Privacy & POPIA Policy

DrawPoint Talent, a division of SATalent1st (Pty) Ltd  |  Version 2.0, March 2026

1. Introduction

DrawPoint Talent (“DrawPoint”) is a division of SATalent1st (Pty) Ltd (“SATalent1st”, “we”, “us”, or “our”). We respect your right to privacy and are committed to protecting your personal information in accordance with the Protection of Personal Information Act, 2013 (“POPIA”) and, where applicable, the General Data Protection Regulation (EU) 2016/679 (“GDPR”).

This Privacy Policy explains how we collect, use, store, share and protect personal information for recruitment and placement within the mining and engineering industry.

2. Responsible Party

• Legal Entity: SATalent1st (Pty) Ltd
• Division: DrawPoint Talent
• Registration Number: 2025/936338/07
• Information Officer: Fransua van der Westhuizen
• Information Officer Registration: 2026-000484 (Information Regulator of South Africa)
• Email: Compliance@SATalent1st.com
• Registered Address: 11 Kanonberg Street, De Bron, 7530, Cape Town, South Africa

3. Purpose of Processing

We collect and process personal information strictly for the following purposes:

• Mining and engineering recruitment and placement
• Candidate assessment and profiling
• Communication regarding employment opportunities
• Reference verification
• Compliance with mining, engineering or employment regulations

Participation in candidate intake is voluntary and not linked to any training institution, certification or academic performance.

4. Information We Collect

We may collect the following categories of personal information:

4.1 Basic Information

• Full name
• Contact details (email, telephone, physical address)
• Nationality
• Date of birth
• Availability
• Employment history
• Qualifications and certifications

4.2 Recruitment Information

• Curriculum vitae (CV)
• Industry tickets and certificates
• Professional references
• Photographs (where applicable)

4.3 Identification Information (Where Required)

• Passport details
• Visa status
• Identification numbers

4.4 Special Personal Information (Only Where Necessary)

• Criminal background clearances
• Medical fitness documentation
• Regulatory compliance documentation

Special personal information is processed only where required by law or by the nature of the placement, and only with your explicit consent.

5. Lawful Basis for Processing

We process personal information on one or more of the following lawful bases:

• Your voluntary, informed and specific consent
• Our legitimate interest in providing recruitment and placement services
• The performance of a contract to which you are a party, or in order to take steps at your request prior to entering into a contract
• Compliance with a legal or regulatory obligation

Where processing is based on consent, you may withdraw that consent at any time by contacting Compliance@SATalent1st.com. Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal.

6. Sharing of Information

Your personal information may be shared with the following categories of recipients, and only to the extent necessary for recruitment and placement purposes:

• Prospective employers on mining and engineering operations
• Tier 1 and Tier 2 producers, junior miners, exploration and drilling companies
• EPCM and engineering contractors
• Mine and project management acting for those operations
• Regulatory authorities, where required by law

We do not sell, rent or trade personal information. Your information is never used for marketing, analytics or any purpose other than providing our recruitment service.

7. Cross-Border Transfers

Mining and engineering employment is international by nature, and DrawPoint places on the corridor between African and Australian operations. Your personal information may be transferred to, and processed in, countries outside South Africa in order to facilitate recruitment and placement.

Where such transfers occur:

• They are strictly for legitimate recruitment and placement purposes
• Appropriate safeguards are implemented, including contractual data protection obligations on the receiving party
• Our platform infrastructure is ISO 27001 accredited and operates on secure, globally recognised cloud services with encryption in transit and at rest
• Your explicit consent is obtained where required by POPIA or GDPR

Where personal information is transferred to a country that does not provide an adequate level of data protection, we ensure that appropriate contractual or other safeguards are in place to protect your information.

8. Data Security

We implement appropriate technical and organisational measures to protect personal information against unauthorised access, loss, destruction or damage. These include:

• A secure, ISO 27001 accredited recruitment platform
• Encryption of data in transit (TLS) and at rest
• Role-based access controls
• Multi-factor authentication
• Access logging and monitoring
• Restricted internal access limited to authorised personnel only

Security measures are reviewed regularly and updated as necessary to address emerging threats and vulnerabilities.

9. Data Retention

We retain personal information only for as long as is necessary to fulfil the purposes for which it was collected, or as required by law.

• Candidate profiles may be retained for up to 3 years from the date of last activity, unless you request earlier deletion
• Special personal information (medical fitness, criminal clearances) is retained only for the duration necessary for placement consideration
• Platform records required for regulatory compliance or audit purposes may be retained for the period prescribed by applicable law

You may request deletion of your personal information at any time by contacting Compliance@SATalent1st.com. We will action your request unless we are required by law to retain the information.

10. Your Rights

Under POPIA, and where applicable the GDPR, you have the following rights in relation to your personal information:

• Access: the right to request confirmation of whether we hold personal information about you, and to request a copy of that information
• Correction: the right to request correction or updating of inaccurate, incomplete or misleading personal information
• Deletion: the right to request deletion or destruction of your personal information where it is no longer necessary for the purpose for which it was collected
• Objection: the right to object to the processing of your personal information on reasonable grounds
• Withdrawal of consent: the right to withdraw consent at any time, where processing is based on consent
• Restriction of processing: the right to request that we restrict the processing of your personal information in certain circumstances (GDPR)
• Data portability: the right to receive your personal information in a structured, commonly used and machine-readable format, and to transmit it to another controller (GDPR)
• Complaint: the right to lodge a complaint with the Information Regulator of South Africa or, for EU data subjects, with the relevant supervisory authority in your member state

To exercise any of these rights, please contact Compliance@SATalent1st.com. We will respond to your request within the timeframes required by applicable law, generally within 30 days under POPIA, or one month under GDPR.

11. Data Breaches

In the event of a personal data breach that poses a risk to the rights and freedoms of data subjects, we will:

• Take immediate steps to contain and remediate the breach
• Notify the Information Regulator of South Africa as soon as reasonably possible, as required by POPIA Section 22
• Notify affected data subjects where the breach is likely to result in a risk to their rights and freedoms
• Where applicable, notify the relevant EU supervisory authority within 72 hours in accordance with GDPR Article 33

All suspected or actual data breaches are investigated under our internal Data Breach Protocol and recorded for audit purposes.

12. Third-Party Processing: the Hired1st Platform

DrawPoint uses the Hired1st recruitment platform, operated by PowerHouse Hub, to securely manage candidate information.

12.1 Roles and Responsibilities

• SATalent1st, through its DrawPoint Talent division, acts as the Data Controller and determines the purposes and means of processing
• Hired1st acts solely as Data Processor and processes personal information only on DrawPoint’s documented instructions

All personal data processed on the platform remains the property of SATalent1st and/or the relevant data subject. Hired1st does not use personal data for analytics, marketing or any purpose other than providing the recruitment platform service.

12.2 Data Processing Standards

Hired1st processes personal data:

• Only in accordance with SATalent1st’s documented instructions
• In alignment with applicable privacy laws, including POPIA and GDPR
• Under ISO 27001 accredited information security management standards

12.3 Security Controls

The Hired1st platform implements the following security controls:

• Encryption of data in transit (TLS) and at rest (AWS SSE-S3/KMS)
• Role-based access controls
• Multi-factor authentication
• Comprehensive access logging
• Secure, globally recognised cloud infrastructure (AWS)

Access by Hired1st personnel occurs only where necessary, for example support or troubleshooting, and is subject to strict authorisation and logging controls.

12.4 Candidate Privacy Controls

The platform provides candidates with control over their own data:

• Candidates control what information employers can view on their profile
• Candidates can set availability status, removing their profile from active search results
• Candidates can edit, update or delete their job role profiles at any time
• All candidate data is encrypted within the system
• Candidate contact details are hidden from employers until the candidate is shortlisted

12.5 Retention and Deletion

Data processed via the Hired1st platform is retained for the duration of the active service relationship unless deletion is requested. Upon termination of the service agreement, data is securely deleted in accordance with Hired1st’s data retention and termination policy, unless otherwise instructed by SATalent1st.

13. Website and Cookies

The DrawPoint website uses only essential and functional cookies that are necessary for the website to operate correctly. We do not use analytics cookies, marketing cookies, advertising trackers or any third-party tracking technologies.

Essential cookies may include session management cookies required for login functionality and security. These cookies do not collect personal information for marketing or profiling purposes and cannot be disabled without affecting the functionality of the website.

14. Updates to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology or legal requirements. The most recent version will always be published on this website at drawpointtalent.com/privacy.html. We encourage you to review this policy periodically.

Where material changes are made that affect how we process your personal information, we will take reasonable steps to notify you.

15. Contact and Complaints

For any questions regarding this Privacy Policy, your personal information, or to exercise any of your rights, please contact:

• Information Officer
• SATalent1st (Pty) Ltd, DrawPoint Talent division
• Email: Compliance@SATalent1st.com
• Post: 11 Kanonberg Street, De Bron, 7530, Cape Town, South Africa

If you are not satisfied with our response, you have the right to lodge a complaint with:

• Information Regulator of South Africa: inforegulator.org.za
• For EU data subjects: the supervisory authority in your member state of residence