POPIA POLICY
Protection of Personal Information, Information Security and Records Management Policy Privacy is paramount
This is the Protection of Personal Information, Information Security and Records Management Policy for:
SENSORY FX (PTY) LIMITED
Registration Number: 2010/016074/07 and all its subsidiaries and divisions (hereinafter referred to as the “the Organisation”).
PROTECTION OF PERSONAL INFORMATION IN TERMS OF THE PROTECTION OF PERSONAL INFORMATION ACT 4 OF 2013
1. INTRODUCTION
1.1.The Organisation is in the business of manufacturing flavours and fragrances. This requires the Organisation to collect, collate, store and disseminate a vast amount of personal information on a daily basis, obliging the Organisation to comply with the Protection of Personal Information Act 4 of 2013 (“Act”).
1.2 The Act requires the Organisation to inform their clients as to the manner in which their personal information is used, disclosed and destroyed. The Organisation is committed to protecting its client’s privacy and ensuring that their personal information is used appropriately, transparently, securely and in accordance with applicable laws.
1.3 This Policy sets out the manner in which the Organisation deals with their client’s personal information as well as stipulates the purpose for which said information is used.
1.4 The Policy is made available on the Organisation website sensoryfx.co.za and by request from the Organisation.
1.5 The Policy is drafted in conjunction with the National Credit Act 34 of 2005, and the Consumer Protection Act 68 of 2008.
2. BACKGROUND AND PURPOSE
2.1 What is the purpose of the Act (POPIA)?
2.2 The aim of the Act is to ensure the right of South African citizens to the privacy of personal information and to regulate all organisations that collect, store and disseminate personal information.
2.3 Personal information may only be processed if the process meets the conditions of the Act.
2.4 There are 8 (eight) distinct conditions which organisations need to meet to be acting lawfully:
2.4.1 accountability;
2.4.2 processing limitation;
2.4.3 purpose specification;
2.4.4 use limitation;
2.4.5 information quality;
2.4.6 openness;
2.4.7 security safeguards; and
2.4.8 individual/data subject participation.
2.5 What is “personal information”?
2.6 Personal information means any information relating to an identifiable natural person (and existing juristic persons where applicable), including information relating to:
2.6.1 race, gender, sex, pregnancy, marital status, mental health, well-being, disability, religion, belief, culture, language and birth;
2.6.2 education, medical, financial, criminal or employment;
2.6.3 identity number, electronic and physical addresses, telephone numbers and on-line identifiers;
2.6.4 biometric information;
2.6.5 personal opinions, views or preferences; and
2.6.6 correspondence sent by a person implicitly or explicitly of a personal nature or confidential.
2.7 An organisation may not process the personal information of a child (under 18) unless the processing:
2.7.1 is carried out with the consent of the legal guardian;
2.7.2 is necessary to establish, exercise or defence of a right or obligation in law;
2.7.3 is necessary for historical, statistical or research purposes; or
2.7.4 is information that is deliberately been made public by the child with the consent of the guardian.
2.8 What is processing personal information?
2.9 Processing means any operation or activity, or set of activities, by automatic means or otherwise, including:
2.9.1 collecting, receiving, recording, collating, storing, updating, modifying, retrieving or use;
2.9.2 disseminating by means of transmission, distribution or any other means; or
2.9.3 merging, linking, restricting, erasing or destructing of information.
2.10 Who must comply?
2.10.1 All public and private bodies (natural and juristic persons) must comply.
2.11 What does compliance mean?
2.11.1 Accountability
2.11.1.1 Organisations must assign responsibility to ensure compliance with the Act to a suitable person or persons.
2.11.1.2 Each organisation has an “information officer”. This will be the same person who has been appointed by the organisation as head in terms of the Promotion of Access to Information Act, i.e. the CEO or equivalent.
2.11.1.3 The information officer, together with an executive team/board, should decide on and record the POPI policy and procedure (this policy).
2.11.1.4 The information officer must appoint a “data controller” or a number of data controllers who decide:
2.11.1.4.1 the purpose of the data processing; and
2.11.1.4.2 the way the personal information should be processed.
2.11.1.5 The data controllers should be management who execute the POPI policy and procedure.
2.11.1.6 “Data processor/s” perform the processing administration/function (e.g. data capturing etc).
2.11.2 Processing limitation
2.11.2.1 Personal information may only be processed if it is:
2.11.2.1.1 adequate, relevant and necessary for the purpose for which it is processed;
2.11.2.1.2 with the consent of the data subject;
2.11.2.1.3 necessary for the contract to which the data subject is party;
2.11.2.1.4 necessary for the protection of a legitimate interest of the data subject
2.11.2.1.5 required by law;
2.11.2.1.6 necessary to pursue the legitimate interest of the organisation; or
2.11.2.1.7 collected directly from the data subject, except in certain circumstances (e.g. in public domain or to do so would defeat the purpose for collecting and processing).
2.11.2.2 “Consent” must be:
2.11.2.2.1 voluntary;
2.11.2.2.2 specific; and
2.11.2.2.3 Informed
2.11.2.3 consent requires that the data subject understand:
2.11.2.3.1 what information is being collected/processed;
2.11.2.3.2 why the information is being processed;
2.11.2.3.3 how the information is to be processed;
2.11.2.3.4 where the information is being processed; and
2.11.2.3.5 to whom the information is intended to be given.
2.11.3 Purpose specification
2.11.3.1 The data subject must be made aware of the purpose for which the information is being collected (“identified purpose”). This is necessary for giving consent (see above).
2.11.4 Use limitation
2.11.4.1 Information/records may only be kept for as long as it is necessary to achieve the identified purpose. There are some statutory record keeping periods which may exceed this.
2.11.4.2 After this retention period the responsible person must delete or destroy such information as soon as reasonably possible.
2.11.4.3 If the purpose changes (e.g. something else occurs that could use the same information again for this alternative purpose), it may be necessary to inform the data subject and get consent again.
2.11.5 Information quality
2.11.5.1 Information must be as accurate as possible, complete and updated if necessary.
2.11.52 Information must be available to the data subject to verify/object to the accuracy thereof.
2.11.6 Openness
2.11.6.1 The Organisation must take reasonable practical steps to ensure that the data subject is aware of what personal information is being collected, stored and used, whether or not collected directly from the data subject.
2.11.7 Security safeguards
2.11.7.1 The organisation must secure the integrity and confidentiality of personal information und must take appropriate technical/organisational measure to prevent:
2.11.7.1.1 the loss of or damage to personal information; or
2.11.7.1.2 the unlawful access to or processing of personal information.
To do this, the organisation must:
identify all reasonable foreseeable internal and external risks to personal information held;
establish and maintain appropriate reasonable safeguards against the risks;
monitor the safeguards and regularly verify safeguards are effective; and
ensure safeguards are updated to respond to new risks or deficiencies in previous safeguards
The data controllers and data processors must operate under his/her authority from the information officer and treat all personal information as confidential.
Where there are reasonable grounds for suspecting a breach of data security, the responsible person must notify the Regulator and the data subject.
Data subject participation
Any person who can positively identify themselves is entitled to access their own personal information.
A data subject has the right to correct or amend any of their personal information that may be inaccurate, misleading or out of date.
What steps should be taken to comply?
An audit should be conducted of the following:
what personal information is held?
where the personal information is being held?
by whom is the personal information being held?
Establish what personal information is being collected in one place and being transferred to another.
Review website and other privacy statements, email indemnity, supplier or other standard terms and conditions, engagement letters, employee letters of appointment and third-party agreements that will process personal information of your clients or customers.
Develop organisation wide standard data protection policies and protocols, and if in place already in place, review such policies and protocols.
Review IT outsourcing contracts and arrangements.
Review data collecting activities (completion of forms etc).
Appoint an information officer for POPI and PAIA purposes.
Provide training to staff.
Details of Information Officer and Head Office
The details of the Organisation’s Information Officer and Head Office are as follows:
| Information Officer | Daniel Francois Strydom |
| Address | 154 Edward Avenue, Hennopspark, Centurion, South Africa |
| Telephone Number | 0834117958 |
| francois@sensoryfx.co.za |
| Deputy Information Officer | Johennes Wilhelm Stodart |
| Address | 154 Edward Avenue, Hennopspark, Centurion, South Africa |
| Telephone Number | 0825755054 |
| jw@sensoryfx.co.za |
PERSONAL INFORMATION COLLECTED
Section 9 of the Act states that “Personal Information” may only be processed if, given the purpose for which it is processed, it is adequate, relevant and not “excessive.”
The Organisation collects and processes client’s personal information for the ordering, manufacturing and delivery of products, for the opening of trading accounts, where applicable, for communication purposes relating to the ordering, manufacturing and delivery of products and to communicate with clients with regards to future orders, prices and accounts.
The type of information will depend on the need for which it is collected and will be processed for that purpose only.
Whenever possible, the Organisation will inform the client as to the information required and the information deemed optional.
The Organisation also collects and processes the client’s personal information for marketing purposes in order to ensure that our products and services remain relevant to our clients and potential clients.
The Organisation aims to have agreements in place with all product suppliers and third-party service providers to ensure a mutual understanding with regard to the protection of the client’s personal information. The Organisation suppliers will be subject to the same regulations as applicable to the Organisation.
With the client’s consent, the Organisation may also supplement the information provided with information the Organisation receives from other providers in order to offer a more consistent and personalized experience in the client’s interaction with the Organisation. For purposes of this Policy, clients include potential and existing clients.
THE USE OF PERSONAL INFORMATION
The Client’s personal information will only be used for the purpose for which it was collected and as agreed. This may include:
providing products or services to clients and to carry out the transactions requested;
for the ordering, manufacturing and delivery of products;
for the opening of trading accounts, where applicable;
for communication purposes relating to the ordering, manufacturing and delivery of products; and
to communicate with clients with regards to future orders, prices and accounts.
confirming, verifying and updating client details;
conducting market or customer satisfaction research;
for audit and record keeping purposes;
in connection with legal proceedings;
in connection with and to comply with legal and regulatory requirements or when it is otherwise allowed by law; and
as required in terms of clause 3.2 above.
According to section 10 of the Act, personal information may only be processed if certain conditions, listed below, are met along with supporting information for the Organisation processing of Personal Information:
the client’s consent to the processing: – consent is obtained from clients during the introductory, appointment and needs analysis stage of the relationship;
the necessity of processing: in order to conduct an accurate analysis of the client’s needs;
processing complies with an obligation imposed by law on the Organisation;
the National Credit Act requires a Credit Provider’s to conduct an affordability assessment
processing protects a legitimate interest of the client; or
processing is necessary for pursuing the legitimate interests of the Organisation or of a third party to whom information is supplied — in order to provide the Organisation clients with products and or services both the Organisation and any of our product suppliers require certain personal information from the clients in order to make an expert decision on the unique and specific product and or service required.
DISCLOSURE OF PERSONAL INFORMATION
The Organisation may disclose a client’s personal information to any of the Organisation subsidiaries, joint venture companies and or approved product supplier or third-party service providers whose services or products clients elect to use. The Organisation has agreements in place to ensure compliance with confidentiality and privacy conditions.
The Organisation may also share client personal information with, and obtain information about clients from third parties for the reasons already discussed above.
The Organisation may also disclose a client’s information where it has a duty or a right to disclose in terms of applicable legislation, the law, or where it may be deemed necessary in order to protect the Organisation rights.
All employees have a duty of confidentiality in relation to the Organisation and clients.
Information on clients: Our clients’ right to confidentiality is protected in the Constitution and in terms of the Law. Information may be given to a third party if the client has consented in writing to that person receiving the information.
The Organisation views any contravention of this policy very seriously and employees who are guilty of contravening the policy will be subject to disciplinary procedures, which may lead to the dismissal of any guilty party.
SAFEGUARDING PERSONAL INFORMATION
It is a requirement of the Act to adequately protect personal information. The Organisation will continuously review its security controls and processes to ensure that personal information is properly safeguarded.
The Organisation Information Officer is responsible for the compliance of the conditions of the lawful processing of personal information and other provisions of the Act. The Information Officer will be assisted by Deputy Information Officer/s.
This policy has been put in place throughout the Organisation and training on this policy and the Act has already taken place and will continue to be conducted by the Organisation.
Each new employee will be required to sign an Employment Contract containing relevant consent clauses for the use and storage of employee information, or any other action so required, in terms of the Act.
Every employee currently employed within the Organisation will be required to sign an addendum to their Employment Contracts containing relevant consent clauses for the use and storage of employee information, or any other action so required, in terms of the Act.
All the Organisation electronic files or data are backed and stored off site.
The Organisation product suppliers, insurers and other third-party service providers will be required to sign a service level agreement guaranteeing their commitment to the Protection of Personal Information; this is however an ongoing process that will be evaluated as needed.
CORRECTION OF PERSONAL INFORMATION
Clients have the right to access the personal information the Organisation holds about them. Clients also have the right to ask the Organisation to update, correct or delete their personal information on reasonable grounds. Once a client objects to the processing of their personal information, the Organisation may no longer process said personal information.
The Organisation will take all reasonable steps to confirm its clients’ identity before providing details of their personal information or making changes to their personal information.
AMENDMENTS TO THIS POLICY
Amendments to, or a review of this Policy, will take place on an ad hoc basis or at least once a year.
Clients are advised to access the Organisation’s website periodically to keep abreast of any changes. Where material changes take place, clients will be notified directly or changes will be stipulated on the Organisation website or on request from the registered office of the Organisation.
ACCESS TO DOCUMENTS
All company and client information must be dealt with in the strictest confidence and may only be disclosed, without fear of redress, in the following circumstances:
where disclosure is under compulsion of law;
where there is a duty to the public to disclose;
where the interests of the Organisation require disclosure; or
where disclosure is made with the express or implied consent of the client.
REQUESTS FOR THE ORGANISATION INFORMATION
This is dealt with in terms of the Promotion of Access to Information Act, 2 of 2000 (“PAIA”), which gives effect to the constitutional right of access to information held by the State or any person (natural and juristic) that is required for the exercise or protection of rights. Private bodies, like the Organisation, must however refuse access to records if disclosure would constitute an action for breach of the duty of secrecy owed to a third party.
In terms hereof, requests must be made in writing on the prescribed form to the Information Officer in terms of PAIA. The requesting party has to state the reason for wanting the information and has to pay a prescribed fee.
The Organisation’s manuals in terms of PAIA, which contains the prescribed forms and details of prescribed fees, is available on the intranet and the Organisation website www.sensoryfx.co.za.
Confidential company and/or business information of the Organisation may not be disclosed to third parties as this could constitute industrial espionage. The affairs of the Organisation must be kept strictly confidential at all times.
RETENTION OF DOCUMENTS
Hard Copy – The statutory periods for the retention of documents are as per the Law. These are available on request.
Electronic Storage – The internal procedure requires that electronic storage of information: important documents and information must be referred to and discussed with IT who will arrange for the indexing, storage and retrieval thereof. This will be done in conjunction with the departments concerned.
Scanned documents: If documents are scanned, the hard copy must be retained for as long as the information is used or for 1 year after the date of scanning, with the exception of documents pertaining to personnel. Any document containing information on the written particulars of an employee, including: employee’s name and occupation, time worked by each employee, remuneration and date of birth of an employee under the age of 18 years; must be retained for a period of 3 years after termination of employment.
Section 51 of the Electronic Communications Act No 25 of 2005 requires that personal information and the purpose for which the data was collected must be kept by the person who electronically requests, collects, collates, processes or stores the information and a record of any third party to whom the information was disclosed must be retained for a period of 1 year or for as long as the information is used.
It is also required that all personal information which has become obsolete must be destroyed.
DESTRUCTION OF DOCUMENTS
Documents may be destroyed after the termination of the retention period specified in terms of the Law. Registration will request departments to attend to the destruction of their documents and these requests shall be attended to as soon as possible.
Each department is responsible for attending to the destruction of its documents, which must be done on a regular basis. Files must be checked in order to make sure that they may be destroyed and also to ascertain if there are important original documents in the file. Original documents must be returned to the holder thereof, failing which, they should be retained by the Organisation pending such return.
After completion of the process in clause 13.2 above, the General Manager of the department shall, in writing, authorise the removal and destruction of the documents in the authorisation document. These records will be retained by Registration.
The documents are then made available for collection by the removers of the Organisation’s documents, who also ensure that the documents are shredded before disposal. This also helps to ensure confidentiality of information.
Documents may also be stored off-site, in storage facilities approved by the Organisation.
CROSS-BORDER FLOWS OF PERSONAL INFORMATION
Section 72 of the Act provides that Personal Information may only be transferred out of the Republic of South Africa if the:
recipient country can offer such data an “adequate level” of protection. This means that its data privacy laws must be substantially similar to the Conditions for Lawful Processing as contained in the Act; or
the client or customer consents to the transfer of their personal information; or
transfer is necessary for the performance of a contractual obligation between the client or customer and the Organisation; or
transfer is necessary for the performance of a contractual obligation between the Organisation and a third party, in the interests of the client or customer; or
the transfer is for the benefit of the client or customer, and it is not reasonably practicable to obtain the consent of the client or customer, and if it were, the client or customer, would in all likelihood provide such consent.
| Document Owner: | Ink Legal (Pty) Limited |
| Approved by: | SENSORY FX (PTY) LIMITED |
| Date approved: | January 2022 |
| Due for review by Owner: | January 2023 |
| Version: | Version 2 |