Privacy Policy

GoHire (Pty) Ltd ("GoHire", "we", "us", "our") is the responsible party under the Protection of Personal Information Act 4 of 2013 ("POPIA") in respect of the personal information we collect and process through the GoHire platform (gohireco.com). This Privacy Policy explains what personal information we collect, why we collect it, how we use it, who we share it with, how long we keep it, and what your rights are. Our designated Information Officer is: [ATTORNEY: Insert full name of designated Information Officer] Contact: [ATTORNEY: Insert Information Officer email address] [ATTORNEY: Confirm registration with the Information Regulator of South Africa if required and insert registration details.]

We collect the following categories of personal information depending on your account type: ALL USERS • Full name and email address • Password (stored as a one-way hash — we cannot see your password) • IP address and device/browser information (for security and fraud detection) • Date and time of account creation and consent to these terms CANDIDATES • First and last name, contact details • Employment history, education, skills and qualifications • CV documents and any information contained therein • Voluntarily provided Employment Equity information (gender, race) — used for EEA reporting features only • Profile visibility preferences • Application history and status EMPLOYERS • Company name, registration details, industry • Contact person name and details • Job specifications and vacancy information • Billing history (payment amount and date — card details are never stored by GoHire) RECRUITERS • Agency/company name • Contact person name and details • Candidate shortlists and search history • Billing history [ATTORNEY: Review and expand this list to ensure it is exhaustive. Confirm whether any special personal information (as defined in POPIA s26) is collected and if so, add appropriate safeguards and grounds for processing.]

We collect personal information: • Directly from you when you register, complete your profile, upload a CV, or use platform features • Automatically when you use the platform (session data, usage logs, IP addresses) • From third-party authentication providers if you use social sign-in (where applicable) • From payment processors (PayFast) in respect of transaction confirmations — we do not receive full card details [ATTORNEY: List any other sources, e.g. LinkedIn profile imports, background check integrations, etc.]

We process personal information for the following purposes: 4.1 To provide the GoHire service — matching candidates with employers and recruiters, managing job applications, running the hiring pipeline. 4.2 To process payments — subscription billing and credit purchases via PayFast. 4.3 To improve the platform — analysing usage patterns to improve features and user experience (using aggregated, de-identified data where possible). 4.4 To ensure security and prevent fraud — detecting and preventing fraudulent activity and unauthorised access. 4.5 To comply with legal obligations — retaining records as required by South African law. 4.6 Marketing communications — only where you have opted in. You may opt out at any time. 4.7 AI-powered matching and scoring — candidate profile data is processed by our AI systems to generate relevance scores and matching recommendations. This processing is automated but is used only to assist human recruiters and employers, not to make legally binding employment decisions autonomously. [ATTORNEY: Confirm lawful basis for each processing purpose under POPIA s11. If any processing relies on consent, ensure consent is freely given, specific and informed. Add detail on automated decision-making disclosures under POPIA s71.]

We share personal information only as follows: WITHIN THE PLATFORM • Candidate profiles are visible to registered, verified employers and recruiters (subject to the candidate's visibility settings). • Employer company information is visible to candidates viewing job listings. SERVICE PROVIDERS (operators under POPIA) • Supabase — database hosting and storage (data hosted in EU-West, covered by adequacy arrangements) • Vercel — application hosting and deployment • PayFast — payment processing • Anthropic — AI processing (Claude API) for matching and scoring features [ATTORNEY: For each operator, confirm that a data processing agreement (operator agreement under POPIA s20-21) is in place. Confirm cross-border transfer compliance under POPIA s72. Insert current details of any additional processors.] WE DO NOT • Sell your personal information to third parties • Share your personal information with advertisers • Use candidate data for any purpose other than operating the GoHire platform LEGAL REQUIREMENTS We may disclose personal information if required to do so by law or in response to valid legal process.

We retain personal information for as long as your account is active and for a reasonable period thereafter to comply with legal obligations. Specifically: • Active account data: retained for the duration of the account • Billing records: retained for 5 (five) years from the date of transaction in accordance with South African tax and accounting requirements • Security and fraud logs: retained for 12 (twelve) months • Deleted account data: purged within 30 (thirty) days of a verified deletion request, except where retention is required by law [ATTORNEY: Review retention periods against applicable legislation. Confirm if longer retention is required for any category.]

We implement appropriate technical and organisational measures to protect your personal information, including: • Passwords stored as one-way cryptographic hashes (bcrypt) • All data transmitted over encrypted HTTPS connections • Database access restricted to authorised application services • Regular security reviews and access controls • Fraud detection and anomaly monitoring No method of transmission over the internet is completely secure. While we take reasonable precautions, we cannot guarantee absolute security. [ATTORNEY: Add any specific ISO, SOC 2 or other certifications if applicable. Add incident response and breach notification obligations under POPIA s22.]

As a data subject under POPIA, you have the right to: 8.1 ACCESS — request a copy of the personal information we hold about you. 8.2 CORRECTION — request that we correct inaccurate or incomplete personal information. 8.3 DELETION (erasure) — request that we delete your personal information. Note: some data may be retained to comply with legal obligations. 8.4 OBJECTION — object to the processing of your personal information in certain circumstances. 8.5 WITHDRAW CONSENT — where processing is based on consent, withdraw your consent at any time (this will not affect the lawfulness of prior processing). 8.6 LODGE A COMPLAINT — lodge a complaint with the Information Regulator of South Africa: Website: https://www.justice.gov.za/inforeg/ Email: inforeg@justice.gov.za To exercise any of these rights, contact our Information Officer at [ATTORNEY: Insert Information Officer email address] or use the data request feature in your account settings. We will respond to data requests within 30 (thirty) days.

GoHire uses session cookies necessary for the platform to function (authentication sessions). We do not use advertising or tracking cookies. By using GoHire you consent to the use of essential session cookies. You may disable cookies in your browser settings, but this may prevent you from using the platform. [ATTORNEY: Review against POPIA requirements for electronic communications. Confirm if a cookie banner is required given the limited cookie use.]

GoHire is not intended for use by persons under the age of 18. We do not knowingly collect personal information from minors. If you believe a minor has registered on the platform, please contact us at privacy@gohireco.com and we will delete the account promptly.

We may update this Privacy Policy from time to time. We will notify you by email at least 30 (thirty) days before material changes take effect. The current version and effective date are always displayed at the top of this page.

For any questions, requests or complaints regarding this Privacy Policy or the processing of your personal information: Information Officer: [ATTORNEY: Insert full name of designated Information Officer] Email: [ATTORNEY: Insert Information Officer email address] General privacy enquiries: privacy@gohireco.com [ATTORNEY: Insert physical address and any required regulatory contact details.]