This Privacy Policy explains how [LEGAL ENTITY NAME], trading as Rossouw Human Resources Consulting ("Rossouw HR Consulting", "we", "us"), collects, uses, discloses and protects personal information through the RemPulse salary-benchmarking platform available at rempulse.rossconsult.com.na (the "Platform").
Namibia's Constitution (Article 13) protects the right to privacy. At the date of this policy the Namibian Data Protection Bill has been tabled in Parliament but is not yet in force. We have therefore written this policy to the internationally recognised data-protection principles that the Bill is expected to adopt, and we will update it when the Act commences. Where applicable we also comply with the Electronic Transactions Act 4 of 2019, the Labour Act 11 of 2007 and our common-law duties of confidentiality.
1. Who we are
| Legal entity | [LEGAL ENTITY NAME] |
|---|---|
| Registration number | [REGISTRATION NUMBER] |
| Physical address | [PHYSICAL ADDRESS], Namibia |
| Privacy contact | rempulse@rossconsult.com.na |
2. Scope and our role
This policy applies to:
- Visitors to our public website;
- Subscriber users — people who create an account on behalf of a company that subscribes to the Platform (a "Subscriber"); and
- Employees of Subscribers whose remuneration details are uploaded to the Platform by their employer.
Our role differs for each category of information:
| Information | Our role | Explanation |
|---|---|---|
| Account, company and billing information | Controller | We decide how this information is used to run the Platform and the subscription. |
| Remuneration records uploaded by a Subscriber | Processor on behalf of the Subscriber | The Subscriber (the employer) remains the controller of its employees' information and is responsible for having a lawful basis to share it with us. We process it only to provide the service described in this policy and our Terms of Service. |
| Aggregated benchmark statistics | Controller | Statistics (sample sizes, means, percentiles) derived from pooled records are no longer attributable to any individual or company. |
3. Information we collect
3.1 Account information
- Name, surname and email address;
- Password (stored only as a one-way hash);
- Your acceptance of our Terms and this policy, with the date and time of acceptance.
3.2 Company information
- Company name, registered name, registration number and VAT number;
- Physical and postal address, industry and entity type;
- Contact person name, telephone number and email address;
- Subscription plan, term, amounts due and payment status;
- Optional company logo.
3.3 Remuneration records (uploaded by Subscribers)
When a Subscriber uploads its payroll data in our template, the following is stored for each employee record:
- Employee number, name and surname (as provided by the employer);
- Town, industry, job title, job grading system and job grade;
- Basic salary, housing allowance, basic package, medical aid, pension, social security contribution and total cost to company.
We do not require identity numbers, dates of birth, bank details or any special categories of information, and Subscribers must not upload them.
3.4 Technical and usage information
- IP address, browser type and device information;
- Pages visited and actions taken within the Platform;
- Audit-log entries recording logins and changes made to data (who, what and when);
- Analytics data collected by Google Analytics (see section 11).
4. Why we process information
| Purpose | Basis |
|---|---|
| Creating and administering accounts and subscriptions, invoicing and support | Performance of our contract with the Subscriber |
| Storing and processing uploaded remuneration records to produce reports for the uploading Subscriber | Instructions of the Subscriber (as controller) under our Terms |
| Calculating anonymised, aggregated benchmark statistics across all participating Subscribers | Our legitimate interest in operating a salary survey, balanced against the low privacy impact of aggregated statistics |
| Securing the Platform, preventing misuse and keeping audit logs | Legitimate interest and legal obligations |
| Sending service emails (welcome, billing reminders, system notices) | Performance of contract |
| Understanding how the public website and Platform are used | Legitimate interest (analytics) |
| Complying with legal obligations and responding to lawful requests | Legal obligation |
Each Subscriber warrants to us that it has informed its employees and holds a lawful basis under Namibian law to share their remuneration information with us for these purposes.
5. How benchmark data is used
- Your uploaded records are visible only to users of your own company and to authorised Rossouw HR Consulting administrators.
- Other Subscribers never see your individual records, your employees' names, or the fact that your company contributed a particular record.
- Reports show only aggregated statistics per job grade: sample size, mean and percentiles (10th, 25th, 50th, 75th and 90th).
- Where a benchmark is filtered (for example by industry), the filter applied and the date of the underlying data are disclosed on the report.
- We may publish or share aggregated, anonymised market insights that cannot reasonably be linked to any company or individual.
6. Who we share information with
- Rossouw HR Consulting staff and administrators who need access to operate the Platform and support Subscribers, all bound by confidentiality obligations.
- Hosting provider — the Platform is hosted on servers managed through Laravel Forge, located in [SERVER LOCATION / COUNTRY].
- Email delivery provider — [EMAIL PROVIDER NAME], used to send service emails.
- Google LLC — for website and Platform analytics (see section 11).
- Professional advisers (auditors, lawyers) and authorities where required by law or to protect our rights.
- A successor in the event of a merger, acquisition or sale of the business, subject to this policy.
We do not sell personal information.
7. Cross-border transfers
Some of the providers listed above store or process information outside Namibia. Where this happens we rely on contractual commitments from the provider to protect the information to a standard at least equivalent to this policy. Namibia does not currently regulate cross-border transfers of personal information; we will align with any requirements introduced when the Data Protection Act commences.
8. How we protect information
- Encryption in transit: all traffic between your browser and the Platform is encrypted using TLS 1.3, with TLS 1.2 as the minimum supported version. Connections use AES-256-GCM authenticated encryption and ECDHE key exchange (forward secrecy), so past sessions cannot be decrypted even if a key is later compromised. TLS 1.0/1.1 and SSL are disabled. Certificates are issued by a publicly trusted certificate authority and renewed automatically.
- Credential protection: passwords are stored only as salted bcrypt hashes and are never visible to us or recoverable from the database.
- Session security: session and anti-forgery cookies are encrypted with AES-256-CBC, flagged
HttpOnlyandSameSite, and sessions are invalidated when a password changes. - Each Subscriber operates in an isolated workspace; access is controlled by role-based permissions.
- Every change to remuneration records is recorded in an audit trail showing the previous and new values, the user responsible and the time.
- Administrative access is limited to named Rossouw HR Consulting personnel.
- Backups are taken regularly and stored securely.
No system is completely secure. You are responsible for keeping your login credentials confidential and for notifying us immediately of any suspected unauthorised access.
9. How long we keep information
| Information | Retention period |
|---|---|
| Account and company information | For the duration of the subscription and [N] years thereafter, for accounting and legal purposes |
| Uploaded remuneration records | While the Subscriber participates and for [N] months after the subscription ends, after which they are deleted or irreversibly anonymised |
| Aggregated benchmark statistics | Indefinitely (not personal information) |
| Audit logs and data-change history | [N] years |
| Analytics data | According to Google Analytics retention settings (currently [14] months) |
We may retain information for longer where required by law or to establish, exercise or defend legal claims.
10. Your rights
Subject to applicable law, you may ask us to:
- Access the personal information we hold about you;
- Correct inaccurate or incomplete information;
- Delete information we no longer need to retain;
- Restrict or object to processing in certain circumstances;
- Withdraw consent where processing is based on consent;
- Lodge a complaint with us, and once established, with the Namibian data-protection supervisory authority.
If you are an employee of a Subscriber, your employer is the controller of your remuneration information. Please direct requests to your employer in the first instance; we will assist them in responding. You may also contact us directly and we will forward your request to your employer where appropriate.
To exercise any right, email rempulse@rossconsult.com.na. We may need to verify your identity. We aim to respond within 30 days.
11. Cookies and analytics
11.1 Essential cookies
The Platform uses a session cookie and a security (XSRF) cookie that are strictly necessary for you to log in and use the service. These cannot be disabled.
11.2 Google Analytics
We use Google Analytics 4, provided by Google LLC, on our public website and within the Platform to understand how they are used and to improve them. Google Analytics sets cookies (_ga and _ga_*) and collects pseudonymous identifiers, pages visited, approximate location derived from a truncated IP address, and device and browser information. Within the Platform we also send Google a pseudonymous user identifier (a one-way hash that cannot be reversed to identify you) and non-identifying properties such as the subscription plan, so that we can understand usage by plan. We never send names, email addresses or remuneration data to Google.
You can prevent Google Analytics from collecting data by installing the Google Analytics opt-out browser add-on or by blocking cookies in your browser. Google's own privacy policy is available at policies.google.com/privacy.
12. Children
The Platform is a business service and is not directed at anyone under the age of 18. We do not knowingly collect information from children.
13. Security incidents
If we become aware of a security incident that compromises personal information, we will investigate promptly, take steps to contain it, and notify affected Subscribers without undue delay so that they can meet their own obligations to their employees. We will notify the supervisory authority where required by law.
14. Changes to this policy
We may update this policy from time to time, including to reflect the commencement of the Namibian Data Protection Act. The "Last updated" date at the top shows when it was last changed. Material changes will be communicated to Subscriber users by email or by notice within the Platform.
15. Contact us
[LEGAL ENTITY NAME] t/a Rossouw Human Resources Consulting
[PHYSICAL ADDRESS], Namibia
Email: rempulse@rossconsult.com.na