Record of Processing Activities (ROPA)
Public Summary
No Sweat Work Media CC
Trading as NoSweat
Registration Number: 2009/090625/23
Website: www.nosweat.co.za
Effective Date: 10 August 2026
1. Purpose of This Record
NoSweat maintains a Record of Processing Activities to document how personal information is collected, used, stored, disclosed, retained and protected across our business.
NoSweat operates a talent platform through which candidates create profiles, upload CVs, apply for freelance, fractional and full-time opportunities, and are matched with clients seeking talent. NoSweat also facilitates aspects of vetting, placements, purchase orders, freelancer payments and PAYE administration. (No Sweat)
This page is a public summary of our principal processing activities.
Our more detailed internal processing register is maintained for governance, privacy, security and regulatory compliance purposes.
2. Legal Framework
NoSweat processes personal information primarily in accordance with the Protection of Personal Information Act 4 of 2013 (“POPIA”).
POPIA establishes minimum requirements for the lawful processing of personal information by public and private bodies. (Government of South Africa)
Section 17 of POPIA requires a responsible party to maintain documentation relating to the processing operations for which it is responsible. South African government POPIA guidance specifically links this obligation with the organisation's PAIA documentation requirements. (csa.environment.gov.za)
This ROPA should therefore be read together with NoSweat's:
Privacy Policy · POPIA & Data Protection · PAIA Manual · Cookie Policy · Direct Marketing Policy · Data Breach & Security Compromise Response Plan
3. Responsible Party
For purposes of POPIA, the responsible party is:
No Sweat Work Media CC
Trading as NoSweat
Information Officer: Sebastian van ’t Hoff
Email:sebastian@nosweat.co.za
Telephone / WhatsApp: +27 81 818 2053
Website:www.nosweat.co.za
NoSweat currently publishes these contact details through its website and PAIA information. (No Sweat)
4. Overview of Our Processing Activities
The table below summarises NoSweat's main categories of personal-information processing.
| Processing Activity | Data Subjects | Information Processed | Main Purpose | Typical Recipients |
|---|---|---|---|---|
| Candidate registration and profiles | Candidates and freelancers | Name, email, phone/WhatsApp, CV, portfolio, discipline, experience, rates or salary expectations, availability and professional information | Create and maintain candidate profiles and provide access to NoSweat opportunities | NoSweat personnel and authorised technology providers |
| Job applications | Candidates | Candidate profile, CV, portfolio, application details, availability and relevant communications | Allow candidates to apply for freelance, fractional and full-time opportunities | NoSweat and relevant clients |
| Candidate matching and shortlisting | Candidates and clients | Skills, experience, qualifications, employment history, rates, salary expectations, availability and job requirements | Identify candidates whose professional profile matches a client's requirements | Relevant clients and authorised NoSweat personnel |
| Client registration and job briefs | Clients and client representatives | Name, company, email, telephone, role requirements, budgets, salary information and correspondence | Receive hiring requirements, create jobs and facilitate candidate matching | NoSweat personnel and authorised service providers |
| Candidate presentation to clients | Candidates | CV, portfolio, skills, experience, qualifications, availability and other role-relevant information | Enable a prospective client to assess a candidate for a specific opportunity | Prospective or existing NoSweat clients |
| Candidate verification | Candidates | Identity, employment information, qualifications and other verification information | Verify information relevant to a proposed engagement | Verification providers and relevant authorised NoSweat personnel |
| Background checks | Candidates | Information necessary for lawful identity, qualification and, where applicable, criminal-record checks | Vet candidates for appropriate placements | Approved screening providers, NoSweat and, where appropriate, relevant clients |
| Freelance engagement administration | Freelancers and clients | Contact information, assignment information, rates, purchase orders, timesheets or milestone information where applicable | Administer freelance engagements | NoSweat, clients and relevant administrative providers |
| Payments and PAYE | Freelancers | Payment details, banking information, amounts payable, tax-related information and transaction records | Process payments and applicable statutory deductions | Banks, accounting providers and SARS where legally required |
| Full-time and fractional placement administration | Candidates and clients | Placement details, agreed remuneration, start information, correspondence and contractual information | Administer successful placements and related fees | NoSweat, client and relevant professional advisers |
| Customer and candidate support | Candidates, clients and other contacts | Contact information, account information and correspondence | Respond to enquiries and support requests | NoSweat and relevant service providers |
| Website accounts and authentication | Website users | Account credentials, login information, session information and security-related information | Provide secure access to candidate and client functionality | NoSweat and authorised hosting/technology providers |
| Website and technical information | Website visitors | IP address, browser/device information, usage data, cookies and technical logs where applicable | Operate, secure, troubleshoot and improve the website | Hosting, security and analytics providers as applicable |
| Direct marketing | Candidates, clients and business contacts | Name, business relationship, email address, telephone or other permitted contact information | Send lawful and relevant marketing communications | NoSweat and authorised communications providers |
| Accounting and financial administration | Clients, suppliers and contractors | Invoices, payments, transaction information, tax information and accounting records | Financial management and legal compliance | Accountants, banks, SARS and professional advisers |
| Supplier management | Suppliers and service providers | Contact details, company information, contracts, invoices, banking details and correspondence | Procure and manage services provided to NoSweat | NoSweat, banks, accountants and professional advisers |
| Legal and compliance administration | Candidates, clients, suppliers and other persons | Contracts, requests, correspondence, complaints and compliance records | Meet legal obligations and establish, exercise or defend legal rights | Legal advisers, regulators or authorities where appropriate |
| POPIA and PAIA requests | Data subjects and requesters | Identity/contact information, request details and relevant underlying records | Respond to privacy and access-to-information rights | NoSweat Information Officer and the Information Regulator where applicable |
| Security incident management | Potentially affected data subjects | Information necessary to investigate the incident, affected records and communications | Investigate, contain and respond to security compromises | NoSweat, relevant operators, professional advisers, affected persons and the Information Regulator where required |
The candidate information described above reflects information NoSweat currently asks candidates to provide, including name, contact details, professional discipline, experience, rates or salary expectations, portfolio/LinkedIn information and CVs. (No Sweat)
5. Categories of Data Subjects
NoSweat's processing activities may concern candidates and job seekers, freelancers and contractors, clients and their representatives, prospective clients, suppliers and service providers, employees or other personnel where applicable, referees, website visitors, account users and persons who contact NoSweat.
The information processed depends on the person's relationship with NoSweat and the service being provided.
6. Processing Justifications
POPIA permits personal information to be processed in specified circumstances, including where the data subject consents, where processing is necessary to conclude or perform a contract, where processing is required by law, where it protects a legitimate interest of the data subject, or where processing is necessary for the legitimate interests of the responsible party or a third party. These statutory grounds are reflected in South African public-sector POPIA guidance. (Umzimvubu Local Municipality)
NoSweat determines the appropriate justification according to the particular processing activity.
For example, candidate application information may be processed to provide the talent service requested by the candidate; payment and tax records may be processed to fulfil contractual and statutory obligations; security logs may be processed to protect legitimate security interests; and marketing information may require consent or another permitted basis under POPIA's direct-marketing rules.
NoSweat does not treat consent as the only possible justification for all processing.
7. Candidate Matching and Client Access
Candidates join NoSweat for the purpose of accessing work opportunities and being matched with relevant client requirements.
NoSweat's website states that candidates can create profiles, upload CVs, browse jobs and apply directly, while clients can post roles and review matched candidates. (No Sweat)
Accordingly, relevant candidate information may be made available to a client where necessary for a genuine hiring or freelance-engagement process.
NoSweat does not consider this permission to use candidate information for unrelated purposes.
8. Verification and Special Personal Information
For appropriate full-time placements, NoSweat currently states that it performs or facilitates identity, qualification and criminal-record checks. (No Sweat)
Information concerning criminal behaviour falls within POPIA's rules relating to special personal information and may therefore be subject to additional legal requirements.
Where NoSweat processes this type of information, the relevant activity should be documented separately in the internal ROPA, including the exact purpose, provider, authorisation, access controls, retention arrangement and applicable POPIA justification.
Where prior authorisation from the Information Regulator is required for a particular processing operation, NoSweat will follow the applicable process. The Regulator currently provides a dedicated prior-authorisation mechanism through its eServices environment. (Empowered Compliance Monitoring)
9. Operators and Service Providers
NoSweat may use external organisations to assist with activities such as:
website and cloud hosting;
business and CRM systems;
email and communications;
payment processing and banking;
accounting and tax administration;
verification and background screening;
IT and cybersecurity; and
professional advice.
Where another organisation processes personal information on NoSweat's behalf, that relationship is assessed to determine the appropriate POPIA responsibilities and contractual safeguards.
The internal ROPA records the relevant operators and the categories of personal information they process.
10. International Processing
Some software, cloud or technology services may process or store information outside South Africa.
Where a processing activity involves an international transfer, NoSweat's internal ROPA should record the countries or locations involved where reasonably known, the recipient or operator, the reason for the transfer and the safeguards applicable to it.
International processing is also addressed in NoSweat's Privacy Policy and POPIA & Data Protection documentation.
11. Retention
NoSweat aims to retain personal information only for as long as it is required for the purpose for which it was collected or for another lawful reason.
Relevant considerations may include:
contractual obligations, tax and accounting requirements, statutory record-keeping requirements, active candidate or client relationships, placement administration, legal claims, disputes, fraud prevention and regulatory obligations.
South African POPIA guidance reflects the principle that personal information should not be retained longer than necessary for the purpose for which it was collected, subject to legal or other legitimate retention requirements. (Umzimvubu Local Municipality)
Specific retention periods should be maintained in NoSweat's internal ROPA and retention schedule, rather than relying only on this public summary.
12. Security Measures
NoSweat takes reasonable technical and organisational measures appropriate to the nature of the personal information being processed.
The precise controls may vary according to the system and processing activity and are documented internally rather than published in detail for security reasons.
Controls may address access management, authentication, user permissions, service-provider management, backup and recovery, device and system security, confidentiality, security monitoring and incident response.
NoSweat's Data Breach & Security Compromise Response Plan describes our approach where personal information may have been compromised.
13. Automated and AI-Assisted Processing
Where NoSweat uses automated or AI-assisted tools as part of a processing activity, that use should be recorded within the relevant internal ROPA entry.
The internal record should identify, where applicable, the information being processed, the purpose of the AI-assisted activity, the system or provider involved, who receives the result, whether human review is involved and any material privacy or security safeguards.
AI-assisted processing does not remove NoSweat's responsibility to comply with POPIA.
Where automated processing may materially affect an individual, NoSweat will consider the additional protections applicable under POPIA.
14. Data Subject Rights
People whose personal information is processed by NoSweat may have rights under POPIA to request access to personal information, request correction or deletion where applicable, object to certain processing, withdraw consent where processing depends upon consent, object to direct marketing and complain about unlawful processing.
The Information Regulator maintains facilities for POPIA complaints, assessments and other compliance matters. (Empowered Compliance Monitoring)
Requests to NoSweat may be directed to:
Sebastian van ’t Hoff
Information Officer
sebastian@nosweat.co.za
+27 81 818 2053
15. Internal ROPA
This public page is not intended to reproduce NoSweat's complete internal processing register.
The internal ROPA should contain more detailed information for each processing activity, including:
processing owner; systems used; precise categories of information; categories of data subjects; source of information; processing purpose; POPIA justification; recipients; operators; special personal information; international transfers; retention period; access restrictions; security measures; data-subject rights; privacy notices; contractual safeguards; prior authorisation where applicable; and the date on which the activity was last reviewed.
This detail is maintained internally because portions may contain confidential information, service-provider information or technical security details that should not be published publicly.
16. Review and Maintenance
NoSweat will review its processing activities periodically and when material changes occur.
The ROPA should be updated when, for example, NoSweat:
introduces a new system; engages a new operator; begins collecting a new category of information; changes how candidate or client information is used; introduces new AI functionality; begins processing new special personal information; changes an international data flow; or materially changes a retention or security process.
This reflects POPIA's accountability principle and section 17 requirement to maintain documentation of the processing operations under the responsible party's control. (csa.environment.gov.za)
17. Related Documents
This Record of Processing Activities should be read together with NoSweat's:
Privacy Policy
POPIA & Data Protection
Cookie Policy
PAIA Manual
Information Officer Registration & Contact Details
Direct Marketing Policy
Do Not Sell or Share My Personal Information
Data Breach & Security Compromise Response Plan
Supplier Code of Conduct
18. Contact NoSweat
For questions concerning this Record of Processing Activities or NoSweat's processing of personal information:
No Sweat Work Media CC
Trading as NoSweat
Information Officer: Sebastian van ’t Hoff
Email:sebastian@nosweat.co.za
Telephone / WhatsApp: +27 81 818 2053
Website:www.nosweat.co.za
One important thing I would do internally
The website page above is useful for transparency, but it should not be treated as the actual complete ROPA. Section 17 is about maintaining documentation of NoSweat's processing operations. (csa.environment.gov.za)
For NoSweat, I would create the internal ROPA as a spreadsheet with one row per processing activity and roughly 20–25 columns. That would allow you to map, for example:
Candidate CV → website → CRM → matching → client → archive/deletion
and separately:
Candidate ID → screening provider → result → NoSweat → client (if applicable) → deletion
That internal register would become the central compliance document tying together your Privacy Policy, POPIA page, operators, Zoho workflows, AI agents, retention periods, background checks and security controls. It would also expose any contradictions between the website policies and what the systems are actually doing.