This Privacy Policy explains how WorkGist ("WorkGist", "we", "us" or "our") collects, uses, shares and protects personal data when you use getworkgist.com and our related services (the "Service"), and the rights you have. It should be read together with our Terms of Service and Cookie Policy.
WorkGist is built so that the people who share their workplace experiences cannot be identified. This policy explains exactly how we do that, and where the limits are.
1. Our privacy promise in brief
- What we keep: a phone number or email address, only to log you in; your posts, without your name.
- What we never keep: payslips or ID photos after they have been checked, and your work email address (we keep only the part after "@").
- Who sees what: readers see your post, never who wrote it. Employers never see who wrote anything, even if they pay us.
- What we never do: sell your personal data, show you targeted advertising, or let advertising networks track you on WorkGist.
The rest of this policy gives the full detail.
2. Who is responsible for your data
2.1. WorkGist is the data controller responsible for your personal data under this policy.
2.2. Our Data Protection Officer can be contacted at privacy@getworkgist.com. The Data Protection Officer also acts as our Information Officer for the purposes of the Protection of Personal Information Act of South Africa.
2.3. Where Data Protection Laws require us to register with a data protection authority, we do so and keep that registration up to date.
3. Laws this policy follows
We process personal data in line with the data protection laws that apply to us and to you, including the Nigeria Data Protection Act 2023 and the General Application and Implementation Directive issued under it, the Data Protection Act 2019 of Kenya, the Protection of Personal Information Act 4 of 2013 of South Africa ("POPIA"), the Data Protection Act 2012 (Act 843) of Ghana, Law No. 151 of 2020 on the Protection of Personal Data of Egypt, Law No. 09-08 of Morocco, and, where they apply to people in the European Economic Area or the United Kingdom, the General Data Protection Regulation and the UK GDPR (together, "Data Protection Laws").
4. The personal data we collect
4.1. Data you give us
| Category | What it includes | When |
|---|---|---|
| Login details | Your phone number or email address. If you choose "Continue with Google": your Google account and email address, and the name and profile picture Google shares with us. | When you sign up, log in, or add or change a login method |
| Preferences | Your country, your field of work, the companies you follow, and your alert settings | When you complete "Make it yours" or change settings |
| Contributions | The reviews, ratings, flags, manager reviews, interview experiences, salary information, questions, answers, workplace news reports and confirmations, poll votes, "Helpful" votes and reports you submit, with the details you choose to give (for example company, department, city, job title, level, employment status and year) | When you post |
| Verification details | A work email address, or a payslip, contract or ID document you upload to show that you work or worked at an employer | Only if you ask to be verified |
| Employer account details | The name, role and work email of an employer representative, the company claimed, proof of authority and, for paid plans, billing details | When an employer claims a page or subscribes |
| Messages | What you tell us when you contact us, report content or appeal a decision | When you contact us |
4.2. Data we collect automatically
| Category | What it includes | Why |
|---|---|---|
| Security data | Basic information about your device and connection, such as your IP address and browser type, and records of log-in attempts | To keep accounts and the Service secure, prevent abuse, and fix problems |
| Cookies | Small pieces of information saved on your device, for example to keep you logged in (see the Cookie Policy) | To make the Service work as you expect |
| Alerts on your device | If you turn on alerts on a device, what we need to send alerts to that device | To send you the alerts you asked for |
4.3. Data we do not collect
We do not collect your precise location, your contacts, or your browsing activity on other websites. We do not ask for your name to create an account. We do not use analytics or advertising cookies unless you agree to them, and we do not currently use any.
5. How we use personal data and our legal bases
| Purpose | Data used | Legal basis |
|---|---|---|
| Creating your account and logging you in, including sending one-time codes by SMS or email | Login details, security data | Performance of our contract with you |
| Publishing your Contributions anonymously, showing "Your posts", unlocking features (give-to-get) and letting you delete your posts | Contributions, the internal link between your account and your Contributions | Performance of our contract with you |
| Calculating ratings, salary ranges, rankings, poll results and other statistics, which we show only when enough people have contributed | Contributions, preferences | Our legitimate interest in providing useful, aggregated information; the statistics do not identify anyone |
| Moderating content, preventing fake, duplicate or paid reviews, and enforcing our Terms | Contributions, login details, security data | Our legitimate interest in keeping the Service honest and safe; compliance with legal obligations |
| Verifying that a contributor works or worked at an employer | Verification details | Your consent, which you can withdraw at any time, and performance of our contract with you |
| Sending you alerts and notifications you have chosen, such as replies to your questions or news about companies you follow | Preferences, login details | Performance of our contract with you; your consent where Data Protection Laws require it |
| Keeping the Service and accounts secure, detecting fraud and abuse, and fixing errors | Security and technical data, login details | Our legitimate interest in protecting our users and the Service |
| Handling reports, notices, appeals and requests from you | Messages, Contributions | Compliance with legal obligations; our legitimate interest in resolving disputes |
| Managing employer accounts and paid plans | Employer account details | Performance of our contract with the employer; compliance with legal obligations such as tax and accounting |
| Complying with the law and responding to valid legal requests (see section 8) | Any data we hold, limited to what is required | Compliance with legal obligations |
| Analytics, if we introduce it | Usage data | Your consent, given through our cookie settings |
Where we rely on legitimate interests, we have balanced our interests against your rights and freedoms, and we apply the safeguards in section 6. You may object at any time (see section 11).
6. How we protect your anonymity
6.1. Your login details stay private. Your phone number, email address and account are never shown on your Contributions or to anyone else. Where you need to see where a code was sent, we show only part of it (such as "+234 801 ••• 5678").
6.2. Your posts are not linked to you in public. We keep a private link between your Contributions and your account so that we can show you your own posts, moderate them and delete them when you ask. This link is never published, and only a small number of authorised staff can see it when needed for moderation or the law.
6.3. Minimum numbers. We show a company's rating and reviews only once it has at least five approved reviews, and a salary range only once a role has at least five salaries.
6.4. Managers by role only. We do not publish the names of managers or other individuals.
6.5. Share images. Images and text created when you share content never include information that identifies a contributor.
6.6. Employers. Employers, including those on paid plans, cannot see who wrote anything and cannot edit, delete or hide Contributions.
6.7. Verification. Payslips and ID documents you upload to get verified are checked and then deleted, within 7 days at most. We never keep your work email address, only the part after "@". We remember that you are verified at an employer for 6 months, so you do not need to verify again for each post.
7. Who we share personal data with
7.1. We never sell your personal data, and we never share it with employers, advertisers or data brokers.
7.2. We share personal data only with:
- Service providers who process it on our behalf under written contracts that require them to keep it confidential and secure and to use it only on our instructions:
| Provider | What they do for us | Where |
|---|---|---|
| Our hosting and data storage provider | Store our data and run log-in | European Union (Ireland) |
| Our text message provider | Send log-in codes by text message | United States and other countries where it operates |
| Our email provider | Send log-in codes and service emails | European Union (Ireland) |
| "Continue with Google", only if you use it | United States and other countries where Google operates | |
| Our AI moderation provider | Check posts and verification documents against our rules. It receives only the content, never who you are, and does not keep it or learn from it | United States |
| Our payment provider | Take payments from employers who choose Pro. We never see card details | Nigeria |
| Our website hosting provider | Host our website | The countries our website is served from |
You can ask our Data Protection Officer for the names of these providers.
- Professional advisers, such as lawyers, auditors and insurers, under duties of confidentiality, where needed.
- Authorities and courts, only as described in section 8.
- A buyer or successor of all or part of our business, under the same protections as this policy. We will tell you before your personal data becomes subject to a different privacy policy.
- Anyone else, only with your clear instruction or consent.
8. Legal requests for information
8.1. We will disclose information that could identify a contributor only if we are required to by a valid, legally binding order of a court or authority with jurisdiction over us, or where disclosure is necessary to prevent a serious and imminent threat to someone's life or safety.
8.2. When we receive such a request, we will: check that it is valid and lawful; challenge it where we believe it is unlawful, too broad or not properly made, including by seeking to have it set aside where appropriate; disclose only the minimum information required; and tell the affected person before we disclose, unless the law or the order prohibits us from doing so or doing so would put someone at risk.
8.3. We do not hand over information to employers, even if they threaten legal action, unless a court orders us to.
9. International transfers
9.1. Some of our service providers process personal data outside the country where you live, including outside Africa (see section 7).
9.2. When we transfer personal data internationally, we make sure it receives a level of protection that meets Data Protection Laws, for example by transferring to a country recognised as providing adequate protection, by using standard contractual clauses or other contractual safeguards approved under the applicable law, by relying on binding corporate rules of the provider, or, where permitted, with your consent. These measures follow, among others, sections 41 to 43 of the Nigeria Data Protection Act 2023, sections 48 to 50 of the Data Protection Act 2019 of Kenya, and section 72 of POPIA.
9.3. You can ask us for a copy of the safeguards we use by contacting our Data Protection Officer.
10. How long we keep personal data
| Data | How long |
|---|---|
| Login details | For as long as your account exists. Deleted when you delete your account, and removed from backups within 30 days |
| Name and picture received from Google | For as long as your Google login is connected to your account |
| Preferences, follows and alert settings | For as long as your account exists |
| Contributions | For as long as they are published. If you delete your account, they remain published without any link to you, unless you choose to remove them, in which case they are deleted |
| Verification documents | Deleted once checked, within 7 days at most |
| Work email used for verification | Never kept, only the part after "@". The fact that you are verified is kept for 6 months |
| Cookies | As set out in the Cookie Policy |
| Alerts on a device | Until you turn alerts off on that device |
| Security records | Up to 90 days, unless needed longer to investigate a specific security incident or abuse |
| Reports, appeals and correspondence | Up to 2 years after the matter is closed |
| Employer account and billing records | For as long as the employer account exists, and then for the period required by tax and accounting law, up to 6 years |
| Information subject to a legal hold | Until the legal matter is resolved |
When data is no longer needed, we delete it or anonymise it so that it can no longer identify anyone.
11. Your rights
11.1. Depending on where you live, Data Protection Laws give you the right to:
- be informed about how your personal data is used, which is what this policy does;
- access the personal data we hold about you and receive a copy;
- correct personal data that is inaccurate or incomplete;
- delete your personal data;
- restrict how we use your personal data in certain circumstances;
- object to processing based on our legitimate interests, and to direct marketing at any time;
- data portability, meaning to receive your personal data in a structured, commonly used, machine-readable format and have it sent to another organisation where technically feasible;
- withdraw consent at any time where we rely on consent, without affecting processing that took place before;
- not be subject to decisions based solely on automated processing that produce legal or similarly significant effects for you; and
- complain to a data protection authority (see section 11.4).
11.2. How to use your rights. You can do much of this yourself from your Account page: see and change how you log in, download a copy of your data, log out everywhere, and delete your account with or without your posts. For anything else, write to privacy@getworkgist.com from the email address you log in with, or tell us the masked login details shown on your Account page so that we can find your account without you sending us more personal data.
11.3. How we respond. We will respond within one month, or sooner where Data Protection Laws require. We may extend this by a further period allowed by law for complex requests, and we will tell you if we do. We do not charge a fee unless a request is manifestly unfounded or excessive. Because we keep as little information as possible about our members, we may need you to log in to confirm a request comes from you. We will not ask for ID documents unless there is no other way.
11.4. Complaints. We would like the chance to resolve any concern first, so please contact our Data Protection Officer. You also have the right to complain to the data protection authority where you live or work, including:
| Country | Authority |
|---|---|
| Nigeria | Nigeria Data Protection Commission (ndpc.gov.ng) |
| Kenya | Office of the Data Protection Commissioner (odpc.go.ke) |
| South Africa | Information Regulator (inforegulator.org.za) |
| Ghana | Data Protection Commission (dataprotection.org.gh) |
| Egypt | Personal Data Protection Center |
| Morocco | Commission Nationale de contrôle de la protection des Données à caractère Personnel (cndp.ma) |
| European Economic Area or United Kingdom | Your national data protection authority, or the Information Commissioner's Office in the United Kingdom |
12. Security
12.1. We use strong safeguards to protect personal data, including encryption, strict limits on which staff can see what, and regular checks of our systems.
12.2. No system is completely secure. If we become aware of a personal data breach that is likely to put your rights at risk, we will notify the relevant data protection authority within 72 hours where required, and notify you without undue delay where the breach is likely to result in a high risk to you, as Data Protection Laws require.
13. Automated tools
We use automated tools, including AI, to check Contributions for spam, abuse, personal details and anything else that breaks our Terms, and to check verification documents. The tools receive only the content, never your account, phone number or email address. Clear cases are approved automatically; anything unclear goes to a person. We do not make decisions based only on automated tools that have legal or similarly significant effects on you. If a Contribution is removed or a verification is refused, you can appeal or try again, and a person will look at it.
14. Children
The Service is for people aged 18 and over. We do not knowingly collect personal data from anyone under 18. If you believe a child has given us personal data, contact us and we will delete it.
15. Marketing
We do not send marketing messages unless you have agreed to receive them, and you can stop them at any time. Messages about your account, log-in codes and alerts you have chosen are not marketing.
16. Cookies
We use only the cookies and similar technologies that are needed to run the Service, unless you agree to others. Our Cookie Policy lists each of them and explains how to manage your choices.
17. Changes to this policy
We may update this policy from time to time. We will show the date of the latest version at the top. If we make a material change, we will tell you through the Service or by message to your login email or phone before it takes effect.
18. Contact us
For any question about this policy or your personal data, contact our Data Protection Officer at privacy@getworkgist.com.