Privacy policy

Last updated 4 October 2026.

WageZA is payroll and leave software for small South African employers. It is run by Bardy Digital (Pty) Ltd, a South African company ("we"). This policy explains what personal information WageZA holds, why, where it is kept, and what you can ask of us, as the Protection of Personal Information Act (POPIA) requires.

Who is responsible for what

• Your account. For the details of the employer who signs up (the business name, the owner's email, sign-in and billing records), we are the responsible party.
• Your staff and customers. For the people an employer enters (employees, and customers they invoice), the employer is the responsible party and we are their operator. We process that information only to provide WageZA to the employer, on the employer's instructions. The operator terms are in our terms of service.

What we hold

• The employer's account: the business name; the owner's email; the password, stored only as a one-way hash; if the owner signs in with Google, the Google account's id and email; the plan, and Paystack's customer and subscription references (never card details).
• Employees: full name, SA ID number, tax number, date of birth, occupation, cell number, email, the date they agreed to WhatsApp messages, pay terms, hours, leave, advances and expenses, and the payslips made for them.
• Customers of the employer: name, email, invoices, and the consent they gave.
• Security records: active sign-in sessions; failed sign-in attempts with the connection's IP address, kept 15 minutes; a log of who viewed, exported or removed someone's records.

We don't use advertising, analytics or tracking cookies, and we don't sell or share personal information for marketing.

Why we hold it

• To work out pay, PAYE, UIF and SDL, make payslips, track leave, and prepare the employer's draft SARS files.
• To sign people in and keep accounts secure.
• To bill for paid plans.
• To send the emails the service needs, such as the link that confirms an email address.
• To meet legal duties, such as keeping payroll records.

Where it is kept, and who helps us

Payroll data is stored on Cloudflare, which has no data centre in South Africa.

That makes this a cross-border transfer. POPIA (section 72) allows it where the recipient is bound to protect the information to a standard like POPIA's. Cloudflare is bound by its data processing addendum with us. These companies process personal information for us:

• Cloudflare runs the website, the database and our outgoing email.
• Paystack takes payments for paid plans. Card details go to Paystack's own pages; we never see them.
• Google signs you in if you choose "Continue with Google". We receive your email address and Google's id for your account.

How long we keep it

Employers must keep payroll records: at least five years under the Tax Administration Act, and three years under the Basic Conditions of Employment Act. So when an employer removes someone, WageZA marks their records removed rather than erasing them, and when an employer leaves, their account is archived. Once the period the law requires has passed, ask us and we will erase or anonymise the records. Failed sign-in attempts are deleted after 15 minutes, and expired sessions and links are deleted.

How we protect it

• Every connection is encrypted (HTTPS only).
• Passwords are stored as hashes, never as the password itself.
• Each employer sees only their own records.
• Repeated wrong passwords lock sign-in.
• Our own staff console needs a second factor, sits behind an extra access check, and every look at an employer's records is logged.

If personal information is accessed without authority, we will tell the employers affected and the Information Regulator as soon as reasonably possible, as POPIA section 22 requires.

Your rights

You may ask what personal information we hold about you, ask us to correct or delete it, or object to how it is used.

• Employers can download all their records at any time from WageZA, and email privacy@wageza.co.za for anything else.
• Employees and customers of an employer: ask the employer first, since they are responsible for your information. You can also email us, and we will help them answer you.

We reply within 30 days. If you are unhappy with how we handled your information, you may complain to the Information Regulator (inforegulator.org.za).

Information Officer

Jethro Badenhorst, Bardy Digital (Pty) Ltd, South Africa. Email privacy@wageza.co.za.

Changes

If we change this policy in a way that matters, we will email account owners before the change takes effect. The date at the top shows the latest version.