Privacy notice

Who we are

Watchly is a compliance and payroll platform for security firms. We are the responsible party for the account information of the firms that use Watchly. For a firm’s own people, Watchly processes their information on that firm’s instruction as its operator. Our Information Officer is the head of the business; the registered legal-entity name, registration number and address are being finalised and are available on request.

What we process

• Account and user details for the firms that sign up.
• For a firm’s people: identity and contact details, competency and compliance records, rostering and attendance, and payroll.
• Face-check references. Where a firm uses identity verification, a check leaves behind a reference number and the fact that a check was made and what it answered. No photograph of a face is stored by Watchly — there is no place for one in the system. A face check is biometric information, which POPIA treats as special personal information, so it is handled only with the person’s recorded consent. The full terms behind that consent are at the face-check consent page.
• Any health information a firm records, such as a sick note, is treated as special personal information and handled with additional care.

Where it is kept and who processes it

Watchly’s data is hosted in the European Union (Frankfurt, Germany) with our hosting provider, and processed only by the service providers needed to run Watchly. That hosting is a cross-border arrangement papered under POPIA. We do not sell personal information. The sub-processors we use, and the terms Watchly processes a firm’s data under, are set out in our Data Processing Addendum.

AI processing

Watchly offers an owner-triggered AI check on a payroll run, before it is approved. It does nothing until Watchly switches it on for the whole product — a single platform credential, not a setting an individual firm turns on for itself — and even then it never edits a figure or approves a run: a human always keeps the wheel. When it runs, officers are replaced with anonymous labels before anything is sent: no name, PSIRA number or contact detail leaves Watchly for that check, only the already-computed figures. What is sent, to whom, and under what conditions is set out in our AI processing notice.

How we protect it

Each firm’s data is isolated at the database layer, access is controlled and logged, and information is encrypted in transit and at rest. No system can be guaranteed perfectly secure, but we take reasonable technical and organisational measures under POPIA.

Your rights, and how to use them

Under POPIA you may ask to see the personal information we hold about you, ask us to correct or delete it, object to certain processing, and withdraw a consent you have given. To withdraw consent to a face check, you can say so at any time and it takes effect the moment you say it — the face-check consent page explains how. For any other request, contact us as set out below. We log every request and respond as soon as reasonably possible, and within the time POPIA’s Regulations require.

Contact

For any privacy question or request, email us at info@watchly.co.za. You may also complain to the Information Regulator (South Africa) at inforeg@inforegulator.org.za.