Privacy Policy

1. Lawful Processing

The following conditions of lawful processing of personal information are the principles in terms of which we will be processing the collected personal information. They are:

• Accountability – we will make sure that your personal information is processed in a lawful and responsible manner;
• Processing limitation – we shall lawfully collect your personal information for a defined purpose and where applicable, with your consent;
• Purpose specification – we will collect your personal information only for a specific, explicitly defined and lawful purpose, and we will use it only for the purposes that we communicated to you at the time of collection, or for purposes that are reasonably necessary to achieve those communicated purposes, in accordance with section 13 of POPIA;
• Further processing limitation – where a processing activity is seen as further processing (means a new purpose for processing your personal information) and this new purpose is inconsistent with the original purpose (original reason we collected your personal information), we will make sure that our processing activities meet the requirements of the applicable information protection laws;
• Information quality – we will take reasonable steps to ensure your personal information is accurate, complete and updated and not misleading;
• Openness – from the start, we will be open, clear and honest with you on how and why we use your personal information and how we protect your personal information;
• Security safeguards – we will apply and follow appropriate and reasonable technical and organisational measures to make sure that the confidentiality, integrity and availability of your personal information are secured. These measures will also be applied to protect your personal information against loss, damage, unauthorised destruction or unlawful access;
• Data subject participation – we have processes in place for you to access, correct and delete personal information and exercise your rights in terms of applicable information protection laws.

2. How Do We Collect Your Personal Information?

We will collect your personal information in the following ways:

• directly from you; and
• where lawful and reasonable, from third parties and public sources.

If we do not obtain your personal information directly from you, we may obtain it from the following sources:

• publicly available sources (registers or the internet);
• our employees, contractors, (prospective) members of board of directors and/or shareholders;
• our affiliates, subsidiaries and newly acquired businesses;
• employers of our contractors;
• public authorities, public websites and social media;
• previous employers, educational institutions, suppliers and vendors (including third party information providers).

Where we collect your personal information from a source other than directly from you, we will notify you of the collection and of the source as soon as reasonably practicable after collecting it, unless you are already aware of it, notification would prejudice a lawful purpose of the collection, or we are exempt from doing so under section 18(4) of POPIA. Information that is publicly available, including information that you have posted publicly on social media, remains personal information under POPIA. The fact that it is public does not amount to your consent to our processing it, and we will process it only where we have a lawful basis to do so.

Specifically we may collect your personal information via our Website in the following ways:

• directly if you provide the information in response to a request (for example, when you provide personal information to sign up for a newsletter) or if you otherwise provide same (for example via any postings, comments, or other content that you upload of post on our Website); and/or
• indirectly through the use of technologies such as cookies. Please refer to our Cookie Policy available on Yobi Code’s website at www.yobicode.co.za.

3. Which Categories of Personal Information Do We Collect?

The personal information we collect includes the categories of personal information referred to in this Privacy Statement or in other statements you have received.

Below is a chart describing certain categories of personal information that we may collect:

We also may derive inferences about you based on the information described above and also collect other information about you as described in this Privacy Statement. If you provide us with personal information of another person, you are responsible for ensuring that such person is made aware of the information contained in this Privacy Statement and that the person has given you his/her consent for sharing the information with us.

The above-mentioned categories of personal information have been obtained either directly from you (for example, when you provide information to sign up for a newsletter or register to comment on a forum website) or indirectly from certain third parties (for example, through our Website’s technology). Such third parties include our affiliates, public authorities, public websites and social media, suppliers and vendors. Except where certain information is required by law or by our policies, your decision to provide any personal information to us is voluntary. Please note that if you do not provide certain information, we may not be able to accomplish some or all of the purposes outlined in this Privacy Statement, and you may not be able to use certain tools and systems which require the use of such personal information.

We do not knowingly collect the personal information of a child directly from that child. A child means a person under the age of 18 (eighteen) years who is not legally competent, without the assistance of a competent person, to take any decision in respect of any matter concerning himself or herself. A competent person means a person who is legally competent to consent to any action or decision in respect of a matter concerning a child. Where we process the personal information of a child, we will do so only with the prior consent of a competent person, or on another ground permitted by section 35 of POPIA. We do not use the personal information of children for direct marketing, targeted advertising or profiling. A competent person may exercise the rights set out in this Privacy Statement on behalf of a child by contacting our Information Officer.

4. When Can We Process or Share Your Personal Information?

We will process your personal information where you have given us your consent, or where another ground of lawful processing set out below applies.

Where we rely on your consent, we will ask for it separately for each specific purpose, at or before the point of collection, using a clear and voluntary opt-in that is not selected in advance. Accepting this Privacy Statement, or clicking “I accept” or “I agree” in relation to it, is not treated by us as your consent to any processing of your personal information.

Consent under POPIA must be a voluntary, specific and informed expression of will, and the burden of proving that consent was given rests on us. We therefore record each consent, the purpose for which it was given and the date on which it was given. You may withdraw your consent at any time, as set out in the Your Rights provisions of this Privacy Statement.

5. For Which Purposes and on Which Legal Basis Do We Use Your Personal Information?

We will only use and share your personal information where it is necessary for us to carry out our lawful business activities. To enable you to fully understand the way in which we process your personal information, we have described the different lawful grounds for such processing in detail below:

• Consent – We may process your personal information for a specific and explicitly defined purpose where you, or a competent person in the case of personal information relating to a child, provide us with your express consent for such processing or where law requires;
• Contractual need – We may process your personal information where it is necessary to enter into a contract with you in order for us to provide our products or services to you or to perform our obligations under that contract. Please note that if you do not agree to provide us with the requested personal information, it may not be possible for us to continue to provide products or services to you;
• Compliance with an obligation imposed by law – When you apply for a product or service, we are required by law to collect and process certain personal information about you. Please note that if you do not agree to provide us with the requested personal information, it may not be possible for us to continue to provide products or services to you;
• Legitimate interests – We may process your personal information where it is in our legitimate interests, or in the legitimate interests of a third party, to do so, and where doing so does not harm your interests or your fundamental rights and freedoms. We assess and record that balance before relying on this ground. We do not rely on legitimate interests for direct marketing by electronic communication, or for the processing of special personal information.

Please view the table below for: (i) a non-exhaustive list of specific purposes for which we may use your personal information and (ii) an overview of the legal basis for each such purpose:

Legitimate interest means that we have reasonable grounds to process your personal information. Where the table above states that we rely on our legitimate interests for a given purpose, we are of the opinion that our legitimate interests are not overridden by your interests, rights or freedoms, given (i) the transparency we provide on the processing activity, (ii) our privacy by design approach, (iii) our regular privacy reviews and (iv) the rights you have in relation to the processing activity. We record our assessment of that balance for each purpose for which we rely on this ground, and we will make a summary of it available to you on request. If you wish to obtain further information on this balancing test approach, please contact our Information Officer or Deputy Information Officer, whose details appear in the How To Exercise Your Rights And Who To Contact provisions of this Privacy Statement.

6. Automated Decision-Making and Profiling

We may use automated processing, including profiling, to personalise the content and communications that you receive and to protect the security of our Website and systems. Where we use automated processing, we do so on the lawful basis recorded in the table above and, where that basis is consent, only with your consent.

You have the right under section 71 of POPIA not to be subject to a decision which results in legal consequences for you, or which affects you to a substantial degree, and which is based solely on the automated processing of your personal information intended to create a profile of you. Where we take such a decision, we will give you sufficient information about the underlying logic, and you may make representations to us or ask us to review the decision with human involvement, by contacting our Information Officer.

We do not use artificial intelligence or machine-learning tools that retain or use your personal information to train external or third-party models. Where we use enterprise tools that involve automated processing, the provider is contractually required not to use your personal information for its own purposes or for model training.

7. Will We Share Your Personal Information with Third Parties?

We will only share your personal information if:

• the law requires it;
• we have a public duty to share the personal information;
• our or your legitimate interests require us to share the personal information;
• it is necessary to conclude or perform due to an agreement between you and us; or
• you agreed that we may share your personal information.

As specified by the above purposes, we may share your personal information with any of the parties mentioned below:

• Any member of the Group;
• Professional advisers like auditors, third-party vendors, or independent contractors who process personal information on our behalf to support our business;
• Our business partners who provide their products and services to you;
• Service providers that provide services to us, including billing, payment processing, customer service, email deployment, advertising and marketing, security and performance monitoring, maintaining or servicing accounts, processing or fulfilling orders and transactions, verifying customer information, research, information hosting, auditing, and information processing;
• Any individual who needs your personal information due to foreign or local law or regulation;
• Any court of justice, regulatory body, taxation authority (including any authority investigating an offence) or their agents;
• Any debt collection agency, credit bureau, insurer or broker, direct or indirect provider of credit protection and fraud prevention agencies;
• Any financial institution to conduct credit checks, anti-money laundering related checks, for fraud prevention and detection of crime purposes for the Group.

The operators and service providers that may process your personal information on our behalf currently fall into the following categories. We will give you the identity of a specific provider on request:

• cloud infrastructure and hosting providers, for the hosting of our Website, our systems and our back-ups;
• e-mail, communication and collaboration platforms;
• customer relationship management and marketing platforms, for the distribution and measurement of communications that you have asked to receive;
• website analytics providers, as described in our Cookie Policy;
• payroll and accounting providers, and professional advisers including auditors and attorneys;
• background screening and verification providers, in recruitment; and
• information technology support and information security providers.

Each operator is required by written agreement to process your personal information only with our knowledge and authorisation and for the purposes that we specify, to treat it as confidential, to establish and maintain appropriate security safeguards, and to notify us immediately where there are reasonable grounds to believe that your personal information has been accessed or acquired by an unauthorised person, in accordance with sections 20 and 21 of POPIA.

We may also share your information in connection with a substantial corporate transaction, such as the sale of a website, a merger, consolidation, asset sale, initial public offering, or in the unlikely event of a bankruptcy.

Some of the operators and service providers that we use process personal information outside the Republic of South Africa. We will transfer your personal information to a third party in a foreign country only where one of the grounds in section 72(1) of POPIA applies, namely where:

• the recipient is subject to a law, binding corporate rules or a binding agreement which provides an adequate level of protection that upholds principles for the reasonable processing of personal information substantially similar to the conditions in POPIA, and which includes provisions substantially similar to section 72 in relation to the onward transfer of personal information;
• you have consented to the transfer;
• the transfer is necessary for the performance of a contract between you and us, or for the conclusion or performance of a contract concluded in your interest between us and a third party; or
• the transfer is for your benefit, it is not reasonably practicable to obtain your consent, and if it were reasonably practicable to obtain that consent, you would be likely to give it.

Where we rely on the adequacy ground, we do so on the basis of the data protection terms and binding corporate rules of the relevant provider. We will give you details of the countries in which your personal information is processed, and of the safeguards applied, on request to our Information Officer.

8. When We Act as an Operator for Our Clients

In conducting business activities and rendering our services, we often process personal information on behalf of a client. For that processing the client is the responsible party and we act as an operator, as those terms are defined in POPIA.

In that role we process personal information only with the knowledge and authorisation of the client, treat it as confidential, establish and maintain appropriate security safeguards, and notify the client immediately where there are reasonable grounds to believe that personal information has been accessed or acquired by an unauthorised person, in accordance with sections 20, 21 and 22 of POPIA.

This Privacy Statement does not govern that processing. Our processing as an operator is governed by the written agreement between us and the relevant client. If you believe that we process your personal information on behalf of one of our clients, please direct your request to that client, and we will assist the client in responding to you.

9. What About Special Personal Information?

We do not seek to collect special personal information, as defined in section 26 of POPIA, through our Website. We process special personal information only in the following limited circumstances, and only on a ground permitted by section 27 of POPIA:

• biometric information, where you elect to use fingerprint or similar authentication to access our systems or premises. We process this information only with your consent, use it only to authenticate access, and retain it only for as long as your access relationship with us continues;
• health information, where you provide it to us for a specific purpose that we have explained to you, for example to accommodate a dietary or accessibility requirement at an event. We process this information only with your consent or where another ground in section 27 of POPIA applies; and
• information on criminal behaviour, where a background or verification check forms part of a recruitment or vetting process. We process this information only with your consent or on another ground permitted by sections 27 and 33 of POPIA.

We do not collect information concerning your religious or philosophical beliefs, trade union membership, political persuasion or sex life through our Website. Where we are required to record race or ethnic origin for employment equity or broad-based black economic empowerment reporting, we do so only as permitted by section 29 of POPIA and the applicable legislation. Where we receive special personal information that we did not ask for, we will delete it as soon as reasonably practicable, unless we are required to retain it.

10. Storage

We will store and keep your personal information according to the retention periods defined by law for legitimate business purposes and will take reasonably practicable steps to make sure that it is kept up to date and deleted and archived as appropriate.

We maintain records management and retention policies and procedures so that your personal information is deleted, destroyed or de-identified once we are no longer authorised to retain it. We will retain your personal information for as long as it is necessary for the purpose for which it was collected, for as long as retention is required or authorised by law, for as long as we reasonably require it for a lawful business purpose, or for as long as you have consented to its retention.

The following retention periods apply to the main categories of records that we hold:

• company, accounting and general company records: 7 (seven) years, in terms of section 24 of the Companies Act 71 of 2008;
• tax, payroll and value-added tax records: 5 (five) years from the submission of the relevant return, in terms of section 29 of the Tax Administration Act 28 of 2011 and the Value-Added Tax Act 89 of 1991;
• client identification and verification records: 5 (five) years from the termination of the business relationship or from the date of the transaction, in terms of sections 22 and 23 of the Financial Intelligence Centre Act 38 of 2001;
• employment records, including the written particulars of employment: 3 (three) years from the date of the last entry, in terms of sections 29 and 31 of the Basic Conditions of Employment Act 75 of 1997;
• personal information collected electronically through our Website: for as long as it is used, and thereafter for at least 1 (one) year, in line with section 51 of the Electronic Communications and Transactions Act 25 of 2002; and
• marketing contact details: until you object, unsubscribe or withdraw your consent, after which we retain only the minimum record needed to give effect to your objection.

When we dispose of personal information, we destroy or delete it, or de-identify it, in a manner that prevents its reconstruction in an intelligible form. Our Policy on Retention and Destruction of Records is available from our Information Officer on request.

11. Information Security

The security of your personal information is important to us. We have implemented appropriate and reasonable technical and organisational measures to prevent the loss of, damage to, or unauthorised destruction of your personal information, and to prevent unlawful access to it or unlawful processing of it, as required by section 19 of POPIA. We have protocols, controls and relevant policies, procedures and guidance to maintain these arrangements, taking into account the risks associated with the categories of personal information that we hold and the processing that we undertake.

Our measures include:

• encryption of personal information in transit, using current transport layer security standards;
• encryption of personal information at rest on our systems;
• role-based access controls, with access granted on a need-to-know basis and reviewed periodically;
• logging and monitoring of access to the systems on which personal information is held;
• regular security assessment of our systems;
• privacy and information security training for our personnel, who are also bound by written confidentiality undertakings; and
• security due diligence on operators before we engage them.

Although we use appropriate security measures once we have received your personal information, the transmission of information over the internet (including by e-mail) is never completely secure. We endeavour to protect personal information, but we cannot guarantee the security of information transmitted to or by us.

If we have reasonable grounds to believe that your personal information has been accessed or acquired by an unauthorised person, we will notify the Information Regulator and you as soon as reasonably possible after discovering the compromise, in accordance with section 22 of POPIA. We may delay notifying you only if a public body responsible for the investigation of offences, or the Information Regulator, determines that notifying you would impede a criminal investigation.

Our notification to you will be in writing and will be sent to you by e-mail or post, or published prominently on our Website where we are unable to identify or reach you. It will give you sufficient information to allow you to take protective measures, including a description of the possible consequences of the compromise, the measures that we intend to take or have taken to address it, what we recommend that you do to mitigate its possible adverse effects, and, if it is known to us, the identity of the unauthorised person. Please keep your contact details current so that we are able to reach you.

Our internal incident process requires the identification, verification and initial containment of a suspected compromise to be completed within 72 (seventy-two) hours of its discovery. That period is our internal standard and does not limit the notification obligations described above.

12. Marketing by Electronic Means

We would like to send you information about our own products, services and special offers that are similar to the products or services that you have obtained from us, using the method of communication that you have indicated to us, such as e-mail, text message, social media platform or notification on your mobile application.

We will send you direct marketing by electronic communication, including by e-mail, text message or automatic calling machine, only where:

• you have given us your consent to receive it; or
• you are an existing customer of ours, we obtained your contact details in the context of the sale of a product or service to you, we market only our own similar products or services, and we have given you a reasonable opportunity to object both when we collected your details and in each communication that we send to you, as contemplated in section 69(3) of POPIA.

If your consent is required and you have not previously withheld it, we may approach you once, and only once, to request that consent, in the prescribed manner and form, as contemplated in section 69(2) of POPIA.

We will share your contact details with our partner companies for their own marketing, or send you marketing about the products and services of our partner companies, only where you have given us separate and specific consent to that. Your consent to receive our own marketing does not extend to marketing by our partner companies, and you may withdraw either consent independently of the other.

If you have opted in to receive marketing communications, you may opt out at any time by clicking the “Unsubscribe” option included in every marketing communication that we send to you, or by contacting us as set out below. You have the right at any time to stop us from contacting you for marketing purposes, and to object to us giving your personal information to other members of the Group for that purpose.

If you no longer wish to be contacted for marketing purposes, please request for us to mark you as ‘No’ to Marketing by calling us on +27 (0) 12 012 5092 or emailing us on popia@yobi.co.za. Your request will be recorded and will apply to all future marketing communications from us. The details of our Information Officer appear in the How To Exercise Your Rights And Who To Contact provisions of this Privacy Statement.

13. Use of Cookies

Please refer to our Cookie Policy available on Yobi Code’s website at www.yobicode.co.za.

14. Your Rights

You are entitled (in the circumstances and under the conditions, and subject to the exceptions, set out in applicable law) to:

• Right to access – You have a right to get access to the personal information that we hold about you. If you would like a record or description of the personal information that we hold about you, please request this from our Information Officer or Deputy Information Officer at popia@yobi.co.za. We may, if allowed by law, charge a fee for this. We will respond to your request within 30 (thirty) days of receiving it. Confirmation of whether we hold personal information about you is free of charge. Where you ask for the record itself, or for a description of it, we may charge the prescribed fee, and we will give you a written estimate of that fee and require payment before we do the work. A formal request for access to a record must be made in the manner set out in our PAIA Manual, which is available on our Website, using the form prescribed under the Promotion of Access to Information Act 2 of 2000, and access may be refused only on a ground set out in Chapter 4 of Part 3 of that Act.
• Right to rectify/correct/update – You have a right to correct inaccurate personal information and to update incomplete personal information. Please request this through our Information Officer or Deputy Information Officer at popia@yobi.co.za.
• Right to be notified – You have the right to be notified that your personal information is being collected by us or has been accessed or acquired by an unauthorised person.
• Right to withdraw – You have the right to withdraw your consent to us processing your personal information. Please note that if you withdraw your consent to us processing your personal information, we may have to stop or suspend the provision of the products and services we provide to you. Please note that where the law requires us to process your personal information, we will have a legal obligation to do so. Please note that where the law permits us to process your personal information, we may continue to do so. Please request this through our Information Officer or Deputy Information Officer at popia@yobi.co.za.
• Right to object – You have a right to object to us processing your personal information where we have relied on one of the lawful grounds above for legitimate interest or where we perform a public law duty (and to request us to restrict processing). Please note that if you request us to restrict processing your personal information, we may have to stop or suspend the provision of the products and services we provide to you. Please note that where the law requires us to process your personal information, we will have a legal obligation to do so. Please note that where the law permits us to process your personal information, we may continue to do so. Please request this through our Information Officer or Deputy Information Officer at popia@yobi.co.za.
• Right to deletion – You have a right to request that we delete your personal information. Despite your request, you may still have a legal right or obligation to retain your personal information. Please note that if you request us to delete your personal information, we may have to stop or suspend the provision of the products and services we provide to you. Please request this through our Information Officer or Deputy Information Officer at popia@yobi.co.za.
• Right to object to the processing of personal information for the purposes of direct marketing – You have a right to object at any time to the processing of your personal information for direct marketing purposes, including profiling you for the purposes of direct marketing. Please request this through our Information Officer or Deputy Information Officer at popia@yobi.co.za.
• Right to lodge a complaint with the Regulator. If you wish to raise a complaint on how we have handled your personal information, you can contact our Information Officer or Deputy Information Officer at popia@yobi.co.za who will investigate the matter. We hope that we can address any concerns you may have.
• You may also lodge a complaint directly with the Information Regulator at any time, and you do not have to use our internal complaints process first. We will respond to a complaint in writing within 30 (thirty) days. The Information Regulator’s details are: The Information Regulator (South Africa), Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191. Telephone: +27 (0) 10 023 5200. E-mail: POPIAComplaints@inforegulator.org.za.

15. How to Exercise Your Rights and Who to Contact

You may exercise any of the rights set out above by contacting our Information Officer or Deputy Information Officer. In the ordinary course we will identify and retrieve the relevant personal information within the first 10 (ten) days of receiving your request, decide how to deal with your request and act on that decision by day 20 (twenty), and report the outcome to you by day 30 (thirty).

• Information Officer: Andre Coetzee
• Deputy Information Officer: Mieke van der Bank
• Postal and physical address: 268 Kent Avenue, Ferndale, Randburg, 2192
• E-mail: popia@yobi.co.za
• Telephone: +27 (0) 12 012 5092

We may ask you for proof of identity before we act on a request, so that we do not disclose your personal information to someone else. Where you object to processing, or withdraw your consent, we will tell you the likely consequences before we act, and we will tell you the outcome and, if we continue to process your personal information, the lawful basis on which we do so.

16. Third Party Websites

Our Website may include:

• Links to and from the sites of our partner networks, advertisers and affiliates
• Certain programs (widgets and apps) of third parties. Where this is the case, note that such third parties may process your personal information collected through such programs for their own purposes. Where third-party programs place cookies or similar technologies on your device through our Website, we disclose this in our Cookie Policy, and your preferences are managed through the cookie preference settings described in that policy.

This Privacy Statement does not apply to any third party websites which may be accessible through links on our Website.

We do not make any representation and/or warranties about the privacy of any third party websites and do not accept any responsibility or liability for them. Third-party website providers are responsible for informing users about their own privacy practices and we suggest that you review the privacy policies of any third-party providers whose sites you access.

17. Changes to This Privacy Statement

We may update this Privacy Statement at any time by publishing an updated version here. We will amend the revision date recorded in the version table below, and the updated Privacy Statement will apply from that date. Where we make a material change, meaning a change to the purposes for which we process your personal information, to the categories of personal information that we collect, or to the parties with whom we share it, we will notify you at least 14 (fourteen) days before the change takes effect, by e-mail where we have your e-mail address and by a prominent notice on our Website. Where the change requires your consent, we will ask for that consent before the change takes effect. Minor clarifications will be recorded by updating the revision date.

This Privacy Statement was last reviewed on the date recorded against the current version in the table below.