CONSENT TO PROCESS PERSONAL INFORMATION IN TERMS OF THE PROTECTION OF PERSONAL INFORMATION ACT, 4 OF 2013 (POPI) BY SNUZA, including its divisions and trading partners (hereinafter referred to as the “Group of Companies”)
INTRODUCTION
The Protection of Personal Information Act, 4 of 2013, (POPI) regulates and controls the collection, use, transfer and processing of an individual or legal entity’s Personal Information. In terms of POPI, a “Responsible Party” (in this case being any member of the Group of Companies) has a legal duty to process a Data Subject’s Personal Information (in this case being your “Personal Information”) in a lawful, legitimate and responsible
The companies and their employees comprising the Group of Companies do from time to time process Personal Information.
In terms of POPI all persons, including any Group of Companies’ employee who collects, manages, processes, transfers, stores and / or retains Personal Information, whether held under a document, record or in any other format has a responsibility to process such information in accordance with the provisions housed under POPI.
In order to discharge this duty, the Group of Companies require your express and informed permission to process your Personal Information.
DEFINITIONS
“Personal information” means any information of a personal nature belonging to a Data Subject which may be or which is processed, collected, and used by a Responsible Party, and which will include any information related to or owned by either a private or public entity and/or natural individual such as a name, address and ID number, educational, medical, criminal or employment history, as well as information pertaining to financial transactions, views or opinions and information relating to the race, gender, sex, pregnancy, marital status, nationality, ethnic or social origin, colour, sexual orientation, age, physical or mental health, well-being, disability, religion, conscience, belief, culture, language and birth of the person.
“Processing” means the collecting, receiving, storing, using (including sharing of Personal Information with credit bureaus), updating, modifying, disseminating and destruction of Personal Information.
“Responsible Party” means the person, legal entity, company or public body that is responsible for processing an entity or individual’s personal information.
“Data Subject” means the individual, legal entity, public body or company, whose personal information is being processed.
“Information Officer” means in the information officer or deputy information officer of the Group of Companies who has been appointed in terms of as section 1 or 17 of PAIA.
PURPOSE FOR THE COLLECTION
The purpose for the collection of your Personal Information and the reason why the Group of Companies require your Personal Information is to enable the Group of Companies to:
All Personal Information which you provide to the Group of Companies will only be used for the purposes for which it is collected.
CONSEQUENCES OF WITHHOLDING CONSENT OR PERSONAL INFORMATION
Should you refuse to provide the Group of Companies with the required consent and / or Personal Information, then the Group of Companies will be unable to assist with your requirements or provide you with the requested services.
STORAGE AND RETENTION AND DESTRUCTION OF INFORMATION
All Personal Information which you provide to the Group of Companies will be held and / or stored securely and held for the purpose for which it was collected, as reflected above. Your Personal Information will be stored electronically in a centralised database, which, for operational reasons, will be accessible to all within the Group of Companies. Where appropriate, some information may be retained in hard copy. In either event, storage will be secure and audited regularly regarding the safety and the security of the information.
Where Personal Information and related data is transferred to a country which is situated outside the borders of the Republic of South Africa, said storage shall only be done in countries which have similar privacy laws to our own or where such facilities are bound contractually to no lesser regulations that those imposed by POPI.
Once your Personal Information is no longer required due to the fact that the purpose for which the information was held has expired, such Personal Information will be safely and securely archived for a period of 7 (seven) years, as per the requirements of the Companies Act, 71 of 2008 or longer should this be required by any other law applicable in the Republic of South Africa. Thereafter, all your Personal Information will be permanently destroyed.
RIGHT TO OBJECT
In terms of section 11(3) of POPI you have the right to object in the prescribed manner to the Group of Companies processing your Personal Information. On receipt of your objection the Group of Companies will place a hold on any further processing until the cause of the objection has been resolved.
Accuracy of Information and Onus
POPI requires that all your Personal Information and related details, as supplied are complete, accurate and up-to-date. Whilst the Group of Companies will always use its best endeavours to ensure that your Personal Information is reliable, it will be your responsibility to advise the Group of Companies of any changes to your Personal Information, as and when these may occur.
Access to the Information by the Data Subject
You have the right at any time to ask the Group of Companies to provide you with:
Complaints
You have the right to address any complaints to the Group of Companies Information Officer or to the Personal Information Regulator.
Direct Marketing, Advertising and Promotional activities
The Group of Companies:
Declaration and informed Consent
By accepting these terms I hereby acknowledge that: