Privacy Policy

Overview

The Protection of Personal Information Act, 2013 ("POPI") came into complete commencement on 1 July 2021. In this regard, EXSA (PTY) LTD has a number of obligations and duties in terms of POPI that it must comply with. The protection of personal information is treated as a high priority and steps have been taken to ensure that personal information is protected and remains private.

In addition to serving as a privacy policy, this document also serves as a data subject notification as contemplated in section 18 of POPI. It explains what personal information is collected, why it is collected, how it is used, and what safety measures are in place to protect it.

Where this policy refers to "process", it means how personal information is collected, used, stored, made available, destroyed, updated, disclosed, or otherwise dealt with. As a general rule, personal information will only be processed where this is required to deliver or offer a service, provide a product, or carry out a transaction.

Personal information may be combined and used for any of the purposes stated in this policy. In this document, any reference to "we", "us", or "our" means EXSA (PTY) LTD.

If you use EXSA services, goods, and/or products, you agree that EXSA may process your personal information as explained in this policy.

What is personal information?

Personal information refers to any information that identifies you or specifically relates to you. It includes, but is not limited to, the following:

Is the supply of personal information voluntary or mandatory?

The supply of certain personal information is mandatory, meaning it must be collected by law. If that information is not supplied, EXSA cannot comply with its legal obligations and may be unable to do business with you.

EXSA collects personal information as required by legislation including:

• Basic Conditions of Employment Act, No 75 of 1997
• Continuing Education and Training Act 16 of 2006
• Compensation for Occupational Injuries and Diseases Act, No. 130 of 1993
• Credit Agreement Act, No. 75 of 1980
• Criminal Procedure Act, No. 51 of 1977
• Debt Collectors Act, No. 114 of 1998
• Employment Equity Act, No. 55 of 1998
• Financial Intelligence Centre Act, No. 38 of 2001
• Financial Advisory and Intermediary Service Act, No. 37 of 2002
• Higher Education Act 101 of 1997
• Income Tax Act 58 of 1962
• Labour Relations Act, No 66 of 1995
• National Credit Act, No. 34 of 2005
• NQF Act No 67 of 2008
• Occupational Health and Safety Act No. 85 of 1993
• Pension Funds Act, No. 24 of 1956
• Prevention of Organised Crime Act No. 121 of 1998
• Skills Development Act 97 of 1998
• Unemployment Insurance Act, No. 63 of 2001

In other instances, the supply of personal information is voluntary, meaning there is no law that compels the collection of that information. Even where no law imposes collection, EXSA may still require it in order to deliver products and/or services. If the information is not supplied, EXSA may be unable to do business with you.

When will personal information be processed?

Personal information will only be processed for lawful purposes relating to the business where one or more of the following apply:

• You have consented.
• A person legally authorised by you, the law, or a court has consented.
• It is necessary to conclude or perform under a contract with you.
• The law requires or permits it.
• It is required to protect or pursue your, EXSA's, or a third party's legitimate interest.

What is special personal information?

Special personal information includes personal information about the following:

When will special personal information be processed?

• You have consented to the processing.
• The information is used for a human resource or payroll requirement.
• The processing is needed to create, use, or protect a right or obligation in law.
• The processing is for statistical or research purposes and all legal conditions are met.
• The special personal information was made public by you.
• The processing is required by law.
• Racial information is processed to identify you, or health information is processed to determine insurance risk, comply with an insurance policy, or enforce an insurance right or obligation.

When and from where may personal information be obtained?

EXSA may collect personal information about you from the following sources:

• Directly from you.
• From a public record.
• From an area where you have deliberately made it public.
• From your use of products, services, or service channels.
• From how you engage or interact with EXSA, including support desks, emails, letters, telephone calls, and surveys.
• From a third party.
• From another source where you have given consent.

If the law requires it, consent will be requested before collecting personal information from third parties.

Third parties may include, but are not limited to, the following:

• Partners of the company for any of the purposes identified in this policy.
• Your spouse, dependents, partners, employer, and similar sources.
• Attorneys, tracing agents, debt collectors, and others assisting with the enforcement of agreements.
• Payment processing service providers, merchants, banks, and others assisting with payment instructions and EFT transaction processing.
• Insurers, brokers, financial institutions, and organisations assisting with underwriting, policies, products, and claims.
• Law enforcement and fraud prevention agencies and others tasked with the prevention and prosecution of crime.
• Regulatory authorities, industry ombudsman, governmental departments, and local and international tax authorities.
• Trustees, executors, or curators appointed by a court of law.
• Service providers, agents, and sub-contractors such as couriers and others used to provide products and services.
• Courts of law or tribunals.

Reasons personal information may be processed

• To provide products, goods, and services.
• To market products, goods, and services.
• To respond to enquiries and complaints.
• To comply with legislative, regulatory, risk, and compliance requirements.
• To conduct market and behavioural research, including scoring and analysis.
• To develop, test, and improve products and services.
• For historical, statistical, and research purposes.
• To process payment instruments.
• To create, manufacture, and print payment issues such as payslips.
• To deliver goods, documents, or notices.
• For security, identity verification, and accuracy checks.
• To communicate and carry out instructions and requests.
• For customer satisfaction surveys and promotional offerings.
• For insurance and assurance underwriting and administration.
• To process, consider, or assess insurance or assurance claims.
• To provide insurance and assurance policies, products, and related services.
• To support loyalty rewards, value-added products, and related services.
• To assess lending and insurance risks.
• For any other related purposes.

How personal information is used for marketing

• Personal information may be used to market products and services.
• Marketing may be done in person, by post, telephone, or electronic channels such as SMS, email, and fax.
• If you are not a customer, or where the law requires it, electronic marketing will only be sent with your consent.
• You can request that marketing communications stop at any time.

When, how, and with whom personal information may be shared

In general, personal information will only be shared where one or more of the following apply:

• You have consented.
• It is necessary to conclude or perform under a contract with you.
• The law requires it.
• It is necessary to protect or pursue your, EXSA's, or a third party's legitimate interest.

Transfers to other countries

Personal information will only be transferred to third parties in another country where one or more of the following apply:

• The information will be adequately protected under the other country's laws or an agreement with the third-party recipient.
• The transfer is necessary to enter into or perform under a contract with you, or a contract with a third party that is in your interest.
• You have consented to the transfer.
• It is not reasonably practical to obtain your consent, but the transfer is in your interest.

Any such transfer will take place within the requirements and safeguards of the law. Where possible, the receiving party will apply the same level of protection available by law in your country, or the higher standard available in the receiving country where that offers better protection.

How personal information is secured

Appropriate and reasonable technical and organisational steps will be taken to protect personal information according to industry best practices. Security measures, including physical, technological, and procedural safeguards, will be appropriate and reasonable.

• Keeping systems secure, including monitoring access and usage.
• Storing records securely.
• Controlling access to buildings, systems, and records.
• Safely destroying or deleting records.
• Ensuring compliance with best practice standards.

How long personal information is kept

Personal information may be kept for as long as:

• The law requires it.
• A contract between you and EXSA requires it.
• You have consented to it being kept.
• It is required to achieve the purposes listed in this policy.
• It is required for statistical or research purposes.
• A code of conduct requires it.
• It is required for lawful business purposes.

Personal information may also be retained even after the relationship has ended where historical data may still be required by an employer or employee.

Cookie policy

A cookie is a small piece of data sent from websites or applications to your computer, device hard drive, or internet browser where it is saved. Cookies contain information that personalises your experience and may improve how websites or applications function for you. They can also identify your device, such as a computer or smartphone.

By using the relevant websites or applications, you agree that cookies may be forwarded to your computer or device. Cookies help identify that you have visited the site or application before and may also be used for fraud prevention and analytics.

Your duties and rights

• You must provide proof of identity when enforcing the rights below.
• You must inform EXSA when your personal information changes.
• You should contact the Information Officer to give effect to any of these rights.

You have the right to request access to the personal information held about you, including:

• Confirmation that EXSA holds your personal information.
• A copy or description of the record containing your personal information.
• The identity or categories of third parties who have had access to your personal information.

Requests for access will be attended to within a reasonable time. A reasonable fee may be charged for copies, descriptions of records, or information about third parties, and the fee will be communicated before the request is processed.

The law may limit your right to access information. You may also request correction or deletion of personal information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading, obtained unlawfully, or no longer authorised to be kept. Requests must be made in writing and may take up to 15 business days to reflect on systems. Supporting documents may be required.

If the law requires EXSA to keep the personal information, it will not be deleted on request. Deleting certain personal information may also lead to the termination of the business relationship.

You may object on reasonable grounds to the processing of personal information. However, an objection cannot be given effect where the processing is permitted by law, done according to consent already provided, or necessary to conclude or perform under a contract with you.

Where consent has been provided, you may withdraw it. EXSA may still continue processing if the law permits or requires it. Changes may take up to 15 business days to reflect on systems, and objections must be submitted in writing.

You also have the right to file a complaint with EXSA or with any Regulator that has jurisdiction regarding an alleged contravention relating to the protection of your personal information.

Information Regulator contact details

How to get in touch

For queries in relation to this policy or the processing of personal information in general, you can contact the Information Officer and/or Deputy Information Officer using the details below.