Help
POPIA
1 Introduction
Processing is any operation or activity, whether by automatic means, including:
- Collection, receipt, recording, organization, collation, storage, updating or modification, retrieval, alteration, consultation, or use.
- Dissemination by means of transmission, distribution or making available in any form.
- Merging, linking, as well a restriction, degradation, erasure, or destruction.
- Consent means any voluntary, specific, and informed expression agreeing to the processing of PI.
- Data Subject means the person to whom the PI relates.
- Further retention is required by law.
- The responsible party reasonably requires keeping it.
- Retention is required by a contract between the parties.
- The data subject consents to further retention.
- The Accountability employee shall ensure that the information collected will not be used for any other purpose before obtaining the individual's approval unless the new purpose is required by law.
- The Accountability employee shall ensure that the person collecting PI will be able to explain to the individual why this is being done.
- The Accountability employee shall ensure that limited collection, limited use, disclosure, and retention principles are respected in identifying why PI is to be collected.
Information Officers? Accountability and Responsibility:
- Value Fencing's Directors will be appointed as Information Officers and the Compliance Officers will serve as the deputies.
- All persons who collect, process, or use PI shall be accountable to the Information Officers/Deputies for such information.
- Any person suspecting that the information is being used for purposes other than that explicitly approved and collected for, may register a complaint with the Deputy Information Officer/s at disputes@accountability.co.za / ludwig@accountability.co.za
- The Deputy Information Officer/s shall investigate the above complaint and inform the complainant of his/her findings and corrective action taken, if any.
- If the complainant is dissatisfied with the findings of the Deputy Information Officer/s, an appeal may be submitted to Value Fencing's Information Officers. The decision made by Value Fencing's Information Officer/s will be final.
- The Deputy Information Officer/s shall be responsible for giving training to all Value Fencing's employees and other Partner(s) who might collect, use, or retain PI.
- When collecting PI, the responsible party shall obtain consent from the Data Subject, to use, collect, retain, or disclose said PI.
- When collecting PI, the responsible party shall ensure that the Data Subject understands how the PI will be used.
- Express consent will be obtained from the Data Subject, unless it is in the Information Officer's opinion that implied consent will be acceptable. The consent must be clear and verifiable.
- The reasonable expectations of the Data Subjects will be respected.
- The Data Subject may, at any time, withdraw consent given, subject to legal and contractual restrictions by giving reasonable notice.
- The data subject consents to the processing.
- Processing is necessary for the conclusion or performance of a contract to which the data subject is a party.
PI must be collected directly from the data subject except if:
- The information is contained in a public record or has deliberately been made public by the data subject.
- The data subject has consented to the collection from another source.
- Collection from another source would not prejudice a legitimate interest of the data subject.
- Further processing must be compatible with the purpose for which it was collected unless the data subject gives consent to the further processing.
Direct marketing means unsolicited electronic communication.
- Has given consent; or
- Is a member of the responsible party and if:
- The party responsible has obtained the contact details of the data subject in the context of the sale of a product or service.
- It is for marketing the responsible parties own related products or services; and
- If the data subject has been given a reasonable opportunity to object, free of charge, at the time the information was collected or on the occasion of each communication for the purpose of marketing.
- Anyone processing PI on behalf of a responsible party must:
- Treat the information as confidential and do not disclose it unless required by law.
- Apply the same security measures as the party responsible.
- The processing must be governed by a written contract ensuring safeguards are in place; and
- If domiciled outside the Republic of South Africa, comply with local protection of personal information laws.
The Data Subject may request the responsible party to:
- Correct or delete PI that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading, or obtained unlawfully.
- Delete or destroy PI that the responsible party is no longer authorized to retain.
- The Deputy Information Officer shall ensure that all employees and consultants know the importance of keeping PI confidential. The Deputy Information Officer shall ensure that care is taken when PI is disposed of or destroyed to prevent unauthorized parties from gaining access to it.
- The information being collected.
- The name and address of the Responsible Party.
- The purpose for which the information is being collected.
- Whether or not the supply of the information is voluntary or mandatory.
- The consequences of failure to provide the information.
- Any law authorizing the requirement of the collection.
- The right of access to, and the right to rectify, the information collected.
- The fact that, where applicable, the responsible party intends to transfer the information to a third country/international organization and the level of protection afforded by that third country / organization; and
- The right to object to the processing of the information.
This policy can be updated at any time and when necessary, by the Information Officer.
The distribution of this Policy is circulated to the following persons:
15 Management ReviewReports required for the reviewing of input and output of this process are:
- Customer service delivery reports
- Customer Satisfaction survey results
- Minutes of customer meetings
- Follow up actions from previous management reviews
- IF-001-Risk Management Register
- Information Security Incident Management Reports