CONSENT TO PROCESS PERSONAL INFORMATION IN TERMS OF THE PROTECTION OF INFORMATION ACT, 4 OF 2013 (POPIA)
1.1. This Informed Consent Notice will apply to (the “Company” / “Responsible Party”), and to you / the Data Subject, and / or your / the Data Subject’s Personal Information which is processed or may be processed by the Company including any processing of your / the Data Subject’s Personal Information by any Operators duly appointed by the Company.
1.2. The Protection of Personal Information Act, 4 of 2013, (“POPIA”) regulates and controls the processing, including the collection, use, and transfer of a person’s personal information.
1.3. In terms of POPIA, a person (Responsible Party) has a legal duty to collect, use, transfer and destroy (process) another’s (Data Subject) personal information (Personal Information) in a lawful, legitimate and responsible manner and in accordance with the provisions and processing conditions set out under POPIA.
Furthermore, unless the processing is –
Necessary to carry out actions for the conclusion or performance of a contract to which the Data Subject is a party; or
required and complies with an obligation imposed by law on either the Data Subject or the Responsible Party; or
necessary to protect the legitimate interest(s) of the Data Subject or the Responsible Party; or
necessary for the proper performance of a public law duty by a public body; or
necessary for pursuing the Data Subject or the Responsible Party’s legitimate interests, or that of a third party to whom the Personal Information is supplied.
All processing of a Data Subject’s Personal Information must be done with the Data Subject’s permission–i.e. the Data Subject has to consent to the processing of its Personal Information.
The Company does and will from time to time process Personal Information which belongs or is held by a Data Subject.
Following this, in order to comply with POPIA, the Company, in its capacity as the Responsible Party, requires the Data Subject’s permission to process its/his/her Personal Information.
2. In order to understand the implications of this document and the objectives of POPIA the reader is to take note of the following explanatory notes and definitions, which will be used throughout this Informed Consent Notice and which may be used in the interpretation of this document:
Consent means any voluntary, specific and informed expression of will in terms of which permission is given for the processing of Personal Information;
Data Subject means you, the person who will provide the Company or its Operator(s) with Personal Information and who consents when providing such Personal Information, to the Company’s use thereof in accordance with this Informed Consent Policy;
Operator means a natural person or a juristic person who processes a Data Subject’s Personal Information on behalf of the Company in terms of a contract or mandate, without coming under the direct authority of the Company.
Person means a natural person or a juristic person;
Personal Information means information relating to any identifiable, living, natural person, and where it is applicable, an identifiable, existing juristic person, including, but not limited to:
(i) information relating to the race, gender, sex, pregnancy, marital status, national, ethnic or social origin, sexual orientation, age, physical or mental health, well-being, disability, religion, conscience belief, culture, language and birth of the person;
(ii) information relating to the financial, criminal or employment history of the person;
(iii) any identifying number, symbol, e-mail address, physical address, telephone number, location information, online identifier or other particular assignment to the person;
(iv) the personal opinions, views or preferences of the person;
(v) correspondence sent by the person that is implicitly or explicitly of a private or confidential nature or further correspondence that would reveal the contents of the original correspondence;
(vi) the views or opinions of another individual about the person; and
(vii) the name of the person if it appears with other Personal Information relating to the person or if the disclosure of the name itself would reveal information about the person;
Processing means any operation or activity or any set of operations, whether or not by automatic means, concerning Personal Information, including
(i) the collection, receipt, recording, organisation, collation, storage, updating or modification, retrieval, alteration, consultation or use; (ii) dissemination by means of transmission, distribution or making available in any other form;
(ii) merging, linking, as well as restriction, degradation, erasure or destruction of information;
(iii) sharing with, transfer and further processing, to and with such information.
Record means any recorded information regardless of form or medium, including any of the following:
(i) Writing on any material; information produced, recorded or stored by means of any tape-recorded, computer equipment, whether hardware or software or both, or other device, and any material subsequently derived from information so produced, recorded or stored; label, marking or other writing that identifies or describes anything of which it forms part, or to which it is attached by any means; book, map, plan, graph or drawing; photograph, film, negative, tape or other device in which one or more visual images are embodied so as to be capable, with or without the aid of some other equipment, of being reproduced;
(ii) in the possession or under the control of a responsible party;
(iii) whether or not it was created by a responsible party; and
(iv) regardless of when it came into existence;
The Company and its Operators will from time to time process Personal Information pertaining to a Data Subject for business, marketing, promotional, investigations, security, employment, and contractual purposes. All Personal Information processed by the Company and its Operators will be housed under a record.
Responsible party means the Company including without detracting from the generality thereof, its directors, management, executives, HR practitioners, payroll department, internal auditors, legal practitioner and compliance officers, company secretary, and all other employees and Operators who need to process a Data Subject’s personal Information for the Company’s business purposes.
Special Personal information includes any information relating to an individual’s Ethnicity, Gender, Religious or other beliefs, Political opinions, Membership of a trade union, Sexual orientation, Medical history, Offences committed or alleged to have been committed by that individual, Biometric details, and Children’s details;
You means the person who is reading this Informed consent notice, namely the Data Subject, who by providing the Company with your Personal Information, gives the Company and its Operators consent to use and process your Personal Information in accordance with the provisions of this Informed Consent Policy.
PURPOSE OF COLLECTION
In order for the Company to pursue its business objectives and strategies, the Company needs to process the Data Subject’s Personal Information, which Personal Information will be used for a number of legitimate purposes, including, inter alia, the following:
3.1. for the purposes of complying with a variety of lawful obligations, including without detracting from the generality thereof: Administrative laws, Company laws, Corporate governance codes, Communication laws, Customs and Excise laws, Environmental laws, Financial and Tax laws, Health and Safety laws, Consumer laws, and Labour and Employment laws.
3.2. for the purposes of carrying out actions for the conclusion and performance of a contract as between the Company and yourself / the Data Subject;
3.3. for the purposes of protecting you/ the Data Subject’s and/or the Company’s legitimate interest(s) including the performance of risk assessments and risk profiles;
3.4. where required by law or company policy receiving from or providing to any credit bureau or credit provider or credit association information about your / the Data Subject’s credit record, including personal information about any judgement or default history;
3.5. for the purposes of any proposed or actual merger, acquisition or any form of sale of some or all the Company’s assets, providing your / the Data Subject’s Personal Information to third parties in connection with the evaluation of the transaction and related due diligence procedures;
3.6. for the purposes of making contact with you / the Data Subject and attending to your / the Data Subject’s enquiries and requests;
3.7. for the purpose of providing you/ the Data Subject from time to time with information pertaining to the Company, its directors, employees, services and goods and other ad hoc business-related information.
3.8. for academic research and statistical analysis purposes, including data analysis, testing, research and product development and product review purposes;
3.9. for the purposes of pursuing your / the Data Subject’s and / or the Company’s legitimate interests, or that of a third party to whom the Personal Information is supplied;
3.10. for the purposes of providing, maintaining, and improving the Company’s products and Services, and to monitor and analyse various usage and activity trends pertaining thereto;
3.11. for the purposes of performing internal operations, attending to all financial matters including budgeting, planning, invoicing, facilitating and making payments, making deliveries, sending receipts, and generally providing commercial support, where needed, requested or required;
3.12. for the purpose of preventing fraud and abuse of the Company’s processes, systems, procedures and operations, including conducting internal and external investigations and disciplinary enquiries and hearings.
You / the Data Subject agree that the Company may use all the Personal Information which you / the Data Subject provides to the Company which it requires for the purposes of pursuing its business objectives and strategies.
The Company in turn undertakes that it will only use your/the Data Subject’s Personal Information for the aforementioned purposes and for no other, unless with your / the Data Subject’s prior permission.
4. CONSEQUENCES OF YOU WITHOLDING CONSENT OR PERSONAL INFORMATION
Should you/the Data Subject refuse to provide the Company with your Personal Information which is required by the Company for the purposes indicated above, and the required consent to process the aforementioned Personal Information, then the Company will be unable to engage with you/the Data Subject or enter into any agreement or relationship with you/ the Data Subject.
5. STORAGE AND RETENTION AND DESTRUCTION OF INFORMATION
5.1. Your/the Data Subject’s Personal Information will be stored electronically in a centralised data base, which, for operational reasons, will be accessible to all within the Company on a need to know and business basis, save that where appropriate, some of your/the Data Subject’s Personal Information may be retained in hard copy.
5.2. All Personal Information which you/the Data Subject provide to the Company will be held and/or stored securely. In this regard the Company undertakes to conduct regular audits regarding the safety and the security of your/the Data Subject’s Personal Information.
5.3 Once your/the Data Subject’s Personal Information is no longer required due to the fact that the purpose for which the Personal Information was held has come to an end and expired, such Personal Information will be safely and securely archived for a period of 7 years, as per the requirements of the Companies Act, 71 of 2008 or longer should this be required by any other law applicable in South Africa. The Company thereafter will ensure that such Personal Information is permanently destroyed.
6. ACCESS BY OTHERS AND CROSS BORDER TRANSFER
6.1. The Company may from time to time have to disclose your / the Data Subject’s Personal Information to other parties, including its group companies or subsidiaries, joint venture companies, client companies and entities, and or approved product or third party service providers, regulators and or governmental officials, overseas service providers and related companies or agents, but such disclosure will always be subject to an agreement which will be concluded as between the Company and the party to whom it is disclosing your/ the Data Subject’s Personal Information to, which contractually obliges the recipient of your Personal Information to comply with strict confidentiality and data security conditions.
6.2 Where Personal Information and related data is transferred to a country which is situated outside the borders of South Africa, your / the Data Subject’s Personal Information will only be transferred to those countries which have similar data privacy laws in place or where the recipient of the Personal Information is bound contractually to a no lesser set of obligations that those imposed by POPIA.
7. RIGHT TO OBJECT AND COMPLAINTS
You / the Data Subject is encouraged to make immediate contact with the Company Information Officer at any time if you are not comfortable or satisfied with the manner in which the Company is processing your / the Data Subject’s Personal Information. On receipt of your / the Data Subject’s objection the Company will place a hold on any further processing until the cause of the objection has been resolved. If you / the Data Subject is not satisfied with such process, you / the Data Subject has the right to lodge a complaint with the Information Regulator.
8. ACCURACY OF INFORMATION AND ONUS
POPIA requires that all your / the Data Subject’s Personal Information and related details, as supplied are complete, accurate and up-to-date. Whilst the Company will always use its best endeavours to ensure that your / the Data Subject’s Personal Information is reliable, it will be your / the Data Subject’s responsibility to advise the Company of any changes to your / the Data Subject’s Personal Information, as and when these may occur.
9. ACCESS TO THE INFORMATION BY THE DATA SUBJECT
You / the Data Subject has the right at any time to ask the Company to provide you / the Data Subject with details of the Personal Information which the Company holds on your/ the Data Subject’s behalf; and/or the purpose for which it has been used provided that such request is made using the standard Section 51 PAIA process, which procedure is contained in the Company’s PAIA Manual and which can be provided to you on request.
10. AMENDMENTS AND BINDING ON SUCCESSORS IN TITLE
10.1. The Company reserves the right to amend this Informed Consent Notice from time to time, and the Company will inform you in writing of such changes.
10.2. The rights and obligations of the parties under this Informed Consent Notice will be binding on, and will be of benefit to, each of the parties’ successors in title and / or assigns where applicable, i.e. in the case of a sale or transfer of business by the Data Subject to another.
11. DECLARATION AND INFORMED CONSENT
11.1. I/ the Data Subject confirm that my / the Data Subject’s Personal Information, provided is accurate, up-to-date, not misleading and is complete in all respects, save where same may change and then in such an event, I/ the Data Subject undertake to advise the Company or its Operator (s) of these changes.
11.2. I, / the Data Subject, in providing the required Personal Information to the Company and / or to its Operator, consent and give the Company permission to process and further process my/the Data Subject’s Personal Information as and where required and acknowledge that I/the Data Subject understand the purposes for which the Personal Information is required and for which it will be used.
11.3. Furthermore, should any of the Personal Information which has been provided by myself concern or pertain to a legal entity whom I represent, I confirm that I have the necessary authority to act on behalf of such legal entity/ Data Subject and that I have the right to provide the Personal Information and / or the required consent to use said Personal Information, on behalf of the aforementioned legal entity.
11.4. Furthermore, should any of the Personal Information belong to any of my dependants and/or beneficiaries who are underage, I in my capacity as their legal guardian and competent person give the Company the appropriate permission to process their Personal Information for the purposes for which these details were given.
Building Future Value
[+27] 21 110 0260
Unit 8 | 30 Bella Rosa Street |
Rosenpark Bellville | 7530 | RSA
[+27] 12 346 1672
49 High Street | Alphenpark |
Pretoria | 0081 | RSA
[+27] 43 721 1424
4 Pearce Street | Berea | East London | 5241 | RSA