Privacy Policy

1. Introduction

This Privacy Policy explains how Vation, a Business Operating System owned by Afrovation (Pty) Ltd and licensed to Afrovation Group (Pty) Ltd, collects, uses, stores, and protects the personal and proprietary information of Afrovation Group (Pty) Ltd employees. Vation is an internal staff platform: accounts are provisioned only for Afrovation Group employees, and the mobile app cannot be used without an employee account. By accessing Vation on the web or through the mobile app, you agree to the terms outlined in this policy.

2. Information We Collect

• Account credentials: Your work email address and password, used to sign in. The mobile app stores authentication tokens (not your password) in the device's secure storage (iOS Keychain / Android Keystore).
• Personal information: Name, email address, phone number, ID number, date of birth, department, job title, and location as provided during account creation or staff directory import.
• Employment data: Leave balances, performance reviews, job descriptions, expense claims, team assignments, reporting structures, and activity logs.
• Photos and files: Receipt photos you capture or select on the mobile app for expense claims, and documents you upload to the platform. Camera and photo library access is used only when you choose to attach a photo; the app never accesses your camera or library in the background.
• Push notification tokens: A device push token, so we can deliver work notifications (approvals, tasks, inbox messages) to your device. Tokens identify the device installation, not your location.
• Usage data: Login timestamps, feature usage patterns, and session information for platform improvement, security, and reporting purposes.
• Communications: Messages sent through the AI assistant, notes, task descriptions, and request submissions.

Vation does not collect your device location, contacts, health data, browsing history, or advertising identifiers, and does not use your data for advertising or tracking across other companies' apps or websites.

3. How We Use Your Information

• Provide and maintain platform functionality including HR management, expense claims, task tracking, and CRM features.
• Process leave applications, performance reviews, and expense claims (including attached receipt photos).
• Send notifications related to approvals, tasks, and system updates via email, in-app notifications, and mobile push notifications.
• Generate reports for management and HR administration.
• Power the AI assistant with relevant context to provide helpful responses.
• Secure the platform, including rate limiting and audit logging.

4. Data Storage and Security

All data is transmitted over encrypted connections (TLS) and stored securely using industry-standard encryption. The platform uses PostgreSQL databases with encrypted connections, and documents and photos are stored in secure cloud object storage. Access to data is controlled through role-based access control (RBAC), ensuring employees can only access information appropriate to their role. On the mobile app, session tokens are held in the operating system's secure storage and are revoked on sign-out.

5. Data Sharing

Your personal information is not sold and is not shared with third parties outside of Afrovation, except for the service providers required to operate the platform: cloud hosting and database providers, an email delivery provider (for transactional email), push notification delivery services (Apple Push Notification service, Google Firebase Cloud Messaging / Expo push service), and third-party AI services that process AI assistant queries for the duration of the session only. Data may be shared internally with HR administrators, line managers, and relevant department heads as required for business operations.

6. Data Retention and Deletion

Employee data is retained for the duration of your employment and thereafter as required by South African employment and tax law. Push tokens are deleted when you sign out or uninstall the app. To request access to, correction of, or deletion of your personal data, contact HR administration or email info@afrovation.com. Account deletion is handled through HR as part of the employment relationship.

7. Your Rights

In line with the Protection of Personal Information Act (POPIA), you have the right to access your personal information, request corrections to inaccurate data, understand how your data is used, and raise concerns about data handling with HR administration or the Information Regulator of South Africa.

8. Children

Vation is a workplace tool for Afrovation Group employees and is not directed at, or usable by, children.

9. Changes to This Policy

We may update this policy from time to time. The "Last updated" date above reflects the latest revision; material changes are announced on the platform.

10. Contact

Afrovation (Pty) Ltd · info@afrovation.com · vation.afrovation.com