Privacy Policy

For manager and administrator data, EWARP acts as the data controller — we decide how and why that information is processed.

For complaint data submitted by employees, EWARP acts as a data processor — we process that data on behalf of the employing company (the data controller). The company is responsible for its employees' data under their own data protection obligations.

A Data Processing Addendum (DPA) is available to companies using EWARP. Contact privacy@ewarp.org to request a copy.

When you submit a complaint, we collect:

• The complaint category (e.g. harassment, safety, unfair treatment)
• Your department (as selected — not linked to your identity)
• A written description of your concern
• Any file attachment you choose to include (optional)
• A tracking token — a random code generated for your complaint so you can follow up anonymously

That's it. Nothing else.

When a manager registers and logs in, we collect:

• Email address — used for login via Supabase Auth
• Company name — to link your account to your organisation

Our hosting providers (Vercel and Supabase) generate standard server and access logs. These may include IP addresses and request timestamps. These logs are temporary, automatically rotated, used only for infrastructure health and security monitoring, and never linked to complaint submissions.

Complaints are shared with your company's designated managers only. We do not sell complaint data, share it with third parties beyond your company's managers, or use it for marketing, profiling, or analysis.

Your email address is used solely for authentication. We don't use it for marketing without your consent.

Under the Protection of Personal Information Act, 4 of 2013 (POPIA), EWARP processes personal information on the following grounds:

For data subjects located in the EEA or UK, EWARP relies on the following lawful bases under the General Data Protection Regulation (GDPR):

Where EWARP processes complaint data as a data processor, the lawful basis is determined by the company as data controller.

Complaint data is shared exclusively with the managers and administrators registered to your company's EWARP account. Access is enforced at the database level using row-level security (RLS) — it is technically impossible for one company to access another company's complaint data.

EWARP uses the following third-party sub-processors to deliver the platform:

Both providers are bound by data processing agreements and are contractually required to process data only as instructed.

EWARP may disclose personal information to South African authorities (including SAPS, the Information Regulator, or a court of law) where required by law. We will, where legally permitted, notify affected parties of such disclosure.

In the event of a merger, acquisition, or sale of EWARP or its assets, personal information may be transferred to the acquiring entity. We will notify managers by email prior to any such transfer and will ensure equivalent privacy protections.

• ❌We do not sell personal information
• ❌We do not rent or trade personal information
• ❌We do not share personal information with third parties for marketing or advertising purposes
• ❌We do not use complaint content for training AI models or any form of profiling

EWARP's primary data store — Supabase — is hosted in London (EU West), which is within the European Economic Area. For GDPR and POPIA purposes, this is considered an adequate destination for personal data originating from South Africa or the EEA.

Vercel operates a global edge network and may process request-level metadata (including IP addresses from server logs) on infrastructure located in the United States. Vercel is covered by a Data Processing Addendum and relies on Standard Contractual Clauses (SCCs) for transatlantic data transfers in accordance with GDPR requirements.

For South African data subjects, EWARP ensures that any cross-border transfers of personal information comply with Section 72 of POPIA, which requires that the receiving party is subject to a law, binding corporate rules, or a binding agreement that provides an adequate level of protection.

That is the complete list of cookies used on EWARP.

• ❌No analytics cookies (no Google Analytics, Mixpanel, or similar)
• ❌No advertising or retargeting cookies
• ❌No third-party tracking pixels
• ❌No social media tracking (no Facebook Pixel, etc.)
• ❌No cookies on the anonymous employee submission flow

Questions, concerns, or requests related to this policy:

We aim to respond to general queries within 5 business days and formal rights requests within 30 days.

If you are not satisfied with how EWARP has handled your privacy concern, you have the right to lodge a complaint with the South African Information Regulator:

• Website: inforeg.org.za
• Email: inforeg@justice.gov.za
• Address: JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001

If you are located in the EEA or UK, you may lodge a complaint with your national data protection supervisory authority. A list of EEA supervisory authorities is available at edpb.europa.eu .