Skip to main content


POPIA Policy 

 

 

 

 

 

INTRODUCTION

 

POPI is the abbreviated term for the PROTECTION OF PERSONAL INFORMATION ACT 4 of 2013 ("the Act"). The Act is distinguished from other similar pieces of legislation worldwide because the "personal information" as defined in the Act refers to ANY information RELATING TO AN IDENTIFIABLE, LIVING NATURAL PERSON OR JURISTIC PERSON. This means that there is not only a requirement to safeguard the personal information of an individual but that of Clients, stakeholders and suppliers as well. 

POPI therefore requires that Spacertech CC t/a Altitude Glass inform their clients and all relevant data subjects as to the manner, in which, their personal information is used, disclosed and destroyed and commits to Clients that their privacy will be protected by ensuring that their personal information is used in an appropriate and secure manner in accordance with applicable laws. 

Whilst the Act is South African legislation, the implementation of the provisions of this Act applies to all employers including those with subsidiaries abroad or trading transborder and will be followed to the extent that such provisions do not contradict prevailing legislation in those jurisdictions; and where no governmental protective legislation exists, agreements will be required from foreign trade partners that they will adhere to the POPIA and or the European General Data Protection Regulation (GDPR).  

 

COLLECTION OF PERSONAL INFORMATION

 

2.1 The Act provides that personal information may only be processed if, given the purpose for which it is processed, it is adequate, relevant, and not excessive. 

2.2 In this regard, Spacertech CC t/a Altitude Glass collects and processes the personal information of its Client/Customers for the purposes of:  

assessing of the Clients, in the provision of loyalty programme and processing, 

using such information for the development of services from Clients, 

conducting due diligences on the Clients with reference to complying with the Clients and Spacertech CC t/a Altitude Glass, policies in terms of the Act, 

marketing purposes in print and digital media, 

confirming and verifying their details on record with their consent, 

for record and audit purposes, 

in connection with and complying with legal and statutory requirements or otherwise allowed or required by law, 

necessary for pursuing the legitimate interests of Spacertech CC t/a Altitude Glass, which the Client/Customer trades with or a third party involved directly in this. 

In all material instances, the consent of the Client/Customer is obtained based on the fact that the Organisation makes the Client/Customer aware of what information is required to be collected and processed, why it is collected, how it will be collected and processed, where it will be processed and to whom that information will be given to. 

The starting point with regards to the collection of personal information of a Client lies in the Organisation’ respective Standard Terms and Conditions in respect of which the Client provides consent for the use of its information to assess the Client/Customer by the Organisation when it fills in and signs the Form. By signing the Form, and subject to no deletions in this regard, the Client is deemed to have provided its consent. 

In the event of a Client refusing to accept the Organisation’s Standard Terms and Conditions, it shall, still remain, the policy of the Organisation to abide by the provisions of the Act by collecting and processing information in the manner as contemplated in 2.2 above. 

 

PARAMETERS OF DISCLOSURE OF PERSONAL INFORMATION

 

3.1 A Client's personal information may be disclosed from an Organisation to another Organisation for the purposes of providing the Client with the opportunity to engage with the Organisation’s range of services. However, personal information relating to a Client/Customer for trade with more than one Organisation shall follow the same procedure in the collection and processing of the Client’s personal information as contemplated in 2.2 above. 

3.2 A Client's personal information may also be disclosed to third parties where the Organisation whom it trades with or the Group is required to do so in terms of applicable legislation, the law or, where deemed necessary to protect the rights of the Group Organisation or the Group. 

3.3 In terms of 3.1 and 3.2, the Finance Department is responsible for the collection and processing of Client information regarding the activation of the Client from an incidental credit perspective. With the particular reference to 3.2, if it is necessary for the personal information of the Client to be disclosed to third parties (i.e., credit bureau, this would be in accordance with the provisions of: (i) assessing the creditworthiness of the Client and (ii) conducting due diligences on the Client with reference to complying with the Organisation’s policies. 

3.4 In terms of 3.3, it is contemplated that providing the Client information to such third parties, would also be a necessary requirement for pursuing the legitimate interests of the Organisation provided that such service providers themselves have a duty of responsibility to collect and process such information for the specific purpose required. 

 

AMENDMENTS TO PERSONAL INFORMATION

 

4.1 Clients have the right, at all material times, to access the information in the possession of the Organisation that it trades with and further the Client can ask for the updating, collecting or deletion of personal information on reasonable grounds. The deletion of personal information is subject to the Organisation not being restricted to comply thereto by means of prevailing legislation or to protect the legitimate interests of the Organisation. 

4.2 The Organisation shall take all reasonable steps to confirm a Client's identity before providing details of their personal information or making changes to personal information. 

 

SAFEGUARDING CLIENT/CUSTOMER INFORMATION

 

5.1 This condition imposed by POPIA requires that the Organisation adequately protects the personal information of the Client and in this regard, key consideration will be given, taking into account the following: 

the integrity and confidentiality of personal information in possession OR under the control by taking appropriate and reasonable measure to prevent the loss or damage to or unauthorized destruction of personal information and unlawful access to or processing of personal information of the Client, 

have regard to generally and reasonably accepted information security practices and procedures, 

take reasonable steps to identify reasonable and foreseeable risks to personal information in the possession and control of the Organisation and establish and maintain Reasonable safeguards against the risks identified and implement the safeguards, continually update them, and regularly verify them. 

With specific reference to the personal information obtained from a Client by the Organisation’s finance department, access to the department’s electronic files, are restricted to designated Managers and employees who are required to process the data with permitted authorization levels to access such data. Physical documents of Client’s personal information are filed under lock and key and access to the Finance Department is restricted from third parties. 

All the Organisation’s electronic files/data are backed up daily and stored off site and safeguards are in place for the protection of such files and data which is administered by the IT provider along strict protocols. 

 

ACCESS TO DOCUMENTS

 

6.1 It is a mandatory requirement in the Organisation that the information belonging to the Organisation and those of a Client, must be dealt with in strict confidence and may only be disclosed where there is no fear of redress such as: 

disclosure is subject to a legal (statutory or regulatory) requirement, 

where there is a duty to the public to disclose such as where the public interest outweighs any, 

interference with the privacy of the individual or Client or to prevent or mitigate a serious or imminent threat to public health,

where the interests of the Group require disclosure, 

where the disclosure is made with the express or implied consent of the Client. 

6.2 DISCLOSURE TO THIRD PARTIES 

All employees of the Organisation have a duty of confidentiality to the Organisation and have signed acknowledgment of such duty with the relevant Organisation with which they concerned. Accordingly, Client’s information may only be given to a third party if the Client has consented thereto in writing and the Organisation General Manager or Financial Officer has confirmed agreement thereto as well. 

Confidential information or information belonging to an Organisation may not be disclosed to third parties without the consent of the responsible party. 

 

STORAGE OF DOCUMENTS

 

7.1 The storage of hard copy documents, whether they are Organisation documents, Client information and supplier information may be required to be kept for periods as stipulated by prevailing legislation. Accordingly, the request by a Client to destroy personal information may not be complied with due to a prevailing statutory or regulatory requirement. In the event of uncertainty, contact Spacertech CC t/a Altitude Glass for clarity. 

7.2 A few examples are: 

  • Organisation Act - 7 Years and in some cases, indefinitely. 
  • Financial Intelligence Centre Act (FICA)- 5 years. 
  • Compensation for Occupational Injuries & Diseases Act (COIDA)- Vary from 40 years to 3 years. 
  • South Africa Revenue Services Acts- 5 years. 
  • Electronic storage of information in the Organisation must be done in conjunction with the IT provider and comply with the policies and procedures of the Organisation. 

The Electronic Communications Act of 2005 requires that personal information and the purpose for which the data was collected must be kept by the person who electronically requests, collects, collates, processes or stores the information and a record of any third party to whom the information was disclosed must be retained for a period of 1 year or for as long as the information is used. In this regard, the IT provider required to ensure that such "Business Information" is stored and archived in line with the Organisation policy on the Control and Retention of Documents and Records. 

Personal information that has become obsolete must be destroyed with the consent of the data subject if available and applicable. Such obsolete information must be destroyed in a manner that it is not able to be reconstituted in a legible format. 

The Organisation has a policy and procedure for the storage of and destruction of electronic data. 

 

INFORMATION OFFICER

 

8.1 POPI prescribes the appointment of an Information Officer who is responsible for the compliance with the conditions of the lawful processing of personal information and compliance with the provisions of POPI. 

 

8.2 The details of the Information Officer are: 

Name:  Carmen Watt

Registration number: 02584/2022-2023/IRRTT

Email Address: [email protected]

Physical Address: Unit B2, 56 Kelly Road, Jet park, 1457

Telephone Number: 0828514152