Legal

FRIDAY

Privacy Policy

1. Introduction

Friday is a WhatsApp-native household employment platform that helps South African households manage their obligations as employers of domestic workers. We handle employment contracts, payslips and leave records on behalf of the households that use our service. We do not currently provide Unemployment Insurance Fund (UIF) registration or filing services. If these are introduced in future, this policy will be updated and affected users notified before any UIF-related processing begins.

This Privacy Policy explains what personal information we collect, why we collect it, how we use it, who we share it with, how long we keep it, and what rights you have under the Protection of Personal Information Act 4 of 2013 (POPIA).

This policy applies to:

• employers (the households that register to use Friday), and

• domestic workers (whose personal information is processed as part of the compliance service provided to their employers).

By registering to use Friday, or by having your employer use Friday on your behalf, you acknowledge that your personal information will be processed in the manner described in this policy.

2. Who we are

Friday is the trading name of JARVIS Corp (Pty) Ltd, a company registered in South Africa. We act as the responsible party in respect of all personal information processed through our platform.

Our registered address is 36 6th Road, Hyde Park, Sandton, 2196. For all privacy-related queries, you may contact us at support@getfriday.co.za.

We have appointed an Information Officer as required by POPIA and the Promotion of Access to Information Act 2 of 2000 (PAIA). The Information Officer can be contacted at the above email address.

3. What personal information we collect

3.1 Information collected from employers

When a household registers with Friday, we collect:

• Full name of the account holder

• WhatsApp mobile number

• Email address

• Residential or postal address (for contract and filing purposes)

• Payment information (processed via our payment provider; Friday does not store card details)

3.2 Information collected about domestic workers

When an employer registers a worker through our platform, we collect the following information about that worker:

• Full name

• South African Identity Document number, or passport number for foreign nationals

• Date of birth

• Gender

• Nationality

• WhatsApp mobile number

• Residential address

• Job title and role description

• Employment start date

• Monthly wage and pay structure

• Employment contract (generated and stored by the platform)

• Monthly payslips

Some of this information, specifically identity document numbers, may constitute special personal information under POPIA. We collect this information because it is needed to produce accurate and legally compliant employment contracts and statutory employment records for each worker.

3.3 Information generated by the platform

In the ordinary course of providing the service, we generate and store:

• Employment contracts (PDF format)

• Monthly payslips (PDF format)

• Leave records (applications, approvals and balances)

• Inbound and outbound WhatsApp message logs (for service delivery and audit purposes)

4. Why we collect this information (purpose of processing)

We process personal information only for the purposes for which it was collected. These purposes are:

5. Legal basis for processing

We rely on the following legal bases for processing personal information:

• Consent: where you have provided your informed consent to a specific processing activity.

• Contract: where processing is necessary to perform the service you have engaged us to provide.

• Legal obligation: where processing is required to comply with applicable South African law, including the Basic Conditions of Employment Act 75 of 1997 and applicable tax and record-keeping legislation.

• Legitimate interest: where we have a legitimate interest in processing that is not overridden by your rights, for example maintaining message logs for audit and dispute resolution purposes.

6. How we collect information

We collect personal information in the following ways:

• Directly from employers, via WhatsApp conversation when they register an account or register a worker.

• About workers, from their employer, who is responsible for providing accurate information and for obtaining appropriate acknowledgement from the worker that their information will be shared with and processed by Friday.

Important note for employers: by submitting a worker's personal information through our platform, you confirm that you have informed the worker that their information will be processed by Friday for the purposes described in this policy. Friday will send the worker a notice via WhatsApp at the point of registration confirming how their information will be used.

7. Who we share your information with

We do not sell personal information. We share personal information only in the following circumstances:

7.1 Department of Employment and Labour (future UIF services)

We do not currently share any information with the Department of Employment and Labour, because UIF registration and filing services are not part of the current service. If these services are introduced in future, worker information (including identity number, name, employer details and contribution amounts) will be shared with the Department as required by law, and the Department may in turn share relevant information with the South African Revenue Service (SARS) in accordance with applicable legislation. This policy will be updated and affected users notified before any such sharing begins.

7.2 Technology service providers (operators)

We use third-party technology providers to deliver our service. These providers process personal information on our behalf as operators under POPIA and are contractually required to maintain appropriate security measures:

7.3 Future bank partners

Friday intends, in the future, to offer domestic workers access to financial products (such as credit, savings and insurance) through a partner bank or financial institution. Before any worker information is shared with a bank partner, we will:

• Obtain the worker's separate, explicit, informed and voluntary consent;

• Provide a clear explanation of what information will be shared, with whom, and for what purpose;

• Give the worker the right to withdraw consent at any time without affecting their employment compliance service.

This sharing will not happen without consent. Workers will never be disadvantaged in their use of the Friday compliance service if they decline to give consent for financial data sharing.

7.4 Legal disclosure

We may disclose personal information if required to do so by law, court order, or if we believe in good faith that such disclosure is necessary to protect the rights, property or safety of Friday, our users or the public.

8. How we protect your information

We implement appropriate technical and organisational measures to protect personal information against loss, theft, unauthorised access, disclosure, alteration or destruction. These measures include:

• Encryption of data in transit using TLS.

• Private cloud storage with access controls and row-level security.

• Documents (payslips and contracts) delivered via time-limited signed URLs that expire within one hour of generation.

• Role-based access controls ensuring that only authorised personnel can access personal information.

• Audit logging of data access events.

In the event of a security compromise affecting personal information, we will notify the Information Regulator and affected data subjects as required by POPIA.

9. Future financial services - workers

Friday's long-term purpose includes helping domestic workers access formal financial services by providing a verified record of their income and employment history. This matters because millions of South African domestic workers are currently excluded from credit, savings and insurance products because they have no formal, verifiable employment record.

We are transparent about this intent. When this service is ready to launch:

• It will be entirely optional for workers.

• It will require a separate, specific, informed and written consent process - workers will not be enrolled automatically.

• Workers will be able to revoke consent and request deletion of financial data at any time.

• Workers will continue to receive the full compliance service (contracts, payslips and leave records) regardless of whether they participate.

We will update this privacy policy and issue a specific consent notice to workers before this service goes live.

10. Data retention

We retain personal information only for as long as is necessary for the purposes for which it was collected, or as required by law. Our retention schedule is as follows:

11. Your rights as a data subject

Under POPIA, you have the following rights in relation to your personal information:

To exercise any of these rights, contact us at support@getfriday.co.za. We will respond within a reasonable time and in any event within 30 days.

12. Cookies and website data

Our primary service is delivered via WhatsApp. Our marketing website (getfriday.co.za) may use standard web analytics tools to understand how visitors interact with the site. No personal information collected via the website is linked to individual WhatsApp accounts without your explicit knowledge and consent.

13. International data transfers

Some of our technology service providers may process or store data outside South Africa. Where this occurs, we take steps to ensure that appropriate protections are in place, including contractual safeguards consistent with POPIA requirements, before any transfer is made.

14. Children

Our service is intended for adults. We do not knowingly collect personal information from persons under the age of 18. If you believe that a minor's information has been submitted to our platform without appropriate authority, please contact us immediately at support@getfriday.co.za.

15. The Information Regulator

The Information Regulator of South Africa is the supervisory authority responsible for enforcing POPIA. If you believe your rights have been violated and we have not resolved your concern, you may contact the Information Regulator:

16. Changes to this policy

We may update this policy from time to time. Where changes are material, we will notify employers via WhatsApp or email. The effective date at the top of this document will be updated to reflect any revision. Continued use of our service after notification of a material change constitutes acceptance of the updated policy.

17. Contact us

For any privacy-related queries, access requests, or complaints, please contact: