Protection of Personal Information Policy

NUMERAL XII (Pty) Ltd · Registration number 2021/748540/07

Policy statement

This policy forms part of the internal business processes and procedures of NUMERAL XII (Pty) Ltd (“Numeral”).
Any reference to “the organisation” includes Numeral as the policy owner.
The organisation’s governing body, employees, volunteers, contractors, suppliers and any other persons acting on its behalf must familiarise themselves with this policy and comply with its processes and procedures.
Risk owners and control owners are responsible for overseeing and maintaining control procedures and activities.

1. Introduction

The right to privacy is a fundamental human right recognised and protected by the South African Constitution and by the Protection of Personal Information Act 4 of 2013 (“POPIA”).

POPIA promotes the protection of privacy by setting out guiding principles to be applied to the processing of personal information in a context-sensitive manner.

In providing its products and services, the organisation necessarily collects, uses and discloses certain personal information of clients, employees and other stakeholders.

A person’s right to privacy includes having control over their personal information and being able to conduct their affairs relatively free from unwanted intrusion. Given the importance of privacy, the organisation is committed to managing personal information effectively and in accordance with POPIA.

2. Definitions

These definitions are included for convenience and guidance only. If there is any inconsistency, the definitions in POPIA take precedence.

2.1 Personal information

Any information relating to an identifiable, living natural person and, where applicable, an identifiable, existing juristic person (such as a company), including but not limited to:

full names or initials;
telephone numbers, e-mail addresses and physical addresses;
identity numbers, passport numbers or other unique identifiers;
age, gender, race and marital status;
bank account details, credit card numbers and income information;
medical history or health status; and
fingerprints, facial recognition data or voiceprints.

POPIA also identifies certain categories of “special personal information” that require additional protection because of their sensitive nature. These are:

religious or philosophical beliefs;
race or ethnic origin;
trade union membership;
political persuasion;
health or sex life;
biometric information; and
criminal behaviour.

2.2 Data subject

The natural or juristic person to whom personal information relates, such as an individual client or a company that supplies the organisation with products or services.

2.3 Responsible party

The party that, alone or with others, determines the purpose of and means for processing personal information. In this case, the organisation is the responsible party.

2.4 Operator

A person who processes personal information for a responsible party in terms of a contract or mandate, without coming under the direct authority of that party. An example is a service provider contracted by the organisation to shred documents containing personal information.

2.5 Information Officer

The person responsible for ensuring the organisation’s compliance with POPIA. In a private body, the head of the organisation is the Information Officer unless that role is duly authorised to another person. The Information Officer must be registered with the Information Regulator before performing their duties. Deputy Information Officers may be designated to assist the Information Officer.

2.6 Processing

Any operation or activity, or set of operations, whether or not by automatic means, concerning personal information, including:

collection, receipt, recording, organisation, collation, storage, updating or modification, retrieval, alteration, consultation or use;
dissemination by means of transmission, distribution or making available in any other form; or
merging, linking, restriction, degradation, erasure or destruction of information.

2.7 Record

Any recorded information, regardless of form or medium, including:

writing on any material;
information produced, recorded or stored by means of a tape recorder, computer equipment (hardware, software or both) or other device, and any material subsequently derived from it;
a label, marking or other writing that identifies or describes anything of which it forms part, or to which it is attached;
a book, map, plan, graph or drawing; and
a photograph, film, negative, tape or other device in which one or more visual images are embodied so as to be capable of being reproduced.

2.8 Filing system

Any structured set of personal information, whether centralised, decentralised or dispersed on a functional or geographical basis, that is accessible according to specific criteria.

2.9 Unique identifier

Any identifier assigned to a data subject and used by a responsible party for its operations, which uniquely identifies that data subject in relation to that responsible party.

2.10 De-identify

To delete any information that identifies a data subject, or that can be used by a reasonably foreseeable method, or linked to other information, to identify the data subject.

2.11 Re-identify

To resurrect de-identified information so that it identifies the data subject, or can be used or manipulated by a reasonably foreseeable method to do so.

2.12 Consent

Any voluntary, specific and informed expression of will in terms of which permission is given for the processing of personal information.

2.13 Direct marketing

Approaching a data subject, in person, by post or by electronic communication, for the direct or indirect purpose of:

promoting or offering to supply, in the ordinary course of business, goods or services to the data subject; or
requesting the data subject to make a donation of any kind for any reason.

2.14 Biometrics

A technique of personal identification based on physical, physiological or behavioural characterisation, including blood typing, fingerprinting, DNA analysis, retinal scanning and voice recognition.

3. Purpose of this policy

This policy protects the organisation from the compliance risks associated with the protection of personal information, including:

Breaches of confidentiality: the organisation could suffer a loss of revenue if personal information is shared or disclosed inappropriately.
Failing to offer choice: data subjects should be free to choose how, and for what purpose, the organisation uses information relating to them.
Reputational damage: the organisation could suffer a decline in value following an adverse event, such as a hacker deleting personal information it holds.

The policy demonstrates the organisation’s commitment to protecting the privacy rights of data subjects by:

stating desired behaviour and directing compliance with POPIA and best practice;
cultivating an organisational culture that recognises privacy as a valuable human right;
developing and implementing internal controls to manage the compliance risk associated with personal information;
creating business practices that provide reasonable assurance that the rights of data subjects are protected and balanced with the organisation’s legitimate business needs;
assigning specific duties and responsibilities to control owners, including the Information Officer and, where necessary, Deputy Information Officers; and
raising awareness through training and guidance, so that individuals who process personal information can act confidently and consistently.

4. Application of this policy

This policy and its guiding principles apply to:

the organisation’s governing body;
all branches, business units and divisions of the organisation;
all employees and volunteers; and
all contractors, suppliers and other persons acting on behalf of the organisation.

The policy must be read together with POPIA and the organisation’s PAIA Manual, published in terms of the Promotion of Access to Information Act 2 of 2000.

The duty to comply with POPIA applies whenever personal information is processed and entered in a record by or for a responsible party that is domiciled in South Africa, or that uses automated or non-automated means in South Africa.

POPIA does not apply where the processing of personal information:

takes place in the course of a purely personal or household activity; or
relates to information that has been de-identified to the extent that it cannot be re-identified.

5. Rights of data subjects

Where appropriate, the organisation will make its clients aware of their rights as data subjects, and will give effect to the following rights.

5.1 The right to access personal information

A data subject has the right to establish whether the organisation holds personal information about them, and to request access to that information. A Personal Information Request Form is included as Annexure A.

5.2 The right to have personal information corrected or deleted

A data subject has the right to request that their personal information be corrected or deleted where it is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or obtained unlawfully, or where the organisation is no longer authorised to retain it.

5.3 The right to object to processing

A data subject has the right, on reasonable grounds, to object to the processing of their personal information. The organisation will give due consideration to the objection and to the requirements of POPIA. It may stop using or disclosing the personal information and, subject to any statutory and contractual record-keeping requirements, may approve its destruction.

5.4 The right to object to direct marketing

A data subject has the right to object to the processing of their personal information for direct marketing by means of unsolicited electronic communications.

5.5 The right to complain to the Information Regulator

A data subject has the right to submit a complaint to the Information Regulator about an alleged infringement of any right protected under POPIA, and to institute civil proceedings regarding alleged non-compliance. A POPI Complaint Form is included as Annexure B.

5.6 The right to be informed

A data subject has the right to be notified that their personal information is being collected, and to be notified where the organisation has reasonable grounds to believe that their personal information has been accessed or acquired by an unauthorised person.

6. General guiding principles

All employees and persons acting on behalf of the organisation must at all times act in accordance with the following principles.

6.1 Accountability

Failing to comply with POPIA could damage the organisation’s reputation or expose it to a civil claim for damages. The protection of personal information is therefore everybody’s responsibility.

The organisation will ensure compliance with POPIA and this policy by encouraging desired behaviour. It will, however, take appropriate action, which may include disciplinary action, against individuals who, through intentional or negligent acts or omissions, fail to comply with this policy.

6.2 Processing limitation

The organisation will ensure that personal information under its control is processed:

lawfully, and in a reasonable manner that does not infringe the privacy of the data subject;
only where it is adequate, relevant and not excessive for the purpose; and
only on a lawful basis recognised by section 11 of POPIA, such as the data subject’s consent, the conclusion or performance of a contract, compliance with a legal obligation, or a legitimate interest (see section 8.5).

Where processing is based on consent, the organisation will inform the data subject of the reasons for collecting their personal information and obtain their consent before processing it. Where services or transactions are concluded by telephone or video call, the organisation will keep a voice recording of the stated purpose and of the data subject’s consent.

The organisation will not share personal information with other legal entities, including group companies, or with individuals who are not directly involved in fulfilling the purpose for which it was collected, unless the sharing is lawful and necessary for that purpose. Where applicable, data subjects will be informed that their personal information may be shared within the organisation or its group, and why. A POPI Notice and Consent Form is included as Annexure C.

6.3 Purpose specification

All of the organisation’s business units and operations must be guided by the principle of transparency. The organisation will process personal information only for specific, explicitly defined and lawful purposes, and will inform data subjects of these purposes before collecting their personal information.

6.4 Further processing limitation

Personal information will not be processed for a secondary purpose unless that processing is compatible with the original purpose. Where the organisation wishes to process personal information for a purpose that is not compatible with the original purpose, it will first obtain additional consent from the data subject.

6.5 Information quality

The organisation will take reasonable steps to ensure that personal information is complete, accurate, up to date and not misleading. The more important the accuracy of the information, the greater the effort the organisation will make to ensure it.

Where personal information is received from third parties, the organisation will take reasonable steps to confirm that it is correct, by verifying it with the data subject or with independent sources.

6.6 Openness

The organisation will take reasonable steps to ensure that data subjects are aware that their personal information is being collected, and of the purpose for which it is collected and processed.

The organisation will maintain a “contact us” facility, for example on its website, for data subjects who want to:

enquire whether the organisation holds their personal information;
request access to their personal information;
ask the organisation to update or correct their personal information; or
complain about the processing of their personal information.

6.7 Security safeguards

The organisation will manage the security of its filing systems so that personal information is adequately protected, implementing controls to minimise the risk of loss, unauthorised access, disclosure, interference, modification or destruction.

Security measures will be applied in a context-sensitive manner: the more sensitive the personal information, such as medical information or credit card details, the greater the security required.

The organisation will continuously review its security controls, including regular testing of the protocols and measures in place to combat cyber-attacks on its IT network. All paper and electronic records containing personal information will be stored securely and made accessible only to authorised individuals.

All new employees will sign employment contracts containing terms for the use and storage of employee information, as well as confidentiality clauses to reduce the risk of unauthorised disclosure. Existing employees will, after the required consultation process, be asked to sign an addendum to their employment contracts containing the relevant consent and confidentiality clauses.

The organisation’s operators and third-party service providers will be required to enter into service level agreements in which both parties commit to complying with POPIA and to processing personal information lawfully.

6.8 Data subject participation

A data subject may request the correction or deletion of their personal information held by the organisation, and the organisation will provide a facility for them to do so. Where applicable, the organisation will include a link to unsubscribe from its electronic newsletters and other marketing communications.

7. Information Officers

In terms of POPIA and PAIA, the head of the organisation is its Information Officer and is responsible for ensuring compliance with POPIA. The head may duly authorise another person to act as Information Officer and may designate one or more Deputy Information Officers to assist.

The organisation will register its Information Officer and any Deputy Information Officers with the Information Regulator before they perform their duties, and will update the registration whenever the appointment changes. The appointment or replacement of the Information Officer and any Deputy Information Officers will be considered annually.

The organisation’s current Information Officer and Deputy Information Officer are listed in its PAIA Manual.

8. Specific duties and responsibilities

8.1 Governing body

The governing body cannot delegate its accountability and is ultimately answerable for ensuring that the organisation meets its obligations under POPIA. It may, however, delegate some of its responsibilities to management or other capable individuals.

The governing body is responsible for ensuring that:

the organisation has an Information Officer and, where necessary, a Deputy Information Officer;
everyone who processes personal information on behalf of the organisation:
- is appropriately trained and supervised;
- understands that they are contractually obliged to protect the personal information they come into contact with; and
- is aware that a wilful or negligent breach of this policy may lead to disciplinary action;
data subjects who want to enquire about their personal information are made aware of the procedure to follow; and
regular POPI audits are scheduled to assess how the organisation collects, holds, uses, shares, discloses, destroys and otherwise processes personal information.

8.2 Information Officer

The Information Officer is responsible for:

taking steps to ensure the organisation’s reasonable compliance with POPIA;
keeping the governing body informed of the organisation’s information protection responsibilities under POPIA, including advising it of its obligations in the event of a security breach;
continually analysing privacy regulations and aligning the organisation’s processing procedures and related policies with them;
ensuring that POPI audits are scheduled and conducted regularly;
making it convenient for data subjects to update their personal information or submit POPI-related complaints, for example through a “contact us” facility on the website;
approving contracts with operators, employees and other third parties that may affect the personal information held by the organisation, including overseeing amendments to employment contracts and service level agreements;
encouraging compliance with the conditions for the lawful processing of personal information;
ensuring that employees and other persons acting on behalf of the organisation are aware of the risks associated with processing personal information and remain informed about the organisation’s security controls;
organising and overseeing POPI awareness training;
answering employees’ POPIA-related questions;
addressing all POPIA-related requests and complaints from data subjects; and
working with the Information Regulator on any investigation, acting as the organisation’s contact point for the Regulator on matters relating to the processing of personal information, and consulting the Regulator where appropriate.

The Deputy Information Officer assists the Information Officer in performing these duties.

8.3 IT Manager

The IT Manager is responsible for ensuring that:

the organisation’s IT infrastructure, filing systems and other devices used to process personal information meet acceptable security standards;
electronically held personal information is kept only on designated drives and servers, and uploaded only to approved cloud services;
servers containing personal information are kept in a secure location, away from the general office space;
electronically stored personal information is backed up, and back-ups are tested regularly;
back-ups containing personal information are protected from unauthorised access, accidental deletion and malicious hacking;
personal information transferred electronically is encrypted;
servers and computers containing personal information are protected by a firewall and up-to-date security software;
regular IT audits are performed to confirm that hardware and software security is functioning properly, and to verify whether electronically stored personal information has been accessed or acquired by unauthorised persons; and
proper due diligence is performed before contracting with operators or other third parties, such as cloud service providers, to process personal information on the organisation’s behalf.

8.4 Marketing and Communication Manager

The Marketing and Communication Manager is responsible for:

approving and maintaining the privacy statements and disclaimers displayed on the organisation’s website and attached to communications such as e-mails and electronic newsletters;
addressing personal information queries from journalists and the media; and
where necessary, working with persons acting on behalf of the organisation to ensure that outsourced marketing initiatives comply with POPIA.

8.5 Employees and other persons acting on behalf of the organisation

Employees and other persons acting on behalf of the organisation will, in performing their duties, have access to the personal information of clients, suppliers and other employees. They must treat personal information as a confidential business asset and respect the privacy of data subjects.

They may not, directly or indirectly, use, disclose or make public any personal information to any person, inside or outside the organisation, unless the information is already publicly known or the disclosure is necessary to perform their duties. If they are unsure about any aspect of protecting personal information, they must ask their line manager or the Information Officer for help.

Personal information may be processed only where:

the data subject, or a competent person where the data subject is a child, consents;
processing is necessary to conclude or perform a contract to which the data subject is a party;
processing complies with an obligation imposed by law on the organisation;
processing protects a legitimate interest of the data subject; or
processing is necessary to pursue the legitimate interests of the organisation or of a third party to whom the information is supplied.

Where processing relies on consent, the data subject must clearly understand why, and for what purpose, their personal information is collected and with whom it will be shared, and must give specific, informed consent before processing begins. Consent may be given in writing, including any electronic form that can be accurately reproduced in print, or recorded by voice where a transaction is concluded by telephone or video call. A data subject may withdraw consent at any time.

Personal information must be collected directly from the data subject, except where:

the information is contained in a public record or has deliberately been made public by the data subject;
the data subject has consented to collection from another source; or
collection from another source is necessary for the purposes set out in section 12(2) of POPIA, such as law enforcement.

Employees and other persons acting on behalf of the organisation must never:

process or access personal information that is not required for their work;
save copies of personal information to their own computers, laptops, tablets or phones; all personal information must be accessed and updated from the organisation’s central database or a dedicated server;
share personal information informally, including by unencrypted e-mail; where access to personal information is needed, it should be requested from the relevant line manager or the Information Officer; or
transfer personal information outside South Africa without the express permission of the Information Officer.

Employees and other persons acting on behalf of the organisation are responsible for:

keeping all personal information they come into contact with secure, by taking sensible precautions and following this policy;
holding personal information in as few places as necessary, without creating unnecessary additional records, filing systems or data sets;
encrypting personal information before sending or sharing it electronically (the IT Manager will assist with sending personal information to authorised external persons);
password-protecting all computers, laptops, tablets, flash drives and phones that store personal information, never leaving them unattended, changing passwords regularly and never sharing them with unauthorised persons;
locking or switching off screens and devices when not in use or when away from their desks;
locking away removable storage media, such as external drives, CDs or DVDs, when not in use;
keeping paper records in a secure place where unauthorised people cannot access them, such as a locked filing cabinet;
not leaving printouts unattended where unauthorised people could see or copy them, such as at the printer;
taking reasonable steps to keep personal information accurate and up to date, for example by confirming a client’s contact details when they get in touch, and obtaining authorisation from their line manager or the Information Officer before updating out-of-date information;
keeping personal information only for as long as it is needed for the purpose for which it was collected, and obtaining authorisation from their line manager or the Information Officer before deleting or disposing of it appropriately; and
completing POPI awareness training from time to time.

Anyone who becomes aware of, or suspects, a security breach, such as unauthorised access, interference, modification, destruction or disclosure of personal information, must immediately report it to the Information Officer or Deputy Information Officer.

9. POPI audit

The Information Officer will schedule periodic POPI audits to:

identify the processes used to collect, record, store, disseminate and destroy personal information;
determine how personal information flows through the organisation, including its business units, divisions, branches and associated organisations;
redefine the purposes for collecting and processing personal information;
ensure that processing remains adequately limited;
ensure that new data subjects are made aware of the processing of their personal information;
re-establish the rationale for any further processing of information received from third parties;
verify the quality and security of personal information;
monitor the extent of compliance with POPIA and this policy; and
monitor the effectiveness of the internal controls that manage the organisation’s POPI-related compliance risk.

In performing a POPI audit, the Information Officer will liaise with line managers to identify the areas of the organisation’s operations most vulnerable to the unlawful processing of personal information. The Information Officer will have direct access to, and the demonstrable support of, line managers and the governing body in performing these duties.

10. Requests for access to personal information

Data subjects have the right to:

ask what personal information the organisation holds about them, and why;
request access to their personal information; and
be informed how to keep their personal information up to date.

Requests may be e-mailed to the Information Officer, who will provide a Personal Information Request Form (Annexure A). Once the completed form is received, the Information Officer will verify the data subject’s identity before releasing any personal information. Confirming whether the organisation holds a data subject’s personal information is free of charge. Requests will be considered in line with the organisation’s PAIA Manual and processed within a reasonable time.

11. POPI complaints procedure

Data subjects have the right to complain if any of their rights under POPIA have been infringed. The organisation takes all complaints seriously and will address them as follows:

Complaints must be submitted in writing. Where required, the Information Officer will provide a POPI Complaint Form (Annexure B).
If anyone other than the Information Officer receives a complaint, they must ensure its full details reach the Information Officer within 1 working day.
The Information Officer will acknowledge receipt of the complaint in writing within 2 working days.
The Information Officer will consider the complaint carefully and try to resolve it amicably, fairly and in accordance with the principles of POPIA.
The Information Officer will determine whether the complaint relates to an error or breach of confidentiality that may have a wider impact on the organisation’s data subjects.
If the Information Officer has reason to believe that personal information has been accessed or acquired by an unauthorised person, they will consult the governing body, after which the affected data subjects and the Information Regulator will be notified of the breach.
Within 7 working days of receiving the complaint, the Information Officer will respond to the complainant with a proposed solution and the option of escalating the complaint to the governing body. The organisation will give reasons for any decision and communicate any expected delay.
The response may include a suggested remedy; a dismissal of the complaint, with reasons; or an apology (where applicable) and details of any disciplinary action taken against the employees involved.
If the data subject is not satisfied with the outcome, they have the right to complain to the Information Regulator.

The Information Officer will periodically review the complaints process to assess its effectiveness and improve it where necessary, and will review the causes of complaints to prevent them from recurring.

12. Disciplinary action

Once a POPI complaint or infringement investigation has been finalised, the organisation may recommend appropriate administrative, legal or disciplinary action against any employee reasonably suspected of being involved in non-compliant activity.

In cases of ignorance or minor negligence, the organisation will provide further awareness training. Gross negligence or wilful mismanagement of personal information will be treated as serious misconduct, which may lead to dismissal. Disciplinary procedures will begin where there is sufficient evidence of gross negligence.

Actions that may follow an investigation include:

a recommendation to start disciplinary proceedings;
referral to the appropriate law enforcement agencies for criminal investigation; and
recovery of funds and assets to limit any prejudice or damage caused.

Annexure A: Personal Information Request Form

Please submit the completed form to the Information Officer:

Name	Neville Graham
Telephone	082 499 3302
E-mail	neville@numeral.co.za

We may ask you for proof of identity before processing your request. Confirming whether we hold your personal information is free; a reasonable fee may apply for copies of the information requested.

A. Particulars of data subject
Name and surname
Identity number
Postal address
Telephone
E-mail

B. Request (tick as applicable)
I request the organisation to:
(a) Tell me whether it holds any of my personal information
(b) Provide me with a record or description of my personal information
(c) Correct or update my personal information
(d) Destroy or delete a record of my personal information

C. Instructions

D. Signature
Signature
Date

Annexure B: POPI Complaint Form

We are committed to safeguarding your privacy and the confidentiality of your personal information, and are bound by the Protection of Personal Information Act. Please submit your complaint to the Information Officer:

Name	Neville Graham
Telephone	082 499 3302
E-mail	neville@numeral.co.za

If we are unable to resolve your complaint to your satisfaction, you have the right to complain to the Information Regulator:

Information Regulator
Website	https://inforegulator.org.za/
Telephone	010 023 5200
Toll-free	0800 017 160
E-mail	enquiries@inforegulator.org.za
Physical address	Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191

A. Particulars of complainant
Name and surname
Identity number
Postal address
Telephone
E-mail

B. Details of complaint

C. Desired outcome

D. Signature
Signature
Date

Annexure C: POPI Notice and Consent Form

We understand that your personal information is important to you and that you may be hesitant to share it. Your privacy is just as important to us, and we are committed to safeguarding your information and processing it lawfully.

We want you to understand how, and for what purpose, we process your information. If you believe your information is not being processed correctly, or is being used for a purpose other than the one for which it was collected, please contact our Information Officer. You may ask for access to the information we hold about you at any time, and ask us to update or correct it if it is out of date.

Our Information Officer
Name	Neville Graham
Telephone	082 499 3302
E-mail	neville@numeral.co.za

Why we process your information

We collect, hold, use and disclose your personal information mainly to give you access to our products and services. We will only process your information for purposes you would reasonably expect, including to:

provide you with the advice, products and services you have requested;
verify your identity and conduct credit reference checks;
issue, administer and manage your insurance policies;
process insurance claims and take recovery action;
tell you about new products or developments that may interest you;
confirm, verify and update your details; and
comply with legal and regulatory requirements.

The information we hold may include your first and last name, e-mail address, home, postal or other physical address, other contact details, title, date of birth, gender, occupation, qualifications, employment history, residency status, investments, assets, liabilities, insurance, income, expenditure, family history, medical information and banking details.

Sharing your information

We may need to share your information to provide the advice, reports, analyses, products or services you have requested. Where we do, we will take all reasonable precautions to ensure that the third party protects your information to the same standard we do. Your information may be hosted on servers managed by a third-party service provider, which may be located outside South Africa.

You may withdraw your consent at any time by contacting our Information Officer.

Consent
I authorise and consent to the organisation sharing my personal information with the following persons:

Name and surname
Signature
Date