EXPAND LIVE (PTY) LTD
PROTECTION OF
PERSONAL INFORMATION
AND PRIVACY POLICY FRAMEWORK
1. WHAT IS THE PURPOSE OF THIS FRAMEWORK?
1.1 The purpose of this Protection of Personal Information and Privacy Framework
(“Framework”) is to inform data subjects about the type/s of personal information that we,
Expand Live (Pty) Ltd (hereinafter collectively referred to as “Expand”, “we” or “us”)
processes by collecting or collating, receiving, recording, storing, updating, distributing,
erasing or destroying, using and disclosing such Personal Information (which is explained in
paragraph 3 below). In this Framework, data subjects include any private, public, juristic or
natural persons which includes customers, suppliers, contractors, subcontractors,
associates, consultants, job applicants, users of our products and services, prospects,
partners, users of our websites or clients (“you” or “your”) of Expand.
1.2 This Framework explains how we process your Personal Information, the choices you
have regarding its use and disclosure, and how you may correct the Personal Information,
which we have on record for you.
1.3 We are proud to demonstrate our commitment to your privacy, by complying with the
laws and regulations under applicable privacy laws in South Africa, specifically the
Protection of Personal Information Act, No 4 of 2013. We may, from time to time, make
changes to this Framework. We will treat Personal Information in a manner consistent with
this Framework under which it was collected, unless we have your consent to treat it
differently. This Framework applies to any information we collect or receive about you, from
any source.
1.4 Expand recognizes its obligations to its customers and community to adhere to the
highest standards of decency, fairness and integrity in all its operations. Likewise, Expand is
dedicated to the fundamentals of protecting consumer privacy.
2 TO WHOM DOES THIS FRAMEWORK APPLY?
This Framework applies to the processing of your Personal Information by Expand and its
subsidiaries and affiliates.
3 WHAT IS PERSONAL INFORMATION?
Personal information, for the purposes of this Framework, is any form of information that is
identifiable with you. This information may include but is not limited to your name, race,
gender, pregnancy, marital status, mailing address, phone number, email address, business
facsimile number, education, employment history, and your financial history (such as your
credit history, credit facilities, and shares).
4 HOW DO WE COLLECT YOUR PERSONAL INFORMATION?
4.1 We will always collect your Personal Information by fair, lawful and reasonable means
ensuring that we protect your privacy. We will ensure that we only collect and use your
Personal Information based on legitimate grounds and that your Personal Information is handled and processed in a way that you would reasonably expect and in a way that does not adversely affect you.
4.2 We may collect Personal Information directly from you or from third parties, where we
have obtained your consent to do so or as otherwise permitted by law such as where it is
contained in a public record or has been made public by you or where collecting your
Personal Information from a third party would not prejudice any of your legitimate interests.
5 WHEN AND HOW DO WE OBTAIN YOUR CONSENT?
5.1 We obtain your consent prior to collecting or prior to using or disclosing your Personal
Information for any purpose, unless we are otherwise permitted to do so without your
consent including to carry out actions in relation to the conclusion or performance of a
contract to which you are a party (such as a purchasing or supply agreement or an
advertising agreement or subcontractor agreement or lease agreement). You may provide
your consent to us either electronically or in writing.
5.2 We will inform and make clear to you from the outset the manner and reason for which
your Personal Information will be processed before we obtain your consent to process it.
You may withdraw your consent or object to our processing of your Personal Information at
any time by contacting us using the contact details provided in paragraph 20 below.
However, your withdrawal of consent or objecting to our processing of your Personal
Information are not absolute rights and we may have legal or legitimate grounds not to
uphold or give effect to your withdrawal of consent or objection to processing.
5.3 Further, by visiting our website you agree to us:
5.3.1 collecting operational information, including through reliance on “cookies”, such as the
pages you access or visit, your IP address, your domain name, the last URL you visited
before clicking to our site, and your browser and platform type (e.g., a Netscape browser on
a Macintosh computer). This information may be used to measure usage, number of visits,
average time spent on the site, pages viewed, etc., and to improve the content of our site.
None of the aforegoing would allow us or a third party to identify you or contact you. It is
used for internal review only and not shared with other organizations for commercial
purposes without first providing notification to you; and
5.3.2 using links that allow visitors to contact us via e-mail for a variety of purposes. We
cannot guarantee or warrant the security of any data you submit to us. Except for human
resources information, we shall treat any data or information transmitted to us through this
site as non-confidential and non-proprietary. We may elect to save such information, share it
with third parties, or discard it entirely. However, we will use reasonable efforts to treat as
confidential any e-mails, resumes, applications or inquiries sent to us for purpose of inquiring
into potential employment with us. Any e-mail, resume or submission you send to us will be
used only for internal purposes. Please be aware that submission of your resume or
application may not be considered, and we are under no obligation to respond to such
solicitations. We are an equal opportunity employer.
5.4 We do not collect personal information from children under the age of 13. Guests who
are 13 to 17 years of age should seek parental consent before providing any personally
information on our website. We do not collect personal or corporate e-mail addresses, or any
personally identifiable information on visitors to our website, without your permission.
6 WHERE DO WE STORE YOUR PERSONAL INFORMATION?
We will keep the Personal Information that we collect from you on site, at our offices at 2
Federation Road, Parktown, Johannesburg, as well as off site. Our service providers, which
include data storage and processing providers operating both in the Republic of South Africa
and in certain instances, outside of the Republic of South Africa, may, from time to time, also
hold your Personal Information in connection with purposes for which you provided your
consent. We will ensure that any data processors that we utilise to deal with or process your
Personal Information comply with the provisions of this Framework.
7 HOW DO WE USE YOUR PERSONAL INFORMATION?
7.1 We identify the purposes for which we use your Personal Information at the time we
collect such information from you.
7.2 We will only collect your Personal Information for a specific, lawful and clear purpose of
which we will inform you as far as possible prior to when such processing occurs. We will
ensure that your consent to such processing will relate only to the purpose for which you
have been made aware and we will not process your Personal Information for any other
purpose.
7.3 We generally use your Personal Information and process it for the following purposes:
7.3.1 for the purpose of providing services or products you request or obtaining services or
products from you;
7.3.2 to respond to an e-mail that you have sent to us by return e-mail of if e-mail is
unsuccessful, by phone;
7.3.3 to contact you from time to time, where you have specifically consented to follow-up
contacts by Expand or its subsidiaries or affiliates or clients to be put on our mailing list to
receive our newsletters, daily push messages and other commercial information from us;
7.3.4 when you subscribe to one of our services;
7.3.5 when you browse our websites;
7.3.6 when you participate in events or public relations activities organised by us;
7.3.7 when you wish to apply for a job at Expand;
7.3.8 when you wish to get in touch with us to ask us a question or make a complaint;
7.3.9 for such other purposes to which you may consent from time to time; and
7.3.10 for such other uses authorised by law.
7.4 In this context, Personal Information we collect and process could include:
7.4.1 Your identity: surname, name, preferred form of address (Mr./Mrs./Ms.), identification
numbers, date of birth, whenever necessary;
7.4.2 Your contact details: email, phone number, mobile number;
7.4.3 Your identifiers (in case you create an account upon subscription to a service):
subscriber number, secret code;
7.4.4 Your transactions and payment information: details of the transaction, bank cheque,
bank account information;
7.4.5 Your job application information: CV, motivation letter and interview notes;
7.4.6 Your technical and browsing information on our websites. When browsing our
websites, cookies can be placed on your web browser to enable you, in particular, to benefit
from optimal browsing. Cookies are data stored on the terminal equipment of an internet
user. Our websites use cookies to send information to the user’s browser, enabling the
browser to pass data back to the original website (for instance, a session ID, language
preference or a date). Other types of trackers, such as Web beacons, can also be used.
These beacons make calls to servers to display a pixel and enable us to share data with
third parties for the purposes described in our cookie policies which is set out above.
7.4.7 Any other information you directly and voluntarily provide to us in the course of your
use of our websites, services and any contracts you may enter into with us.
8 DO WE USE YOUR PERSONAL INFORMATION FOR DIRECT MARKETING
PURPOSES?
8.1 We only use your Personal Information to contact you from time-to-time where you have
consented to us doing so.
8.2 We may also use your Personal Information to contact you and market our or our
partners, affiliates and client’s products directly to you. If you are an existing user, we will
only use your Personal Information if we obtained it in relation to similar products and
services to the ones, we previously provided to you.
8.3 We will ensure that you are given a reasonable opportunity to object to the use of your
Personal Information for our marketing purposes when we collect your Personal Information.
9 WHAT IS SPECIAL PERSONAL INFORMATION AND WHEN DO WE PROCESS IT?
Special Personal Information is sensitive Personal Information that may relate to your race
or ethnic origin, trade union membership or criminal behaviour. We only process special
Personal Information if (i) you have expressly consented to such processing; (ii) our
processing of such information is necessary in terms of law or in order for us to exercise or
defend a legal claim; or (iii) the processing is for historical or statistical purposes.
10 HOW LONG WILL WE UTILISE OR RETAIN YOUR PERSONAL INFORMATION?
10.1 We may keep a record of your Personal Information, correspondence or comments on
file. We will utilise, disclose or retain your Personal Information for as long as necessary to
fulfil the purposes for which that Personal Information was collected and as permitted or
required by law.
10.2 We may retain your Personal Information for longer periods for statistical, historical or
research purposes and should this occur, we will ensure that appropriate safeguards have
been put in place to ensure that your recorded Personal Information is not processed for any
other purpose.
10.3 Once the purpose for which your Personal Information was obtained no longer applies
or becomes obsolete, we will ensure that it is deleted or destroyed or de-identified so that it
can no longer be ascribed to you.
11 TO WHOM DO WE PROVIDE YOUR PERSONAL INFORMATION?
11.1 We identify to whom, and for what purpose, we disclose your Personal Information, at
the time we collect such information from you and obtain your consent to such disclosure.
11.2 We may disclose your Personal Information to third party service providers with whom
we have contractual agreements in place that include appropriate privacy standards. Such
third parties may be assisting us with the purposes listed above for example, service
providers may be used to provide telephone support, marketing, assist in the completion of
orders, notify you of any contests or special offers, and for data storage and backups. We
will only make disclosures of Personal Information to such persons or third parties for which
you provide your consent.
11.3 We may also make disclosures of Personal Information to a potential acquirer in
connection with a transaction involving the sale of business of Expand or as otherwise
permitted or required by law.
11.4 In addition, we may send Personal Information outside of the jurisdiction in which it is
collected for the above purposes, including for processing and storage by service providers
in connection with such purposes. You should note that while your Personal Information is
out of that jurisdiction, it is subject to the laws of the country in which it is held, and may be
subject to disclosure to the governments, courts or law enforcement or regulatory agencies
of such other country, pursuant to the laws of such country.
11.5 Expand can provide access to your Personal Information to the companies of its group,
to local government authorities or bodies, to its partners, and to its possible third-party
service providers, acting as operators, for the provision of services in connection with
Expand’s services and IT applications (such as hosting, storage, analytical, data processing,
database management or IT maintenance services). These third-party providers will act only
on the instructions of Expand and will only have access to your Personal Information to
achieve the purposes pursued upon collection of such data and shall be under the same
security and confidentiality obligations as Expand.
11.6 We may also disclose your Personal Information:
11.6.1 in the context of a merger or acquisition of all or part of Expand by a third party;
11.6.2 in response to legal or administrative proceedings of any kind or enforcement
measures requested by competent authorities; and
11.6.3 to comply with legal obligations, protect the rights and/or safety of an individual,
protect the rights and property of Expand, including the need to ensure that this Framework
is respected and to prevent any technical, security or fraud related issues.
12 HOW DO WE ENSURE THE PRIVACY OF YOUR PERSONAL INFORMATION WHEN
DEALING WITH OUR AFFILIATES, SUBSIDIARIES AND OTHER THIRD PARTIES?
We ensure that all affiliates, subsidiaries and other third parties that are retained to perform
services on our behalf and are provided with Personal Information are required to comply
with this Framework and our privacy practices.
13 HOW CAN YOU REVIEW YOUR PERSONAL INFORMATION THAT WE HAVE
COLLECTED, UTILISED OR DISCLOSED?
If you make a written request to review any Personal Information about you that we have
collected, utilised or disclosed, we will provide you with any such Personal Information to the
extent required by law. We will make such Personal Information available to you in a form
that is generally understandable, and will explain any abbreviations.
14 HOW DO YOU KNOW THAT THE PERSONAL INFORMATION WE HAVE ON YOU IS
ACCURATE?
We will ensure that your Personal Information is kept as accurate, complete and up-to-date
to the extent reasonably possible. We will not routinely update your Personal Information,
unless such a process is necessary. We expect you, from time to time, to supply us with
updates to your Personal Information, when required.
15 WHAT IF THE PERSONAL INFORMATION WE HAVE ON YOU IS INACCURATE?
At any time, you can challenge the accuracy or completeness of your Personal Information
in our records to the extent required by law. If you successfully demonstrate that your
Personal Information in our records is inaccurate or incomplete, we will amend or delete the
Personal Information as required. Where appropriate, we will transmit the amended or
deleted information to third parties having access to your Personal Information.
16 HOW FAST WILL WE RESPOND TO YOUR WRITTEN REQUESTS?
We will attempt to respond to each of your written requests not later than 30 days after
receipt of such requests. You have the right to make a complaint to us in respect of this time
limit by contacting us using the contact details provided in paragraph 20 below.
17 ARE THERE ANY COSTS TO YOU FOR REQUESTING INFORMATION ABOUT YOUR
PERSONAL INFORMATION OR THIS FRAMEWORK?
We will not charge any fees for you to access your Personal Information in our records or in
terms of this Framework or practices without first providing you with an estimate of the
approximate costs, if any. You may withdraw your request for access to information by
notifying us within the 30-day notice period disclosed on the estimate. If you do not notify us
within such 30-day period, we will send you a further notice indicating that you will be
deemed to have withdrawn your request for access unless you advise us otherwise within 30
days. If, after the expiry of this second 30-day period, you have not so advised us, we will
deem your request to have been withdrawn and provide you with written notice to that effect.
18 HOW DO WE KNOW THAT IT IS REALLY YOU REQUESTING YOUR PERSONAL
INFORMATION?
We may request that you provide sufficient identification to permit access to the existence,
use or disclosure of your Personal Information. Any such identifying information shall be
used only for this purpose.
19 WHAT SAFEGUARDS HAVE WE IMPLEMENTED TO PROTECT YOUR PERSONAL
INFORMATION?
19.1 We have implemented physical, organisational, contractual and technological security
measures to protect your Personal Information from loss or theft, unauthorised access,
disclosure, copying, use or modification. The only employees who are granted access to
your Personal Information are those with a business 'need-to-know' or whose duties
reasonably require such information.
19.2 We will provide you and the information protection regulator with detailed written
notification should there be a security breach or a reasonable belief of a security breach
which allows unauthorised persons to access your Personal Information. We will provide
such notification as soon as reasonably possible after we discover a security compromise.
20 HOW DO YOU CONTACT US REGARDING ACCESS TO YOUR PERSONAL
INFORMATION?
All comments, questions, concerns or complaints regarding your Personal Information or this
Framework, should be forwarded to us as follows:
Attention: The Information Officer
Per email: [email protected]
21 CHANGES TO FRAMEWORK
21.1 We may update this Framework at any time to reflect possible new practices and
service offers. In such case, the date of the Framework will be updated and indicate the date
when such changes were made.
21.2 We invite you to check for any possible updates of this Framework, which will be
published on our website.
21.3 If we make any changes, we consider substantial, you will be informed by a notice
posted on our website.
22 LINKS TO THIRD PARTY WEBSITES
22.1 While browsing our websites, you may come across content containing links to third-
party applications and websites. Expand has no control over the cookies or other functions
used by such third-party applications and websites, and any Personal Information
processing that may be implemented by such applications and websites are not governed by
this Framework.
22.2 Accordingly, it is up to you to directly contact and/or visit such third-party applications
and websites to obtain further information on their data protection guidelines.