Privacy notice (POPIA)

Blue Oceans Approach (Pty) Ltd (registration 2019/629537/07) is the responsible party for personal information collected through this website and for our own customer relationships. When customers use Blue Oceans Business OS to process their own employees', clients' or beneficiaries' information, the customer is the responsible party and we act as its operator under a written data processing agreement.

Our Information Officer can be contacted at +27 82 849 7200 or through the contact page. Information Officer name and registration details: [to be published once registration with the Information Regulator is confirmed].

• Demo and contact requests — name, work email, company, phone and your message, to respond to your request (with your consent).
• Customer accounts — administrator and user details, to provide and support the service under our contract.
• Billing — company and invoicing details, to meet contractual and tax obligations.
• Security logs — IP address, timestamps and actions, to protect the service and investigate incidents (legitimate interest).
• Marketing — only where you opt in; you can unsubscribe at any time.

PeopleOS records work outputs and system interactions (such as submitted deliverables, accepted evidence and approvals) that the employer has disclosed to its workers. It does not intercept personal communications or track personal location. Special personal information — including health and counselling information — is kept out of performance records. Employers remain responsible for lawful processing, notices and fair labour practice; no dismissal or disciplinary decision is automated by the platform.

We share personal information only with operators that help us deliver the service (for example cloud hosting, e-signature, messaging and accounting providers) under written agreements that require appropriate security measures, or where the law requires it. We do not sell personal information.

Production data is intended to be hosted in South Africa. Where an operator processes information outside South Africa, we only transfer it in line with section 72 of POPIA — for example where the recipient is subject to binding agreements or laws that provide an adequate level of protection.

We apply tenant isolation, encryption in transit and at rest, least-privilege access, multi-factor authentication for privileged users, audit logging and tested backups. If a security compromise affecting your personal information occurs, we will notify you and the Information Regulator as POPIA requires.

We keep personal information only as long as needed for the purpose collected, or as required by law, and then delete or de-identify it. Customers can export their workspace data at any time.

You may request access to, correction or deletion of your personal information, object to processing, and withdraw consent where processing is based on consent. Contact us using the details above. You also have the right to lodge a complaint with the Information Regulator (South Africa) via inforegulator.org.za.

The public website uses no advertising or tracking cookies. Demo portals use one strictly necessary cookie to remember the selected demo persona.