Privacy Policy

1 Objectives of this Policy

The Protection of Personal Information Act 4 of 2013 (referred to as POPIA) establishes the rights of natural and juristic persons (Data Subjects) who/which are the owners of Personal Information, and the duties of organisations (Responsible Parties) that collect, process, use, retain, and dispose of that Personal Information.

This policy defines the responsibilities of Promotion ZA (Pty) Ltd trading as PromoLink (as a Responsible Party) that processes Personal Information from Data Subjects in South Africa in the course of normal business dealings. The policy regulates the acquisition, use, and retention of the Data Subject’s information including:

1. The supply of Personal Information by a Data Subject; and
2. The collection, processing, evaluation, use, disclosure, retention, and disposal of the Data Subject’s Personal Information by the Company.

Processing of Special Personal Information (apart from the information referring to a child) is prohibited (Section 26 POPIA). Unless a general authorisation, alternatively a specific authorisation relating to the different types of Special Personal Information applies, the Company is prohibited from processing Special Personal Information.

* Special Personal Information is information concerning: the religious or philosophical beliefs, race or ethnic origin, trade union membership, political persuasion, health or sex life or biometric information of the Data Subject, or the criminal behaviour of the Data Subject.

Business information shared by the Company and clients or business partners will, in addition to POPIA, be protected by contracts containing agreed confidentiality provisions.

2 Legislative Source

2.1 In its dealings with a Data Subject, a Responsible Party has to comply with the Constitution of the Republic of South Africa Act 108 of 1996.

2.2 Personal Information is protected by the right to privacy, which ranks together with such fundamental rights as the right to life, equality, and freedom of religion, belief, and opinion. The Constitution of South Africa, which is our most important and overriding law, states in Chapter 2 (The Bill of Rights), Section 14 that everyone has the right to privacy:

“Everyone has the right to privacy, which includes the right not to have—
(a) their person or home searched;
(b) their property searched;
(c) their possessions seized; or
(d) the privacy of their communications infringed.”

3 Application

3.1 POPIA applies to Responsible Parties and Operators processing Personal Information in South Africa, and to transmission of Personal Information outside of South Africa by those persons. The privacy legislation of another country may apply to cross-border transfers in addition to POPIA.

POPIA is the specific legislation that is in harmony with international standards and embodies the principles of Section 14 of the Constitution. POPIA regulates the way in which Personal Information may be processed by public and private bodies by prescribing the minimum requirements for lawful processing.

POPIA recognises that: “the right to privacy includes a right to protection against the unlawful collection, retention, dissemination and use of personal information” and the State must respect, protect, promote, and fulfil the rights in the Bill of Rights. POPIA has established the office of the Information Regulator to provide education, compliance monitoring, consultation, and complaints adjudication.

3.2 POPIA applies to a Responsible Party domiciled in South Africa and a Responsible Party not domiciled in South Africa that makes use of automated or non-automated means in South Africa, unless the means are used only as a conduit to forward information through the Republic (Section 3(1)(b) POPIA).

4 Definitions

4.1 Statutory Definitions under POPIA:

4.1.2 Scope of Personal Information: POPIA protects both natural and juristic persons. POPIA defines Personal Information as information relating to an identifiable living person or existing juristic person, including but not limited to:

• Information relating to race, gender, sex, pregnancy, marital status, national/ethnic/social origin, colour, sexual orientation, age, physical/mental health, disability, religion, conscience, belief, culture, language, and birth;
• Information relating to the education, medical, financial, criminal, or employment history of the person;
• Any identifying number, symbol, email address, physical address, telephone number, location information, online identifier, or other assigned identifier;
• The biometric information of the person (where expressly permitted and consented);
• Personal opinions, views, or preferences;
• Correspondence sent by the person that is implicitly or explicitly private/confidential, or further correspondence revealing the original contents;
• The views or opinions of another individual about the person (e.g. agency ratings, reliability feedback); and
• The name of the person if it appears with other personal information relating to the person or if disclosure would reveal information about the person.

6 Rights of the Data Subject

Under Section 5 of POPIA, all Data Subjects have the right:

• To be notified that personal information is being collected or that information has been accessed or acquired by an unauthorized person;
• To establish whether PromoLink holds personal information and request reasonable access to that information;
• To request where necessary the correction, destruction, or deletion of personal information;
• To object on reasonable grounds to the processing of personal information;
• To object to the processing of personal information for direct marketing;
• Not to have personal information processed for direct marketing by means of unsolicited electronic communications without consent;
• Not to be subject to decisions based solely on automated processing intended to create a profile, where such decision produces legal effects;
• To submit a formal complaint to the Information Regulator; and
• To institute civil proceedings regarding alleged interference with the protection of their personal information.

7 Direct Marketing & Directories

Processing of Personal Information for direct marketing is prohibited unless the Data Subject has given prior consent, or is an existing customer approached in the context of PromoLink's brand activation services.

Every marketing communication includes an immediate, free, and simple opt-out/unsubscribe mechanism. Any public promoter directory or search catalogue requires explicit promoter opt-in prior to listing.