Last updated: 28 June 2026
CVDesk is committed to protecting your privacy and complying with the Protection of Personal Information Act (POPIA), Act 4 of 2013. This policy explains what information we collect, why we collect it, and how we use and protect it.
1. Who we are
CVDesk SA (Pty) Ltd operates the CVDesk platform at cvdesksa.co.za. We are the responsible party for the processing of your personal information as defined under POPIA. For any privacy related queries contact us at privacy@cvdesksa.co.za.
2. Information we collect
From candidates
- Email address and password (hashed — we never store plain text passwords)
- Full name, phone number, city and country
- Professional information including job title, years of experience, skills and salary expectations
- CV document uploaded in PDF or DOCX format
- Consent records including timestamp, IP address and consent version
- Profile activity data including how many times your CV was downloaded
From recruiters
- Company name and work email address
- Password (hashed)
- Payment information processed by Stripe — we do not store card details
- Download activity logs including timestamps and IP addresses
Automatically collected
- IP addresses for security and rate limiting purposes
- Session data to keep you logged in
- Browser type and device information for security monitoring
3. How we use your information
- To create and manage your account
- To make candidate profiles searchable by verified recruiters
- To process recruiter payments and credit transactions
- To send transactional emails such as registration confirmation and profile activity notifications
- To detect and prevent fraud, abuse and unauthorised access
- To comply with legal obligations including POPIA
- To send marketing communications if you have given explicit consent
4. How we share your information
We do not sell your personal information to any third party. Your information is shared only in the following circumstances:
- With verified recruiters who have paid to unlock your profile — only after you have registered and consented
- With Stripe for payment processing
- With our hosting provider for server infrastructure
- With law enforcement if required by South African law
5. How we protect your information
- All data is transmitted over HTTPS using TLS encryption
- Passwords are hashed using bcrypt and never stored in plain text
- CV files are stored in a private directory inaccessible from the web
- Recruiter downloads are rate limited and fully logged
- Admin access is protected by separate authentication
6. Your rights under POPIA
As a data subject under POPIA you have the right to:
- Access the personal information we hold about you
- Request correction of inaccurate information
- Request deletion of your personal information
- Object to the processing of your information
- Withdraw consent for marketing communications at any time
- Lodge a complaint with the Information Regulator of South Africa
To exercise any of these rights contact us at privacy@cvdesksa.co.za. We will respond within 7 business days.
7. Data retention
- Candidate profiles and CVs are retained until you delete your account
- On account deletion all personal data is removed within 30 days
- Download audit logs are retained for 2 years for dispute resolution
- Payment records are retained for 5 years as required by law
8. Cookies
We use session cookies to keep you logged in. These are essential for the platform to function and cannot be disabled. We do not use tracking cookies or third party advertising cookies.
9. Changes to this policy
We may update this policy from time to time. When we do we will update the date at the top of this page. For significant changes we will notify registered users by email.
10. Contact us
For any privacy related queries or to exercise your rights under POPIA contact us at privacy@cvdesksa.co.za or use our contact form.