Privacy and Data Processing Policy for the use of the Overdue Invoice Register website (an initiative of Sustainability of SMEs NPC) (“OIR website”).

Introduction

Sustainability of SMEs NPC is a non-profit company (“the NPC”). The NPC protects the integrity of all information housed by it, keeping such information secure. The NPC is sensitive to the issues regarding privacy of information.

The NPC strives to ensure that your privacy is protected. This Privacy and Data Processing Policy therefore regulates the manner in which we collect, use, process, disclose, transfer and retain your personal and company information.

We comply with the Protection of Personal Information Act, 2013 (No. 4 of 2013) (“PoPIA”) and the principles outlined in Sections 50 and 51 of the Electronic Communications and Transactions Act, 2002 (No.25 of 2002) which govern your right to having your personal information kept private of which these principles are covered in this Privacy Policy. The NPC will be the party who will be collecting and processing a User’s personal information and as such is designated as the “responsible party” for purposes of PoPIA.

This Privacy Policy is incorporated into and is subject to the NPC’s Terms of Use as reflected on our website (www.overdue-invoice-register.co.za).

For the purpose of this Privacy Policy: “Company information” means information pertaining to the SME user who is recording their customer as a Late Payer. “Personal information” means personal information as defined in Section 1 of the PoPIA. You will be asked to provide some Company and Personal Information when registering, accessing or using any Services (as defined under the Terms of Use). In this regard, we may collect a variety of information, including:

• full name;
• telephone numbers;
• email address;
• SA ID number and/or Date of Birth;
• address details;
• company name;
• company registration number.

The NPC is committed to conducting its operations in an ethical manner and in compliance with all applicable laws. To be able to successfully ensure this, it is vital that all entities contributing to the OIR website of the NPC ascribe to the same standards. Accordingly, the NPC has set out, in this policy, obligations that need to be adhered to when an entity requests and uses information from, or supplies information to the NPC.

This policy may be updated from time to time to reflect any amendments made to applicable Laws or association/industry policy directives and guidelines.

Purpose of Policy

To outline obligations for protecting the integrity and confidentiality of information that is transmitted to and from the NPC’s systems, as required by applicable Laws.

Application of Policy

This policy is applicable to all entities who (a) procure and/or use and/or process information from the NPC (whether directly or indirectly) and who (b) supply information to the NPC (whether directly or indirectly).

General Conditions for Processing Personal Information

The NPC shall comply with all applicable laws, contracts or regulations when it processes a user’s personal information.

Use and Disclosure of Personal and Company Information

The NPC limits the use and disclosure of Personal information and Company information to include only what is permitted and prescribed in terms of PoPIA or any other applicable laws or in instances where consumers have consented to such collection, use and disclosure.

At no point is a user’s personal or company information ever exposed publicly. The only data used is de-identified (all identifying data points removed), aggregated and then mixed in with all the other OIR submissions to meet the objective of the OIR website.

Confidentiality of your Personal information and Company information is important to us. Unless we have your consent or are permitted under the national laws, we will not sell, rent or lease your Personal information or Company information to others. We will not use or share your Personal information or Company information in ways unrelated to the circumstances described in this Privacy Policy.

Unless permitted by the laws or with your consent, we do not use any of your Personal Information concerning religious, or philosophical beliefs, race or ethnic origin, trade union membership, political persuasion, health or sex life or biometric information.

Specifically, we use and disclose information in the following circumstances:

• The OIR website consists of a registry of information of overdue invoices provided by the users of the website. The information is submitted by a SME User, and de-identified (all identifying data points removed), aggregated and then collated with the other OIR submissions which then comprises the Late Payer information.
• To provide customer service to you, we may use your Personal information and Company information:
• To identify you which may include: your full name, your email address, mobile telephone number, your identity card number, your date of birth, address information.
• Where applicable, to create a user account (login user name and password);
• To fulfil your requests for any information which you’re entitled to request and access;
• To provide service and support;
• To help us develop, deliver, and improve the Late Payer information and /or services;
• To send important communications regarding any changes to the terms of use and or to advise you of any other important circumstances;
• For internal purposes such as auditing, data analysis, and research to improve the OIR website and services.

Direct Marketing. We will not use your Personal information or Company information for direct marketing purposes.

Compliance with laws and regulations. We may only access, use and/or disclose your Personal information without your consent in exceptional circumstances. These include circumstances where we believe such action is necessary to:

• comply with the law or legal process served on us;
• comply with requests for information from police or government authorities;
• protect and defend our rights or property (including the enforcement of our agreements);
• protect the public interest;
• act in urgent circumstances to protect the personal safety of our employees or members of the public;
• where applicable, with your implied consent ; and
• to the extent permitted or required in terms of PoPIA and other relevant national legislation.

Submission of Data to the NPC

The user will submit data to the NPC that meets the conditions set out in the Terms of Use.

Consent

The user hereby consents to the processing of their personal information in terms of the provisions of this Privacy and Data Processing Policy.

The user acknowledges and agrees that such consent has been given voluntarily after the user has read and understood the provisions of this Privacy and data processing policy, in particular, regarding the following:

• the types of personal information to be processed;
• the specific processing activities to be undertaken;
• the specific purpose/s for such processing; and
• the possible consequences for the User that may arise from such processing.

 Retention of Your Information

We retain your Personal information and Company information for as long as reasonably necessary to fulfil the purpose(s) for which it was collected and to comply with applicable laws.

Transfer of Personal and Company Information Outside

Unless permitted under the law or your consent is obtained, the NPC will not transfer your Personal information and Company information outside the Republic of South Africa.

Your Rights and Participation

The NPC aims to ensure that your Personal Information is accurately recorded. To be able to achieve this, we adhere to processes that help ensure and maintain data accuracy. We will provide you with reasonable access to review and correct your Personal and Company information, as detailed in our website.

You have the right to access, update, correct or object to processing your Personal and Company information. You may contact us by e-mail: info@overdue-invoice-register.org.za

You have the right to lodge a complaint to the Information Regulator:

• by e-mail: inforeg@justice.gov.za;
• to the following postal address: SALU Building, 316 Thabo Sehume Street, PRETORIA; or
• by telephone: 012 406 4818; or by Fax: 086 500 3351.

Security of Your Information

The NPC takes security and the protection of Personal and Company information seriously. We maintain physical, technical and organizational safeguards to protect any data that we collect. We have adopted procedures to secure storage of Personal information and Company information and are committed to working with our data suppliers to protect the security of Personal and Company information during any transfer to or from us. Furthermore, your Personal and Company information is only accessible to those NPC employee members, agents or contractors for business purposes and on a strictly need to know basis.

In the OIR website, we take precautions to secure your Personal Information.

To protect your privacy and security, we will also take reasonable steps to verify your identity before granting access to or making alterations to data we maintain.

Third Party Sites

OIR website may offer links to third party websites. You should be aware that operators of linked websites may also collect your Personal Information (including information generated through the use of cookies) when you link to their websites.

The NPC is not responsible for how such parties collect, use or disclose your information and it is important for you to familiarize yourself with their privacy policies before providing them with your Personal Information.

Compliance and Enforcement Of this Privacy Policy

Our compliance with this Privacy Policy will be monitored on a regular basis. The NPC reserves the right to modify this Privacy Policy. The Privacy Policy posted at any time via OIR website shall be deemed to be the Privacy Policy then in effect.

Users of the OIR website are welcome to contact the NPC should they require more information or have any questions. Should you have any queries with our Privacy Policy or the manner in which your Personal and Company information is treated, we encourage you to direct any such queries or concerns to the NPC by contacting us at the following email address info@overdue-invoice-register.org.za. We will ensure you are contacted without delay in an effort to respond to your queries and/or attempt to resolve your concerns in accordance with the principles embodied in this Privacy Policy.

Internet Information

When you visit and use any functions in OIR website, we may collect the behavioural data and general internet data, including your internet protocol (“IP”) address, metadata, location data, date and time you visit:

• A “cookie” is also set on your computer to allow us to recognize you whenever you visit and collect information, like the pages you visit and the preferences you choose. We use the information we collect for statistical purposes and to study how the OIR website is used so that we may improve and enhance your experience on the OIR website. We may provide such information collected to outside vendors located overseas for such purposes. No personal information is stored in cookies. It is possible for you not to accept our cookies while using OIR website by setting the preference in your web browser. If you would like more information about cookies, you can visit http://www.cookiecentral.com/n_cookie_faq.htm. OIR website uses two different types of cookies.
• One type of cookie is used so that OIR website “recognizes” you each time you return using the same computer, and you do not have to re-enter all your personal information on each visit. You can set your web browser to refuse to accept this cookie, or delete this type of cookie from your hard drive, and still access our products and services, as long as you re-enter information each time you visit. The second type of cookie is needed so that we can process each step of your interaction with us. If you refuse to accept this type of cookie, you will not be able to access our Services. Most web browsers automatically delete this type of cookie when you terminate your session;
• We may use domestic or overseas third-party advertising companies to serve ads on OIR website or on other sites which we use for advertising. These companies may employ cookies and action tags (also known as single pixel gifs or web beacons) to measure advertising effectiveness; and they are not authorized to use the information we share with them for any other purpose. Any information that these third parties collect via cookies and action tags is completely anonymous.
• We may use Google Analytics or other similar analytical tools to obtain information collected in order to display, optimize and personalize advertisements and customer experience on our web properties that are designed to bring visitors to OIR website, to determine which advertisements you may find useful, and to personalize your experience on the OIR website and web properties. We may also use this information to segment, enhance or modify our advertisements and to personalize your experience;

Anonymous Data

• In order to enhance the usefulness of OIR website and our services, OIR website will collect data about our customers’ use of OIR website, in a manner that does not include any Personal Information. While you browse the OIR website, we note which pages of the OIR website you visit and note the IP address of your computer (as all web sites do automatically), but we do not link that address information to your personal information, other than for purposes of authentication and protection of your personal information when you access the website electronically.
• The general information we gather enables us to serve our customers better by continually enhancing OIR website based on up-to-date use patterns. We are provided anonymous information collected from other websites on which we display advertisements that enables us to understand how visitors to OIR website, who were exposed to ads we have placed on those other web sites, interact with the OIR website. We may use this information to enhance or modify our campaigns that are designed to bring web visitors to the OIR website.
• You may opt-out of this anonymous data collection and sharing activity by visiting the Google Analytics Privacy Overview web page and following the procedures noted under the Browser Opt-Out and Privacy Centre information sections (search for these sites through google.com).