Privacy Policy

Odeon Staffing (Pty) Ltd (trading as Odeon Staffing, registration number 2025/016552/07, with its registered address at Gardens, Cape Town, 8001, South Africa) is the responsible party for the personal information processed via this website, in line with the Protection of Personal Information Act, 2013 ("POPIA"). In this policy "we", "us" and "our" refer to Odeon Staffing.

If you are a client booking staff, we collect: your name, email address, event location and date, event type, the number and type of staff you require, and the payment metadata returned to us by PayFast (transaction id, status). We do not see or store your card details — those are handled by PayFast (Pty) Ltd.

If you are a staff applicant, we collect: your full name, email, phone number, South African ID number, home address and suburb, role preference, experience level, availability, an optional uploaded CV, and a password. Your password is stored as a one-way bcrypt hash and is never visible to us or to anyone else. Your ID number is stored in our database and is masked to show only the last three digits in any system response or admin view — the full number is only ever decrypted for legitimate operational use such as verifying your right to work or processing payment.

• To provide the service you requested (concluding and performing a contract).
• To process payments and issue invoices (legitimate interests).
• To match staff applicants to suitable jobs and pay them (consent + contract).
• To comply with tax, labour and immigration record-keeping obligations (law).

We share the minimum personal information necessary with the following operators, who are contractually bound to process it only on our instruction:

• PayFast (Pty) Ltd — payment processing.
• Resend, Inc. — transactional email delivery.
• Replit, Inc. — application hosting and managed PostgreSQL database.

Some of these operators may process data outside South Africa. Where this happens we ensure adequate protection in line with POPIA s.72.

• Booking records and invoices: 5 years (SARS retention rule).
• Active staff profiles: while you remain on our roster.
• Declined / inactive staff applications: 12 months, then deleted.
• Server logs (IP address, request times): 30 days.

You have the right to:

• Request access to the personal information we hold about you.
• Ask us to correct or delete inaccurate or out-of-date information.
• Object to processing on direct-marketing grounds at any time.
• Lodge a complaint with the Information Regulator (South Africa) at inforegulator.org.za.

We use a single first-party cookie (connect.sid) to keep you logged in to the staff portal and admin portal. We do not use any third-party tracking, analytics or advertising cookies on this site.

This service is not directed at people under 18. We do not knowingly accept staff applications from minors and we do not knowingly process personal information of children. If you believe a child has registered, contact us and we will delete the record.

POPIA s.55-56 requires us to appoint an Information Officer. Ours is The Director, contactable at info@odeon-group.co.za. Please direct all data subject requests, complaints and POPIA queries to this address.

We may update this policy from time to time. The "Last updated" date at the top of the page reflects the most recent revision. Material changes will be communicated by email to active account holders.