PAIA Manual
PROMOTION OF ACCESS TO INFORMATION ACT MANUAL
In terms of Section 51 of the Promotion of Access to Information Act 2 of 2000 (PAIA), as read with the Protection of Personal Information Act 4 of 2013 (POPIA)
| Company Name | Humanly |
|---|---|
| Registration Number (US EIN) | 84-1778718 |
| Physical Address | 10900 NE 8th St, Suite 200, Bellevue, WA 98004, United States |
| South African Contact Address | N/A |
| Website | https://humanly.io |
| support@humanly.io | |
| Phone | +1 425 696 0670 |
Disclaimer: This manual is provided for informational purposes in terms of PAIA and POPIA. It does not constitute legal advice. Humanly recommends that requesters and data subjects obtain independent legal advice where necessary.
Part A: Introduction
1. Purpose of This Manual
This manual has been compiled in accordance with Section 51 of the Promotion of Access to Information Act, 2 of 2000 (PAIA) and the requirements of the Protection of Personal Information Act, 4 of 2013 (POPIA).
It is intended to:
- Foster a culture of transparency and openness in how Humanly holds and processes information;
- Inform data subjects and requesters of the types of records held by Humanly; Set out the process by which individuals may request access to records;
- Describe how Humanly protects personal information in accordance with
- POPIA; and
- Explain the rights available to data subjects under POPIA.
This manual is available free of charge and will be updated as required. The most current version will be published on Humanly's website.
2. About Humanly
Humanly is a human resources technology company that provides recruitment and hiring support services to corporate clients (employers). Our core services include:
- Conducting initial candidate engagement via chat, SMS, phone, and video interview platforms;
- Collecting, processing, and evaluating candidate information for the purpose of job applications;
- Submitting applications and candidate profiles to prospective employers on behalf of candidates; and
- Providing related recruitment process outsourcing (RPO) and talent acquisition services.
In the course of providing these services, Humanly collects and processes personal information about job candidates, employees of client organizations, and representatives of corporate clients.
Part B: Information Officer Details
3. Information Officer
In terms of POPIA, every responsible party must designate an Information Officer (IO) responsible for ensuring compliance with POPIA and for handling PAIA requests. By default, the Information Officer is the head of the organization unless a deputy has been formally designated and registered.
| Information Officer Name | Bryan Leptich |
|---|---|
| Title / Position | Chief Technical Strategist |
| Email Address | support@humanly.io |
| Telephone Number | +1 425 696 0670 |
| Postal Address | 10900 NE 8th St, Suite 200, Bellevue, WA 98004, United States |
Note: The Information Officer has been registered with the Information
Regulator of South Africa as required under POPIA. All PAIA requests and
POPIA-related queries should be directed to the Information Officer using the contact details above.
Part C: The Information Regulator
5. Information Regulator of South Africa
The Information Regulator oversees the enforcement of both PAIA and POPIA. Data subjects who wish to lodge a complaint regarding Humanly's processing of their personal information, or requesters who wish to appeal a refusal of access, may contact the Information Regulator.
Information Regulator (South Africa)
Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191 Telephone: 010 023 5200
Email: enquiries@inforegulator.org.za
Website: inforegulator.org.za
Part E: Records Held By Humanly
6. Categories of Records
Humanly holds records across the following categories in the ordinary course of its business. Where records contain personal information, they are processed and held in accordance with POPIA.
6.1 Candidate Records
These are records relating to individuals who engage with Humanly for
recruitment or job application purposes.
| Category | Examples of Records |
|---|---|
| Identity and Contact Information | Full name, date of birth, nationality, email address, phone number |
| Professional and Employment History | CV/résumé, previous employer names, job titles, dates of employment |
| Qualifications and Credentials | Educational certificates, professional licenses, accreditation documents, transcripts |
| Application Materials | Cover letters, application forms, employer submitted documents, draft and final job applications |
| Interview and Assessment Records | Chat transcripts, phone call recordings, video interview recordings, assessment scores, recruiter notes and evaluations |
| Sensitive / Special Category Information | Where voluntarily provided or required by law: disability status, health information relevant to role requirements, demographic data for equity reporting |
| Category | Examples of Records |
| Correspondence | Email, chat, and messaging records between candidates and Humanly staff |
| Consent Records | Records of consent given by candidates for processing, including consent to record conversations |
6.2 Client (Employer) Records
These are records relating to corporate clients who engage Humanly to provide recruitment services on their behalf.
| Category | Examples of Records |
|---|---|
| Company Information | Registered company name, registration number, VAT number, physical and postal addresses |
| Contact Person Information | Names, job titles, email addresses, and telephone numbers of client representatives |
| Contractual Records | Service agreements, statements of work, NDAs, SLAs, correspondence |
| Job Vacancy Information | Job descriptions, role requirements, salary bands, hiring manager notes |
| Billing and Payment Records | Invoices, payment records, purchase orders |
7. Records Available Without a Formal PAIA Request
The following information is made freely available by Humanly and does not require a formal PAIA request:
- This PAIA Manual (available on Humanly's website)
- Humanly's Privacy Notice / Policy (available on Humanly's website)
- General company information (name, registration, contact details)
8. Records Subject to a Formal PAIA Request
All other records held by Humanly are subject to a formal PAIA request process as described in Part F below. Access may be granted, restricted, or refused
depending on the nature of the records and applicable grounds for refusal under PAIA.
Part F: How to Request Access To Records
9. Procedure for Requesting Access
Any person (the "requester") may submit a formal request for access to records held by Humanly by following the steps below.
Step 1 - Complete the Prescribed Request Form
Requests must be submitted using the prescribed PAIA Form C (available from the SAHRC website and from Humanly's Information Officer upon request). Requests must include:
- The requester's full name, contact details, and capacity (e.g. data subject, authorized representative)
- A description of the records requested
- The form in which access is required (e.g. copy, inspection)
- If the requester is acting on behalf of another person, proof of authority
Step 2 – Submit the Request to the Information Officer
Submit the completed form to the Information Officer via:
Email: support@humanly.io
Post: 10900 NE 8th St, Suite 200, Bellevue, WA 98004, United States
Step 3 – Pay the Request Fee (if applicable)
A request fee of R50 is payable by requesters who are not the data subject (i.e. third-party requesters), before the request is processed.
No request fee is payable by the data subject requesting their own personal information.
If access is granted, an access fee reflecting the cost of reproduction and/or search may also be charged in accordance with the PAIA Regulations.
Step 4 – Await a Decision
Humanly will respond to a request within 30 days of receipt of the completed form (and payment of any applicable fee). This period may be extended by a further 30 days in exceptional circumstances, with written notice to the requester.
The response will:
- Grant the request (in full or in part);
- Refuse the request (with written reasons); or
- Request clarification if the request is unclear.
10. Grounds for Refusal of Access
Humanly may refuse access to records on the following grounds as provided in PAIA:
- Protection of third-party personal information — where disclosure would unreasonably infringe on another person's privacy
- Protection of commercially sensitive information — trade secrets, financial or business information supplied in confidence
- Legal privilege — records subject to attorney-client privilege
- Safety of individuals or public — information that could endanger a person's safety
- Confidential third-party information — information about a third party
- supplied in confidence
- Operations of Humanly — records whose disclosure would cause substantial harm to Humanly's operations or negotiations
- Records that do not exist or cannot be found — after all reasonable steps have been taken
Where a request is refused, Humanly will provide written reasons, and the requester may lodge an internal appeal or approach the Information Regulator.
Part G: POPIA — Data Subject Rights and Processing Information
11. Basis for Processing Personal Information
Humanly processes personal information on one or more of the following lawful bases under POPIA:
| Lawful Basis | Application to Humanly |
|---|---|
| Consent | Candidates consent to their information being collected, processed, and submitted to prospective employers; consent to call and video recording |
| Contractual necessity | Processing necessary to perform services under a recruitment agreement with a candidate or client |
| Legitimate Interest | Processing for internal quality assurance, training of staff, and service improvement |
| Legal Obligation | Retention of records required by applicable South African law (e.g. tax, employment equity) |
12. Purposes of Processing
Humanly processes personal information for the following purposes:
- Conducting initial candidate screening via chat, phone, and video interview Evaluating candidate suitability for specific roles
- Preparing and submitting job applications on behalf of candidates
- Communicating with prospective employers about candidate profiles
- Managing ongoing candidate relationships and pipelines
- Improving and developing our technology and processes
- Complying with legal and regulatory obligations
- Responding to PAIA requests and data subject rights exercises
13. Special Categories of Personal Information
Where Humanly processes special categories of personal information (e.g. disability status, health information for workplace accommodation purposes, or demographic data for employment equity reporting), this is done:
- Only with the explicit consent of the data subject, or
- Where required by law (e.g. Employment Equity Act reporting obligations), or
- Where processing is necessary for the establishment, exercise, or defense of a right or obligation in law
Candidates will always be informed when special category data is being collected and for what purpose.
14. Cross-Border Transfers of Personal Information
Humanly's services involve the use of cloud infrastructure and third-party technology platforms. As a result, some personal information may be temporarily processed outside South Africa as part of real-time data operations (e.g. live transcription, AI-assisted screening). However, all permanent storage and archival of personal information takes place within South Africa.
Humanly ensures that cross-border transfers comply with POPIA by ensuring that recipient parties:
- Are subject to a law, binding corporate rules, or binding agreements that provide an adequate level of protection substantially similar to POPIA; or
- Are contractually bound to process the information in accordance with standards equivalent to POPIA.
A record of all cross-border transfer arrangements is maintained by the
Information Officer.
15. Retention and Deletion of Records
Humanly retains personal information only for as long as necessary to fulfill the purposes for which it was collected, or as required by applicable law. General retention guidelines are as follows:
| Record Type | Retention Period |
|---|---|
| Candidate records | Duration of client contract, or as long as there is a business or legal reason to do so |
| Call and interview recordings | Duration of client contract, or as long as there is a business or legal reason to do so |
| Client records | Duration of client contract |
| Financial records | Permanent |
Upon expiry of the applicable retention period, personal information is securely deleted or anonymized.
16. Data Subject Rights Under POPIA
Data subjects whose personal information is held by Humanly have the following rights, which may be exercised by contacting the Information Officer:
| Right | Description |
|---|---|
| Right of Access | Request confirmation of whether Humanly holds your personal information and obtain a copy |
| Right to Correction | Request correction of inaccurate, irrelevant, excessive, outdated, or misleading information |
| Right to Deletion | Request deletion or destruction of personal information where it was unlawfully collected or is no longer necessary |
| Right to Object | Object to the processing of your personal information on reasonable grounds |
| Right to Opt Out of Direct Marketing | Withdraw consent for marketing communications at any time |
| Right not to be subject to automated decision-making | Request human review of decisions made solely on automated processing that significantly affect you |
Requests to exercise any of the above rights should be submitted in writing to the Information Officer. Humanly will respond within 30 days.
17. Security Safeguards
Humanly implements appropriate technical and organizational measures to protect the personal information it holds, including but not limited to:
- Encrypted storage and transmission of personal data
- Role-based access controls limiting access to authorized personnel only
- Secure handling and storage of conversation recordings (chat, telephone, video)
- Regular staff training on data protection obligations
- Data processing agreements with all third-party operators
- An internal data breach response procedure
18. Data Breach Notification
In the event of a data breach that affects personal information, Humanly will:
- Notify the Information Regulator as soon as reasonably possible after becoming aware of the breach; and
- Notify affected data subjects as soon as reasonably possible where the breach may result in serious harm.
Notifications will include the nature of the breach, the personal information involved, recommended protective steps, and contact details for further enquiries.
Part H: General
19. Updating This Manual
This manual will be reviewed and updated at least annually, or sooner if there are material changes to Humanly's operations, the law, or the Information Regulator's guidance. The current version will always be available on Humanly's website and from the Information Officer upon request.
20. Availability of This Manual
This manual is available:
- On Humanly's website at https://humanly.io
- In Humanly's offices upon request
- From the Information Officer upon written request