Privacy Policy

Privacy Policy & Data Processing Agreement

Last updated: 29 August 2026

IMD Innovations Proprietary Limited (Registration No. 2012/003345/07), trading as iStratgo ("IMD", "we", "us", or "our"), with its principal place of business at Fourways Golf Park, Roos Street, Fourways, Johannesburg, 2190, is committed to protecting your privacy and personal information.

This Privacy Policy and Data Processing Agreement explains how we collect, use, disclose, and safeguard your personal information when you use our recruitment platform at recruitment.istratgo.com (the "Platform").

This policy is governed by the Protection of Personal Information Act 4 of 2013 (POPIA) and applies to all users of the Platform, including job seekers, employers, and recruiters. By registering an account or using the Platform, you confirm that you have read and understood this Privacy Policy and agree to its terms.

1. Role Clarification

For purposes of data protection legislation:

IMD (as Operator/Processor): IMD fulfils the role of Operator/Processor where it processes Personal Information on behalf of Employers/Customers who use the Platform for recruitment purposes, acting on their instructions for the purpose of providing the Services.
IMD (as Responsible Party/Controller): IMD fulfils the role of Responsible Party/Controller in respect of Personal Information it collects and processes for its own purposes, including platform operations, account management, and service improvement.
Employers/Customers: Employers and Recruiters using the Platform fulfil the role of Responsible Party/Controller in respect of candidate data they access and process through the Platform for recruitment purposes.

2. Definitions

Unless otherwise expressly stated, the following definitions apply throughout this Agreement:

"Agreement" means this Privacy Policy and Data Processing Agreement together with IMD's Terms of Service.
"Authorized User" means Job Seekers, Employers, Recruiters, and their Personnel who are authorized to access and use the Services.
"Confidential Information" means all technical, trade, commercial, financial and management information and secrets used by a Party in the conduct of its business which is not readily available to competitors.
"Data Subject" means an individual or juristic entity which is the subject of Personal Information that may be Processed under this Agreement.
"Intellectual Property Rights" means all intellectual property rights wherever in the world, whether registrable or unregistrable, registered or unregistered, including copyright, database rights, trade secrets, know-how, trademarks, patents, and designs.
"Operator/Processor" means a public or private body or any other person who processes Personal Information for a Responsible Party/Controller in terms of a contract or mandate, without coming under the direct authority of the Responsible Party/Controller.
"Personal Information" means all information relating to an identifiable, living natural person, including that which IMD (or any of its Affiliates or Personnel) processes in connection with its relationship with Users.
"Personal Information Breach" means an occurrence where there are reasonable grounds to believe that Personal Information of a Data Subject has been accessed or acquired by any unauthorised person.
"Process, Processed or Processing" means the collection, use, disclosure, transfer, storage, deletion, combination, regulatory submission, and/or other use of Personal Information.
"POPIA" means the Protection of Personal Information Act 4 of 2013 (as amended) of the Republic of South Africa.
"Responsible Party/Controller" means a public or private body or any other person which, alone or in conjunction with others, determines the purpose of and means for processing Personal Information.
"Services" means the iStratgo Recruitment software-as-a-service platform and all associated features and functionality.
"Sub-contractor" means a third-party contractor to whom the Processing of Personal Information is subcontracted or outsourced by IMD in accordance with this Agreement.
"Supervisory Authority" means the Information Regulator as established in South Africa pursuant to POPIA.
"Territory" means any country where IMD processes information on behalf of Users.
"User or Users" means any individual or organisation that uses the Platform, including Job Seekers, Employers, Recruiters, and visitors.

3. Information We Collect

3.1 Registration Information

To create an account on the Platform, Users must provide at least an email address and a password and agree to our Terms of Service and this Agreement. Users will provide additional information during the registration flow to help build their profile and to enable us to provide Services. By creating an account, IMD will be able to identify Users by their profiles on the Platform.

3.2 Identity & Contact Information

Full name, date of birth, gender, and nationality
Email address, phone number, and physical / postal address
Profile photo and cover image
National identity number or passport number (where required for verification)

3.3 Professional & CV Information

Curriculum vitae (CV) / résumé — including all content you upload or enter
Current and previous employment history (employer names, job titles, duties, dates)
Educational background (institutions, qualifications, graduation years)
Professional skills, certifications, licences, and accreditations
Languages spoken and proficiency levels
Portfolio links, GitHub, LinkedIn profile URLs, and personal website URLs
References and referee contact details

3.4 Account & Application Data

Username and encrypted password
Account settings and notification preferences
Job applications submitted, application status history, and cover letters
Responses to employer screening questions
Interview scheduling information
Saved jobs and job alert preferences

3.5 Sensitive / Special Category Information

We may collect the following categories of sensitive information only where you voluntarily provide it or where it is required by law:

Disability status or accessibility requirements
Right-to-work / work permit / visa status
Results of criminal background checks (conducted only with your explicit written consent)
Race or ethnic origin, where voluntarily disclosed for B-BBEE or employment equity reporting

3.6 Technical & Usage Data

When Users visit or leave the Platform, we automatically receive technical information including:

IP address, browser type and version, operating system, and device identifiers
The URL of the site from which you came or to which you are directed
Mobile device identifier, mobile operating system (if accessing via mobile)
Pages visited, features used, search queries made on the Platform
Login timestamps and session duration
Referring URLs and click-through data
Name of your ISP or mobile carrier
Location data passed from GPS-enabled devices (where enabled by User)
Essential cookies (see Section 11)

3.7 Communications Data

Messages sent between you and employers or recruiters via the Platform
Support queries and correspondence with our team
Feedback and survey responses

4. How We Collect Your Information

Directly from you: when you register, complete your profile, upload your CV, apply for jobs, or contact us
Automatically: via server logs, cookies, and usage analytics when you interact with the Platform
From third parties: if you sign in via Google, LinkedIn, or another third-party provider, we receive basic profile data from that provider in accordance with your permissions
From employers or recruiters: employers may import or submit candidate information on your behalf for roles you have been referred for

5. Legal Basis for Processing

Under POPIA, we process your personal information on the following lawful grounds:

Consent: where you have given us explicit consent, e.g. for optional data fields, background checks, or marketing communications
Contractual necessity: to provide you with the recruitment services you have signed up for
Legitimate interests: to improve the Platform, detect fraud, and ensure security, where these interests are not overridden by your rights
Legal obligation: where we are required to process your data to comply with applicable South African law

6. Processing of Information

6.1 License to Process

By using the Platform, you grant to IMD a non-exclusive licence to copy, reproduce, store, distribute, publish, export, adapt, edit, and translate your Personal Information to the extent reasonably required for the performance of IMD's obligations and the exercise of IMD's rights under this Agreement.

You also grant IMD the right to sub-license these rights to its hosting, connectivity, and telecommunications providers, subject to the restrictions in this Agreement.

6.2 Lawful Basis Confirmation

By using the Platform, you confirm that you have an appropriate lawful basis for providing Personal Information (including any third-party data such as references) to IMD for purposes of Processing recruitment-related services.

6.3 Compliance Standards

IMD will comply with POPIA and applicable data protection standards. If applicable law related to data protection in any territory conflicts with or is more onerous than these provisions, IMD shall assess feasibility of compliance and advise accordingly.

7. How We Use Your Information

Creating, verifying, and managing your account
Making your profile, CV, skills, and professional history visible to registered employers and recruiters who are actively seeking candidates for open positions
Matching your profile to relevant job opportunities using our platform algorithms
Processing and tracking job applications you submit
Sending notifications about application status, interview invitations, and job alerts
Facilitating communication between you and employers or recruiters
Conducting or facilitating background and reference checks (with your explicit consent)
Improving, personalising, and maintaining the Platform
Detecting and preventing fraudulent activity or misuse of the Platform
Meeting our legal and regulatory obligations under South African law
Generating anonymised, aggregated analytics and reports (which cannot identify you personally)
Providing customer support services

8. Communications

IMD communicates with Users through email, notices posted on the Platform, and other available means. These include:

Welcome and engagement communications: informing Users about how to best use the Platform, new features, and updates
Service communications: covering service availability, security, and other issues about the functioning of the Platform
Promotional communications: containing promotional information. These are sent based on User profile information and messaging preferences. Users may change email and contact preferences at any time by signing into their account and opting out

Users cannot opt out of receiving essential service messages. IMD may provide notices via a banner on the Platform, email, or other contact methods. Users agree to keep their contact information up to date.

9. Sharing Your Information

9.1 Employers & Recruiters

By creating a profile on iStratgo, you acknowledge and consent that your profile information — including your name, CV, skills, work experience, education, and qualifications — may be viewed by registered employers and recruiters on the Platform. Employers may only use this information for legitimate recruitment and hiring purposes. They are contractually prohibited from using your data for any other purpose or from sharing it with unauthorised third parties.

9.2 Service Providers & Sub-contractors

We share data with trusted third-party service providers and sub-contractors who assist us in operating the Platform, including cloud hosting providers, email delivery services, and analytics tools. All such providers are bound by confidentiality agreements and may only process your data on our instructions.

9.3 Background Check Agencies

Where you apply for a position that requires a background, credit, or qualification check, your information will be shared with an accredited third-party verification agency only with your prior written consent.

9.4 Legal & Regulatory Disclosure

We may disclose your personal information if required to do so by law, court order, or a competent regulatory authority (including the Information Regulator of South Africa). If IMD receives any demand for disclosure of Personal Information by law, IMD will promptly notify the affected User in writing (unless legally prohibited from doing so).

9.5 Business Transfers

In the event of a merger, acquisition, or sale of all or part of our business, your personal information may be transferred to the relevant third party. We will notify you before your data is transferred and becomes subject to a different privacy policy.

9.6 What We Do Not Do

We do not sell, rent, or trade your personal information to any third party for marketing or advertising purposes.

10. CV & Profile Visibility Controls

You can control whether your profile is set to Open to Opportunities (visible to employers), Private (visible only when you apply), or Hidden
You may update, edit, or remove information from your CV and profile at any time from your account settings
If you deactivate your account, your profile will no longer be visible to employers. Full data deletion is subject to the retention periods in Section 12

11. Cookies & Tracking Technologies

IMD uses cookies to store a session identifier in order to correctly serve Users their data as well as improve experience, increase security, and measure use and effectiveness of the Platform.

We use the following types of cookies:

Essential cookies: required for the Platform to function, including maintaining your login session and remembering your preferences. These cannot be disabled.
Analytics cookies: help us understand how the Platform is used so we can improve it. These are anonymised and do not track you across other websites.

We do not use third-party advertising or retargeting cookies. Users can control cookies through browser settings and other tools. By visiting the Platform, Users consent to the placement of cookies in their browser in accordance with this Agreement.

12. Data Retention & Storage

We retain your personal information only for as long as necessary for the purposes outlined in this policy, or as required by law. Our general retention periods are:

Data Type	Retention Period
Active account & profile data	Duration of your account
CV and professional information	Duration of your account
Job application records	3 years after application date
Background check results	Deleted within 30 days of completion
Communications & support logs	2 years
Server and access logs	90 days
Marketing consent records	Until you withdraw consent
Deleted account data	Fully purged within 30 days of account deletion request

After the applicable retention period, data is securely deleted or anonymised so it can no longer identify you.

12.1 Data After Account Termination

On notice of termination or account deletion, Users will have 30 days to download or export their data using available mechanisms such as profile export or data portability requests.
After the 30-day period, IMD will lock the account and the User will no longer have access to any of the Personal Information.
Personal Information, after the 30-day download period has expired, may be retained for the legal basis of historical purposes. When required, access may be provided upon request to the Information Officer.
Appropriate safeguarding measures will continue to be applied as if the agreement for processing of Personal Information was still in place.
IMD warrants that Personal Information stored for historical purposes will not be used for any other purpose.
Should a User require that their Personal Information be permanently deleted, IMD will delete or destroy all copies in its systems or possession, unless legally prohibited from doing so.

13. Safeguarding Measures & Data Security

IMD has implemented appropriate safeguards against the unauthorized access to, and destruction, loss, or alteration of Users' Confidential Information and Personal Information. We implement appropriate technical and organisational measures including:

Encrypted connections (HTTPS / TLS) for all data in transit
Encrypted storage for passwords and sensitive data at rest
Role-based access controls limiting employee access to personal data
Regular security reviews and vulnerability assessments
Secure data centres hosted within compliant cloud environments
Logical separation of User data from data processed on behalf of other parties

IMD warrants that it shall maintain such safeguards for so long as it has any User Confidential Information and Personal Information in its possession or has access to such information.

In the event of a Personal Information Breach that is likely to affect your rights or interests, we will notify you and the Information Regulator within 72 hours of becoming aware of the breach, in accordance with POPIA, and provide a detailed description of the breach, the type of data affected, and all reasonable steps taken to remedy and prevent further breaches.

Please note that no method of electronic transmission or storage is 100% secure. If you suspect unauthorised access to your account, please contact us immediately.

14. Compliance: Sub-contractors and Affiliates

IMD shall procure that each of its Sub-contractors and/or Affiliates contractually agree in writing that they will:

Comply with POPIA and this Agreement;
Not access, use, or process User data and/or Personal Information except to the extent reasonably necessary in performance of obligations;
Not perform any act that puts Users at risk of their data being disclosed;
Implement appropriate technical and organisational security measures to preserve the integrity of User data; and
Prevent any unauthorised or unlawful access, accidental or unauthorised destruction, corruption, loss, alteration or disclosure of User data.

15. Your Rights Under POPIA

As a data subject under the Protection of Personal Information Act (POPIA), you have the following rights:

Right to Access: request a copy of all personal information we hold about you
Right to Rectification: request correction of inaccurate or incomplete information
Right to Erasure: request deletion of your personal data, subject to our legal retention obligations
Right to Restriction: request that we limit the processing of your data in certain circumstances
Right to Object: object to the processing of your data for direct marketing or where processing is based on our legitimate interests
Right to Withdraw Consent: withdraw consent at any time where processing is based on consent, without affecting the lawfulness of prior processing
Right to Data Portability: request your data in a structured, machine-readable format (e.g. JSON or CSV)
Right to Close Account: close your account at any time, subject to the data retention provisions in Section 12
Right to Complain: lodge a complaint with the Information Regulator of South Africa if you believe we have violated your rights

To exercise any of these rights, please contact our Information Officer at info@istratgo.com. We will respond within 30 days of receiving your request.

16. Cross-Border Data Transfers

Our Platform is primarily hosted and operated within South Africa. IMD may perform replication of Personal Information to data centres in other jurisdictions for the purposes of implementing adequate disaster recovery processes and other legitimate processing activities.

Section 72 of POPIA allows the transfer of Personal Information to a recipient in a foreign country in circumstances where, amongst others:

The recipient is subject to a law, binding corporate rules or binding agreement that provides an adequate level of protection substantially similar to POPIA;
The Data Subject consents to the transfer;
The transfer is necessary for the performance of a contract between the Data Subject and the Responsible Party/Controller; or
The transfer is for the benefit of the Data Subject, and it is not reasonably practicable to obtain consent.

Where any of our service providers process data outside of South Africa, we ensure that appropriate safeguards are in place consistent with Section 72 of POPIA, including that the receiving jurisdiction provides adequate data protection that effectively upholds the principles of lawful processing.

17. Automated Decision-Making

Our Platform uses algorithms to match candidate profiles to relevant job listings based on skills, experience, and location. These matches are suggestions only — no automated system makes final hiring decisions on behalf of employers. All final decisions are made by human recruiters or employers. You may contact us to request information about how any automated matching has been applied to your profile.

18. Employer & Recruiter Obligations

Employers and recruiters who access candidate data through the Platform are required to:

Comply with all applicable data protection laws, including POPIA
Use candidate data solely for the purpose of evaluating suitability for specific roles
Not discriminate against candidates on any grounds prohibited by the Employment Equity Act or other applicable South African legislation
Not share candidate data with unauthorised third parties
Delete or return candidate data when it is no longer required for recruitment purposes

19. Audit Rights

In cases of suspected fraud, theft, or suspected data breach, IMD shall allow affected parties and their auditors, regulators, and other advisers to audit relevant records pertaining to the data breach, subject to:

At least 30 (thirty) business days' prior written notice of intention to conduct an audit;
Reasonable endeavours to complete the audit within 5 (five) business days from commencement;
The requesting party bearing all costs and expenses incurred in respect of the audit.

In the event that an audit identifies substantive findings relating to misrepresentation or a material default by IMD, IMD shall reimburse reasonable costs incurred and take necessary steps to comply with its obligations at no additional cost.

20. External Links

The Platform may contain links to third-party websites, employer career pages, or external resources. These sites do not fall under the control of IMD and therefore IMD cannot be held responsible for the privacy practices or the contents of such other websites. We encourage you to review the privacy policies of any external sites you visit.

21. Children's Privacy

The Platform is intended for use by persons who are 18 years of age or older. We do not knowingly collect personal information from individuals under the age of 18. If we become aware that a minor has registered on the Platform, we will delete their account and all associated data promptly. If you believe a minor has provided us with personal information, please contact us immediately.

22. Cooperation with Supervisory Authority

IMD shall cooperate, on request, with the Information Regulator (Supervisory Authority) in the performance of its tasks, in accordance with POPIA.

23. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or in applicable law. When we make material changes, we will notify you by email and/or a prominent notice on the Platform prior to the change taking effect. The updated policy will always be available at recruitment.istratgo.com/privacy-policy with a revised "Last updated" date. Continued use of the Platform after changes take effect constitutes your acceptance of the updated policy.

24. Contact Us & Information Officer

If you have any questions, concerns, or requests relating to this Privacy Policy or your personal information, please contact our Information Officer:

Information Officer: Alwyn Stoman
Email: info@istratgo.com
Phone: +27 (010) 035 0223
Address: Fourways Golf Park, Roos Street, Fourways, Johannesburg, 2190, South Africa

If you are not satisfied with our response, you have the right to lodge a complaint with the Information Regulator of South Africa:

Website: www.inforegulator.org.za
Email: complaints.IR@justice.gov.za
Address: JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001