Privacy Policy
This policy explains how Sous-Chef collects, uses, shares and protects personal information when you or your employer use the Sous-Chef service. It explains our practices under the Protection of Personal Information Act, 2013 (POPIA).
1. Who we are
Sous-Chef ("Sous-Chef", "we", "us") is operated by SOUS CHEF (PTY) LTD, a private company (registration number 2026/803346/07) trading as Sous-Chef, whose registered address is 46 Kings Road, Bedfordview, Johannesburg, 2007. We provide employee management software to employers, primarily in the hospitality sector. References to "you" mean either the employer-administrator who registers an organisation, or an employee-member added to an organisation, depending on context.
2. Scope of this policy
When an employer (the "Customer") registers an organisation on Sous-Chef and adds employees, the Customer is the responsible party for those employees' personal information under POPIA. Sous-Chef is the operator processing that information on the Customer's instructions, governed by our Operator Agreement.
In our capacity as a service provider directly to the Customer (account, billing, support), Sous-Chef (SOUS CHEF (PTY) LTD, a private company (registration number 2026/803346/07) trading as Sous-Chef) is itself the responsible party. This policy covers both capacities and tells you which applies in each case.
3. Information we collect
3.1 From Customer-administrators
- Name, work email address, password (hashed)
- Organisation name, slug, registration number, address
- Industry, default work schedule, ordinary hours per week
- Information Officer name, email, phone number and ID or passport number (the number is stored encrypted)
- Invoices, the payment method and the payment reference (for example a bank reference or the last four digits of a card), all held by us
- Session metadata: IP address, user-agent, sign-in timestamps
3.2 From employee-members
- Name, work email, role, employment type, start date
- Date of birth
- South African ID number or passport number, where required, with the country of issue and expiry date for a passport
- SARS tax reference number
- Phone number, residential address, branch and department
- Emergency contact: name, relationship and phone number (a third party)
- Salary and salary history
- Leave requests and balances, including reasons and uploaded sick notes (special personal information — health)
- Injury-on-duty records, including a description of the injury (special personal information — health)
- Performance records
- Schedule and shift records
- Uploaded personal documents (for example an ID copy, CV, proof of banking or proof of address) and a profile photo
- Contracts and signed documents (signature value, IP, user-agent at signing)
- Disciplinary records, charge sheets, hearing minutes and outcomes, including the names of witnesses and of anyone who represents the employee (third parties). Where an allegation is also an offence (for example theft or assault), that part is special personal information under POPIA s26(b). All disciplinary records get the same safeguards.
- For members aged 15 to 17: the name of a parent or guardian and their relationship to the member (see section 11)
- Audit log of activity within the platform
Special personal information (health, alleged criminal behaviour) is processed only because, and to the extent that, it is necessary to comply with an obligation of South African labour law (BCEA, LRA, CATRA Collective Agreement) — POPIA s27(1)(b).
3.3 Where it comes from, and what happens if it is not given
- Where it comes from. Most employee information is entered by the employer (the Customer) when it invites you or manages your record. The rest comes from you: your own leave requests, the documents you upload, and what you enter when you accept your invitation.
- Required or voluntary. To invite an employee, the employer must enter their name, email address, date of birth, an ID or passport number, job title, department, role, work arrangement, employment type and start date. A member aged 15 to 17 must also give a parent or guardian's name and relationship when they accept. Every other detail is held only if the employer or the employee enters it.
- If it is not given. Without the required details, the employer cannot add the person to its Sous-Chef organisation. A detail that is left out is simply not recorded.
4. How we use your information
On the Customer's instructions, we process employee personal information to:
- Maintain the employee record and statutory written particulars (BCEA s29)
- Calculate leave entitlements, balances, sick leave cycles and overtime (BCEA, CATRA)
- Schedule shifts and capture shift change requests
- Generate, send, sign and store contracts, offer letters, charge sheets, outcome letters and certificates of service
- Maintain a tamper-evident audit log of who did what
- Deliver email notifications (invitations, leave decisions, contracts, certificates) via our email sub-processor
In our own capacity (as responsible party for our customer relationships), we also use information to provide and bill for the service, respond to support requests, prevent fraud and abuse, and comply with our own legal obligations. Where you opt in, we also use optional product analytics to understand which features are used so we can improve the service (see section 12).
5. Lawful basis for processing
We rely on the following grounds in POPIA s11:
- Contract — to perform the Sous-Chef service for the Customer and the underlying employment contract between Customer and member
- Legal obligation — record-keeping and HR-process obligations under BCEA, LRA, the CATRA Collective Agreement and the Income Tax Act
- Legitimate interest — secure operation of the platform, fraud prevention, audit-trail integrity
- Consent — for marketing communications and any optional processing not covered above, such as product analytics (section 12); consent can be withdrawn at any time
7. Cross-border transfers
Our infrastructure sub-processors operate outside South Africa. In particular, the database and file storage are hosted in Frankfurt, Germany; transactional email is sent from Dublin, Ireland; application hosting runs from Washington, D.C., USA; and bot protection runs on Cloudflare's global edge network.
The European Union and the United Kingdom are recognised as providing a level of protection that is comparable to POPIA. For transfers to the United States, we rely on contractual safeguards imposed on the relevant sub-processor (POPIA s72(1)(a)). The current sub-processor list and their hosting regions are kept up-to-date at /legal/sub-processors.
8. How long we keep your information
We keep personal information only as long as we need it to deliver the service or to meet a legal obligation. The default schedule below applies in the absence of a longer retention requirement imposed by the Customer or by law:
| Category | Default retention |
|---|---|
| Active employee records (while employed) | Kept for as long as the person is employed. |
| Terminated employees' ID number, phone number and address | Removed three years after the employment end date. The profile photo is removed at the same time if the person has no other active membership. The record stays, with the employment dates, job title and how the employment ended. Other details on it, such as a passport number, tax reference, date of birth and emergency contact, stay until the organisation is deleted. |
| Disciplinary records | Deleted three years after the case was opened. A hearing case that is still open (being investigated, heard or decided, with an outcome issued, or with an appeal pending) is kept until it is closed, and so is any case referred to the CCMA or a bargaining council. |
| Retrenchment consultation records | Attendee names and notes are removed three years after the process concluded or was abandoned. The timeline (statuses, dates and counts) stays. |
| Sick notes (uploaded medical certificates) | The uploaded sick-note file is deleted three years after the leave it supports ended. The leave request itself stays with the employee's leave records. |
| Compliance findings (recorded scheduling breaches) | Deleted three years after the date of the shift the finding is about. |
| Compliance audit runs, results, corrective actions and evidence | Deleted three years after the audit run was locked. Closed or waived corrective actions are deleted three years after they were last updated. |
| Audit log entries | Deleted five years after they were written. |
| IP address and browser details on document signatures | Removed three years after the signature was captured. The signature itself stays. |
| Documents sent through a phone upload link that nobody reviewed | Deleted 30 days after the link closed. Pages an owner or admin approved onto an employee's file follow that employee's record. |
| Email-verification and rate-limit records | Deleted daily once expired. |
| Data of a cancelled organisation | Deleted 60 days after the organisation's service ends: the end of the period it paid for or, if it was suspended or had stopped paying, the date it was cancelled. That is the export window. |
An automated daily retention job applies these windows. Where the table says “removed”, the record stays and only the details named are cleared. Where it says “deleted”, the record is deleted. The windows for employment records follow the Basic Conditions of Employment Act, which requires them to be kept for at least three years (BCEA s31, and s29 for the written particulars of employment). Our other windows are periods we set, most of them to the same length. If a law that applies to your employer's sector requires a longer period, the job keeps those records for that longer period. The table says which date each window is counted from.
When a subscription is cancelled, the organisation keeps working until the end of the period already paid for (an organisation that was suspended or had stopped paying stops on the date it is cancelled). For 60 days after that we keep the data available so the Customer can request a complete export of it. Once that window closes the whole organisation is deleted — every record, together with the stored contracts, HR documents, sick notes and evidence files. That deletion is permanent and cannot be reversed. Copies held in our database provider's backups are removed when they age out on its backup rotation cycle, so they outlast the deletion for a while.
Apart from those backup copies, two things survive that deletion, and only these two. We keep an entry in our internal audit log recording that the deletion took place, and we keep the financial record of the invoices we issued to the Customer — invoice numbers, dates and amounts, with no personal information attached. We are obliged to retain the latter under the Income Tax Act and the Tax Administration Act, which is the carve-out for retention “required by law” in section 11 of the Operator Agreement.
9. How we protect your information
- TLS 1.2 or higher in transit; AES-256 encryption at rest at the database layer
- Role-based access control (owner / admin / member)
- Internal access by authorised Sous-Chef personnel is subject to additional authentication safeguards and a tamper-evident audit log. Day to day, that access is limited to organisation-level information (see section 6). Staff can also generate a full export of an organisation's data on the customer's request; each export is logged and rate-limited.
- Audit logging of administrative and HR actions inside the platform
- Server-side validation of email domains at registration (disposable-domain blocklist + MX-record check)
- Bot protection on registration, login and password-reset flows via Cloudflare Turnstile
If you have found a security issue and want to report it, see our security & vulnerability disclosure page.
10. Your rights as a data subject
Under POPIA you have the right to:
- Be informed about which of your personal information we hold, and request a copy of it (a Data Subject Access Request, or DSAR) (s23)
- Request correction or deletion of information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or unlawfully obtained (s24)
- Object to processing on reasonable grounds, subject to lawful exceptions (s11(3))
- Withdraw consent where processing relies on consent (s11(2)(b)). For cookies, see section 12
- Lodge a complaint with the Information Regulator (see section 14)
For employee-members, requests for correction or deletion are ordinarily routed first to your employer (the responsible party). If your employer does not act on a request, you may escalate to Sous-Chef at sous.chef.south.africa@gmail.com. We respond to verified requests within a reasonable time and aim for 30 days (POPIA s23(1)(b)(i)). We tell you in writing what we did with a correction or deletion request within 30 days (POPIA Regulations, reg 3.6).
11. Children and minor employees
Sous-Chef is intended for use by employers with adult employees. The hospitality sector occasionally engages 15–17-year-olds in line with BCEA s43 and s44.
Children under 15. The Basic Conditions of Employment Act s43 prohibits the employment of any person under the age of 15, and a contravention is a criminal offence. Sous-Chef enforces this at the platform level: a Customer who records a date of birth indicating a member is under 15 cannot send the invitation. We do not save the date of birth or an invitation. The blocked attempt is written to the audit log with the email address that was entered and the calculated age, and that entry is kept for the audit-log period in section 8.
Members aged 15–17. When a 15–17-year-old accepts their invitation, they must enter the name of a parent or guardian and their relationship to the member, and confirm that the parent or guardian consents. We store the name (encrypted), the relationship and the date on the member record. The audit log records that the consent was entered and the relationship, but not the name (action: consent.minor.parental_recorded). Sous-Chef does not contact or verify the parent or guardian. Customers remain responsible for complying with the BCEA s44 restrictions on hazardous work, hours, and types of work that apply to minor employees.
A guardian (or the minor on reaching 18) may exercise any of the rights described in section 10 — including the right to withdraw consent at any time.
13. Changes to this policy
We update this policy whenever we change how we process personal information. The version number and effective date at the top of this page change with each update. We email the organisation owner at least 30 days before a change to this policy takes effect. When it takes effect, every user is asked to accept the new version in the app (we record the version each user accepted).
14. Information Officer & contact
Sous-Chef's Information Officer encourages compliance with POPIA and handles requests. They are reachable at sous.chef.south.africa@gmail.com (or via /legal/contact-information-officer).
You may also lodge a complaint directly with the Information Regulator (South Africa), on its complaint form (Form 5, at inforegulator.org.za/popia-forms):
- Complaints email: POPIAComplaints@inforegulator.org.za
- Physical address: Woodmead North Office Park, 54 Maxwell Drive Woodmead, Johannesburg, 2191
- Telephone: 010 023 5200 (toll free 0800 017 160)
- Website: inforegulator.org.za