Privacy Policy

Who we are

Rovuwa Holdings (Pty) Ltd is the responsible party for the personal information described in this policy. That is the term POPIA uses for the organisation that decides why and how your information is processed.

Our Information Officer is registered with the Information Regulator and is accountable for how we handle personal information, for responding to your requests, and for our compliance with POPIA and the Promotion of Access to Information Act.

What personal information we collect

We only collect what we actually need. What that amounts to depends on your relationship with us.

If you contact us through this website

• Your name, company name, email address and telephone number
• The service area you selected and whatever you chose to write in your message
• The date and time of the enquiry, and the consent you gave when submitting it

If you apply for a role or an internship

• Identity details: your name, South African ID number or passport number and nationality, and work permit status where relevant
• Contact details: email address, mobile number, province and city
• Employment and education history, certifications, notice period, salary expectation where you chose to give one, driver's licence details and availability for standby work
• Documents you upload: your CV, a copy of your ID or passport, academic transcripts, certificates and references
• Any accommodations you tell us you need during recruitment, which may include health or disability information

If you register as a supplier or subcontractor

• Company details: registered and trading name, registration number, VAT number, B-BBEE contributor level and CSD supplier number
• Business information: services offered, provincial coverage, staff numbers, turnover band, insurance cover and public sector track record
• Contact details for your nominated representative
• Documents you upload: company profile, B-BBEE certificate or sworn affidavit, tax clearance, CIPC and CSD documents

Collected automatically when you browse

• Your IP address, browser type and operating system, and the pages you visited
• Cookie identifiers, but only in the categories you have agreed to — see our Cookie Notice

Why we process it

Our lawful basis for processing

POPIA requires a justification for every act of processing. We rely on the following:

• Your consent — for optional things such as keeping your CV on file for future roles, sending you updates, and setting non-essential cookies. You can withdraw consent at any time, and withdrawing it does not affect anything we lawfully did before you withdrew it.
• Performance of a contract — where we need your information to do work you or your employer engaged us for, or to conclude an employment or supply agreement with you.
• A legal obligation — where tax, labour, company or B-BBEE legislation requires us to collect and keep records.
• Our legitimate interests — for example securing our network, preventing fraudulent form submissions and maintaining business records, where those interests are not outweighed by your rights.

Special personal information and children

Some categories carry extra protection under POPIA. We handle them as follows:

• Criminal record checks are carried out only where a role genuinely requires it, such as roles with access to client control rooms or secure sites, and only with your separate written consent.
• Health or disability information is processed only if you volunteer it, and only to make our recruitment process accessible to you or to meet occupational health obligations. Telling us never counts against an application.
• Race is processed only where we are legally required to report it under employment equity or B-BBEE legislation, and only in aggregate for that purpose.
• Biometric information is processed only where a client site requires biometric access control, under that client's own arrangements, and never for our own marketing purposes.

Who we share it with

We share personal information only where there is a reason to, and we require anyone who receives it to protect it to the same standard we do.

• Our technology partners and operators — email, hosting, backup and security providers who process information on our behalf under written agreements that restrict what they may do with it.
• Verification agencies — accredited providers who confirm qualifications, employment history and criminal records, where you have consented.
• Clients — where we place a technician on a client site and that client requires vetting or site access details. We tell you when this applies.
• Professional advisors — auditors, attorneys and B-BBEE verification agencies, bound by professional confidentiality.
• Law enforcement and regulators — where we are legally compelled, or where it is necessary to establish, exercise or defend a legal claim.

Cross-border transfers

Some of the services we use, such as email and cloud hosting, may store information on servers outside South Africa. Section 72 of POPIA allows this only under specific conditions. Where information leaves the country we satisfy ourselves that the recipient is subject to a law, binding corporate rules or a binding agreement that provides an adequate level of protection, upholds the POPIA conditions for lawful processing, and includes comparable restrictions on onward transfer.

How long we keep it

When a retention period ends we delete the information or de-identify it so it can no longer be linked to you. Where a record is subject to a legal hold, we keep it until the matter is resolved.

How we protect it

Section 19 of POPIA requires appropriate, reasonable technical and organisational measures. Ours include:

• Encryption of data in transit using TLS across this website and our application forms
• Uploaded documents stored outside the public web root, with randomised filenames, so they cannot be reached by guessing a web address
• Role-based access, so recruitment files are visible only to the recruitment team and vendor files only to procurement
• Multi-factor authentication on administrative accounts
• Rate limiting, honeypot fields and challenge questions on public forms to block automated abuse
• Monitored backups, patch management and periodic review of who has access to what

No system is perfectly secure, but we test and review these measures regularly and adjust them as risks change.

If something goes wrong

If personal information under our control is accessed or acquired by an unauthorised person, section 22 of POPIA requires us to notify the Information Regulator and the affected people as soon as reasonably possible after discovering it. Our notification will describe what happened, the likely consequences, what we have done in response and what you can do to protect yourself.

Your rights

POPIA gives you the following rights, free of charge unless a request is manifestly excessive:

1. To be told whether we hold personal information about you, and to be given a description of it.
2. To access a copy of that information, subject to the procedures in the Promotion of Access to Information Act. A prescribed fee may apply to copies.
3. To correct or delete information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or obtained unlawfully.
4. To object to processing that we base on legitimate interests, on reasonable grounds relating to your situation.
5. To withdraw consent at any time where our processing relies on your consent.
6. To object to direct marketing at any time. Electronic marketing under section 69 is sent only to people who have asked for it or who are existing customers, and every message includes an unsubscribe option.
7. Not to be subject to a decision based solely on automated processing that has a legal effect on you. We do not make hiring or vendor decisions by automated means — a person reviews every application.
8. To complain to the Information Regulator, and to seek civil relief in court.

How to exercise a right

Email info@rovuwah.co.za with the subject line "POPIA request", telling us what you want and enough detail for us to identify your records. We may ask you to verify your identity before we act, so that we do not disclose your information to someone else. Requests to access or correct information are made on the prescribed forms, which we will send you on request, and we respond within 30 days. If we need longer we will tell you why before that period expires.

Cookies

This website sets strictly necessary cookies that keep it working, and optional cookies only once you have agreed to them. You can change your choices at any time using the cookie settings link, which also appears in the footer of every page. Full detail is in our Cookie Notice.

Children

Our services are not directed at children, and our application forms are intended for people aged 18 and over. We do not knowingly collect the personal information of a child without the consent of a competent person. If you believe we hold information about a child, contact our Information Officer and we will delete it.

Changes to this policy

We review this policy at least annually and whenever our processing changes materially. The version number and date at the top of this page tell you which version you are reading. Where a change materially affects you, we will bring it to your attention directly rather than relying on you to notice it here.

Contact and complaints

Speak to us first — most concerns are resolved quickly. Contact our Information Officer at info@rovuwah.co.za or +27 11 219 5016.

If you are not satisfied with our response, you may complain to the Information Regulator, using POPIA Form 5:

Related documents: POPIA Notice  ·  Cookie Notice. This policy was last reviewed on 17 September 2026.