Protection of personal information policy

 

2. Purpose and scope

​​

​​

​

​The Protection of personal information policy is prescribed in terms of the Protection of Personal Information Act 4 of 2013 (the POPIA), as amended, or substituted, from time to time. The right to privacy is an integral human right, recognised and protected in the South African Constitution and in the POPIA. The POPIA aims to promote the protection of privacy, through providing guiding principles that are intended to be applied to the processing of personal information, in a context-sensitive way.

The Company is a crypto assets services provider that will be applying for authorisation as a Financial Services Provider (FSP) (currently temporarily exempted from authorisation in terms of FSCA FAIS Notice 90 of 2022), under the Financial Advisory and Intermediary Services Act 37 of 2002 (the FAIS Act), and an Accountable Institution, registered under the Financial Intelligence Centre Act 38 of 2001 (the FICA), through the Financial Sector Regulation Act 9 of 2017 (the FSRA). Through the providing of these services, the Company is necessarily involved in collecting, using, and disclosing certain aspects of the personal information of its clients, employees, and other stakeholders. As a responsible party, the Company must comply with the POPIA. The POPIA requires the Company to inform its clients about the way their personal information is used, disclosed, and destroyed.

A person’s right to privacy entails having control over their personal information and being able to conduct their affairs relatively free from unwanted intrusions. Given the importance of privacy, the Company is committed to effectively managing personal information, in accordance with the POPIA. The Company is committed to protecting the privacy of its clients and ensuring that their personal information is used appropriately, transparently, securely, and in accordance with applicable laws. The Policy sets out the way the Company deals with its clients' personal information, and stipulates the purpose for which the information is used, and how it is used. The Policy is made available on the company website (https://www.dooya.co.za/) and by request, from the Company head office.

​

This Policy must be read together with the Retention of documents policy, in terms of the Protection of Personal Information Act 4 of 2013 (the POPIA), the Information security and privacy policy, in terms of the Electronic Communications and Transactions Act 25 of 2002 (the ECTA), and the Manual, in terms of the Promotion of Access to Information Act 2 of 2000 (the PAIA).

 

The purpose of this Policy is to:

2.1. protect the Company from the compliance risks associated with the protection of personal information, which includes:

• breaches of confidentiality

• reputational damage

2.2. demonstrate the Company’s commitment to protecting the privacy rights of data subjects:

• through stating desired behaviour, and directing compliance with the provisions of the POPIA, and best practice

• by cultivating a culture that recognises privacy as a valuable human right

• by developing, and implementing, internal controls for the purpose of managing the compliance risk associated with the protection of personal information

• by creating business practices that will provide reasonable assurance that the rights of data subjects are protected, and balanced, with the legitimate business needs of the Company

• by assigning specific duties and responsibilities to control owners, including the appointment of an information officer, and where necessary, deputy information officers, to protect the interests of the Company, and data subjects

• by raising awareness, through training, and providing guidance to, individuals, who process personal information, so that they can act confidently, and consistently.

​

​

3. Legislative framework

​

​

​

The reference to legislation, subordinate legislation, and supervision documents, includes amendments made from

time to time.

• Collective Investment Schemes Control Act 45 of 2002

• Companies Act 71 of 2008 (the CA)

• Conduct of Financial Institutions Bill (the COFI Bill)

• Constitution of the Republic of South Africa, 1996 (the Constitution)

• Cybercrime Act 19 of 2020

• Electronic Communications and Transactions Act 25 of 2002 (the ECTA)

• Exchange Control Regulations, as published by the South African Reserve Bank

• Financial Advisory and Intermediary Services Act 37 of 2002 (the FAIS Act)

• Financial Intelligence Centre Act 38 of 2001 (the FICA)

• Financial Markets Act 19 of 2012 (the FMA)

• Financial Sector Regulation Act 9 of 2017 (the FSRA)

• Friendly Societies Act 25 of 1956

• Income Tax Act 58 of 1962

• Pension Funds Act 24 of 1956 (the PFA)

• Prevention and Combating of Corrupt Activities Act 12 of 2004 (the Prevention Act)

• Prevention of Organised Crime Act 121 of 1998 (the POCA)

• Promotion of Access to Information Act 2 of 2000 (the PAIA)

• Protection of Constitutional Democracy against Terrorist and Related Activities Act 33 of 2004 (the

POCDATARA Act)

• Protection of Personal Information Act 4 of 2013 (the POPIA)

• Value-Added Tax Act 89 of 1991 (the VAT Act)

​

​

​

​

4. Definitions

​

​

​

4.1. Biometrics means a technique of personal identification that is based on physical, physiological, or behavioural, characterisation, including blood typing, fingerprinting, DNA analysis, retinal scanning, and voice recognition.

4.2. Child means a natural person under the age of 18 years, who is not legally competent, without the assistance of a competent person, to take any action, or decision, in respect of any matter concerning himself, or herself.

4.3. Competent person means any person, who is legally competent to consent to any action, or decision, being taken in respect of any matter concerning a child (being the child’s legal guardian).

4.4. Consent means any voluntary, specific, and informed, expression of will, in terms of which permission is given for the processing of personal information.

4.5. Data subject means the person to whom personal information relates.

4.6. De-identify and de-identified, in relation to personal information of a data subject, means to delete any information that:

• identifies the data subject

• can be used, or manipulated, by a reasonably foreseeable method, to identify the data subject

• can be linked by a reasonably foreseeable method, to other information that identifies the data subject.

4.7. Direct marketing means to approach a data subject, either in person, or by mail, or electronic communication, for the direct, or indirect, purpose of:

• promoting, or offering, to supply, in the ordinary course of business, any goods, or services, to the data

subject

• requesting the data subject to make a donation of any kind, for any reason.

4.8. Electronic communication means any text, voice, sound, or image, message, sent over an electronic communications network, which is stored in the network, or in the recipient's terminal equipment, until it is collected by the recipient.

4.9. Filing system means any structured set of personal information, whether centralised, decentralised, or dispersed, on a functional, or geographical, basis, which is accessible according to specific criteria.

4.10. Head of a private body means:

• in the case of a natural person, that natural person, or any person duly authorised by that natural person

• in the case of a partnership, any partner of the partnership, or any person duly authorised by the

partnership

• in the case of a juristic person:

• the chief executive officer, or equivalent officer, of the juristic person, or any person duly authorised by that officer

• the person who is acting as such, or any person duly authorised by such acting person.

4.11. Information matching programme means the comparison, whether manually, or by means of any electronic, or other, device, of any document that contains personal information about ten (10), or more, data subjects, with one (1), or more, documents that contain personal information of ten (10), or more, data subjects, for the purpose of producing, or verifying, information that may be used for the purpose of taking any action in regard to an identifiable data subject.

4.12. Information officer of, or in relation to, a:

• public body, means an information officer, or deputy information officer, as contemplated in terms of section 1 or 17 of the PAIA

• private body, means the head of a private body, as contemplated in section 1 of the PAIA.

4.13. Operator means a person who processes personal information for a responsible party, in terms of a contract, or mandate, without coming under the direct authority of that party.

4.14. Person means a natural person, or a juristic person.

4.15. Personal information means information about an identifiable, living, natural person, and where it is applicable, an identifiable, existing juristic person, including, but not limited to:

• information about the race, gender, sex, pregnancy, marital status, national, ethnic, or social, origin, colour, sexual orientation, age, physical, or mental, health, well-being, disability, religion, conscience, belief, culture, language, and birth, of the person

• information relating to the education, or the medical, financial, criminal, or employment history, of the person

• any identifying number, symbol, e-mail address, physical address, telephone number, location information, online identifier, or other particular assignment, to the person

• the biometric information of the person

• the personal opinions, views, or preferences, of the person

• correspondence sent by the person that is implicitly, or explicitly, of a private, or confidential, nature, or further correspondence that would reveal the contents of the original correspondence

• the views, or opinions, of another individual, about the person

• the name of the person, if it appears with other personal information about the person, or if the disclosure of the name itself, would reveal information about the person.

4.16. Private body means:

• a natural person who carries, or has carried on, any trade, business, or profession, but only in the capacity as a natural person

• a partnership, which carries, or has carried on, any trade, business, or profession

• any former, or existing, juristic person, but excludes a public body.

4.17. Processing means any operation, or activity, or any set of operations, whether, or not, by automatic means, about personal information, including:

• the collection, receipt, recording, organisation, collation, storage, updating, or modification, retrieval,

alteration, consultation, or use

• dissemination by means of transmission, distribution, or making available, in any other form

• merging, linking, and restriction, degradation, erasure, or destruction, of information.

4.18. Public body means:

• any department of state, or administration, in the national, or provincial, sphere of government, or any

municipality, in the local sphere of government

• any other functionary, or institution, when:

• exercising a power, or performing a duty, in terms of the Constitution, or a provincial constitution

• exercising a public power, or performing a public function, in terms of any legislation.

4.19. Public record means a record that is accessible in the public domain, and which is in the possession of, or under the control of, a public body, whether, or not, it was created by that public body.

4.20. Record means any recorded information:

• regardless of form, or medium, including:

• writing on any material

• information produced, recorded, or stored, by means of any tape-recorder, computer equipment, whether hardware, or software, or both, or other device, and any material subsequently derived from information produced, recorded, or stored

• label, marking, or other writing that identifies, or describes, anything of which it forms part, or to which it is attached, by any means

• book, map, plan, graph, or drawing

• photograph, film, negative, tape, or other device, in which one (1), or more, visual images are embodied, to be capable, with, or without, the aid of some other equipment, of being reproduced

• in the possession, or under the control of, a responsible party

• whether, or not, it was created by a responsible party

• regardless of when it came into existence.

4.21. Regulator means the Information Regulator, established in terms of section 39 of the POPIA.

4.22. Re-identify and re-identified, in relation to personal information of a data subject, means to resurrect any information that has been de-identified, that:

• identifies the data subject

• can be used, or manipulated, by a reasonably foreseeable method, to identify the data subject

• can be linked by a reasonably foreseeable method to other information that identifies the data subject.

4.23. Responsible party means a public, or private body, or any other person, which, alone, or in conjunction with others, determines the purpose of, and means for, processing personal information.

4.24. Restriction means to withhold from circulation, use, or publication, any personal information that forms part of a filing system, but not to delete, or destroy, the information.

4.25. Special personal information means personal information, as referred to in section 26 of the POPIA:

• religious, or philosophical, beliefs, race, or ethnic origin, trade union membership, political persuasion,

health, or sex life, or biometric information, of a data subject

• criminal behaviour of a data subject, to the extent that the information relates to:

• alleged commission by a data subject of any offence

• proceedings about any offence allegedly committed by a data subject, or the disposal of those

proceedings.

4.26. Unique identifier means any identifier that is assigned to a data subject, and is used by a responsible party, for the purposes of the operations of that responsible party, and that uniquely identifies that data subject, for that responsible party.

​

​

​

5. Lawful processing of personal information

​

​

​

5.1. The Company, as the responsible party, or as the operator, MUST adhere to the 8 conditions for the lawful processing of personal information:

• Condition 1: Accountability

• Condition 2: Processing limitation

• Condition 3: Purpose specification

• Condition 4: Further processing limitation

• Condition 5: Information quality

• Condition 6: Openness

• Condition 7: Security safeguards

• Condition 8: Data subject participation

​

​

​

6. Condition 1: Accountability – responsible party to ensure conditions for lawful processing

​

​

​

6.1. The Company, as the responsible party, must ensure that it complies with the conditions, and the measures that give effect to the conditions, when it determines the purpose of processing, how it processes, and during the processing.

6.2. Where the Company is acting as the operator, the responsible party must ensure that the Company complies with the relevant conditions, and the measures that give effect to the conditions, when it determines the purpose of processing, how it processes, and during the processing.

​

​

​

7. Condition 2: Processing limitation – lawfulness of processing

​

​

​

7.1. The Company MUST only process personal information lawfully, and reasonably, in a way that does not infringe the privacy of the data subject.

​

​

​

​

8. Condition 2: Processing limitation – minimality

​

​

​

8.1. The Company may only process personal information that is adequate, relevant, and not excessive, based on the purpose for processing that information.

​

8.2. The Company collects, and processes, data subjects’ personal information in terms of several other laws, associated with the functions performed by the Company, including the FAIS Act and the FICA. As an FSP (acting under exemption and following application process for approval as an FSP), providing financial advice and non-discretionary intermediary services, in terms of the FAIS Act, the Company obtains personal information of potential and existing clients, to determine the client’s financial needs and investment objectives. The Company is also an AI, in terms of the FICA, which must perform initial and ongoing customer due diligence processes. This includes establishing and verifying the identity of the potential and existing client, the beneficial owners, and other persons associated with the business relationship, and includes performing screening searches, to determine the riskiness of the client and the overall business relationship. The type of information depends on the purpose for which it is collected and will be processed for that purpose only. Wherever possible, the Company will inform the client about the information required and the information deemed optional.

 

8.3. Employees of the Company are also data subjects, and the Company collects personal information of potential and existing employees, in terms of other laws, including the FAIS Act and employment laws.

 

8.4. Examples of personal information that the Company collects from data subjects includes:

• Identity number, passport number, date of birth, nationality, full name physical and postal addresses, marital status, income tax number, number of dependants, race, gender

• Description of residence, business, assets, liabilities, financial information, banking details

• Qualifications, education, employment history, criminal history, credit history

• Any other information required by the Company, its product suppliers, third party service providers

 

8.5. The Company also collects and processes clients’ personal information for marketing purposes, to ensure that our financial products and services remain relevant to our clients and potential clients.

 

8.6. If the Company wants to process personal information for the purpose of direct marketing, it must obtain consent from the data subject, if the data subject is not its client, using the prescribed Form 4.

 

8.7. The Company aims to have agreements in place with all product suppliers, other FSPs, and third-party service providers, to ensure a mutual understanding regarding the protection of clients’ personal information. The Company’s product suppliers will be subject to the same regulations, as applicable to the Company, in terms of the protection of clients’ personal information.

​

​

9. Condition 2: Processing limitation – consent, justification, and objection

​

​

​

9.1. The Company MAY ONLY process personal information IF the:

• data subject, or a competent person (only where the data subject is a child), consents to the

processing. For example, consent is obtained from clients during the introductory appointment, and

needs analysis, stage of the business relationship

• processing is necessary to carry out actions for the conclusion, or performance, of a contract to which

the data subject is party. For example, to conduct an accurate analysis of the client’s financial needs

and objectives

• processing complies with an obligation imposed by law on the responsible party. For example, as

required by the FAIS Act, the FICA, employment related legislation, tax related legislation

• processing protects a legitimate interest of the data subject. For example, it is in the client’s best

interest to have a full, and proper, financial needs analysis performed, to provide them with an applicable,

and beneficial, financial product, or financial service

• processing is necessary for pursuing the legitimate interests of the Company, or third-parties, to

whom the information is supplied. For example, to provide the Company’s clients with financial

products, or financial services, the Company, its product suppliers, its service providers, and other relevant

third parties, require certain personal information from the clients, to make an expert decision about the

unique, and specific, financial product, or financial service, required.

 

9.2. The Company must classify all the personal information processed, according to the reasons for which personal

information is processed, to ensure that it only processes personal information for permitted reasons, and to

identify the instances where the data subject may object to the processing of their personal information.

 

9.3. If the Company identifies that it is processing personal information for a reason that is not a permitted reason,

it must take corrective action.

 

9.4. The Company, as the responsible party, MUST have proof of the data subject's consent, where consent is

required.

 

9.5. Where the Company is acting as the operator, the responsible party MUST ensure that it provides the Company

with the proof of the data subject's consent, where consent is required.

 

9.6. Where the data subject’s consent for processing their personal information is required, the Company MUST

allow the data subject to withdraw their consent, at any time, as long as the lawfulness of the processing before

the withdrawal of consent, or the processing, where consent is not required, will not be affected by the

withdrawal of consent.

 

9.7. If a data subject objects to the processing of their personal information (using the prescribed Form 1, and on

reasonable grounds relating to their situation), where the reason for the processing:

• protects a legitimate interest of the data subject

• processing is necessary for the proper performance of a public law duty by a public body

• processing is necessary for pursuing the legitimate interests of the responsible party

• processing is necessary for pursuing the legitimate interests of a third party to whom the information is

supplied,

the Company MUST STOP processing the data subject's related personal information, UNLESS:

• legislation provides for the processing

• processing is for purposes of direct marketing that is not by means of unsolicited electronic

communications.

 

 

 

10. Condition 2: Processing limitation – collection directly from data subject

​

​

​

10.1. The Company MUST collect personal information directly from the data subject, EXCEPT IF:

• information is contained in, or derived from, a public record, or has deliberately been made public by

the data subject

• data subject, or a competent person (only where the data subject is a child), consents to the

collection of the information from another source

• collection of the information from another source would not prejudice a legitimate interest of

the data subject

• collection of the information from another source is necessary:

• to avoid prejudice to the maintenance of the law by any public body, including the prevention, detection, investigation, prosecution, and punishment, of offences

• to comply with an obligation imposed by law, or to enforce legislation about the collection of revenue (in terms of the South African Revenue Service Act)

• for the conduct of proceedings in any court, or tribunal, which have commenced, or are reasonably contemplated

• in the interests of national security

• to maintain the legitimate interests of the responsible party

• to maintain the legitimate interests of a third party to whom the information is supplied

• compliance would prejudice a lawful purpose of the collection

• compliance is not reasonably practicable in the circumstances of the case.

 

 

 

11. Condition 3: Purpose specification - collection for specific purpose

​

​

​

11.1. The Company MUST only collect personal information of data subjects for the specific, explicitly defined, and

lawful, purpose, based on the relevant function, or activity, of the Company, where it is the responsible party,

or based on the relevant function, or activity of the responsible party, where the Company is acting as the

operator.

 

 

​

12. Condition 3: Purpose specification - retention and restriction of records

​

​

​

12.1. The Company MUST NOT retain records of personal information for any longer than is necessary for

achieving the purpose for which the information was collected, or subsequently processed, UNLESS:

• retention of the record is required, or authorised, by law

• the responsible party reasonably requires the record for lawful purposes, related to its functions, or

activities

• retention of the record is required by a contract between the parties thereto

• the data subject, or a competent person (only where the data subject is a child), consents to the retention

of the record.

 

12.2. The Company MUST determine, and should document, in the Retention of documents policy, the maximum

document retention timeframes necessary for achieving the purpose for which the information was collected,

or subsequently processed.

 

12.3. The Company MAY retain records of personal information for longer than is necessary for achieving the

purpose for which the information was collected, or subsequently processed, FOR historical, statistical, or

research, purposes, IF the responsible party has established appropriate safeguards against the records being

used for any other purposes.

 

12.4. Where the Company is acting as the responsible party, and retains records of personal information for longer

than is necessary for achieving the purpose for which the information was collected, or subsequently

processed, FOR historical, statistical, or research, purposes, it MUST establish appropriate safeguards

against the records being used for any other purposes.

 

12.5. Where the Company is acting as the operator, and retains records of personal information for longer than is

necessary for achieving the purpose for which the information was collected, or subsequently processed, FOR

historical, statistical, or research, purposes, the responsible party must ensure that it establishes, and provides

the Company with, appropriate safeguards against the records being used for any other purposes.

 

12.6. Where the Company, as the responsible party, or acting as the operator, has used a record of personal

information of a data subject to decide about the data subject, IT MUST:

• retain the record for the period, as may be required, or prescribed, by law, or a code of conduct

• if there is no law, or code of conduct, prescribing a retention period, retain the record for a period that will

afford the data subject a reasonable opportunity, taking all considerations about the use of the personal

information into account, to request access to the record.

​

12.7. The Company, as the responsible party, MUST destroy, or delete, a record of

personal information, or de-identify it, as soon as reasonably practicable after the Company

is no longer authorised to retain the record.

 

12.8. Where the Company acts as the operator, on behalf of the responsible party, the responsible party must

ensure that the Company is instructed to destroy, or delete, a record of personal information, or de-identify it,

as soon as reasonably practicable after the responsible party is no longer authorised to retain the record.

 

12.9. When the Company destructs, or deletes, a record of personal information, IT MUST be done in a way that

prevents its reconstruction in an intelligible form.

 

12.10. The Company, as the responsible party, MUST restrict processing of personal information, IF:

• its accuracy is contested by the data subject, for long enough to enable the Company to verify the accuracy

of the information

• the Company no longer needs the personal information to achieve the purpose for which the information

was collected, or subsequently processed, but it MUST be maintained for purposes of proof

• the processing is unlawful, and the data subject opposes its destruction, or deletion, and requests the

restriction of its use

• the data subject requests to transmit the personal data into another automated processing system.

 

12.11. Where the Company is acting as the operator, the responsible party must ensure that the Company restricts

the processing of personal information, when required.

 

12.12. Where processing of personal information is restricted, the Company MUST ONLY process the personal

information (except for storage):

• for purposes of proof

• with the data subject's consent, or a competent person (only where the data subject is a child)

• for the protection of the rights of another person

• if the processing is in the public interest

 

12.13. Where processing of personal information is restricted, and the Company is the responsible party, the

Company MUST inform the data subject BEFORE lifting the restriction on processing.

 

12.14. Where processing of personal information is restricted, and the Company is acting as the operator, the

responsible party MUST inform the data subject BEFORE lifting the restriction on processing.

 

 

 

13. Condition 4: Further processing limitation - further processing to be compatible with purpose of collection

​

​

​

13.1. Where the Company performs further processing of personal information, it MUST be according to, or

compatible with, the specific, explicitly defined, and lawful, purpose for which it was collected, which relates

to a function, or activity, of the Company, where it is the responsible party, or relates to a function, or activity

of the responsible party, where the Company is acting as the operator, on behalf of the responsible party.

 

13.2. Where the Company is the responsible party, IT MUST assess whether further processing is compatible with

the purpose of collection, by considering the:

• relationship between the purpose of the intended further processing, and the purpose for which the

information was collected

• nature of the information concerned

• consequences of the intended further processing for the data subject

• way the information was collected

• contractual rights, and obligations, between the parties.

​

13.3. Where the Company is acting as the operator, the responsible party must ensure that the Company considers

the required aspects, when it assesses whether further processing is compatible with the purpose of

collection.

​

13.4. When the Company is assessing whether further processing is compatible with the purpose of collection, it

may consider the following aspects to be compatible:

• the data subject, or a competent person (only where the data subject is a child), consents to the further processing of the information

• the information is available in, or derived from, a public record, or has deliberately been made public by the data subject

• further processing is necessary:

• to avoid prejudice to the maintenance of the law, by any public body, including the prevention, detection, investigation, prosecution, and punishment, of offences

• to comply with an obligation imposed by law, or to enforce legislation about the collection of revenue (in terms of the South African Revenue Service Act)

• for the conduct of proceedings in a court, or tribunal, which have commenced, or are reasonably contemplated

• in the interests of national security

• the further processing of the information is necessary to prevent, or mitigate, a serious, and imminent,

threat to:

• public health, or public safety

• the life, or health, of the data subject, or another individual

• the information is used for historical, statistical, or research, purposes, and the responsible party ensures

that the further processing is carried out solely for those purposes, and will not be published in an

identifiable form

• the further processing of the information is according to an exemption granted by the Regulator.

​

​

​

14. Condition 5: Information quality - quality of information

​

​

​

14.1. The Company, as the responsible party, MUST take reasonably practicable steps to ensure that the personal

information is complete, accurate, not misleading, and updated, where necessary, based on the purpose for

which the personal information is collected, or further processed.

​

14.2. Where the Company is acting as the operator, the responsible party must ensure that the Company takes

reasonably practicable steps to ensure that the personal information is complete, accurate, not misleading,

and updated, where necessary, based on the purpose for which the personal information is collected, or further

processed.

​

​

​

15. Condition 6: Openness – Documentation

​

​

​

15.1. The Company, as the responsible party, MUST maintain the documents of all processing operations that it is

responsible for, and which information must be included in the PAIA manual, relating to the:

• purpose of the processing

• description of the categories of data subjects, and of the information, or categories of information, relating

thereto

• recipients, or categories of recipients, to whom the personal information may be supplied

• planned transborder flows of personal information

• general description, allowing a preliminary assessment of the suitability of the information security measures to be implemented by the Company, to ensure the confidentiality, integrity, and availability, of the information that is to be processed.

 

15.2. The Company MUST update its PAIA manual, to include the required information for protecting personal

information, and publish the updated manual, as required.

 

15.3. Where the Company is acting as the operator, the responsible party must ensure that the Company maintains

the required documents of all processing operations that it is responsible for.

​

​

​

16. Condition 6: Openness – notification to data subject when collecting personal information

​

​

​

16.1. The Company, as the responsible party, MUST ensure that the data subject is aware of the:

• information that is collected

• source from which the information is collected, where the information is not collected directly from the

data subject

• name, and address, of the Company, as the responsible party

• purpose for collecting the information

• fact that the information they supply is either voluntary, or mandatory

• consequences of failing to provide the information

• law authorising, or requiring, the collecting of the information

• fact that, where applicable, the Company, as the responsible party, intends to transfer the information to a third country, or international organisation, and the level of protection afforded to the information by that third country, or international organisation

• other relevant information, which is necessary, in the specific circumstances in which the information is,

or is not, to be processed, to enable processing, for the data subject, to be reasonable, such as:

• recipient, or category of recipients, of the information

• nature, or category, of the information

• existence of the right of access to, and the right to rectify, the information collected

• existence of the right to object to the processing of personal information

• right to lodge a complaint to the Information Regulator, and the contact details of the Information Regulator

 

16.2. The Company, as the responsible party, MUST make the data subject aware of the required information,

BEFORE the personal information is collected, IF it is collected directly from the data subject, UNLESS the

data subject is already aware of the required information.

 

16.3. The Company, as the responsible party, MUST make the data subject aware of the required information,

BEFORE the personal information is collected, or as soon as reasonably practicable after it has been

collected, IF it is NOT collected directly from the data subject.

 

16.4. Where the Company, as the responsible party, has previously made the data subject aware of the required

information, IT complies with the awareness requirement, for subsequent collection, from the data subject, of

the same information, or information of the same kind, IF the purpose of collection of the information remains

the same.

 

16.5. Where the Company is acting as the operator, the responsible party must ensure that the data subject is aware

of the required information, within the prescribed timeframe.

 

16.6. The Company, as the responsible party, or acting as the operator, DOES NOT need to comply with the

awareness requirement, IF:

• data subject, or a competent person (only if the data subject is a child), consents to the non-compliance

• non-compliance would not prejudice the legitimate interests of the data subject

• non-compliance is necessary:

• to avoid prejudice to the maintenance of the law, by a public body, including the prevention, detection, investigation, prosecution, and punishment, of offences

• to comply with an obligation imposed by law, or to enforce legislation about the collection of revenue (in terms of the South African Revenue Service Act)

• for the conduct of proceedings in a court, or tribunal, which have been commenced, or are reasonably contemplated

• in the interests of national security

• compliance would prejudice a lawful purpose of the collection

• compliance is not reasonably practicable in the circumstances of the case

• information will:

• not be used in a form in which the data subject may be identified

• be used for historical, statistical, or research, purposes.

• ​

16.7. The Company collects (usually directly, or occasionally indirectly, via third parties providing services to the

Company), and further processes, information of clients, as data subjects, for functions, or activities, including,

but not limited to:

• Performing the initial, and ongoing, customer due diligence reviews, for the client, and other people

involved in the business relationship

• Assigning a unique identifier to clients (unique number to access own funds, or credit facilities)

• Providing financial products, or financial services to clients, carrying out the instructions, and transactions, related thereto

• Performing a financial needs analysis for the client, to consider their needs, circumstances, risk tolerance and capacity, and their capacity to understand the features, and complexity, of the financial service and/or the financial product

• Collecting, further processing, and reporting, information about the tax residency of clients

• Underwriting

• Assessing, and processing, claims

• Confirming, verifying, and updating, information

• Claims history

• Detecting, and preventing, fraud, crime, money laundering, or other unlawful activities

• Screening of United Nations lists, media sights, and general internet searches

• Determining the riskiness of clients, other people involved in the business relationship, and the business relationship

• Conducting market, or client, satisfaction research

• Audit, and record keeping

• Legal proceedings

• Activities relating to maintaining, and improving, the business relationship

• Providing communication about the Company, its financial products, the underlying financial products, and financial services, and regulatory matters, which may affect clients

• Sharing information with other relevant FSPs, product suppliers, and service suppliers, with whom we have business relationships, to process information on our behalf, or to those who provide services to us

• Complying with legal and regulatory requirements, or when it is otherwise allowed by law.

​

16.8. The Company collects, and further processes, information of employees, as data subjects, for functions, or activities, including, but not limited to:

• Determining the fitness, and propriety, of the person

• Confirming, verifying, and updating, information, including aspects such as qualifications, education, employment history, criminal history, credit history

• Detecting, and preventing, fraud, crime, money laundering, or other unlawful activities

• Legal proceedings

• Audit, and record keeping

• Sharing information with other relevant FSPs, product suppliers, and service suppliers, with whom we have business relationships, to process information on our behalf, or to those who provide services to us

• Complying with, legal and regulatory requirements, or when it is otherwise allowed by law.

​

​

​

17. Condition 7: Security safeguards - security measures on integrity and confidentiality of personal information

​

​

​

17.1. The Company, as the responsible party, or acting as the operator, MUST secure the integrity, and

confidentiality, of personal information in its possession, or under its control, by taking appropriate, reasonable,

technical, and organisational, measures to prevent:

• loss of, damage to, or unauthorised destruction of, personal information

• unlawful access to, or processing of, personal information,

by taking reasonable measures to:

• identify all reasonably foreseeable internal, and external, risks to personal information in its possession,

or under its control

• establish, and maintain, appropriate safeguards against the risks identified

• regularly verify that the safeguards are effectively implemented

• ensure that the safeguards are continually updated, in response to new risks, or deficiencies in

previously implemented safeguards.

17.2. Where the Company is acting as the operator, the responsible party must ensure that the Company secures

the integrity, and confidentiality, of personal information in its possession, or under its control, by taking

appropriate, reasonable, technical, and organisational, measures.

17.3. The Company, as the responsible party, MUST have due regard to generally accepted information security

practices, and procedures, which may apply to it, generally, or be required in terms of specific industry, or

professional, rules and regulations.

17.4. Where the Company is acting as the operator, on behalf of the responsible party, the responsible party must

ensure that the Company has due regard to generally accepted information security practices, and procedures,

which may apply to it, generally, or be required in terms of specific industry, or professional, rules and

regulations.

​

​

​

18. Condition 7: Security safeguards - information processed by operator, or person acting under authority

​

​

​

18.1. Where the Company is acting as the operator, IT MUST:

• only process the information with the knowledge, or authorisation, of the responsible party

• treat personal information that comes to its knowledge, as confidential, and must not disclose it,

unless required by law, or during the proper performance of its duties.

​

​

​

19. Condition 7: Security safeguards - security measures regarding information processed by operator

​

​

​

19.1. Where the Company is acting as the operator, the responsible party must, in terms of the written contract

between the responsible party, and the Company, ensure that the Company establishes, and maintains, the

required security measures.

19.2. Where the Company is acting as the operator, IT MUST notify the responsible party immediately, where

there are reasonable grounds to believe that the personal information of a data subject has been accessed,

or acquired, by any unauthorised person.

​

​

​

20. Condition 7: Security safeguards - notification of security compromises

​

​

​

20.1. Where the Company is the responsible party, and there are reasonable grounds to believe that the personal

information of a data subject has been accessed, or acquired, by any unauthorised person, it MUST NOTIFY

(in writing):

• Regulator

• data subject, unless the identity of the data subject cannot be established,

as soon as reasonably possible, after the discovery of the compromise, considering the legitimate needs of

law enforcement, or any measures reasonably necessary to determine the scope of the compromise,

and to restore the integrity of the Company's information system.

​

20.2. The Company, as the responsible party, may only delay notifying the data subject, IF a public body,

responsible for the prevention, detection, or investigation, of offences, or the Regulator, determines that

notification will impede a criminal investigation, by the public body.

20.3. Where the Company is acting as the operator, IT MUST immediately notify the responsible party, and provide

the responsible party with the required information, so the responsible party can notify the Regulator, and the

data subject.

20.4. The Company MUST notify, in writing, the data subject, about a personal information compromise, in at least

one (1) of the following ways:

• mailed to the data subject's last known physical, or postal, address

• sent by e-mail to the data subject's last known e-mail address

• placed in a prominent position on the website of the responsible party

• published in the news media

• as may be directed by the Regulator.

20.5. The Company MUST ensure that the notification to the data subject provides sufficient information to allow

the data subject to take protective measures against the potential consequences of the personal information

compromise, including:

• description of the possible consequences of the security compromise

• description of the measures that the responsible party intends to take, or has taken, to address the security

compromise

• recommendation about the measures to be taken by the data subject, to mitigate the possible adverse

effects of the security compromise

• if known to the responsible party, the identity of the unauthorised person, who may have accessed, or

acquired, the personal information.

20.6. The Company, as the responsible party, MUST publicise, in a way specified by the Regulator, a personal

information compromise, if directed to do so, by the Regulator.

• The Regulator will direct a responsible party to publicise a personal data compromise, if it has reasonable

grounds to believe that the publicity would protect a data subject, who may be affected by the compromise.

 

 

 

21. Condition 8: Data subject participation – access to personal information

​

​

​

21.1. A data subject that provides the Company with adequate proof of identity, may ask the Company, as the

responsible party, to confirm, free of charge, whether, or not, the Company holds personal information about

the data subject.

21.2. A data subject that provides the Company with adequate proof of identity, may ask the Company, as the

responsible party, for the record, or a description, of the personal information about the data subject, held by

the Company, including information about the identity of all third parties, or categories of third parties, who

have, or have had, access to the information:

• within a reasonable time

• at a prescribed fee, if any

• in a reasonable way, and format

• in a form that is generally understandable.

21.3. If the Company communicates personal information to a data subject, in response to a request from the data

subject, it MUST advise the data subject of their right to request their personal information to be corrected.

21.4. If the Company, as the responsible party, requires a data subject making a request, to pay a fee for services

provided to the data subject, to enable the responsible party to respond to a request, the Company:

• must give the applicant a written estimate of the fee, before providing the services

• may require the applicant to pay a deposit for all, or part, of the fee.

21.5. The Company, as the responsible party, MAY, OR MUST, refuse, as may be applicable, to disclose

information requested by the data subject, to which the grounds for refusal of access to records are set out in

the applicable sections of the PAIA.

• Refer to the PAIA manual for details.

21.6. The Company, as the responsible party, must apply the applicable provisions of the PAIA, for access to health,

or other, records.

• Refer to the PAIA manual for details.

21.7. Where a data subject requests access to personal information, and part of that information MAY, OR MUST,

be refused, in terms of the PAIA, the Company MUST disclose all other parts of the requested information.

21.8. The Company will take reasonable steps to confirm a data subject’s identity, before providing details of their

personal information.

​

​

​

22. Condition 8: Data subject participation – correction of personal information

​

​

​

22.1. A data subject may, using the prescribed Form 2, request the Company, as the responsible party, to:

• correct, or delete, personal information about the data subject, in its possession, or under its control, which

is inaccurate, irrelevant, excessive, out of date, incomplete, misleading, or obtained unlawfully

• destroy, or delete, a record of personal information about the data subject, which the Company, as the

responsible party, is no longer authorised to retain, because it is no longer necessary for achieving the

purpose for which the information was collected, or subsequently processed

22.2. Where the Company, as the responsible party, receives a request to correct, or delete, personal information,

it MUST, as soon as reasonably practicable:

• correct the information

• destroy, or delete, the information

• provide the data subject, to their satisfaction, with credible evidence, in support of the information

• where agreement cannot be reached between the Company, and the data subject, and if the data subject

requests, take steps that are reasonable, in the circumstances, to attach to the information in a way that

it will always be read with the information, an indication that a correction of the information has been

requested, but has not been made

22.3. Where the Company, as the responsible party, has taken steps that result in a change to the data subject’s

personal information, and the changed information has an impact on decisions that have been, or will be,

taken in respect of the data subject in question, it MUST, if reasonably practicable, inform each person, or

body, or responsible party, to whom the personal information has been disclosed of those steps.

22.4. The Company, as responsible party, MUST notify a data subject, who has made a request to correct, or delete,

their personal information, of the action taken, due to the request.

22.5. The Company will take reasonable steps to confirm a data subject’s identity, before correcting, or deleting,

their personal information.

23. Condition 8: Data subject participation – manner of access

23.1. The Company MUST consider that the provisions of the PAIA, about the form of requests, apply to requests

for access to personal information.

• Refer to the PAIA manual for details.

​

23.2. The Company should ensure that requests from data subjects are received, using the prescribed forms, for

the type of request, as prescribed by the Regulator.​​​​​