Privacy Notice - Talent Registration

Responsible Party

Herbst Alliance (Pty) Ltd ("Herbst Alliance", "we", "us") is the responsible party for processing your personal information under the Protection of Personal Information Act 4 of 2013 (POPIA).

Purpose of Processing

We collect and process your personal information for the following purposes:

• Recruitment matching - Evaluating your suitability for pharmaceutical industry roles and matching you with prospective employers.
• Pre-screening - Automated scoring of your profile to prioritise candidates for review by our Head of Talent.
• Talent pool management - Maintaining an active pool of qualified candidates for current and future opportunities.
• Career communications - Sending you relevant opportunity alerts and career insights (only with your explicit marketing consent).

Categories of Personal Information

Who Sees Your Data

Access to your full personal information is restricted to:

• Herbst Alliance Talent Team - Reviews every candidate profile.
• Dieter Herbst - CEO, Herbst Group (oversight only).

Prospective employers may receive anonymised profiles only. Your name, contact details, and current employer are never shared with employers without your explicit, separate consent.

Automated Decision-Making

We use automated pre-screening to score your profile based on your submitted information (experience, qualifications, availability). This score helps prioritise review.

No automated decision is final. Every candidate who passes initial screening is reviewed by the Herbst Alliance talent team before any placement decision.

You have the right to:

• Request information about the logic behind automated scoring
• Contest any automated decision
• Request human review of your profile at any time

Contact info@herbstteam.com to exercise these rights.

Data Retention

Your personal information is retained for 12 months from the date of your submission.

After 12 months, your record is automatically anonymised and your CV is permanently deleted from our systems. Placed candidates are excluded from automatic deletion.

You may request early deletion at any time by emailing info@herbstteam.com. We will process your request within 30 days.

Consent

We collect three types of consent, each tracked separately:

You may withdraw any consent at any time. Withdrawing processing consent will result in removal of your profile from our active talent pool. Withdrawal does not affect the lawfulness of processing conducted before withdrawal.

Your Rights Under POPIA

• Access - Request a copy of the personal information we hold about you.
• Correction - Request correction of inaccurate or incomplete information.
• Deletion - Request deletion of your personal information.
• Objection - Object to processing of your personal information.
• Data portability - Request your data in a structured, machine-readable format.
• Withdraw consent - Withdraw any consent at any time.

To exercise any right, email info@herbstteam.com with the subject line "POPIA Request - [Your Request Type]". We will respond within 30 days.

Security

We take the security of your data seriously:

• All data transmitted over HTTPS (TLS 1.3)
• Data encrypted at rest on our South African server (full-disk encryption)
• CV files stored in access-controlled object storage under our control
• IP addresses are hashed before storage (not stored in plain text)
• Access restricted to authorised personnel only
• Working toward ISO 27001:2022 certification

Cross-Border Data Transfers

Your personal information is resident within South Africa, stored on a managed database in the Johannesburg region and on our own South African server, under our control. Some processing necessarily occurs outside South Africa: transactional email delivery uses Resend (United States), with Microsoft (Graph API) as a fallback transport, and the public pages and API routes are hosted on Vercel (United States). Each residual cross-border flow is covered by a Data Processing Agreement and available on request.

Adequate safeguards are in place:

• All providers maintain GDPR-compliant data processing agreements
• Data encrypted in transit and at rest
• We are pursuing South African data residency where available

Complaints

If you believe we have not handled your personal information properly, contact us first at info@herbstteam.com.

You also have the right to lodge a complaint with the Information Regulator:

Contact

Parent Privacy Policy

This notice is specific to Herbst Alliance talent registration. For the full Herbst Group privacy policy covering all entities, see our Privacy Policy.