Privacy Policy
How FairCase collects, uses, and protects your personal information under POPIA
Version 2026-09-15 · Supersedes version 2026-07-26 · Prepared under the Protection of Personal Information Act 4 of 2013
1. Introduction
1.1This Privacy Policy explains how BDT Systems (Pty) Ltd, trading as FairCase ("FairCase", "we", "us", "our"), as the responsible party, collects, uses, discloses, and protects personal information in connection with the FairCase website, web application, and mobile application (together, "the Platform"), in accordance with the Protection of Personal Information Act 4 of 2013 ("POPIA").
1.2This Policy applies to all Users of the Platform. By using the Platform and providing your consent where indicated, you acknowledge that you have read and understood this Policy.
1.3We process personal information that is, by its nature, sensitive, including identity numbers, salary information, and details of personal employment disputes. We treat this information with particular care, as set out in this Policy.
2. Definitions
2.1Terms used in this Policy have the meaning given to them in POPIA, including:
- "Personal information" means information relating to an identifiable, living natural person, including but not limited to name, identity number, contact details, employment history, and financial information.
- "Processing" means any operation performed on personal information, including collection, storage, use, disclosure, and deletion.
- "Responsible party" means the entity that determines the purpose and means of processing personal information, in this case FairCase.
- "Operator" means a third party that processes personal information on behalf of FairCase under our instruction, such as our hosting and payment providers.
- "Data subject" means the person to whom personal information relates, in this case you, the User.
3. What personal information we collect
| Category | Examples | Collected at |
|---|---|---|
| Identity information | Full name, South African ID number | Account registration |
| Contact information | Email address, phone number, province | Account registration |
| Employment information | Job title, salary, years of service, employment type, union membership, disciplinary record | Case submission, Step 1 |
| Dismissal information | Employer name, dismissal date, dispute type, reasons given, procedural details, free-text description of circumstances | Case submission, Step 2 |
| Document uploads | Employment contracts, dismissal letters, payslips, warning letters, correspondence | Case submission, Step 3 |
| Payment information | Transaction records, processed by our payment gateway. We do not store full card or banking details | Payment step |
| Technical information | IP address, device type, browser type, sign-in and audit events, privacy-masked usage analytics, bot-protection signals | Automatically, throughout use of the Platform |
4. How your Report is produced
4.1We explain this here because your Report is produced by automated processing, and you are entitled to understand how it works.
4.2The numbers are produced by a rules engine. The engine applies the same published South African labour legislation and CCMA guidance to every User. It uses only the structured answers you gave, such as your dismissal date, the reason your employer gave, whether a hearing was held, your length of service, and your salary. The same answers always produce the same result. The probability score, the classifications, and the settlement range are all produced this way. Your written description of what happened is not an input to those rules.
4.3The analysis sections, being the substantive analysis, the procedural analysis and the key risks, are produced by an artificial intelligence language model operated by Anthropic. The model is given the output of the rules engine, which it is instructed not to change, together with the first 1 200 characters of the written description of what happened that you entered, and six facts about your job: your job title, your employment type, your length of service, your industry sector, and the dismissal reason category you selected. It writes the explanatory sections itself, in its own words. It cannot change your score, your classifications, or your settlement range.
4.4We do not send the model your name, your identity number, your contact details, your employer’s name, your salary, or any document you upload. We also do not remove personal information from the description you typed before we send it, so anything you choose to write there is sent as you wrote it. Please share only what you are comfortable sharing.
4.5The section explaining what happens next in the CCMA process is not produced by artificial intelligence and is not sent to the provider. It is standard information, the same for every User with the same type of dispute, with your own dates filled in. If the artificial intelligence provider is unavailable, the analysis sections are assembled from fixed templates instead, and your Report says so.
4.6No person at FairCase reads your case, or reviews, approves or changes an individual Report, before it is delivered to you.
4.7Your Report is information for you to consider. It is not a decision about you and it does not decide anything for you. What you do next, including whether to refer your dispute, is entirely your decision. If you would like more detail about how the assessment works, contact us using the details in Section 12.
5. Purpose and lawful basis for processing
Under POPIA, we may only process personal information for a specific, lawful purpose, and only where a lawful basis applies. The table below sets out each purpose and the basis relied upon.
| Purpose | Lawful basis |
|---|---|
| Creating and managing your account | Necessary for the performance of our contract with you |
| Generating your case probability Report, including the rules-based assessment and the generation of the written sections of the Report | Necessary for the performance of our contract with you. Processing of special personal information is undertaken with your explicit consent |
| Storing your uploaded documents and your written description of your circumstances, so that your own record of your dismissal is kept in one place, is available for you to download or attach to your referral yourself, and is used to generate the written sections of your Report | Necessary for the performance of our contract with you, and with your explicit consent where special personal information is involved |
| Processing payment for the Report and add-ons | Necessary for the performance of our contract with you |
| Contributing anonymised data to the Employer Database | Your separate, specific, opt-in consent. You may decline without affecting your ability to use the core service |
| Sending you service-related communications, including sign-in codes, payment confirmations, deadline reminders and progress nudges | Necessary for the performance of our contract with you. Reminders and nudges can be switched off at any time in your account settings |
| Improving the Platform and our scoring methodology | Our legitimate interest in improving our service, balanced against your privacy rights, using de-identified or aggregated data wherever feasible |
| Complying with legal obligations, such as tax and record-keeping | Necessary for compliance with a legal obligation |
| Security, fraud prevention, bot protection on our public forms, and audit logging of security-relevant events | Our legitimate interest in keeping the Platform and your account secure |
6. Consent
6.1We obtain your consent separately and explicitly for two distinct purposes, which you may accept or decline independently:
- Platform use consent: your agreement to our processing of your personal information as necessary to create your account and generate your Report. This consent is required to use the core service.
- Data sharing consent: your agreement that anonymised, aggregated data derived from your case may be included in our Employer Database and displayed as aggregated employer statistics within the Platform. This consent is optional. Declining it does not affect your ability to use the core service.
6.2You may withdraw your data sharing consent at any time in your account settings or by contacting us as set out in Section 11. Withdrawal does not affect data already aggregated and anonymised in a manner that no longer identifies you, nor does it affect the lawfulness of processing carried out before withdrawal.
7. Aggregated employer insights: anonymisation standard
7.1Where you have provided data sharing consent, information derived from your case submission may contribute to our Employer Database, which records aggregated statistics about employers, including the number and general nature of disputes referred against them through the Platform.
7.2We apply the following standard before any statistic derived from the Employer Database is displayed:
- No individual case is identifiable. Data is aggregated to the employer level, for example "23 cases logged" rather than any individual case detail.
- No employee name, ID number, contact information, or other directly identifying information is ever included in any displayed statistic.
- Free-text descriptions of circumstances are never included in any displayed statistic or derived feature.
- Aggregation thresholds are applied so that data is not published in a manner that could allow a small number of cases to be reverse-identified to a specific individual. At launch, employer statistics are only displayed where at least three consenting cases exist for the employer concerned.
8. Disclosure of personal information to third parties
8.1We disclose personal information to the following categories of third party, only as necessary for the purposes described in this Policy:
| Third party category | Purpose of disclosure | Information disclosed |
|---|---|---|
| Cloud hosting and database provider | Storing and processing your data to operate the Platform | All personal information you submit, in accordance with our security obligations in Section 9 |
| Payment gateway provider | Processing your payment for the Report or add-ons | Payment-related information necessary to complete the transaction |
| Email delivery provider | Sending you transactional emails, including Report delivery, sign-in codes, and deadline reminders | Your email address and the content of the relevant communication |
| Artificial intelligence text generation provider | Writing the explanatory sections of your Report from the output of our rules engine | The first 1 200 characters of your written description of what happened, your job title, employment type, length of service, industry sector and the dismissal reason category you selected, and the output of our rules engine. Not your name, identity number, contact details, employer name, salary, or any uploaded document. Under our agreement with the provider, this information is not used to train its models |
| Analytics provider | Understanding Platform usage to improve the service | De-identified usage data. No automatic capture of what you type, no session recordings, text masking enabled, events linked only to a random account identifier |
| Error monitoring provider | Detecting and diagnosing technical faults | Technical information such as the failing web address, the error message, and a short log of recent server messages. Form contents, cookies, request headers, web page content and uploaded documents are not captured, and personal fields are redacted before the report is sent |
| Bot protection provider | Checking that a visitor to our public forms is a person and not an automated script | Your IP address and browser signals |
| Email delivery provider, contact form | Delivering a message you send us through the contact form on our website to the FairCase inbox | Your name, your email address, and the message you typed |
| Regulators or courts | Where required by law | Only the specific information required by a valid legal request |
8.2The operators we currently use, and where they process data, are:
| Operator | What it does, and where it processes data |
|---|---|
| Supabase | Database, authentication, and document storage. European Union region |
| Vercel | Application hosting. Global edge network, including the United States and the European Union |
| Resend | Transactional email. United States |
| Anthropic | Artificial intelligence text generation for the written sections of your Report. United States |
| PostHog | Privacy-masked product analytics. European Union region |
| Sentry | Error monitoring. European Union region |
| Cloudflare | Bot protection on our public forms, through Cloudflare Turnstile. Global network |
| PayFast | Payment processing. South Africa |
8.3We will update this list if our operators change. Where an operator changes, we will update this Policy and notify registered Users of material changes as set out in Section 15.
8.4We do not sell personal information to third parties. Aggregated employer statistics displayed within the Platform are subject to the anonymisation and aggregation standard described in Section 7 and do not constitute disclosure of personal information as defined under POPIA.
8.5Transfers outside South Africa. Every operator listed in clause 8.2 other than PayFast processes personal information outside South Africa. For each such operator, we rely on one or both of the following, in terms of section 72 of POPIA: (a) the operator is bound by a written agreement with us that requires it to protect your information to a standard substantially similar to POPIA’s requirements; and (b) the transfer is necessary to perform our contract with you, for example to host your account or generate your Report. We have written data processing agreements in place with each operator listed in clause 8.2 that processes personal information outside South Africa.
9. Security of personal information
9.1We implement appropriate technical and organisational measures to protect personal information against loss, unauthorised access, interference, modification, or destruction, as required by section 19 of POPIA. These measures include:
- Encryption of personal information at rest and in transit
- Row-level access controls restricting data access to what is necessary for each function of the Platform
- Passwordless sign-in with one-time email codes, with optional two-factor authentication
- Blocking of disposable email addresses at registration to protect account continuity
- Masking of ID numbers in administrative views, and restricted internal access on a need-to-know basis
- Audit logging of security-relevant events, including sign-ins and administrative actions
- Bot protection on our public forms
- Regular review of our security practices as the Platform evolves
9.2No method of electronic storage or transmission is completely secure. While we strive to protect your personal information, we cannot guarantee absolute security.
9.3In the event of a security compromise that has compromised, or that we reasonably believe has compromised, your personal information, we will notify the Information Regulator and affected Users as required by section 22 of POPIA.
10. Retention of personal information
10.1We retain your personal information for as long as necessary to fulfil the purposes described in this Policy, or as required by law, whichever is longer. We do not keep it longer than that.
10.2Case content, uploaded documents, the dismissal narrative, and the Report are deleted after 12 months of account inactivity, meaning no sign-in and no case activity. We will email you a warning 30 days before deletion. Signing in or engaging with your case at any point resets this period. Accounts that never complete a payment are deleted after 90 days of inactivity, with the same warning. Payment records are retained for 5 years for tax purposes. You may delete your account and all associated data at any time, regardless of these periods.
| Data category | Retention period |
|---|---|
| Case content, uploaded documents, dismissal narrative, and Report | Deleted after 12 months of account inactivity, with a warning email 30 days before deletion. Any sign-in or case activity resets the period |
| Accounts that never completed a payment | Deleted entirely after 90 days of inactivity, with the same 30-day warning |
| Account and profile information | Retained while your account is active. Deleted when you delete your account, subject to legal retention requirements |
| Payment records | Retained for 5 years, for South African tax record-keeping purposes |
| Audit log entries | Retained for 24 months, for security accountability |
| Anonymised Employer Database contributions | Retained indefinitely in anonymised, aggregated form, as such data no longer constitutes personal information once properly anonymised |
11. Your rights under POPIA
11.1Subject to applicable exceptions, you have the right to:
- Be notified that your personal information is being collected, as set out in this Policy
- Access the personal information we hold about you
- Request correction or deletion of personal information that is inaccurate, irrelevant, excessive, out of date, incomplete, or obtained unlawfully
- Object to the processing of your personal information on reasonable grounds, including for purposes of direct marketing
- Withdraw consent where processing is based on consent, including your data sharing consent for the Employer Database
- Lodge a complaint with the Information Regulator if you believe we have processed your personal information unlawfully
11.2The Platform provides self-service tools for the most important of these rights. You can download a complete copy of your data, and permanently delete your account and all associated information, directly in your account settings, without needing to contact us. For any other request, contact us using the details in Section 12 and we will respond within a reasonable time and in accordance with POPIA’s requirements.
11.3Please note that deletion of certain information, for example financial records required by law, may not be possible while a legal or regulatory retention obligation applies.
12. Information Officer and contact details
| Role | Detail |
|---|---|
| Information Officer | The Information Officer, FairCase |
| infoOfficer@faircase.co.za | |
| Postal address | 194 Bancor Avenue, Park Lane West, Waterkloof Glen, Pretoria 0181 |
| Information Regulator (South Africa) | JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001. enquiries@inforegulator.org.za. complaints.IR@justice.gov.za. www.justice.gov.za/inforeg |
13. Cookies and analytics
13.1We use only the cookies and browser storage needed to keep you signed in and to save your assessment progress on your device. We do not use advertising trackers.
13.2Our product analytics, PostHog, hosted in the European Union, is configured privacy-first: automatic capture of clicks and page content is disabled, session recordings are disabled, and text masking is enabled. Analytics events record which screens and steps you reach and a small number of fixed answers, such as your dispute type. They are linked only to a random account identifier, never to your name, email address, or ID number, and they never contain free text you have typed.
13.3Our public forms use Cloudflare Turnstile to check that a visitor is a person rather than an automated script. This processes your IP address and browser signals for that purpose only. It is not used to track you across websites and it is not used for advertising.
14. Children’s information
14.1The Platform is not intended for use by individuals under the age of 18. We do not knowingly collect personal information from children. If we become aware that we have inadvertently collected personal information from a child without appropriate consent, we will take reasonable steps to delete it.
15. Changes to this Policy
15.1We may update this Policy from time to time to reflect changes in our practices or legal requirements. We will notify registered Users of material changes by email or in-app notice before they take effect. Each version carries a version date.
End of Privacy Policy, version 2026-09-15.