EXPAND LIVE (PTY) LTD
PROTECTION OF
PERSONAL INFORMATION
AND PRIVACY POLICY FRAMEWORK
1 WHAT IS THE PURPOSE OF THIS FRAMEWORK?
1.1 The purpose of this Protection of Personal Information and Privacy Framework (“Framework”) is to inform data subjects about the type/s of personal information that we, Expand Live (Pty) Ltd (hereinafter collectively referred to as “Expand”, “we” or “us”) processes by collecting or collating, receiving, recording, storing, updating, distributing, erasing or destroying, using and disclosing such Personal Information (which is explained in paragraph 3 below). In this Framework, data subjects include any private, public, juristic or natural persons which includes customers, suppliers, contractors, subcontractors, associates, consultants, job applicants, users of our products and services, prospects, partners, users of our websites or clients (“you” or “your”) of Expand.
1.2 This Framework explains how we process your Personal Information, the choices you have regarding its use and disclosure, and how you may correct the Personal Information, which we have on record for you.
1.3 We are proud to demonstrate our commitment to your privacy, by complying with the laws and regulations under applicable privacy laws in South Africa, specifically the Protection of Personal Information Act, No 4 of 2013. We may, from time to time, make changes to this Framework. We will treat Personal Information in a manner consistent with this Framework under which it was collected, unless we have your consent to treat it differently. This Framework applies to any information we collect or receive about you, from any source.
1.4 Expand recognizes its obligations to its customers and community to adhere to the highest standards of decency, fairness and integrity in all its operations. Likewise, Expand is dedicated to the fundamentals of protecting consumer privacy.
2 TO WHOM DOES THIS FRAMEWORK APPLY?
This Framework applies to the processing of your Personal Information by Expand and its subsidiaries and affiliates.
3 WHAT IS PERSONAL INFORMATION?
Personal information, for the purposes of this Framework, is any form of information that is identifiable with you. This information may include but is not limited to your name, race, gender, pregnancy, marital status, mailing address, phone number, email address, business facsimile number, education, employment history, and your financial history (such as your credit history, credit facilities, and shares).
4 HOW DO WE COLLECT YOUR PERSONAL INFORMATION?
4.1 We will always collect your Personal Information by fair, lawful and reasonable means ensuring that we protect your privacy. We will ensure that we only collect and use your Personal Information based on legitimate grounds and that your Personal Information is handled and processed in a way that you would reasonably expect and in a way that does not adversely affect you.
4.2 We may collect Personal Information directly from you or from third parties, where we have obtained your consent to do so or as otherwise permitted by law such as where it is contained in a public record or has been made public by you or where collecting your Personal Information from a third party would not prejudice any of your legitimate interests.
5 WHEN AND HOW DO WE OBTAIN YOUR CONSENT?
5.1 We obtain your consent prior to collecting or prior to using or disclosing your Personal Information for any purpose, unless we are otherwise permitted to do so without your consent including to carry out actions in relation to the conclusion or performance of a contract to which you are a party (such as a purchasing or supply agreement or an advertising rental agreement or subcontractor agreement or lease agreement). You may provide your consent to us either electronically or in writing.
5.2 We will inform and make clear to you from the outset the manner and reason for which your Personal Information will be processed before we obtain your consent to processit. You may withdraw your consent or object to our processing of your Personal Information at any time by contacting us using the contact details provided in paragraph 20 below. However, your withdrawal of consent or objecting to our processing of your Personal Information are not absolute rights and we may have legal or legitimate grounds not to uphold or give effect to your withdrawal of consent or objection to processing.
5.3 Further, by visiting our website you agree to us:
5.3.1 collecting operational information, including through reliance on “cookies”, such as the pages you access or visit, your IP address, your domain name, the last URL you visited before clicking to our site, and your browser and platform type (e.g., a Netscape browser on a Macintosh computer). This information may be used to measure usage, number of visits, average time spent on the site, pages viewed, etc., and to improve the content of our site. None of the a foregoing would allow us or a third party to identify you or contact you. It is used for internal review only and not shared with other organizations for commercial purposes without first providing notification to you; and
5.3.2 using links that allow visitors to contact us via e-mail for a variety of purposes. We cannot guarantee or warrant the security of any data you submit to us. Except for human resources information, we shall treat any data or information transmitted to us through this site as non confidential and non-proprietary. We may elect to save such information, share it with third parties, or discard it entirely. However, we will use reasonable efforts to treat as confidential any e-mails, resumes, applications or inquiries sent to us for purpose of inquiring into potential employment with us. Any e-mail, resume or submission you send to us will be used only for internal purposes. Please be aware that submission of your resume or application may not be considered, and we are under no obligation to respond to such solicitations. We are an equal opportunity employer.
5.4 We do not collect personal information from children under the age of 13. Guests who are 13 to 17 years of age should seek parental consent before providing any personally information on our website. We do not collect personal or corporate e-mail addresses, or any personally identifiable information on visitors to our website, without your permission. We do not use our website for any commercial transactions.
6 WHERE DO WE STORE YOUR PERSONAL INFORMATION?
We will keep the Personal Information that we collect from you on site, at our offices at 2 Federation Rd Parktown, Johannesburg, 2193, as well as off site. Our service providers, which include data storage and processing providers operating both in the Republic of South Africa and in certain instances, outside of the Republic of South Africa, may, from time to time, also hold your Personal Information in connection with purposes for which you provided your consent. We will ensure that any data processors that we utilise to deal with or process your Personal Information comply with the provisions of this Framework.
7 HOW DO WE USE YOUR PERSONAL INFORMATION?
7.1 We identify the purposes for which we use your Personal Information at the time we collect such information from you.
7.2 We will only collect your Personal Information for a specific, lawful and clear purpose of which we will inform you as far as possible prior to when such processing occurs. We will ensure that your consent to such processing will relate only to the purpose for which you have been made aware and we will not process your Personal Information for any other purpose.
7.3 We generally use your Personal Information and process it for the following purposes:
7.3.1 for the purpose of providing services or products you request or obtaining services or products from you;
7.3.2 to respond to an e-mail that you have sent to us by return e-mail of if e-mail is unsuccessful, by phone;
7.3.3 to contact you from time to time, where you have specifically consented to follow-up contacts by Expand or its subsidiaries or affiliates or to be put on our mailing list to receive our newsletters, daily push messages and other commercial information from us;
7.3.4 when you subscribe to one of our services;
7.3.5 when you browse our websites;
7.3.6 when you participate in events or public relations activities organised by us; 7.3.7 when you wish to apply for a job at Expand;
7.3.8 when you wish to get in touch with us to ask us a question or make a complaint; 7.3.9 for such other purposes to which you may consent from time to time; and 7.3.10 for such other uses authorised by law.
7.4 In this context, Personal Information we collect and process could include:
7.4.1 Your identity: surname, name, registration numbers, company statutory information, preferred form of address (Mr./Mrs./Ms.), date of birth, photocopy of your identity card whenever necessary, and your function;
7.4.2 Your contact details: postal address, email, phone number, mobile number, fax number;
7.4.3 Your identifiers (in case you create an account upon subscription to a service): subscriber number, secret code;
7.4.4 Your transactions and payment information: details of the transaction, bank cheque, bank account information;
7.4.5 Your job application information: CV, motivation letter and interview notes;
7.4.6 Your technical and browsing information on our websites. When browsing our websites, cookies can be placed on your web browser to enable you, in particular, to benefit from optimal browsing. Cookies are data stored on the terminal equipment of an internet user. Our websites use cookies to send information to the user’s browser, enabling the browser to pass data back to the original website (for instance, a session ID, language preference or a date). Other types of trackers, such as Web beacons, can also be used. These beacons make calls to servers to display a pixel and enable us to share data with third parties for the purposes described in our cookie policies which is set out above.
7.4.7 Any other information you directly and voluntarily provide to us in the course of your use of our websites, services and any contracts you may enter into with us.
8 DO WE USE YOUR PERSONAL INFORMATION FOR DIRECT MARKETING PURPOSES?
8.1 We only use your Personal Information to contact you from time-to-time where you have consented to us doing so. We may also use your Personal Information to contact you and market our products directly to you if you are one of our existing customers. If you are an existing customer, we will only use your Personal Information if we obtained it through a sale of a product or a service to you and only in relation to similar products and services to the ones, we previously provided to you.
8.2 We will ensure that you are given a reasonable opportunity to object to the use of your Personal Information for our marketing purposes when we collect your Personal Information.
9 WHAT IS SPECIAL PERSONAL INFORMATION AND WHEN DO WE PROCESS IT?
Special Personal Information is sensitive Personal Information that may relate to your race or ethnic origin, trade union membership or criminal behaviour. We only process special Personal Information if (i) you have expressly consented to such processing; (ii) our processing of such information is necessary in terms of law or in order for us to exercise or defend a legal claim; or (iii) the processing is for historical or statistical purposes.
10 HOW LONG WILL WE UTILISE OR RETAIN YOUR PERSONAL INFORMATION?
10.1 We may keep a record of your Personal Information, correspondence or comments on file. We will utilise, disclose or retain your Personal Information for as long as necessary to fulfil the purposes for which that Personal Information was collected and as permitted or required by law.
10.2 We may retain your Personal Information for longer periods for statistical, historical or research purposes and should this occur, we will ensure that appropriate safeguards have been put in place to ensure that your recorded Personal Information is not processed for any other purpose.
10.3 Once the purpose for which your Personal Information was obtained no longer applies or becomes obsolete, we will ensure that it is deleted or destroyed or de-identified so that it can no longer be ascribed to you.
11 TO WHOM DO WE PROVIDE YOUR PERSONAL INFORMATION?
11.1 We identify to whom, and for what purpose, we disclose your Personal Information, at the time we collect such information from you and obtain your consent to such disclosure.
11.2 We may disclose your Personal Information to third party service providers with whom we have contractual agreements in place that include appropriate privacy standards. Such third parties may be assisting us with the purposes listed above for example, service providers may be used to provide telephone support, assist in the completion of your orders, notify you of any contests or special offers,
and for data storage and backups. We will only make disclosures of Personal Information to such persons or third parties for which you provide your consent.
11.3 We may also make disclosures of Personal Information to a potential acquirer in connection with a transaction involving the sale of business of Expand or as otherwise permitted or required by law.
11.4 In addition, we may send Personal Information outside of the jurisdiction in which it is collected for the above purposes, including for processing and storage by service providers in connection with such purposes. You should note that while your Personal Information is out of that jurisdiction, it is subject to the laws of the country in which it is held, and may be subject to disclosure to the governments, courts or law enforcement or regulatory agencies of such other country, pursuant to the laws of such country.
11.5 Expand can provide access to your Personal Information to the companies of its group, to local government authorities or bodies, to its partners, including landlords or potential landlords, and to its possible third-party service providers, acting as operators, for the provision of services in connection with Expand’s services and IT applications (such as hosting, storage, analytical, data processing, database management or IT maintenance services). These third-party providers will act only on the instructions of Expand and will only have access to your Personal Information to achieve the purposes pursued upon collection of such data and shall be under the same security and confidentiality obligations as Expand.
11.6 We may also disclose your Personal Information:
11.6.1 in the context of a merger or acquisition of all or part of Expand by a third party;
11.6.2 in response to legal or administrative proceedings of any kind or enforcement measures requested by competent authorities; and
11.6.3 to comply with legal obligations, protect the rights and/or safety of an individual, protect the rights and property of Expand, including the need to ensure that this Framework is respected and to prevent any technical, security or fraud related issues.
12 HOW DO WE ENSURE THE PRIVACY OF YOUR PERSONAL INFORMATION WHEN DEALING WITH OUR AFFILIATES, SUBSIDIARIES AND OTHER THIRD PARTIES?
We ensure that all affiliates, subsidiaries and other third parties that are retained to perform services on our behalf and are provided with Personal Information are required to comply with this Framework and our privacy practices.
13 HOW CAN YOU REVIEW YOUR PERSONAL INFORMATION THAT WE HAVE COLLECTED, UTILISED OR DISCLOSED?
If you make a written request to review any Personal Information about you that we have collected, utilised or disclosed, we will provide you with any such Personal Information to the extent required by law. We will make such Personal Information available to you in a form that is generally understandable, and will explain any abbreviations.
14 HOW DO YOU KNOW THAT THE PERSONAL INFORMATION WE HAVE ON YOU IS ACCURATE?
We will ensure that your Personal Information is kept as accurate, complete and up-to-date to the extent reasonably possible. We will not routinely update your Personal Information, unless such a process is necessary. We expect you, from time to time, to supply us with written updates to your Personal Information, when required.
15 WHAT IF THE PERSONAL INFORMATION WE HAVE ON YOU IS INACCURATE?
At any time, you can challenge the accuracy or completeness of your Personal Information in our records to the extent required by law. If you successfully demonstrate that your Personal Information in our records is inaccurate or incomplete, we will amend or delete the Personal Information as required. Where appropriate, we will transmit the amended or deleted information to third parties having access to your Personal Information.
16 HOW FAST WILL WE RESPOND TO YOUR WRITTEN REQUESTS?
We will attempt to respond to each of your written requests not later than 30 days after receipt of such requests. You have the right to make a complaint to us in respect of this time limit by contacting us using the contact details provided in paragraph 20 below.
17 ARE THERE ANY COSTS TO YOU FOR REQUESTING INFORMATION ABOUT YOUR PERSONAL INFORMATION OR THIS FRAMEWORK?
We will not charge any fees for you to access your Personal Information in our records or in terms of this Framework or practices without first providing you with an estimate of the approximate costs, if any. You may withdraw your request for access to information by notifying us within the 30-day notice period disclosed on the estimate. If you do not notify us within such 30-day period, we will send you a further notice indicating that you will be deemed to have withdrawn your request for access unless you advise us otherwise within 30 days. If, after the expiry of this second 30-day period, you have not so advised us, we will deem your request to have been withdrawn and provide you with written notice to that effect.
18 HOW DO WE KNOW THAT IT IS REALLY YOU REQUESTING YOUR PERSONAL INFORMATION?
We may request that you provide sufficient identification to permit access to the existence, use or disclosure of your Personal Information. Any such identifying information shall be used only for this purpose.
19 WHAT SAFEGUARDS HAVE WE IMPLEMENTED TO PROTECT YOUR PERSONAL INFORMATION?
19.1 We have implemented physical, organisational, contractual and technological security measures to protect your Personal Information from loss or theft, unauthorised access, disclosure, copying, use or modification. The only employees who are granted access to your Personal Information are those with a business ‘need-to-know’ or whose duties reasonably require such information.
19.2 We will provide you and the information protection regulator with detailed written notification should there be a security breach or a reasonable belief of a security breach which allows unauthorised persons to access your Personal Information. We will provide such notification as soon as reasonably possible after we discover a security compromise.
20 HOW DO YOU CONTACT US REGARDING ACCESS TO YOUR PERSONAL INFORMATION?
All comments, questions, concerns or complaints regarding your Personal Information or this Framework, should be forwarded to us as follows:
Attention: The Information Officer and Deputy Information Officer
Per email: [email protected]
21 CHANGES TO FRAMEWORK
21.1 We may update this Framework at any time to reflect possible new practices and service offers. In such case, the date of the Framework will be updated and indicate the date when such changes were made.
21.2 We invite you to check for any possible updates of this Framework, which will be published on our website.
21.3 If we make any changes, we consider substantial, you will be informed by a notice posted on our website.
22 LINKS TO THIRD PARTY WEBSITES
22.1 While browsing our websites, you may come across content containing links to third-party applications and websites. Expand has no control over the cookies or other functions used by such third-party applications and websites, and any Personal Information processing that may be implemented by such applications and websites are not governed by this Framework.
22.2 Accordingly, it is up to you to directly contact and/or visit such third-party applications and websites to obtain further information on their data protection guidelines.