Privacy & POPIA Policy

New Phase Hub ("we", "us") operates newphasehub.co.za, South Africa's Career & Business Opportunity Hub. For the purposes of the Protection of Personal Information Act 4 of 2013 ("POPIA") we are the responsible party for the personal information described in this policy.

Information Officer: the New Phase Hub Information Officer, Johannesburg, South Africa — privacy@newphasehub.co.za.

• Account information: name, email address, phone number, account type (job seeker, SMME, recruiter, business) and password credentials handled by our authentication provider.
• Profile information: province, city, headline, current role, years of experience, industry, skills and biography.
• CV and career information: the CV file you upload, text extracted from it, AI-generated ATS scores, strengths, gaps, suggested roles, career roadmaps, interview practice answers and cover letters.
• Business information: company name, CIPC registration number, VAT number, B-BBEE level, tax compliance status, professional registrations, services and recent project summaries.
• Job posting information: roles you advertise, including salary ranges and contact details for applications.
• Usage information: saved tenders and jobs, pages visited, device and browser data, and technical logs used to keep the service secure and available.

• To provide the service — creating your account, analysing your CV, generating career roadmaps, matching candidates to job posts and showing you tenders (performance of our contract with you).
• With your consent — AI analysis of your CV, making a limited candidate profile visible to verified hiring accounts, and marketing emails. You may withdraw consent at any time.
• Legitimate interests — fraud prevention, platform security, service improvement and support.
• Legal obligation — where we must keep records or respond to a lawful request.

• Hiring accounts (recruiters, businesses, SMMEs): free accounts see a limited candidate view — role, province, industry, experience level and skills, with your name and contact details masked. Full contact details and CV downloads are available only to paid accounts, and only for candidates who have consented to be discoverable.
• Other users: information you deliberately publish, such as a job advert or an SMME directory listing, is visible to signed-in users.
• Operators (processors) acting on our instruction: our cloud database, storage and authentication provider, and the AI provider that generates CV analysis and career content. They may process data outside South Africa; we only use providers that offer a level of protection substantially similar to POPIA, as required by section 72.
• We do not sell your personal information.

• All traffic is encrypted in transit (HTTPS) and data is encrypted at rest.
• Row-level security rules mean your records are readable only by you and by roles you have expressly allowed.
• CV files live in a private storage bucket accessible only through signed, time-limited links.
• Sensitive fields such as ATS scores and personal development notes are never exposed to hiring accounts.
• If a security compromise affects your personal information, we will notify you and the Information Regulator as required by section 22 of POPIA.

• Account and profile data: for as long as your account is active.
• CVs and AI analyses: until you delete them, or 24 months after your last sign-in.
• Job posts: 12 months after the closing date.
• Deleted accounts: removed within 30 days, except where the law requires us to keep records for longer.

Under sections 23 to 25 of POPIA you may:

• ask what personal information we hold about you;
• ask us to correct or delete information that is inaccurate, irrelevant, excessive or out of date;
• withdraw consent for AI analysis, candidate discoverability or marketing;
• object to processing on reasonable grounds;
• request a copy of your data in a portable format;
• complain to the Information Regulator.

Most of this is self-service: edit or clear your profile, CV and saved items in your profile settings. For anything else email privacy@newphasehub.co.za and we will respond within 30 days.

Information Regulator (South Africa), JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001 — complaints.IR@justice.gov.za, inforegulator.org.za.

New Phase Hub is intended for people aged 18 and older. We do not knowingly process the personal information of children without the consent of a competent person, and will delete such information if we become aware of it.

We use strictly necessary cookies and local storage to keep you signed in and to remember work in progress (for example draft cover letters). We do not use advertising cookies.

We may update this policy as the platform evolves. Material changes will be announced on the site and, where appropriate, by email. The effective date above always reflects the current version.