1. Introduction
The Resilient Workplace Institute NPC ("we," "us," "our") is a Non-Profit Company with Public Benefit Organisation (PBO) status, dedicated to making workplaces safer and preventing governance failures by measuring harassment risk. This Privacy Policy outlines our commitment to protecting the privacy of individuals whose data we process.
This policy explains how we collect, use, store, and protect Personal Information in compliance with South Africa's Protection of Personal Information Act (POPIA) and other relevant data protection laws.
Our registered address is: Mount Quray Road, Midlands Office Park West, Olifantsfontein, South Africa. Our contact email is [email protected].
2. Our Core Commitment: Anonymity and Data Protection
The cornerstone of our work is the trust placed in us by our clients and their employees. We are fundamentally committed to the principles of anonymity and data protection in all our operations, especially concerning the Harassment Risk Index (HRI) survey.
Survey Data is Anonymised at Source: All responses to the HRI survey are collected anonymously. We do not collect directly identifiable Personal Information such as names, employee numbers, or specific email addresses within the survey itself.
Data is Aggregated for Reporting: All our reports, research, and public-facing statistics are based on aggregated data. We implement strict k-anonymity protocols, meaning we will never report on any data segment or group so small that it could lead to the identification of an individual.
Purpose Limitation: The data collected through the HRI is used exclusively for the purpose of analyzing harassment risk trends, providing early warnings of governance failures, and conducting academic research. It is never used for any other purpose.
3. What Information We Collect
We collect information in two main ways:
a) Information from HRI Survey Participants (Anonymous Data):
Survey Responses: Answers to the 18 questions of the HRI survey, which relate to experiences and perceptions of workplace behaviours.
Demographic Data (Non-Identifying): We collect limited, non-identifying demographic information (e.g., gender, job level, department, region) solely for the purpose of high-level trend analysis. This data is always aggregated.
b) Personal Information from Clients, Partners, and Website Users:
Contact Information: When you contact us via our website form, email, or other channels, we may collect your name, email address, phone number, and company/organisation name.
Website Usage Information: We collect technical and behavioural information about your visit to our website through analytics tools such as Google Analytics and Microsoft Clarity. This may include your IP address, browser type, operating system, and how you interact with our pages (e.g., clicks and scrolls). This data is used to improve our website's functionality and user experience. For more detail, see Section 8.
4. How We Use Your Information
To Provide Our Services: We use client contact information to communicate about our services, deliver reports, and manage our professional relationship.
To Conduct Research & Analysis: We use anonymised and aggregated HRI data to identify risk patterns, generate insights, produce reports for clients, and contribute to academic research on workplace resilience.
To Improve Our Website: We use technical data to understand how visitors interact with our website and to make improvements.
To Communicate With You: If you contact us, we will use your information to respond to your inquiry.
5. Data Sharing and Disclosure
We do not sell, trade, or rent Personal Information to others. We may share data under the following limited circumstances:
Anonymised, Aggregated Data: We may share high-level, anonymised statistical data (such as the insights in our "Impact in Numbers" section) with the public, funders, and academic partners. This data is never personally identifiable.
Service Providers: We use third-party service providers to help us operate our business (e.g., website hosting, email services, and the analytics platforms described in Section 8). These providers are contractually bound to protect your information and may not use it for their own purposes.
Legal Obligation: We may disclose information if required to do so by law or in the good faith belief that such action is necessary to comply with a legal obligation.
6. Your Data Protection Rights under POPIA and GDPR
We are committed to upholding your rights over your Personal Information under applicable data protection laws, including South Africa's Protection of Personal Information Act (POPIA) and the European Union's General Data Protection Regulation (GDPR).
As a data subject, you have the right to:
Be Notified and Informed: To be notified that your personal information is being collected and to receive clear information about how we process it.
Access Your Information: To request access to the Personal Information we hold about you.
Rectification (Correction): To request the correction of inaccurate or incomplete Personal Information.
Erasure (Deletion or Destruction): To request the destruction or deletion of your Personal Information where it is no longer necessary for the purpose it was collected, or where you have withdrawn consent.
Object to Processing: To object to the processing of your Personal Information for reasons grounded in your particular situation, especially where processing is based on our legitimate interests or for direct marketing.
Lodge a Complaint: To lodge a complaint with the relevant supervisory authority. For South Africa, this is the Information Regulator. For the European Union, you can lodge a complaint with the data protection authority in your member state.
Additional Rights for Individuals in the European Union (under GDPR)
If you are in the European Union, you also have the right to:
Restrict Processing: To request the restriction of how we process your Personal Information in certain circumstances.
Data Portability: To receive the Personal Information, you have provided to us in a structured, commonly used, and machine-readable format, and to transmit that data to another controller.
To exercise any of these rights regarding your contact information, please email us at [email protected].
Please note that these rights apply to the Personal Information we collect from clients, partners, and website users (such as your contact details). They do not apply to the anonymised HRI survey data, as this data is not personally identifiable and cannot be linked back to an individual.
7. Data Security
We implement appropriate technical and organisational security measures to protect the information we hold from unauthorised access, alteration, disclosure, or destruction. Access to all data is strictly limited to authorised personnel who are bound by confidentiality obligatio
8. Cookies and Website Analytics Tools
Our website uses "cookies" to ensure proper functioning and to enhance user experience. A cookie is a small text file placed on your device by a website.
Essential Cookies: We use only essential cookies required for our website to operate correctly. These are typically provided by our hosting platform (Pocket Business) and are necessary for functions like security and form submissions. These cookies do not track your activity across other websites.
Analytics Cookies: We do not currently use non-essential cookies for third-party analytics (like Google Analytics) or advertising.
You can set your web browser to refuse cookies or to alert you when cookies are being sent. If you do so, note that some parts of the site may not function as intended.
9. Changes to This Privacy Policy
We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new policy on this page and updating the "Last Updated" date. We encourage you to review this Privacy Policy periodically for any changes.
10. Contact Us
If you have any questions about this Privacy Policy, please contact us at:
Email: [email protected]
Learn how the Harassment Risk Index is reshaping how governments, researchers, and companies act on workplace dignity.
Useful Links
© 2025 The Resilient Workplace Institute. All Rights Reserved.