Contents

1. INTRODUCTION
2. ABBREVIATIONS, DEFINITIONS AND TERMINOLOGY
3. SCOPE AND PURPOSE
4. POLICY APPLICATION
5. RIGHTS OF DATA SUBJECTS

6. GENERAL GUIDING PRINCIPLES

7. INFORMATION OFFICERS

Companies E-mail Disclaimer

c. Employees and other Persons acting on behalf of the Organisation

1. INTRODUCTION

The right to privacy is an integral human right recognised and protected in the South African Constitution and in the Protection of Personal Information Act 4 of 2013 (“POPIA”).

POPIA aims to promote the protection of privacy through providing guiding principles that are intended to be applied to the processing of personal information in a context-sensitive manner.

Through the provision of quality services and retail as well as wholesale, KAROSSWERKERS (PTY)LTD  is necessarily involved in the collection, use and disclosure of certain aspects of the personal information of clients, customers, employees and other stakeholders.

A person’s right to privacy entails having control over his or her personal information and being able to conduct his or her affairs relatively free from unwanted intrusions.

Given the importance of privacy, our organisation is committed to effectively managing personal information in accordance with POPIA’s provisions.

2. ABBREVIATIONS, DEFINITIONS AND TERMINOLOGY

3. SCOPE AND PURPOSE

This purpose of this policy is to protect KAROSSWERKERS (PTY)LTD  from the compliance risks associated with the protection of personal information which includes:

• Breaches of confidentiality. For instance, the company could suffer loss in revenue where it is found that the personal information of data subjects has been shared or disclosed inappropriately.
• Failing to offer choice. For instance, all data subjects should be free to choose how and for what purpose the company uses information relating to them.
• Reputational damage. For instance, the company could suffer a decline in shareholder value following an adverse event such as a computer hacker deleting the personal information held by the organisation.

This policy demonstrates the organisation’s commitment to protecting the privacy rights of data subjects in the following manner:

• Through stating desired behaviour and directing compliance with the provisions of POPIA and best practice.
• By cultivating an organisational culture that recognises privacy as a valuable human right.
• By developing and implementing internal controls for the purpose of managing the compliance risk associated with the protection of personal information.
• By creating business practices that will provide reasonable assurance that the rights of data subjects are protected and balanced with the legitimate business needs of the organisation.
• By assigning specific duties and responsibilities to control owners, including the appointment of an Information Officer  and where necessary, Deputy Information Officers in order to protect the interests of the organisation and data subjects.
• By raising awareness through training and providing guidance to individuals who process personal information so that they can act confidently and consistently.

4. POLICY APPLICATION

This policy and its guiding principles apply to:

• The organisation’s governing body
• All branches, business units and divisions of the organisation
• All employees and volunteers
• All sub-contractors, suppliers, customers and other parties acting on behalf of the organisation

The policy’s guiding principles find application in all situations and must be read in conjunction with POPIA as well as the organisation’s PAIA Policy as required by the Promotion of Access to Information Act (Act No 2 of 2000). (Available on our website at https://www.kaross.co.za

The legal duty to comply with POPIA’s provisions is activated in any situation where there is:

• A processing of personal information entered into a record by or for a responsible person who is domiciled in South Africa.

POPIA does not apply in situations where the processing of personal information:

• is concluded in the course of purely personal or household activities, or
• where the personal information has been de-identified.

5. RIGHTS OF DATA SUBJECTS                        

The Right to Access Personal Information

The organisation recognises that a data subject has the right to establish whether the organisation holds personal information related to him, her or it including the right to request access to that personal information.

An example of a “Personal Information Request Form” can be found on our website http://www.kaross.co.za

The data subject has the right to request, where necessary, that his, her or its personal information must be corrected or deleted where the organisation is no longer authorised to retain the personal information.

The data subject has the right, on reasonable grounds, to object to the processing of his, her or its personal information.

In such circumstances, the organisation will give due consideration to the request and the requirements of POPIA. The organisation may cease to use or disclose the data subject’s personal information and may, subject to any statutory and contractual record keeping requirements, also approve the destruction of the personal information.

The data subject has the right to object to the processing of his, her or its personal information for purposes of direct marketing by means of unsolicited electronic communications.

The data subject has the right to submit a complaint to the Information Regulator regarding an alleged infringement of any of the rights protected under POPIA and to institute civil proceedings regarding the alleged non-compliance with the protection of his, her or its personal information.

An example of a “POPI Complaint Form” can be found under marked ANNEXURE A

 The data subject has the right to be notified that his, her or its personal information is being collected by the organisation.

The data subject also has the right to be notified in any situation where the organisation has reasonable grounds to believe that the personal information of the data subject has been accessed or acquired by an unauthorised person.

6. General Guiding Principles 

All employees and persons acting on behalf of the organisation will at all times be subject to, and act in accordance with, the following guiding principles:

Failing to comply with POPIA could potentially damage the organisation’s reputation or expose the organisation to a civil claim for damages. The protection of personal information is therefore responsibility of all employees.

The organisation will ensure that the provisions of POPIA and the guiding principles outlined in this policy are complied with through the encouragement of desired behaviour. However, the organisation will take appropriate sanctions, which may include disciplinary action, against those individuals who through their intentional or negligent actions and/or omissions fail to comply with the principles and responsibilities outlined in this policy.

Processing Limitation

The organisation will ensure that personal information under its control is processed:

• in a fair, lawful and non-excessive manner, and
• only with the informed consent of the data subject, and
• only for a specifically defined purpose.

KAROSSWERKERS (PTY)LTD  will inform the data subject of the reasons for collecting his, her or its personal information and obtain written consent prior to processing personal information.

Alternatively, where services or transactions are concluded over the telephone or electronic video feed, the organisation will maintain a voice recording of the stated purpose for collecting the personal information followed by the data subject’s subsequent consent.

The organisation will under no circumstances distribute or share personal information between separate legal entities, associated organisations (such as subsidiary companies) or with any individuals that are not directly involved with facilitating the purpose for which the information was originally collected.

Where applicable, the data subject must be informed of the possibility that their personal information will be shared with other aspects of the organisation’s business and be provided with the reasons for doing so.

 All of the organisation’s business units and operations must be informed by the principle of transparency.

The organisation will process personal information only for specific, explicitly defined and legitimate reasons. The organisation will inform data subjects of these reasons prior to collecting or recording the data subject’s personal information.

 Personal information will not be processed for a secondary purpose unless that processing is compatible with the original purpose.

Therefore, where the organisation seeks to process personal information, it holds for a purpose other than the original purpose for which it was originally collected, and where this secondary purpose is not compatible with the original purpose, the organisation will first obtain additional consent from the data subject. Consent for further processing is contained in the Letters of Engagement.

 The organisation will take reasonable steps to ensure that all personal information collected is complete, accurate and not misleading.

The more important it is that the personal information be accurate (for example, the beneficiary details of a life insurance policy are of the utmost importance), the greater the effort the organisation will put into ensuring its accuracy.

Where personal information is collected or received from third parties, the organisation will take reasonable steps to confirm that the information is correct by verifying the accuracy of the information directly with the data subject or by way of independent sources.

 The organisation will take reasonable steps to ensure that data subjects are notified (are at all times aware) that their personal information is being collected including the purpose for which it is being collected and processed.

KAROSSWERKERS (PTY)LTD will ensure that it establishes and maintains a “contact us” facility which is our Section 51 Manual Promotion of Access to Information Act No. 2 OF 2000, for data subjects who want to:

• Enquire whether the organisation holds related personal information, or
• Request access to related personal information, or
• Request the organisation to update or correct related personal information, or
• Make a complaint concerning the processing of personal information.

The organisation will manage the security of its filing system to ensure that personal information is adequately protected. To this end, security controls will be implemented to minimise the risk of loss, unauthorised access, disclosure, interference, modification, or destruction. Security measures also need to be applied in a context-sensitive manner.

KAROSSWERKERS (PTY)LTD will continuously review its security controls which will include regular testing of protocols and measures put in place to combat cyber-attacks on the organisation’s IT network. For example, firewalls, anti-virus software and restricted access to servers and cloud-based data recovery.

The organisation will ensure that all paper and electronic records comprising personal information are securely stored in an access-controlled store room and made accessible only to authorised individuals.

All employees will be required to sign employment contracts containing contractual terms for the use and storage of employee information. A confidentiality contract will also be signed to reduce the risk of unauthorised disclosures of personal information for which the organisation is responsible. 

The organisation’s operators and third-party service providers will be required to enter into service level agreements with the organisation where both parties pledge their mutual commitment to POPIA and the lawful processing of any personal information pursuant to the agreement.

A data subject may request the correction or deletion of his, her or its personal information held by the organisation.

The organisation will ensure that it provides a facility for data subjects who want to request the correction of deletion of their personal information.

7. Information Officers

KAROSSWERKERS (PTY)LTD ’s  Information Officer is JANINE PRETORIUS  and where necessary will  appoint a Deputy Information Officer to assist the Information Officer.

The organisation’s Information Officer is responsible for ensuring compliance with POPIA.

Where no Information Officer is appointed, the Chief Executive Officer/Directors will assume the role of the Information Officer. Consideration will be given on an annual basis to the re-appointment or replacement of the Information Officer and the re-appointment or replacement of any Deputy Information Officers.

Once appointed, the organisation will register the Information Officer with the South African Information Regulator established under POPIA prior to performing his or her duties.

Specific Duties and Responsibilities

The organisation’s governing body cannot delegate its accountability and is ultimately answerable for ensuring that the organisation meets its legal obligations in terms of POPIA.

The governing body may however delegate some of its responsibilities in terms of POPIA to management or other capable individuals. 

The governing body is responsible for ensuring that:

• The organisation appoints an Information Officer, and where necessary, a Deputy Information Officer.

• All persons responsible for the processing of personal information on behalf of the organisation:

• are appropriately trained and supervised to do so,
• understand that they are contractually obligated to protect the personal information they come into contact with, and
• are aware that a wilful or negligent breach of this policy’s processes and procedures may lead to disciplinary action being taken against them.

• Data subjects who want to make enquires about their personal information are made aware of the procedure that needs to be followed should they wish to do so.

• The scheduling of a periodic POPI Audit in order to accurately assess and review the ways in which the organisation collects, holds, uses, shares, discloses, destroys and processes personal information

The organisation’s Information Officer is responsible for:

• Taking steps to ensure the organisation’s reasonable compliance with the provision of POPIA.
  Keeping the governing body updated about the organisation’s information protection responsibilities under POPIA. For instance, in the case of a security breach, the Information Officer must inform and advise the governing body of their obligations pursuant to POPIA.
• Continually analysing privacy regulations and aligning them with the organisation’s personal information processing procedures. This will include reviewing the organisation’s information protection procedures and related policies.
• Ensuring that POPI Audits are scheduled and conducted on a regular basis.
• Ensuring that the organisation makes it convenient for data subjects who want to update their personal information or submit POPI related complaints to the organisation. For instance, maintaining a “contact us” facility on the organisation’s website.
• Approving any contracts entered into with operators, employees and other third parties which may have an impact on the personal information held by the organisation. This will include overseeing the amendment of the organisation’s employment contracts and other service level agreements.
• Encouraging compliance with the conditions required for the lawful processing of personal information.
• Ensuring that employees and other persons acting on behalf of the organisation are fully aware of the risks associated with the processing of personal information and that they remain informed about the organisation’s security controls.
• Organising and overseeing the awareness training of employees and other individuals involved in the processing of personal information on behalf of the organisation.
• Addressing employees’ POPIA related questions.
• Addressing all POPIA related requests and complaints made by the organisation’s data subjects.
• Working with the Information Regulator in relation to any ongoing investigations. The Information Officers will therefore act as the contact point for the Information Regulator authority on issues relating to the processing of personal information and will consult with the Information Regulator where appropriate, with regard to any other matter. The Deputy Information Officer will assist the Information Officer in performing his or her duties.

Companies E-mail Disclaimer

KAROSSWERKERS (PTY)LTD  Limited e-mail Disclaimer

This e-mail legal notice is enforceable and binding on the recipient / addressee in terms of sections 11(1) to 11(3) of the Electronic Communications and Transactions (“ECT”) Act 25 of 2002, The Regulation of Interception of Communications Act (“RICA”) Act 70 of 2002 and The Protection of Personal Information Act 4 of 2013. This e-mail transmission contains confidential information, which is the property of KAROSSWERKERS (PTY)LTD  (Pty) Limited. No person, other than the recipient (so indicated by the sender) may use or disclose the contents of this message, links or attachments hereto, to any person whatsoever. Unauthorised disclosure and/or use may result in civil and criminal liability. Under no circumstances shall KAROSSWERKERS (PTY)LTD  Limited or the sender of this e-mail be liable to any party for any direct, indirect, special or consequential damages, including, without limitation, any loss of profits, business interruption, loss of programs or other data on information handling systems or otherwise, even if KAROSSWERKERS (PTY)LTD  Limited or the sender of this e-mail have been expressly advised of the possibility of such damages.

The information in this e-mail or attachments thereto is intended for the attention and use of the addressee only. If you are not the intended addressee/recipient, you are hereby notified that any disclosure, copying or distribution of the contents of this e-mail transmission or the taking of any action in reliance thereon or pursuant thereto, is strictly prohibited in terms of the Protection of Personal Information Act.

Should you have received this e-mail in error, please delete or destroy it and any attachments thereto immediately. At no time may you act or use on the information contained therein. The e-mail address of the sender and of those whose names are set out in the mail may not be used, copied, sold, disclosed or incorporated into any database or mailing list for spamming and/or other direct marketing in terms of the Regulations of the Protection of Personal Information Act. This is in contravention of the Regulations without the prior consent of KAROSSWERKERS (PTY)LTD Limited or the Data Subject.

Any agreements concluded with KAROSSWERKERS (PTY)LTD by using electronic correspondence shall only come into effect once KAROSSWERKERS (PTY)LTD   indicated such contract formation in a follow up or return communication. No e-mail correspondence sent to KAROSSWERKERS (PTY)LTD shall be deemed to have been received until KAROSSWERKERS (PTY)LTD  has responded thereto. An auto-reply shall not constitute such “response” for purposes of this clause.

All disputes and /or disagreements and/or damages and/or liabilities, in any manner related to the following:

• interpretation and enforceability of this e-mail legal notice;
• content (including message headers, links and/or attachments) of this e-mail message and/or
• sending or receipt of this e-mail message, shall be referred to South Gauteng (Johannesburg) Division of the High Court of the Republic of South Africa.

The laws of the Republic of South Africa shall govern this e-mail message and legal notice.
This e-mail legal notice shall always take precedence over any other e-mail disclaimer(s) received by employees or contractors utilising the communications facilities of KAROSSWERKERS (PTY)LTD  

 Employees and other persons acting on behalf of the organisation will, during the course of the performance of their services, gain access to and become acquainted with the personal information of certain clients, suppliers and other employees.

Employees and other persons acting on behalf of the organisation are required to treat personal information as a confidential business asset and to respect the privacy of data subjects.

Employees and other persons acting on behalf of the organisation may not directly or indirectly, utilise, disclose or make public in any manner to any person or third party, either within the organisation or externally, any personal information, unless such information is already publicly known or the disclosure is necessary in order for the employee or person to perform his or her duties.

Employees and other persons acting on behalf of the organisation must request assistance from their reporting manager or the Information Officer if they are unsure about any aspect related to the protection of a data subject’s personal information.

Employees and other persons acting on behalf of the organisation will only process personal information where:

• The data subject, or a competent person where the data subject is a child, consents to the processing; or
• The processing is necessary to carry out actions for the conclusion or performance of a contract to which the data subject is a party; or
• The processing complies with an obligation imposed by law on the responsible party; or
• The processing protects a legitimate interest of the data subject; or
• The processing is necessary for pursuing the legitimate interests of the organisation or of a third party to whom the information is supplied.

Furthermore, personal information will only be processed where the data subject:

• Clearly understands why and for what purpose his, her or its personal information is being collected; and
• Has granted the organisation with explicit written or verbally recorded consent to process his, her or its personal information.

Employees and other persons acting on behalf of the organisation will consequently, prior to processing any personal information, obtain a specific and informed expression of will from the data subject, in terms of which permission is given for the processing of personal information.

Informed consent is therefore when the data subject clearly understands for what purpose his, her or its personal information is needed and who it will be shared with.

Consent can be obtained in written form which includes any appropriate electronic medium that is accurately and readily reducible to printed form. Alternatively, the organisation will keep a voice recording of the data subject’s consent in instances where transactions are concluded telephonically or via electronic video feed.

Consent to process a data subject’s personal information will be obtained directly from the data subject, except where:

• the personal information has been made public, or
• where valid consent has been given to a third party, or
• the information is necessary for effective law enforcement.

Employees and other persons acting on behalf of the organisation will under no circumstances:

• Process or have access to personal information where such processing or access is not a requirement to perform their respective work-related tasks or duties.
• Save copies of personal information directly to their own private computers, laptops or other mobile devices like tablets or smart phones. All personal information must be accessed and updated from the organisation’s central database or a dedicated server.
• Share personal information informally. In particular, personal information should never be sent by email, as this form of communication is not secure. Where access to personal information is required, this may be requested from the relevant line manager or the Information Officer.
• Transfer personal information outside of South Africa without the express permission from the Information Officer. Employees and other persons acting on behalf of the organisation are responsible for:
  • Keeping all personal information that they come into contact with secure, by taking sensible precautions and following the guidelines outlined within this policy.
  • Ensuring that personal information is held in as few places as is necessary. No unnecessary additional records, filing systems and data sets should therefore be created.
  • Ensuring that personal information is encrypted or secure prior to sending or sharing the information electronically. The IT / Network Administrator will assist employees and where required, other persons acting on behalf of the organisation, with the sending or sharing of personal information to or with authorised external persons.
  • Ensuring that all computers, laptops and devices such as tablets, flash drives and smartphones that store personal information are password protected and never left unattended. Passwords must be changed regularly and may not be shared with unauthorised persons.
  • Ensuring that their computer screens and other devices are switched off or locked when not in use or when away from their desks.
  • Ensuring that where personal information is stored on removable storage medias such as external drives, CDs or DVDs that these are kept locked away securely when not being used.
  • Ensuring that where personal information is stored on paper, that such hard copy records are kept in a secure place where unauthorised people cannot access it. For instance, in a locked drawer of a filing cabinet.
  • Ensuring that where personal information has been printed out, that the paper printouts are not left unattended where unauthorised individuals could see or copy them. For instance, close to the printer.
    Taking reasonable steps to ensure that personal information is kept accurate and up to date. For instance, confirming a data subject’s contact details when the client or customer phones or communicates via email. Where a data subject’s information is found to be out of date, authorisation must first be obtained from the relevant line manager or the Information Officer to update the information accordingly.
  • Taking reasonable steps to ensure that personal information is stored only for as long as it is needed or required in terms of the purpose for which it was originally collected. Where personal information is no longer required, authorisation must first be obtained from the relevant line manager or the Information Officer to delete or dispose of the personal information in the appropriate manner.
    Undergoing POPI Awareness training from time to time and inclusion as part of the internal audit process.

8. POPI Audit

The organisation’s Information Officer will schedule periodic POPI Audits as part of the Internal Audit process.

The purpose of a POPI audit is to:

• Identify the processes used to collect, record, store, disseminate and destroy personal information.
• Determine the flow of personal information throughout the organisation. For instance, the organisation’s various business units, divisions, branches and other associated organisations.
• Redefine the purpose for gathering and processing personal information.
• Ensure that the processing parameters are still adequately limited.
• Ensure that new data subjects are made aware of the processing of their personal information.
• Re-establish the rationale for any further processing where information is received via a third party.
• Verify the quality and security of personal information.
• Monitor the extend of compliance with POPIA and this policy.
• Monitor the effectiveness of internal controls established to manage the organisation’s POPI related compliance risk. 

In performing the POPI Audit, Information Officers will liaise with reporting managers and team leaders in order to identify areas within in the organisation’s operation that are most vulnerable or susceptible to the unlawful processing of personal information.

Information Officers will be permitted direct access to and have demonstrable support from line managers and the organisation’s governing body in performing their duties.

9. Request to Access Personal Information Procedure

Data subjects have the right to:

• Request what personal information the organisation holds about them and why.
• Request access to their personal information.
• Be informed how to keep their personal information up to date.

Access to information requests can be made by email, addressed to the Information Officer. The Information Officer will provide the data subject with a “Personal Information Request Form”.

Once the completed form has been received, the Information Officer will verify the identity of the data subject prior to handing over any personal information. All requests will be processed and considered against the organisation’s PAIA Policy.

The Information Officer will process all requests within a reasonable time.

10. POPI Complaints Procedure 

Data subjects have the right to complain in instances where any of their rights under POPIA have been infringed upon. The organisation takes all complaints very seriously and will address all POPI related complaints in accordance with the following procedure:

• POPI complaints must be submitted to the organisation in writing. Where so required, the Information Officer will provide the data subject with a “POPI Complaint Form”.
• Where the complaint has been received by any person other than the Information Officer, that person will ensure that the full details of the complaint reach the Information Officer within 3 working days.
• The Information Officer will provide the complainant with a written acknowledgement of receipt of the complaint within 2 working days.
• The Information Officer will carefully consider the complaint and address the complainant’s concerns in an amicable manner. In considering the complaint, the Information Officer will endeavour to resolve the complaint in a fair manner and in accordance with the principles outlined in POPIA.
• The Information Officer must also determine whether the complaint relates to an error or breach of confidentiality that has occurred and which may have a wider impact on the organisation’s data subjects.
• Where the Information Officer has reason to believe that the personal information of data subjects has been accessed or acquired by an unauthorised person, the Information Officer will consult with the organisation’s governing body where after the affected data subjects and the Information Regulator will be informed of this breach.
• The Information Officer will revert to the complainant with a proposed solution with the option of escalating the complaint to the organisation’s governing body within 7 working days of receipt of the complaint. In all instances, the organisation will provide reasons for any decisions taken and communicate any anticipated deviation from the specified timelines. 

• The Information Officer’s response to the data subject may comprise any of the following:
  • A suggested remedy for the complaint,
  • A dismissal of the complaint and the reasons as to why it was dismissed,
  • An apology (if applicable) and any disciplinary action that has been taken against any employees involved.
• Where the data subject is not satisfied with the Information Officer’s suggested remedies, the data subject has the right to complain to the Information Regulator.
• The Information Officer will review the complaints process to assess the effectiveness of the procedure on a periodic basis and to improve the procedure where it is found wanting. The reason for any complaints will also be reviewed to ensure the avoidance of occurrences giving rise to POPI related complaints.

11. Disciplinary Action

Where a POPI complaint or a POPI infringement investigation has been finalised, the organisation may recommend any appropriate administrative, legal and/or disciplinary action to be taken against any employee reasonably suspected of being implicated in any non-compliant activity outlined within this policy.

In the case of ignorance or minor negligence, the organisation will undertake to provide further awareness training to the employee.

Any gross negligence or the wilful mismanagement of personal information, will be considered a serious form of misconduct for which the organisation may summarily dismiss the employee. Disciplinary procedures will commence where there is sufficient evidence to support an employee’s gross negligence.

Examples of immediate actions that may be taken subsequent to an investigation include:

• A recommendation to commence with disciplinary action.
• A referral to appropriate law enforcement agencies for criminal investigation.
• Recovery of funds and assets in order to limit any prejudice or damages caused.

12. Privacy Policy