POPIA: ownership, access, retention, termination
The four questions every legal and procurement team asks before candidate data is handed to a vendor, answered plainly. Loomee Group (Pty) Ltd, trading as Qcandidate, is the operator. You remain the responsible party for your candidates' personal information.
Last updated September 2026
1. Who owns the data
You do. Under POPIA your organisation is the responsible party for the candidate information you collect and submit; Qcandidate is the operator, processing it only on your documented instruction and only for the purposes you set. We never sell your candidate data, never use it to train an AI model, and never move a candidate into our Talent Network on your behalf — only the candidate can do that, with a typed signature on their own listing. You can export every job, application, score and report as CSV or PDF at any time without asking us.
2. Who can see it
Access is scoped by role and enforced in the database itself:
Your recruiters and hiring managers
Only your own workspace
Row-level security in the database scopes every job, application, score and report to the account that created it. One customer cannot query another customer's candidates — it is enforced at the database, not in the interface.
Candidates
Only their own result
A candidate opens their report through a single expiring link. It shows their own score and evidence and nothing about any other applicant.
Talent Network buyers
Anonymous profiles until unlocked
Scores, skills, gaps and location — no name, no email, no photo — until the candidate's own consent is in place and the buyer spends a credit. Every unlock is logged and visible to the candidate.
Qcandidate staff
Support access only, logged
Administrative access is limited to the founder and used only to investigate a fault or a reported abuse. It is protected by a separate credential and every action is recorded.
Subprocessors
Only what their function needs
The AI model receives job spec and CV text for the duration of a scoring call. Hosting and email providers receive request metadata and email addresses. The full list is on the DPA page.
3. How long it is kept
POPIA section 14 requires that records are not kept longer than necessary. Each record type has its own window, applied automatically:
| Record | Retention | Notes |
|---|---|---|
| CVs screened without an account | Not stored at all | A screening run started without signing in keeps only a count of CVs processed. No name, email or CV text is written to the database. |
| Job applications and scored CVs | 12 months from the screening date | Kept so you can defend a hiring decision if it is challenged, then deleted. You can delete any application sooner from your workspace. |
| Candidate result links (portal tokens) | 30 days | The link a candidate uses to read their own report expires automatically. |
| Talent Network listings | Until the candidate withdraws | Every listing is created by the candidate with a typed signature. Withdrawing removes it immediately and permanently. |
| Decision and sign-off logs | 3 years | Who signed off which shortlist, and when. Retained as the evidence record for Employment Equity and POPIA enquiries. Contains no CV content. |
| Billing records | 5 years | Held by our merchant of record to meet tax law. Contains no candidate data. |
4. Candidate rights
A candidate may ask to see everything held about them, correct it, object to it, or have it deleted. Requests are honoured within 30 days at no cost, to the candidate directly or through you. A candidate who has joined the Talent Network can also see every employer who unlocked their contact details and report misuse. No candidate is ever rejected by software alone: a named person signs off every decision, which is what keeps the process outside the POPIA section 71 prohibition on solely automated decisions with legal consequences.
5. What happens when you terminate
On the day you cancel: your workspace becomes read-only for 30 days so you can export anything you still need; we will also produce a full export for you on request at no charge. At the end of those 30 days every job, application, CV file, score and report belonging to your account is permanently deleted from live systems, and encrypted backups age out within a further 30 days. Decision and sign-off logs are retained for their three-year window because they are your defence record, and they contain no CV content. Billing records stay with our merchant of record for the tax period. You can ask for immediate deletion instead of the 30-day window, and we will confirm it in writing. Nothing is held hostage: there is no exit fee and no data-release charge.
6. Security and location
Candidate data is stored in managed cloud infrastructure with encryption in transit and at rest, access scoped per account at the database level, and administrative access behind a separate credential. Processing may occur outside South Africa, which POPIA section 72 permits where the recipient is bound to a comparable level of protection — every subprocessor is contractually bound to those terms and listed on our DPA page. If a breach affecting your candidates occurs, we notify you without undue delay and within 72 hours of becoming aware, with what happened, who is affected and what we are doing, so you can meet your own section 22 notification duty.
Ask us for the paperwork
The signed operator agreement, subprocessor list and bias-audit methodology are available on request to p.sweleni@loomeeremote.com. Wider legal positions — Employment Equity Act, EU AI Act, NYC Local Law 144 — are on the compliance page.