Where your data lives
- App and database: hosted at the Teraco data centre in Johannesburg, South Africa (provider: domains.co.za).
- Backups: daily, weekly and monthly, kept in South Africa.
- Worker photos, videos and voice notes (Khaya Connect): stored with Amazon Web Services in Cape Town, South Africa. To help them load quickly, short-term copies may be held on Amazon CloudFront servers, some of them outside South Africa.
Some services work outside South Africa. For example, WhatsApp messages are handled by Meta (Ireland and the US). We only send personal information abroad as section 72 of POPIA allows, under agreements that bind the provider to protect it.
Khaya AI and the chat on our website use OpenAI, which processes the questions you ask and the information needed to answer them on servers in the United States. We send only what's needed for the answer, and we rely on the safeguards POPIA requires for transfers outside South Africa (section 72), as set out in our privacy policy. Khaya AI's answers are general guidance, not legal advice. Check important decisions.
Who can get to it
- Our team: access only for authorised people, each with their own login.
- Our hosting account: protected with two-factor authentication.
- Our database: only accepts connections from our own app server.
- Your employees: each employee sees their own payslips, leave and documents in their portal, and nobody else's.
- Documents you send: contracts and documents go out through a secure link for the employee to read and sign.
- ID documents (Khaya Connect workers): kept in a restricted, encrypted storage folder. Employers never see the ID itself.
- Roles in your account: four roles (owner, admin, manager and viewer), enforced on our server, not just hidden on screen. Viewers can only read. Managers can't change your team, settings or billing.
- Employee bank account numbers are masked on screen.
Records you can trust
- A payslip can't be locked unless the employee and employer UIF contributions reconcile.
- Once locked, a payslip is kept on the record as issued.
- Employment history stays on file when someone leaves.
POPIA: who is responsible for what
- You are the responsible party for your employees' personal information. KhayaHR acts as your operator and processes it on your behalf.
- We protect personal information with reasonable technical and organisational measures, as section 19 of POPIA requires.
- Our agreements with service providers include security duties.
- If there's a breach: If we believe someone has accessed your employees' personal information without permission, we'll notify you, as the responsible party, immediately, as section 22 of POPIA requires. You then notify the Information Regulator and the affected employees, and we'll help you do that. For information we're responsible for, such as website and account-user data, we notify the Regulator and the people affected ourselves.
Our Information Officer
Our Information Officer is registered with the Information Regulator. To ask what we hold about you, correct it, object or withdraw consent, email privacy@khayahr.co.za. We may need to confirm who you are first, and we'll respond within 30 days.
If you're an employee of one of our customers, your employer is responsible for your information, so please contact them first. We'll help them respond.
If you're unhappy with how we handle your information, you can complain to the Information Regulator at inforegulator.org.za.
PAIA manual
Our PAIA manual explains how to request records, which form to use and the fees that may apply. People asking for their own personal information don't pay the request fee. Requests are accepted by email or post.
Cookies and tracking
- Essential cookies keep you logged in and the service safe. These are always on.
- Analytics (Google Analytics) helps us understand how the site is used. It loads only if you switch on the Analytics toggle, which is off by default.
- Marketing tags (Meta, LinkedIn and TikTok) load only if you switch on the Marketing toggle, which is off by default.
- You can change your choice at any time in Cookie settings, or in the app under Profile → Privacy & cookies. Separately, Meta receives limited information about website sign-ups and purchases through a server-side connection that the cookie banner doesn't control. See our privacy policy.
How long we keep it
App account and payroll data is kept for 7 years after a customer cancels, then deleted. Deleted information may stay in backups until they're overwritten in their normal cycle.
Read the full documents
Khaya HR Solutions (Pty) Ltd, reg 2026/843132/07.
FAQ
Where is my payroll data stored?
- Our app and database are hosted at the Teraco data centre in Johannesburg, and backups are kept in South Africa. Some services, such as WhatsApp messaging, work outside South Africa under agreements POPIA allows.
Who at KhayaHR can see my data?
- Only authorised people, each with their own login. Our database only accepts connections from our own app server.
Can my employees see each other's payslips?
- No. Each employee sees their own payslips, leave and documents in their portal, and nobody else's.
Who is responsible under POPIA, me or KhayaHR?
- As the employer, you're the responsible party for your employees' data. KhayaHR is your operator.
What happens if there's a data breach?
- We'll notify you, as the responsible party, immediately, as section 22 of POPIA requires, and help you notify the Information Regulator and your affected employees. For our own website and account-user data, we notify the Information Regulator and the people affected ourselves.
How do I ask for my information or have it corrected?
- If you're an employee of one of our customers, contact your employer first. Otherwise, email our Information Officer at privacy@khayahr.co.za. We'll respond within 30 days. For formal record requests, see our PAIA manual.