PROTECTION OF PERSONAL INFORMATION ACT POLICY FOR EPOKOTHWENI with Babalwa Nonkenge (“Policy”)
Publishing Date: 20 December 2022
Frequency of Review: Annually
Next Review Date: 20 December 2023
Policy Owner: Epokothweni with Babalwa Nonkenge
POLICY STATEMENT
▪This Policy forms part of the business processes and procedures.
▪ Risk owners and control owners are responsible for overseeing and maintaining control over the Policy.
Table of Contents
1 INTRODUCTION 4
2 DEFINITIONS 4
2.1 Personal Information 4
2.2 Data Subject5
2.3 Responsible Party 5
2.4 Operator5
2.5 Information Officer5
2.6 Processing 5
2.7 Record 6
2.8 Filing System 6
2.9 Unique Identifier6
2.10 De-Identify 6
2.11 Re-Identify 6
2.12 Consent7
2.13 Direct Marketing 7
2.14 Biometrics 7
3. POLICY PURPOSE 7
4. POLICY APPLICATION 8
5. RIGHTS OF DATA SUBJECTS 8
5.1 The Right to Access Personal Information 8
5.2 The Right to have Personal Information Corrected or Deleted 9
5.3 The Right to Object to the Processing of Personal Information 9
5.4 The Right to Object to Direct Marketing 9
5.5 The Right to Complain to the Information Officer9
5.6 The Right to Complain to the Information Regulator10
5.7 The Right to be Informed 10
6. GENERAL GUIDING PRINCIPLES 10
6.1 Accountability 10
6.2 Processing Limitation 10
6.3 Purpose Specification 11
6.4 Further Processing Limitation 11
6.5 Information Quality 11
6.6 Open Communication 11
6.7 Security Safeguards 12
6.8 Data Subject Participation 12
7. SPECIFIC DUTIES AND RESPONSIBILITIES 13
7.1 Board of Trustees 13
7.2 Information Officer13
7.3 Marketing Manager14
7.4 Employees and other Persons acting on behalf of Epokothweni with Babalwa Nonkenge 14
8. POPIA AUDIT 14
9. REQUEST TO ACCESS PERSONAL INFORMATION PROCEDURE 15
10. POPIA COMPLAINTS PROCEDURE 16
11. DISCIPLINARY ACTION 16
ANNEXURE A: PERSONAL INFORMATION REQUEST FORM 19
ANNEXURE B: POPIA COMPLAINT FORM 21
ANNEXURE C: POPIA NOTICE AND CONSENT FORM 23
1 INTRODUCTION
The right to privacy is an integral human right recognised by Section 14 of the South African Constitution and protected in terms of the Protection of Personal Information Act 4 of 2013 (“POPIA”).
POPIA aims to promote the protection of privacy through providing guiding principles that are intended to be applied to the processing of personal information in a context-sensitive manner.
Through the provision of quality services, Epokothweni with Babalwa Nonkenge is necessarily involved in the collection, use and disclosure of certain aspects of the personal information of clients, employees and other stakeholders.
A person’s right to privacy entails having control over his or her personal information and being able to conduct his or her affairs relatively free from unwanted intrusions.
Given the importance of privacy, Epokothweni with Babalwa Nonkenge is committed to effectively manage personal information in accordance with the provisions of POPIA.
2 DEFINITIONS
2.1 Personal Information
Personal information is any information that can be used to reveal a person’s identity. personal information relates to an identifiable, living, natural person, and where applicable, an identifiable, existing juristic person, including, but not limited to information concerning:
▪ race, gender, sex, pregnancy, marital status, national or ethnic origin, colour, sexual orientation, age, physical or mental health, disability, religion, conscience, belief, culture, language and birth of a person.
▪ information relating to the education or the medical, tax, financial, criminal or employment history of the person.
▪ any identifying number, symbol, email address, physical address, telephone number, location information, online identifier or other assignment to the person.
▪ the biometric information of the person.
▪ the personal opinions, views or preferences of the person.
▪ correspondence sent by the person that is implicitly or explicitly of a private or confidential nature or further correspondence that would reveal the contents of the original correspondence.
▪ the views or opinions of another individual about the person; and
▪ the name of the person if it appears with other personal information relating to the person or if the disclosure of the name itself would reveal information about the person.
2.2 Data Subject
This refers to the natural or juristic person to whom personal information relates, such as an individual client or third-party supplier.
2.3 Responsible PartyThe responsible party is the entity that needs the Personal Information for a particular reason and determines the purpose of and means for Processing the Personal Information. In this case, Epokothweni with Babalwa Nonkenge is the Responsible Party.
2.4 Operator
An Operator means a person who processes Personal Information for a Responsible Party in terms of a contract or mandate, without coming under the direct authority of that party. For example, a third-party service provider that has contracted with Epokothweni with Babalwa Nonkenge to shred documents containing Personal Information.
2.5 Information Officer
The information officer is responsible for ensuring Epokothweni with Babalwa Nonkenge’s compliance with POPIA.
Where no information officer is appointed, the Secretary General, will be responsible for performing the information officer’s duties.
Once appointed, the information officer must be registered with the South African Information Regulator established under POPIA prior to performing his or her duties. Deputy information officers can also be appointed to assist the information officer.
2.6 Processing
The act of processing information includes any activity or any set of operations, by automatic or manual means, concerning Personal Information and includes:
▪ the collection, receipt, Recording, collation, storage, updating or modification, retrieval, alteration, consultation or use.
▪ dissemination by means of transmission, distribution or making available in any other form; or
▪ merging, linking, as well as any restriction, degradation, erasure or destruction of information.
2.7 Record
Means any recorded information, regardless of form or medium, including:
Writing on any material.
Information produced, recorded or stored by means of any tape-recorder, computer equipment, whether hardware or software or both, or other device, and any material subsequently derived from information so produced, recorded or stored.
Label, marking or other writing that identifies or describes anything of which it forms part, or to which it is attached by any means.
Book, map, plan, graph or drawing.
Photograph, film, negative, tape or other device in which one or more visual images are embodied so as to be capable, with or without the aid of some other equipment, of being reproduced.
2.8 Filing System
Means any structured set of Personal Information, whether centralised, decentralised or dispersed on a functional or geographical basis, which is accessible according to specific criteria.
2.9 Unique Identifier
Means any identifier that is assigned to a Data Subject and is used by a Responsible Party for the purposes of the operations of that Responsible Party and that uniquely identifies that Data Subject in relation to that Responsible Party.
2.10 De-Identify
This means to delete any information that identifies a Data Subject, or which can be used by a reasonably foreseeable method to identify, or when linked to other information, which identifies the Data Subject.
2.11 Re-Identify
In relation to Personal Information of a Data Subject, means to resurrect any information that has been de-identified that identifies the Data Subject, or can be used or manipulated by a reasonably foreseeable method to identify the Data Subject.
2.12 Consent
Means any voluntary, specific and informed expression of will in terms of which permission is given for the processing of Personal Information.
2.13 Direct Marketing
Means to approach a Data Subject, either in person or by mail or electronic communication, for the direct or indirect purpose of:
▪ Promoting or offering to supply, in the ordinary course of business, any services to the Data Subject; or
▪ Requesting the Data Subject to make a donation of any kind for any reason.
2.14 Biometrics
Means a technique of personal identification that is based on physical, physiological or behavioural characterisation including blood typing, fingerprinting, DNA analysis, retinal scanning and voice recognition.
3. POLICY PURPOSE
This purpose of this Policy is to protect Epokothweni with Babalwa Nonkenge from the compliance risks associated with POPIA which includes:
▪ Breaches of confidentiality. For instance, Epokothweni with Babalwa Nonkenge could suffer loss in revenue where it is found that the Personal Information of Data Subjects has been shared or have been disclosed inappropriately.
▪ Failing to offer choice. For instance, all Data Subjects should be free to choose how and for what purpose Epokothweni with Babalwa Nonkenge uses its/their Personal Information.
▪ Reputational damage. For instance, Epokothweni with Babalwa Nonkenge could suffer a decline in shareholder value following an adverse event such as a computer hacker deleting the Personal Information held by Epokothweni with Babalwa Nonkenge.
This Policy demonstrates Epokothweni with Babalwa Nonkenge’s commitment to protecting the privacy rights of Data Subjects in the following manner: ▪ Through stating desired behaviour and directing compliance with the provisions of POPIA and best practice. ▪ By cultivating an organisational culture that recognises privacy as a valuable human right.
▪ By developing and implementing internal controls for the purpose of managing the compliance risk associated with POPIA.
▪ By creating business practices that will provide reasonable assurance that the rights of Data Subjects are protected and balanced with the legitimate business needs of Epokothweni with Babalwa Nonkenge.
▪ By assigning specific duties and responsibilities to control owners, including the appointment of an Information Officer and where necessary, Deputy Information Officers in order to protect the interests of Epokothweni with Babalwa Nonkenge and Data Subjects.
▪ By raising awareness through training and providing guidance to individuals who process Personal Information so that they can act confidently and consistently.
4. POLICY APPLICATION
This Policy and its guiding principles are applicable to:
▪ The Board of Trustees
▪ All branches, business units and divisions of Epokothweni with Babalwa Nonkenge
▪ All employees, members and volunteers
▪ All contractors, suppliers and other persons acting on behalf of Epokothweni with Babalwa Nonkenge
The Policy’s guiding principles find application in all situations and must be read in conjunction with the Promotion of Access to Information Act, No 2 of 2000.
The legal duty to comply with POPIA’s provisions is activated in any situation where there is:
▪ A Processing of…...….
▪ …………Personal Information……….
▪ ……………………..entered into a Record……….
▪ ……………………..…………..by or for a responsible person…………
▪ ………………………………………………….…..who is domiciled in South Africa.
POPIA does not apply in situations where the processing of Personal Information:
▪ is concluded in the course of purely personal or household activities, or
▪ where the Personal Information has been de-identified.
5. RIGHTS OF DATA SUBJECTS
Where appropriate, Epokothweni with Babalwa Nonkenge will ensure that its clients are made aware of the rights conferred upon them as Data Subjects. Epokothweni with Babalwa Nonkenge will ensure that it gives effect to the following six rights.
5.1 The Right to Access Personal Information
Epokothweni with Babalwa Nonkenge recognises that Data Subject has the right to establish whether Epokothweni with Babalwa Nonkenge holds Personal Information related to him or her, including the right to request access to that Personal Information.
An example of a “Personal Information Request Form”, which form can be found, as a link Annexure A.
5.2 The Right to have Personal Information Corrected or Deleted
The Data Subject has the right to request, where necessary, that his, her or its Personal Information must be corrected or deleted where Epokothweni with Babalwa Nonkenge is no longer authorised to retain the Personal Information.
5.3 The Right to Object to the Processing of Personal Information
The Data Subject has the right, on reasonable grounds, to object to the Processing of his, her or its Personal Information.
In such circumstances, Epokothweni with Babalwa Nonkenge will give due consideration to the request and the requirements of POPIA. Epokothweni with Babalwa Nonkenge may cease to use or disclose the Data Subject’s Personal Information and may, subject to any statutory and contractual Record keeping requirements, also approve the destruction of the Personal Information.
5.4 The Right to Object to Direct Marketing
The Data Subject has the right to object to the Processing of his, her or its Personal Information for purposes of direct marketing by means of unsolicited electronic communications.
5.5 The Right to Complain to the Information Officer
If for any reason you think that your Personal Information is not processed in the correct manner, or that your Personal Information is being used for a purpose other than that for what it was originally intended, you can contact Epokothweni with Babalwa Nonkenge’s Information Officer. You can request access to the information we hold about you through the process outlined in below at any time and if you think that we have outdated information, request that we update it or correct it accordingly.
Our Information Officer’s Contact Details
Epokothweni Podcast
+27 72 650 7641
Our details:
Epokothweni with Babalwa Nonkenge
babalwa@epokothweni.co.za
Complaints and objections
You have the right to –
▪ Request that we confirm, free of charge, whether or not we hold personal information about you; ▪ Request that we provide you with a description of the personal information we hold about you, and to explain why and how it is being processed, Link to Annexure A
▪ Request that we consider your objections to the processing of your personal information, Link to Annexure B; and Lodge a complaint with the Information Regulator, Link to Annexure B).
5.6 The Right to Complain to the Information Regulator
The Data Subject has the right to submit a complaint to the Information Regulator regarding an alleged infringement of any of the rights protected under POPIA and to institute civil proceedings regarding the alleged non-compliance with the protection of his, her or its Personal Information.
An example of a “POPIA Complaint Form” can be found as a link Annexure B.
5.7 The Right to be Informed
The Data Subject has the right to be notified that his, her or its Personal Information is being collected by Epokothweni with Babalwa Nonkenge.
The Data Subject also has the right to be notified in any situation where Epokothweni with Babalwa Nonkenge has reasonable grounds to believe that the Personal Information of the Data Subject has been accessed or acquired by an unauthorised person.
6. GENERAL GUIDING PRINCIPLES
All employees and persons acting on behalf of Epokothweni with Babalwa Nonkenge will at all times be subject to, and act in accordance with, the following guiding principles:
6.1 Accountability
Failing to comply with POPIA could potentially damage Epokothweni with Babalwa Nonkenge’s reputation or expose Epokothweni with Babalwa Nonkenge to a civil claim for damages. The protection of Personal Information is therefore everybody’s responsibility.
Epokothweni with Babalwa Nonkenge will ensure that the provisions of POPIA and the guiding principles outlined in this Policy are complied with through the encouragement of desired behaviour. However, Epokothweni with Babalwa Nonkenge will take appropriate sanctions, which may include disciplinary action, against those individuals who through their intentional or negligent actions and/or omissions fail to comply with the principles and responsibilities outlined in this Policy.
6.2 Processing Limitation
Epokothweni with Babalwa Nonkenge will ensure that Personal Information under its control is processed:
▪ in a fair, lawful and non-excessive manner, and
▪ for the specific purpose.
Epokothweni with Babalwa Nonkenge will under no circumstances distribute or share Personal Information between separate legal entities, associated companies (such as subsidiary companies) or with any individuals that are not directly involved with facilitating the purpose for which the information was originally collected.
Where applicable, the Data Subject may be informed of the possibility that their Personal Information may be shared with other aspects of Epokothweni with Babalwa Nonkenge’s business.
Should you require information regarding new products or developments that may be of interest to you, and should you not already have subscribed to our database and/or be an investor or client of Epokothweni with Babalwa Nonkenge, kindly fill in POPIA Notice and Consent Form, as a link Annexure C.
6.3 Purpose Specification
All of Epokothweni with Babalwa Nonkenge’s business units and operations must be informed by the principle of transparency.
Epokothweni with Babalwa Nonkenge will process Personal Information only for specific, explicitly defined reasons. Epokothweni with Babalwa Nonkenge will inform Data Subjects of these reasons prior to collecting or recording the Data Subject’s Personal Information.
6.4 Further Processing Limitation
Personal Information will not be processed for a secondary purpose unless that Processing is compatible with the original purpose.
Therefore, where Epokothweni with Babalwa Nonkenge seeks to process Personal Information, it holds for a purpose other than the original purpose for which it was originally collected, and where this secondary purpose is not compatible with the original purpose, Epokothweni with Babalwa Nonkenge will first obtain additional Consent from the Data Subject.
6.5 Information Quality
Epokothweni with Babalwa Nonkenge will take reasonable steps to ensure that all Personal Information collected is complete, accurate and not misleading.
The more important it is that the Personal Information be accurate, the greater the effort Epokothweni with Babalwa Nonkenge will put into ensuring its’ accuracy. Where Personal Information is collected or received from third parties, Epokothweni with Babalwa Nonkenge will take reasonable steps to confirm that the information is correct by verifying the accuracy of the information directly with the Data Subject or by way of independent sources.
6.6 Open Communication
Epokothweni with Babalwa Nonkenge will take reasonable steps to ensure that Data Subjects are notified (are always aware) that their Personal Information is being collected including the purpose for which it is being collected and processed.
Epokothweni with Babalwa Nonkenge will ensure that it establishes and maintains a “contact us” facility, for instance via its website or through an electronic helpdesk, for Data Subjects who want to:
▪ Enquire whether Epokothweni with Babalwa Nonkenge holds related Personal Information, or
▪ Request access to related Personal Information, or
▪ Request Epokothweni with Babalwa Nonkenge to update or correct related Personal Information, or
▪ Make a complaint concerning the Processing of Personal Information.
6.7 Security Safeguards
Epokothweni with Babalwa Nonkenge will manage the security of its Filing System to ensure that Personal Information is protected adequately. To this end, security controls will be implemented in order to minimise the risk of loss, unauthorised access, disclosure, interference, modification or destruction.
Security measures also need to be applied in a context-sensitive manner. For example, the more sensitive the Personal Information, such as shareholder information, banking details and/or credit card details (if applicable), the greater the security required.
Epokothweni with Babalwa Nonkenge will continuously review its security controls which will include regular testing of protocols and measures put in place to combat cyber-attacks on Epokothweni with Babalwa Nonkenge’s IT network.
Epokothweni with Babalwa Nonkenge will ensure that all paper and electronic Records comprising Personal Information are securely stored and made accessible only to authorised individuals.
All new employees will be required to sign employment contracts containing contractual terms for the use and storage of employee information. Confidentiality clauses will also be included to reduce the risk of unauthorised disclosures of Personal Information for which Epokothweni with Babalwa Nonkenge is responsible.
The Operators and third-party service providers will be required to enter into service level agreements with Epokothweni with Babalwa Nonkenge where both parties pledge their mutual commitment to POPIA and the lawful Processing of any Personal Information pursuant to the agreements.
6.8 Data Subject Participation
A Data Subject may request the correction or deletion of his, her or its Personal Information held by Epokothweni with Babalwa Nonkenge having regard to the legislative context.
Epokothweni with Babalwa Nonkenge will ensure that it provides a facility for Data Subjects who want to request the correction of deletion of their Personal Information.
Where applicable, Epokothweni with Babalwa Nonkenge will include a link to unsubscribe from any of its electronic newsletters or related marketing activities.
7. SPECIFIC DUTIES AND RESPONSIBILITIES
7.1 Board of Trustees
The Board of Trustees cannot delegate its accountability and is ultimately answerable for ensuring that Epokothweni with Babalwa Nonkenge meets its legal obligations in terms of POPIA.
Epokothweni with Babalwa Nonkenge may however delegate some of its responsibilities in terms of POPIA to management or other capable individuals. The Board of Trustee is responsible for ensuring that:
▪ Epokothweni with Babalwa Nonkenge appoints an Information Officer.
▪ All persons responsible for the Processing of Personal Information on behalf of Epokothweni with Babalwa Nonkenge:
· Are appropriately trained and supervised to do so,
· Understand that they are contractually obligated to protect the Personal Information they come into contact with, and · are aware that a wilful or negligent breach of this Policy’s processes and procedures may lead to disciplinary action being taken against them.
▪ Data Subjects who want to make enquires about their Personal Information are made aware of the procedure that needs to be followed should they wish to do so.
▪ The scheduling of a periodic POPIA Audit in order to accurately assess and review the ways in which Epokothweni with Babalwa Nonkenge collects, holds, uses, shares, discloses, destroys and processes Personal Information.
7.2 Information Officer
Epokothweni with Babalwa Nonkenge’s Information Officer is responsible for:
▪ Taking steps to ensure Epokothweni with Babalwa Nonkenge’s reasonable compliance with the provision of POPIA.
▪ Keeping the Board of Trustees updated about Epokothweni with Babalwa Nonkenge’s information protection responsibilities under POPIA. For instance, in the case of a security breach, the Information Officer must inform and advise the governing body of their obligations pursuant to POPIA.
▪ Continually analysing privacy regulations and aligning them with Epokothweni with Babalwa Nonkenge’s Personal Information Processing procedures. This will include reviewing Epokothweni with Babalwa Nonkenge’s information protection procedures and related policies.
▪ Ensuring that POPIA Audits are scheduled and conducted on a regular basis.
▪ Ensuring that Epokothweni with Babalwa Nonkenge makes it convenient for Data Subjects who want to update their Personal Information or submit POPIA related complaints to Epokothweni with Babalwa Nonkenge. For instance, maintaining a “contact us” facility on Epokothweni with Babalwa Nonkenge’s website.
▪ Approving any contracts entered into with Operators, employees and other third parties which may have an impact on the Personal Information held by Epokothweni with Babalwa Nonkenge. This will include overseeing the amendment of Epokothweni with Babalwa Nonkenge’s new employment contracts and other new service level agreements.
▪ Encouraging compliance with the conditions required for the lawful Processing of Personal Information.
▪ Ensuring that employees and other persons acting on behalf of Epokothweni with Babalwa Nonkenge are fully aware of the risks associated with the Processing of Personal Information and that they remain informed about Epokothweni with Babalwa Nonkenge’s security controls.
▪ Organising and overseeing the awareness training of employees and other individuals involved in the Processing of Personal Information on behalf of Epokothweni with Babalwa Nonkenge.
▪ Addressing employees’ POPIA related questions.
▪ Addressing all POPIA related requests and complaints made by Epokothweni with Babalwa Nonkenge’s Data Subjects.
▪ Working with the Information Regulator in relation to any ongoing investigations. The Information Officer will therefore act as the contact point for the Information Regulator authority on issues relating to the Processing of Personal Information and will consult with the Information Regulator where appropriate, regarding any other matter.
7.3 Marketing Manager
Epokothweni with Babalwa Nonkenge’s Marketing Manager is responsible for:
▪ Approving and maintaining the protection of Personal Information statements and disclaimers that are displayed on Epokothweni with Babalwa Nonkenge’s website, including those attached to communications such as emails and electronic newsletters.
▪ Addressing any Personal Information protection queries from journalists or media outlets such as newspapers.
▪ Where necessary, working with persons acting on behalf of Epokothweni with Babalwa Nonkenge to ensure that any outsourced marketing initiatives comply with POPIA.
7.4 Employees and other Persons acting on behalf of Epokothweni with Babalwa Nonkenge
Employees and other persons acting on behalf of Epokothweni with Babalwa Nonkenge will, during the course of the performance of their services, gain access to and become acquainted with the Personal Information of certain clients, suppliers and other employees.
Employees and other persons acting on behalf of Epokothweni with Babalwa Nonkenge are required to treat Personal Information as a confidential business asset and to respect the privacy of Data Subjects.
Employees and other persons acting on behalf of Epokothweni with Babalwa Nonkenge may not utilise, disclose or make public in any manner to any person or third party, any Personal Information, unless such information is already publicly known, or the disclosure is necessary in order for the employee or person to perform his or her duties.
8. POPIA AUDIT
Epokothweni with Babalwa Nonkenge’s Information Officer will schedule periodic POPIA Audits.
The purpose of a POPIA audit is to:
▪ Identify the processes used to collect, Record, store, disseminate and destroy Personal Information.
▪ Determine the flow of Personal Information throughout Epokothweni with Babalwa Nonkenge. For instance, Epokothweni with Babalwa Nonkenge’s various business units, divisions, branches and other associated organisations.
▪ Redefine the purpose for gathering and Processing Personal Information.
▪ Confirm the justification grounds for Processing the gathered Personal Information.
▪ Ensure that the Processing parameters are still adequately limited.
▪ Ensure that new Data Subjects are made aware of the Processing of their Personal Information.
▪ Re-establish the rationale for any further Processing where information is received via a third party.
▪ Re-assess all third-party SLAs to determine the nature of the relationship, and update or put in place Operator Agreements where such a relationship exists.
▪ Verify the quality and security of Personal Information.
▪ Monitor the extend of compliance with POPIA and this Policy.
▪ Monitor the effectiveness of internal controls established to manage Epokothweni with Babalwa Nonkenge’s POPIA related compliance risk.
In performing the POPIA Audit, Information Officer will liaise with line managers in order to identify areas within in Epokothweni with Babalwa Nonkenge’s operations that are most vulnerable or susceptible to the unlawful Processing of Personal Information.
Information Officer will be permitted direct access to and have demonstrable support from line managers and the Board of Trustees in performing their duties.
9. REQUEST TO ACCESS PERSONAL INFORMATION PROCEDURE
Data Subjects have the right to:
▪ Request what Personal Information Epokothweni with Babalwa Nonkenge holds about them and why.
▪ Request access to their Personal Information.
▪ Be informed how to keep their Personal Information up to date.
Access to information requests can be made by email, addressed to the Information Officer. The Information Officer will provide the Data Subject with a “Personal Information Request Form”.
Once the completed form has been received, the Information Officer will verify the identity of the Data Subject prior to handing over any Personal Information. All requests will be processed and considered against Epokothweni with Babalwa Nonkenge’s Policy.
The Information Officer will process all requests within a reasonable time.
10. POPIA COMPLAINTS PROCEDURE
Data Subjects have the right to complain in instances where any of their rights under POPIA have been infringed upon. Epokothweni with Babalwa Nonkenge takes all complaints very seriously and will address all POPIA related complaints in accordance with the following procedure:
▪ POPIA complaints must be submitted to Epokothweni with Babalwa Nonkenge in writing. Where so required in terms clause above.
▪ Where the complaint has been received by any person other than the Information Officer, that person will ensure that the full details of the complaint reach the Information Officer within one (1) business day.
▪ The Information Officer will provide the complainant with a written acknowledgement of receipt of the complaint within two (2) business days.
▪ The Information Officer will carefully consider the complaint and address the complainant’s concerns in an amicable manner. In considering the complaint, the Information Officer will endeavour to resolve the complaint in a fair manner and in accordance with the principles outlined in POPIA.
▪ The Information Officer must also determine whether the complaint relates to an error or breach of confidentiality that has occurred and which may have a wider impact on Epokothweni with Babalwa Nonkenge’s Data Subject/s.
▪ Where the Information Officer has reason to believe that the Personal Information of Data Subjects has been accessed or acquired by an unauthorised person, the Information Officer will consult with the Board of Trustees where after the affected Data Subjects and the Information Regulator will be informed of this breach.
▪ The Information Officer will revert to the complainant with a proposed solution with the option of escalating the complaint to Epokothweni with Babalwa Nonkenge’s Board of Trustees within seven (7) business days of receipt of the complaint. In all instances, Epokothweni with Babalwa Nonkenge will provide reasons for any decisions taken and communicate any anticipated deviation from the specified timelines.
▪ The Information Officer’s response to the Data Subject may comprise any of the following:
· A suggested remedy for the complaint,
· A dismissal of the complaint and the reasons as to why it was dismissed,
· An apology (if applicable) and any disciplinary action that has been taken against any employees involved.
▪ Where the Data Subject is not satisfied with the Information Officer’s suggested remedies, the Data Subject has the right to complain directly to the Information Regulator.
▪ The Information Officer will review the complaints process to assess the effectiveness of the procedure on a periodic basis and to improve the procedure where it is found wanting. The reason for any complaints will also be reviewed to ensure the avoidance of occurrences giving rise to POPIA related complaints.
11. DISCIPLINARY ACTION
Where a POPIA complaint or a POPIA infringement investigation has been finalised, Epokothweni with Babalwa Nonkenge may recommend any appropriate administrative, legal and/or disciplinary action to be taken against any employee reasonably suspected of being implicated in any non-compliant activity outlined within this Policy.
In the case of ignorance or minor negligence, Epokothweni with Babalwa Nonkenge will undertake to provide further awareness training to the employee.
Any gross negligence or the wilful mismanagement of Personal Information, will be considered a serious form of misconduct for which Epokothweni with Babalwa Nonkenge may summarily dismiss the employee. Disciplinary procedures will commence where there is sufficient evidence to support an employee’s gross negligence.
Examples of immediate actions that may be taken after an investigation include:
▪ A recommendation to commence with disciplinary action.
▪ A referral to appropriate law enforcement agencies for criminal investigation.
▪ Recovery of funds and/or assets in order to limit any prejudice or damages caused.
ANNEXURE A: PERSONAL INFORMATION REQUEST FORM
Please submit the completed form to the Information Officer:
Name
Contact Number
Email Address:
Please be aware that we may require you to provide proof of identification prior to Processing your request.
There may also be a reasonable charge for providing copies of the information requested.
A. Particulars of Data Subject
Name & Surname
Identity Number:
Postal Address:
Contact Number:
Email Address:
B. Request
I request Epokothweni with Babalwa Nonkenge Foundation to:
(a) Inform me whether it holds any of my Personal Information ◻ (b) Provide me with a Record or description of my Personal Information ◻ (c) Correct or update my Personal Information ◻ (d) Destroy or delete a Record of my Personal Information ◻ C. Instructions
D. Signature Page
Signature
Date
ANNEXURE B: POPIA COMPLAINT FORM
POPIA COMPLAINT FORM
We are committed to safeguarding your privacy and the confidentiality of your Personal Information and are bound by the Protection of Personal Information Act (“POPIA”).
Please submit your complaint to the Information Officer:
Name
Contact Number
Email Address:
Where we are unable to resolve your complaint, to your satisfaction you have the right to complaint to the Information Regulator.
The Information Regulator
Physical Address: SALU Building, 316 Thabo Sehume Street, Pretoria
Email: inforreg@justice.gov.za
Website: http://www.justice.gov.za/inforeg/index.html
A. Particulars of Complainant
Name & Surname
Identity Number:
Postal Address:
Contact Number:
Email Address:
B. Details of Complaint
C. Desired Outcome
D. Signature Page
Signature:
Date
ANNEXURE C: POPIA NOTICE AND CONSENT FORM
POPIA NOTICE AND CONSENT FORM
Epokothweni with Babalwa Nonkenge Corporate Advisory (Pty) Ltd (“Epokothweni with Babalwa Nonkenge”) understands that your Personal Information is important to you and that you may be apprehensive about disclosing it. Your privacy is just as important to us, and we are committed to safeguarding and processing your information in a lawful manner.
We also want to make sure that you understand how and for what purpose we process your information. If for any reason you think that your information is not processed in a correct manner, or that your information is being used for a purpose other than that for what it was originally intended, you can contact our Information Officer.
You can request access to the information we hold about you at any time and if you think that we have outdated information, please request us to update or correct it.
Our Information Officer’s contact details are available on request
Purpose for Processing your Information
We collect, hold, use and disclose your Personal Information mainly to provide you with access to the services and products that we provide. We will only process your information for a purpose you would reasonably expect to notify you of new products or developments that may be of interest to you, should you not already have subscribed to our database and/or be an investor or client of Epokothweni with Babalwa Nonkenge.
Some of your information that we hold may include, your first and last name, email address, a home, postal or other physical address, other contact information, your title, birth date, gender, occupation, qualifications, past employment, residency status, your investments, assets, liabilities, insurance, income, expenditure, family history, medical information and your banking details.
Consent to Disclose and Share your Information
We may need to share your information to provide reports, analyses, products or services that you have requested.
Where we share your information, we will take all precautions to ensure that the third party will treat your information with the same level of protection as required by us. Your information may be hosted on servers managed by a third-party service provider, which may be located outside of South Africa.
I hereby authorise and Consent to Epokothweni with Babalwa Nonkenge sharing my Personal Information with the following persons: Name & Surname
Signature
Date