Privacy Policy

SBV SERVICES (PTY) LTD (“SBV”) PRIVACY NOTICE TO PROCESS PERSONAL INFORMATION

In terms of the protection of information act, 4 0f 2013 (popia)

1. INTRODUCTION

As part of managing the business, SBV is required, in certain instances, to process personal information. Accordingly, SBV is required to protect the personal information as set out in the Protection of Personal Information Act 4 of 2013, including its Regulations (POPI Act). This notice constitutes SBV’s policy statement to declare its commitment to comply with the POPI Act. Accordingly, it provides insights on how SBV processes personal information of data subjects as set out in the POPI Act. SBV shall ensure that personal information is processed within the parameters of the law. This notice must be read in conjunction with the POPI Act and its Regulations, where applicable.

2. OBJECTIVE

The objective of this notice is to give effect to the POPI Act and to provide clarity on the following:

2.1 What personal information SBV collects about a data subject and the basis thereof;

2.2 How SBV uses and protects the personal information of a data subject;

2.3 How long SBV keeps the personal information of a data subject;

2.4 The rights of a data subject regarding their personal information; and

2.5 What the data subject should do if he/ she does not want to provide SBV with his/her personal information.

3. INTERPRETATION AND DEFINITIONS IN THIS NOTICE

3.1 Clause headings are for convenience and reference only and shall not be used in the interpretation thereof.

3.2 Any gender includes the other genders and a natural person includes a juristic person and vice versa;

3.3 The following words and/or expressions shall, unless the context indicates otherwise, bear the meaning assigned to them below and in the POPI Act;

• “Cookie/s” (also called web cookie, Internet cookie, browser cookie, or simply cookie) are alphanumeric identifiers that SBV transfers to a computer’s hard drive through a web browser to enable the SBV systems to recognise a data subject’s browser and to automatically collect information from the computer such as the IP address and other details about the computer which are automatically collected by our web server, operating system and browser type, for system administration and to report aggregate information to SBV.

• “Data subject” means the person to whom Personal information relates.

• “Employee” means a permanent, fixed term or temporary employee of SBV.

• “Operator” means a third party that processes Personal information in terms of a mandate or contract with SBV without coming under the direct authority of SBV.

• “Information officer” means the person appointed by SBV, from time to time, who is responsible for the monitoring of POPI compliance, by SBV, with the conditions for the lawful processing of Personal information; dealing with requests made to SBV in terms of the POPI Act; working with the Regulator in relation to investigations conducted in relation to prior authorisation by the Data subject and ensuring compliance by SBV with the provisions of the POPI Act.

• “Person” means any person, company, close corporation, trust, partnership or other entity.

• “Personal information” means information relating to an identifiable, living, natural person, and where it is applicable, an identifiable, existing juristic person, including, but not limited to:

– information relating to the race, gender, sex, pregnancy, marital status, national, ethnic or social origin, colour, sexual orientation, age, physical or mental health, well-being, disability, religion, conscience, belief, culture, language and birth of the person;

– information relating to the educational, medical, financial, criminal or employment history of the person;

– any identifying number, symbol, e-mail address, physical address, telephone number, location information, online identifier or other particular assignment to the person.

– the biometric information of employees, contractors and certain third parties.

– the personal opinions, views or preferences of the person.

– correspondence sent by the person that is implicitly or explicitly of a private or confidential nature or further correspondence that would reveal the contents of the original correspondence.

– the views or opinions of another individual about the person; and

– the name of the person if it appears with other Personal information relating to the person or if the disclosure of the name itself would reveal information about the person.

• “Privacy Notice or Notice” means this Notice as amended from time to time.

• “Processing” means any operation or activity or any set of operations, whether or not by automatic means, concerning Personal information, including —

– the collection, receipt, recording, organisation, collation, storage, updating or modification, retrieval, alteration, consultation or use;

– dissemination by means of transmission, distribution or making available in any other form; or

– merging, linking, as well as restriction, degradation, erasure or destruction of information.

4. PROCESSING OF PERSONAL INFORMATION

4.1 Personal information SBV collects about a data subject and the basis thereof is for purpose of ordinary course of business and includes:

• only information that is adequate, necessary, and relevant to enable it to effectively render a service or assist in any manner required, such as the Data subject’s name, identity number (where applicable), registration number, Data subject’s employees or its director’s Personal information, contact information etc;

• electronic communications sent to SBV;

• information submitted to SBV in response to a vacancy advertisement;

• technical information, for instance through the use of cookies.

• social media tracking pixels that allow platforms such as Facebook and X to interact with the SBV website and give feedback on the Data subject’s actions;

• Device information, including the unique device identifier, hardware model, operating system and version and mobile network information;

• Personal information that SBV collects when it monitors other websites may include the Data subject’s public Personal information, for example when SBV monitors digital conversations on public platforms to understand what people are saying about it or the industry in general. SBV may combine information that it has about a Data subject from various sources; and

• The SBV website uses various technologies including “cookies” and this is mere statistical data about SBV’s users’ browsing actions and patterns and does not identify any individual.

4.2 Protecting the Data subject’s Personal information

• SBV uses a variety of security measures and technologies to help protect Personal information of a Data subject from unauthorised access, use, disclosure, alteration or destruction in line with applicable Personal information protection and privacy laws. For example, when SBV shares the Personal information of a Data subject with external suppliers, it shall put in place a written agreement which commits the suppliers to keep the Data subject’s Personal information confidential, and to put in place appropriate security measures to keep it secure.

• Despite the security measures that SBV has in place to protect Personal information of a Data subject (firewalls, password access and encryption methods), the Data subject acknowledges that it may be accessed by an unauthorised third party, e.g. as a result of an illegal activity.

4.3 How does SBV use the Personal information of a Data subject: –

• SBV may use the Personal information of a Data subject only for business related activities, financial results and marketing communications about services.

• Contact and interact with the Data subject, including to:

– respond to requests from the Data subject (for instance in case the Data subject applied for employment); and

– provide important notices and updates, such as security alerts and administrative messages.

• Operate SBV’s business activities, including:

– screening data subjects on SBV premises through CCV footage, conducting searches for dangerous weapons and completing the attendance register for security purposes to ensure that only authorised persons enter the premises of SBV;

– complying with applicable laws, regulations and guidance; and

– complying with demands or requests made by regulators, governments, courts and law enforcement authorities.

– to ensure that SBV has up-to-date contact information for the Data subject, where applicable.

4.4 How long will SBV keep Personal information of a Data subject:

SBV will always keep the Personal information of a Data subject for the period required by law and where it needs to do so in connection with legal action or an investigation in which it is involved. Otherwise, SBV will keep Personal information of a Data subject:

• for as long as needed to provide the Data subject with access to services as requested.

• where the Data subject has contacted SBV with a question or request, for as long as necessary to allow SBV to respond to the question or request and as required by law.

4.5 Instances where sharing of Personal information of a Data subject by SBV is permitted

SBV may share Personal information of a Data subject with the following third parties:

• SBV agents and suppliers, medical aid and administrators and insurers for purpose of business activities;

• SBV’s professional advisors, auditors and business partners;

• Regulators, governments and law enforcement authorities; and

• other third parties in connection with re- organising all or any part of SBV’s business.

4.6 Personal information of a Data subject may be processed by SBV and SBV subsidiary companies outside of the Data subject’s home country.

Personal information laws in the countries to which the Personal information of a Data subject is transferred may not be equivalent to, or as protective as, the laws in the Data subject’s home country.

SBV has implemented appropriate and reasonable measures to ensure that the Personal information of a Data subject remains protected and secure when it is transferred outside of the Data subject’s home country, in accordance with applicable Personal information protection and privacy laws.

5. THE DATA SUBJECT’S RIGHTS REGARDING HER / HIS PERSONAL INFORMATION

The Data subject is entitled to:

• Request SBV for access to Personal information SBV holds about her / him;

• Request the correction and/or deletion of her / his Personal information;

• Request the restriction of the processing of her / his Personal information, or object to that processing;

• Withdraw her / his consent to the processing of her / his Personal information (where SBV is processing her / his Personal information based on consent);

• Complain to her / his local data protection authority if her / his privacy rights are violated, or if she / he has suffered as a result of unlawful processing of her / his Personal information.

6. CHANGES TO THIS NOTICE

SBV’s data protection practices will change from time to time without written notice provided to the Data subject. If and when its protection practices change, SBV will update this Notice to describe its new practices. The Data subject is encouraged to check it regularly.

7. CONTACTS

For any questions or requests regarding this Notice or if a Data subject would like to exercise her / his rights including contacting the Information Officer, please use the following contact information:

Name: Shalin Pillai – Information Officer Tel: 082 771 5588

Email: shalinp@sbv.co.za

Fax number: 011 283 2000

Information Officer email: popi@sbv.co.za

For any complaints, please use the following contact information:

The Information Regulator of South Africa is based at:

JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001

P.O Box 31533, Braamfontein, Johannesburg, 2017

POPIAComplaints.IR@justice.gov.za and PAIAComplaints.IR.@justice.gov.za

General enquiries email: inforeg@justice.gov.za