support, service communications, integrations and contractual obligations.
• Maintaining, testing, securing and improving the service using information that is aggregated, minimised or de-identified where practicable.
• Complying with law, lawful process, regulatory obligations, record-keeping requirements and the establishment, exercise or defence of legal claims.
• Sending marketing to business contacts where permitted, subject to an effective opt-out and the direct-marketing requirements of POPIA.

Lawful justification and required information

Depending on the context, processing is justified by consent, performance of a contract, compliance with a legal obligation, protection of a legitimate interest, or the legitimate interests of VerityPay, the customer or a third party, balanced against the data subject's rights.

Certain information is necessary to provide payroll or meet statutory obligations. If required information is not supplied, VerityPay or the employer may be unable to create an account, calculate or pay payroll correctly, produce a statutory record, complete a requested transaction or provide a particular feature. Optional fields should be used only where the customer has an identified purpose.

Payroll calculations and automated processing

VerityPay uses configured rules and supplied data to calculate remuneration, deductions, tax, balances, warnings and reports. These are automated calculations, but customers remain responsible for reviewing inputs and outputs and for making employment, approval, release, disciplinary and other decisions that have legal or significant effects.

VerityPay does not make a solely automated decision to hire, dismiss, discipline or deny a workplace benefit. If a customer configures an integration or process that changes this position, the customer must assess and communicate the consequences required by law.

Who may receive information

Information is available to authorised users of the relevant customer according to their assigned roles. At the customer's instruction, information may be disclosed to employees, banks, SARS, the Unemployment Insurance Fund, benefit funds, unions, auditors, advisers, payroll bureaux and other authorised recipients.

We use contracted Operators for database hosting, cloud and application delivery, file handling, email delivery, authentication, billing, monitoring, support and security. Integrations selected by a customer, such as Stitch or Xero, receive the information necessary to perform the requested transaction. We require service providers to protect information, use it only for the agreed purpose and comply with applicable confidentiality and security obligations.

We may disclose information where required by law or lawful process, to protect rights or security, in connection with a corporate reorganisation subject to appropriate safeguards, or with the instruction or consent of the Responsible Party where required. We do not sell employee information or use it for third-party advertising.

South African hosting and cross-border processing

VerityPay's primary production database is hosted through Aiven for PostgreSQL on Amazon Web Services in the Cape Town region, South Africa (AWS af-south-1). This keeps the core customer database in South Africa under the current production configuration.

Some supporting providers or recipients may process limited information outside South Africa, for example where email delivery, application delivery, support, monitoring, payment services or a customer-selected integration uses international infrastructure. Where section 72 of POPIA applies, we rely on an adequate legal or contractual safeguard, consent, contractual necessity or another permitted ground. Internet routing may also cause encrypted traffic to pass through infrastructure outside South Africa without changing the configured location of the primary database.

Security safeguards

We maintain reasonable, appropriate technical and organisational safeguards having regard to the nature of the information, foreseeable risks and generally accepted information-security practices. No internet service can promise absolute security.

• Encryption in transit and application-layer encryption for sensitive identifiers, bank details and supported integration credentials.
• Organisation-scoped data access, role-based permissions and separation of sensitive payroll actions.
• Authentication controls, security logging, audit records and controlled administrative access.
• Managed infrastructure, backups, maintenance, vulnerability response and incident-handling procedures.
• Contractual confidentiality and data-protection duties for personnel and service providers with access to information.

Security incidents

If there are reasonable grounds to believe that personal information has been accessed or acquired by an unauthorised person, we investigate, contain and remediate the incident. Where VerityPay acts as an Operator, we notify the affected Responsible Party without undue delay and provide information reasonably needed for its assessment and notifications.

Where VerityPay is the Responsible Party, we notify the Information Regulator and affected data subjects as soon as reasonably possible where POPIA requires it, taking account of any lawful delay requested by law-enforcement authorities and the content and method of notice required by section 22.

How long we keep information

We keep personal information only for as long as it is needed for the purpose for which it was collected, the customer's documented instructions, an applicable contract, statutory record-keeping, dispute resolution, fraud prevention, security, backup integrity or another lawful ground.

Payroll, tax, employment, payment and audit records may need to be retained after employment or a subscription ends. A deletion request does not override a legal duty or lawful need to retain a record. When retention is no longer justified, information is deleted, de-identified or placed beyond ordinary use, subject to secure backup rotation and technical constraints. Customers control the retention of workforce information while their account is active, subject to product controls and law.

Cookies and similar technology

VerityPay uses cookies and similar browser storage needed for authentication, session security, user preferences, fraud prevention and reliable operation. These technologies may remember that a user is signed in, preserve a selected organisation and protect an account from unauthorised requests.

We do not currently use third-party advertising cookies on the VerityPay service. Blocking essential cookies may prevent sign-in or other core functions. If we introduce optional analytics or marketing technology, we will update this policy and provide any choice required by law.

Direct marketing

We may send product information to existing business customers about our own similar services where permitted, or to another person where we have the consent or other authority required by law. Every qualifying marketing message provides a reasonable way to opt out. Service, billing, security and legal notices are not marketing and may still be sent where needed to operate the account or perform the contract.

You can object to direct marketing or withdraw marketing consent at any time by using the message's unsubscribe facility or emailing us. We may keep a minimal suppression record so that the opt-out is respected.

Your rights

Subject to POPIA, PAIA and other applicable law, a data subject may ask whether personal information is held, request access to it, request correction or deletion of inaccurate, irrelevant, excessive, outdated, incomplete, misleading or unlawfully obtained information, object to certain processing, withdraw consent where consent is the basis, and lodge a complaint.

Rights are not absolute. Access may require proof of identity, a prescribed process or fee, and a request may be limited where another person's rights, confidentiality, legal privilege, statutory retention or a lawful ground for refusal applies. We will explain the outcome or route the request to the relevant Responsible Party where appropriate.

How to make a request or complaint

Employees should normally contact their employer's HR team or Information Officer first, because the employer controls its workforce records. For information for which VerityPay is the Responsible Party, or for help routing a request, email hello@veritypay.co.za. Describe the information and right concerned, and do not send passwords or unnecessary identity documents until a secure verification method is provided.

You may also lodge a POPIA complaint with the Information Regulator (South Africa). We encourage you to raise the concern with the relevant Responsible Party first so that it has an opportunity to investigate and respond.

Children and employee dependants

The VerityPay service is not directed to children as customers or general website users. A customer may lawfully record limited information about an employee's child or dependant for payroll, benefit, tax, leave or employment administration. The customer is responsible for the required authority and for limiting the record to what is necessary.

Changes to this policy

We may update this policy to reflect changes to the service, providers, law or our processing. The effective date appears at the top. If a change materially affects how we use personal information, we will provide a reasonable notice through the service, email or another appropriate channel before or when the change takes effect, unless urgent legal or security circumstances require otherwise.

Continued use of the service after an update does not remove any consent or other protection required by law. Earlier versions may be requested where reasonably available.