Legal centre
WORK89 PRIVACY

Privacy notice

Effective 11 September 2026 · Transparency update 24 September 2026 · Update 8 October 2026 · Update 12 October 2026 · Update 13 October 2026 · Update 14 October 2026 · Update 19 October 2026 · Version 2026-10-07

This notice explains how RISEN JOURNEY (Pty) Ltd, Registration No. 2026/674738/07, operating WORK89™, processes personal information. The company is based in Johannesburg, South Africa. Privacy enquiries and formal notices may be sent to work89@risenapp.io or made through Data rights. Temporary telephone support: +971 50 182 1056.

Who may use WORK89

WORK89 accounts are currently for people aged 18 or older. We do not knowingly offer accounts to children. Contact us immediately if you believe a child has provided personal information. Public profiles, group profiles and portfolios must not identify or show children unless a parent or guardian has agreed in writing.

Information we process

Depending on the features used, this includes account and contact details; profile, skills and career information; a represented group's or organisation's public name, approximate size and the representative's private role; general location; jobs, applications and invitations; messages, agreements, payment acknowledgements and work records; shared engagement references and cryptographic fingerprints; confidence answers and notes, reports and support requests; optional photos, videos, CVs, identity and address evidence; consent records; and security information such as timestamps, authentication events and technical logs.

Why we process it

We process information to create and secure accounts; provide worker discovery, job search, matching, applications and hiring tools; facilitate communication and work records; moderate content; review optional verification documents; investigate safety concerns; prevent fraud; provide support; comply with law; and improve service reliability. Matching provides recommendations only and does not make final hiring decisions.

Our lawful grounds

Processing is based on performing the service requested by the user, consent for genuinely optional features, legitimate interests in operating and securing a trustworthy marketplace, and legal obligations. Consent may be withdrawn for optional processing without affecting earlier lawful processing.

What other people can see

Depending on account choices, a public profile may show an individual or group name, profile photo, skills, general area, availability, work history, portfolio and confidence level, and any website or social links you choose to add. A work telephone number appears only when the worker or authorised group representative chooses to publish it. For a represented worker group or organisation, the public directory shows the group or organisation identity rather than the representative's private account identity. Exact addresses, private contacts, representative role, CVs, messages, reports, live journey coordinates and verification documents are restricted. A private CV is shared only in the application context described in the platform. When a hirer or worker voluntarily shares a confirmed-engagement verification link, a person holding the complete link may see that WORK89 issued a matching record, its shared reference, version and completion date. The verification page does not disclose participant names, contact information, job details, location, agreement or payment.

Optional Journey location

Journey is separate from public worker and job discovery. For accepted active work, the hirer may activate a fixed destination and the worker may then activate live location sharing while travelling. Journey information is restricted to those two participants. Either participant may withdraw; stopping, withdrawal or arrival removes the worker’s live coordinates. Journey location is not used to show public “near you” distances.

Voice search

If you use the microphone for search or Talk to WORK89, your browser’s built-in speech service turns your voice into text. Depending on your browser and device, the audio may be processed by the browser provider, such as Google or Apple, under its own privacy terms. WORK89 receives only the text and does not record or keep your voice.

Video meetings and recording

WORK89 rooms are video meetings run for us by Cloudflare (RealtimeKit). Camera and microphone are used only when you allow your browser to share them, and only inside the room. A host with a business account may allow a meeting to be recorded and transcribed. If they do, every person is shown a notice and must agree before entering, we save the time of each agreement, and a recording sign is shown while recording runs. Only the host can download the recording, transcript and summary, and Cloudflare deletes them 7 days after the meeting. Transcripts are produced by automated tools and can be wrong or incomplete, especially for languages other than English. If you do not agree to a recording, you can decline to enter. Hosts must not share a recording with people who did not agree to it.

Meetings, guests, files and calendar

When you set up a meeting we keep its title, time, the people invited, their answers and any note you add. If you invite someone without a WORK89 account, we keep the email address you give so they can see the invitation, and they may join a room as a guest with the meeting passcode and a name they type, without creating an account. Files shared in a meeting are stored privately and can be opened only by people on that meeting; the person who added a file, or the host, can remove it, and files you added or hosted are removed when you delete your account. WORK89 does not yet delete old meeting files automatically, so please remove files you no longer need. Large photos are made smaller on your own device before they upload. Events you add to your calendar are private to you. A short strip inside a room shows who is present with the trust WORK89 already holds about them, such as whether an ID document was reviewed and a Confidence level, and never addresses or contact details. Some meetings can use an agreement helper, which the host switches on and everyone agrees to before entering. In those meetings your speech is turned into live English text by our video provider, Cloudflare, and the conversation text is used to write a draft of what was agreed. We do not keep the conversation. We keep only the words that both people confirm, with the time they confirmed them, and you can ask us to delete them.

Commerce Corner

The Commerce Corner is a business directory. If you make a business card, or an administrator makes one with your agreement, we keep the business name, type, area, description, opening hours, how to order, years trading, a WhatsApp number, phone number, email address, website or social media links and a photo if you add them, and, if you add them, a registration or licence you hold, and, for a doctor or other health practice, the profession, professional council and registration number, practice number, medical aid status and practice address if you add them, and whether you say you hold a food certificate (we do not check it). The card is shown to members who can see the Corner. You can hide or remove it at any time. If you choose to share your card, anyone with its link can see the card and the contact details on it without signing in, the page is hidden from search engines, and you can switch sharing off at any time so the link stops working. Anyone can report a shared card to us. You are shown only counts of how many people looked at your card and tapped to contact you, never a list of who. To avoid counting the same member twice in an hour, a look is briefly linked to that member\u2019s account, and it is not shown to anyone. If you like or save a card, we keep that against your account so you can find it again; a business sees only totals, never who liked or saved its card. A business can add an optional location link, which members can open from its card. If a business posts a picture, the picture and caption are stored and shown to members until the business removes them, and they are deleted when the card or account is deleted. If you like a post we keep that against your account, and the business sees only totals. If you message a business, the message is kept so both of you can read the conversation; the business sees your first name and the first letter of your surname, never your email address or phone number. Either person can report a conversation, and only then can an administrator read it. Messages are deleted when the card or either account is deleted. Looks and taps from a shared link are counted without keeping any detail about the visitor. Details you share on a card are public to those members, so do not add anything you want to keep private.

Payments

When a business pays WORK89 for a sponsor placement, Paystack, a payment processor, collects card or bank details on its own page. WORK89 does not see or store card numbers. We keep the payer’s email address, the amount, the reference and the status of the payment for accounting, tax and dispute purposes.

Activity status

Signed-in members can see a rough Active now, Active today or Active this week label on Doer profiles, based on when that member last had WORK89 open. We never show exact times or locations. You can switch this off in Account settings; if you do, you will not see other members’ labels either.

Usage counts and error reports

We count views, clicks and shares of jobs, worker profiles and sponsor placements, so owners and sponsors can see how a listing is doing. These are totals and are not kept as a list of who looked at what. When the app breaks, it sends WORK89 a technical report: the error message, the page, your browser type and, if you are signed in, your account, so we can fix the problem and tell you.

Location

If you tap Near me, your device shares its position with your browser so results can be sorted by distance. This stays in your browser and is not sent to or stored by WORK89. Worker profiles can store an approximate, not exact, position to show distance.

Cookies and similar storage

WORK89 uses cookies and similar browser storage to keep you signed in, remember settings such as dark mode and app lock, and protect the service. We do not use advertising or analytics cookies. Cloudflare, which protects the service, may set its own security cookies.

Service providers and international transfers

WORK89 uses providers such as Supabase and Cloudflare for database, authentication, storage, delivery and security services, and Google Firebase Cloud Messaging for optional device notifications. WORK89 also uses Cloudflare’s Turnstile bot check, Google for sign-in and fonts, Zoho for email, Brevo to send setup reminder emails and emails about important notifications, Paystack for payments, and the Apple and Google app stores for the mobile apps. When enabled, Firebase processes a device registration token and notification-delivery information; WORK89 does not place private messages, identity documents or exact addresses in push alerts. Provider infrastructure or subprocessors may process information outside South Africa. WORK89 must use contractual and other safeguards intended to provide protection consistent with POPIA when personal information crosses borders. When a member uses the poster reader on the Learnerships or Job adverts pages, the photo, file or text they upload is sent to Google’s AI (Google Gemini) so it can be read and the form filled in for them to check. WORK89 does not keep that upload, and members are asked to leave out other people’s personal details. Google processes it under its own terms. Additional providers will be listed here before they materially process user information.

Doer card

A Doer can switch on a public card with a link and a QR code. It is off until they switch it on. When it is on, anyone with the link can see their first name and the first letter of their surname, profile photo, headline, area (no street), up to eight skills, whether they are available now, jobs confirmed by both sides, their rating and whether an ID document was reviewed, but never their email address, phone number or full surname. The page is hidden from search engines. We count looks and requests anonymously and show the Doer only totals. The Doer can switch the card off at any time and the link stops working.

Website statistics

When you open a public WORK89 page we count the view anonymously so we can see how the website is doing. We record only the day, the page, the website you came from, the kind of device, your country and a visitor code that changes every day and cannot be traced back to you. We use your address and browser details only to make that code and never store them. We set no cookies for this, share nothing with anyone, do not count robots, and do not count you if your browser sends Do Not Track or Global Privacy Control. These records are deleted after 90 days.

Retention

Information is kept only as long as its purpose and the law require, then deleted or de-identified. Our retention periods are:

Safety, transaction and administrator records may be retained longer where necessary for legal claims, security, accountability or law.

Security

WORK89 uses access controls, private storage rules, authentication, administrator restrictions, audit records, moderation and other technical and organisational safeguards. Optional authenticator-app protection is handled through Supabase authentication. To warn about an unrecognised browser or installed app, WORK89 stores a random local device identifier, a general device/browser label, limited user-agent information and first/last-seen times. This is not facial recognition, an exact location record or invasive device fingerprinting; users may review and forget recognised devices in Account settings. No online system can promise absolute security. Suspected compromises are investigated and reported to affected people and the Information Regulator when required.

Your rights

Subject to law, you may ask whether we hold your information; request access, correction or deletion; object to processing; withdraw optional consent; request restriction; and complain to the Information Regulator. Account tools allow many corrections and account deletion directly. Use Data rights for a formal request. We may verify identity before releasing or changing information.

Business enquiries

If you contact WORK89 through the For business page, we keep the details you give (your name, organisation, email, phone if you add it, place and the message) to reply to you and to understand what organisations need. Only administrators can read them. We keep an enquiry for up to 24 months after the last contact, or delete it sooner if you ask.

Requests for something we could not find

If a search finds nothing and you choose to tell us what you were looking for, we keep what you typed, the place, and your email if you add one, to understand what people need and, if you asked, to tell you when we have someone. Only administrators can read these. We keep them for up to 12 months, or delete them sooner if you ask.

Direct marketing and notifications

Service and safety messages necessary for an account are different from marketing. Marketing by email, SMS, WhatsApp or browser alert requires an applicable lawful basis and an easy way to opt out. Match and browser alerts remain under the user’s control. If an account is created and the profile is not finished, WORK89 may send up to three short reminder emails to the confirmed email address about finishing setup. They contain no promotions, each has a one-click link to stop them, and a member who stops them is not sent more. Reminders stop on their own once setup is finished. Important notifications, such as meeting invitations and reminders, agreement changes, payment and completion updates, applications, confidence and verification, may also be sent to your confirmed email address, at most six an hour and never as marketing. You can switch these emails off in Alert settings or with the stop link in each email, and you still see everything inside WORK89.

Changes

Material changes will receive a new version date and may require acceptance inside the account. Earlier consent records are retained for accountability.

Information Officer and complaints

Khangelani Mpongwana is the designated WORK89 Information Officer, registered with the South African Information Regulator (registration number 2026-068581, 7 October 2026). Contact work89@risenapp.io. You may also complain to the Information Regulator.

WORK89 is committed to POPIA-aligned operation. Formal registrations, supplier agreements and periodic legal and security reviews remain part of ongoing compliance.