Terms & ConditionsPrivacy PolicyDelete Account

Website · Mobile Application · Platform Services

Privacy Policy

1. WHO WE ARE — RESPONSIBLE PARTY

2gthr Proprietary Limited ("2gthr", "we", "us", or "our") is the responsible party as defined in the Protection of Personal Information Act, 4 of 2013 ("POPIA"). We determine the purpose and means of the processing of your personal information. 2GTHR is a subsidiary of Professional Provident Society Insurance Company Limited (Registration Number 2001/017730/06), a licensed insurance group and a registered Financial Services Provider (FSP No. 1044) ("PPS");

2. INTRODUCTION

The right to privacy and access of personal information is endorsed by the Protection of Personal Information Act 4 of 2013 (POPIA) and the Promotion of Access to Information Act 2 of 2000 (PAIA) as amended from time to time. A person's right to privacy entails having control over his/her personal information and being able to conduct his/her affairs free from unwanted intrusions. POPIA aims to promote the protection of privacy through guiding principles that are intended to be applied to the processing of personal information.

In this PPS Group Privacy Policy (Policy), references to PPS includes, Professional Provident Society Holdings Trust (PPS Holdings Trust), PPS Insurance Company Limited and all its subsidiaries.

It is through the rendering or provision of financial services and other related services that PPS is involved in the collection, use and disclosure of certain aspects of personal information of prospective and existing members, employees and other stakeholders. Considering the importance of privacy, PPS is committed to effectively managing personal information in accordance with POPIA and PAIA.

3. PURPOSE OF THIS POLICY

The purpose of this Policy is to protect PPS and its members by adhering to the protection of personal information which includes to:

  • Give effect to the constitutional right to privacy by safeguarding personal information against breaches of confidentiality where personal information of data subjects is shared or disclosed inappropriately through for example data breaches and hacking;
  • Prevent reputational damage and financial loss that PPS may suffer following an adverse data breach incident; and
  • Offer choice, where required; as all data subjects have the free will to choose how and for what purpose PPS uses information relating to them during and after their contractual relationship.

This Policy demonstrates PPS' commitment to protecting the privacy rights of data subjects by:

  • Stating desired behaviour and directing compliance with the provisions of POPIA including best practice;
  • Developing and implementing internal controls for the purpose of managing the compliance risk associated with the protection of personal information;
  • Creating business practices that will provide reasonable assurance that the rights of data subjects are protected and balanced with the legitimate business needs of PPS;
  • By assigning specific duties and responsibilities to control owners, including the appointment of an Information Officer and where necessary, Deputy Information Officers in order to protect the interests of PPS and data subjects;
  • By raising awareness and providing guidance to employees and any other authorised individuals who process personal information when carrying out their duties or in terms of a scope of contract in order to ensure that they act confidently and consistently; and
  • Cultivating a culture within PPS that recognises privacy as a valuable human right.

4. SCOPE OF THIS POLICY

This Policy is relevant to PPS specifically all:

  • Branches, business units, divisions and subsidiaries within PPS;
  • Employees, independent contractors and volunteers;
  • Members;
  • Clients; and
  • Suppliers and any other persons acting on behalf of PPS.

POPIA does not apply in situations where the processing of personal information is concluded in the course of purely household or personal activities; or where the personal information has been de-identified (anonymised data).

The Policy applies to the entities within the PPS Group.

5. POLICY STATEMENT

PPS is committed to protecting the data subjects' privacy and ensuring their personal information is used appropriately, transparently, securely and in accordance with applicable laws.

6. KEY DEFINITIONS IN THIS POLICY

"Biometrics" means a technique of personal identification that is based on physical, physiological or behavioural characterisation including blood typing, fingerprint, DNA analysis, retinal scanning and voice recognition;

"Child" means a person under the age of 18 years;

"Consent" means any voluntary, specific and informed expression of will in terms of which permission is given for the processing personal information;

"Data subject" means the natural or juristic person to whom personal information relates, such as an individual member, employee or an entity that provides PPS with products or services;

"De-identify" in relation to personal information of a data subject, means to delete any information that identifies the data subject; can be used or manipulated by a reasonably foreseeable method to identify the data subject; or can be linked by a reasonably foreseeable method to other information that identifies the data subject, and "de-identified" has a corresponding meaning;

"Filing system" means any structured set of personal information, whether centralised, decentralised or dispersed on a functional or geographical basis, which is accessible according to specific criteria;

"Information Officer" means the head of a private body. Once appointed the Information Officer must be registered with the South African Information Regulator established under POPIA prior to performing his or her duties. Deputy Information Officers can also be appointed to assist the Information Officer;

"Deputy Information Officer" means the person to whom any power or duty conferred or imposed on an Information Officer in terms of POPIA has been delegated;

"Head" in relation to, a private body means:

  • in the case of a natural person, that natural person or any person duly authorised by that natural person;
  • in the case of a partnership, any partner of the partnership or any person duly authorised by the partnership;
  • in the case of a juristic person: the chief executive officer or equivalent officer of the juristic person or any person duly authorised by that officer; or the person who is acting as such or any person duly authorised by such acting person;

"Information Regulator" means the Regulator established in terms of section 39 of POPIA;

"Operator" means a person processing personal information for a responsible party in terms of a contract or mandate, without coming under the direct authority of that party e.g. a third party service provider that has contracted with PPS to shred documents containing personal information.

"Processing" means any operation or activity or any set of operations, whether by automatic means or not, concerning personal information, including:

  • the collection, receipt, recording, organisation, collation, storage, updating or modification, retrieval, alteration, consultation or use;
  • dissemination by means of transmission, distribution or making available in any other form; or products and legal matters relating to those products; or
  • merging, linking, as well as restriction, degradation, erasure or destruction of information.

"Record" means any recorded information:

  • regardless of form or medium, including any of the following: writing of any material; information produced, recorded or stored by means of any tape-recorder, computer equipment, whether hardware or software or both, or other device, and any material subsequently derived from information so produced, recorded or stored; label, marking or other writing that identifies or describes anything of which it forms part, or to which it is attached by any means; book, map, plan, graph or drawing; photograph, film, negative, tape or other device in which one or more visual images are embodied to be capable, with or without the aid of some other equipment, of being reproduced;
  • in the possession or under the control of a responsible party;
  • whether or not it was created by a responsible party and regardless of when it came into existence.

"Responsible party" means a public or private body or any other person which, alone or in conjunction with others determines the purpose of and means for processing personal information.

"Person" means a natural person or a juristic person;

"Personal information" means information relating to an identifiable, living, natural person, and where it is applicable, an identifiable, existing juristic person, including, but not limited to:

  • information relating to the race, gender, sex, pregnancy, marital status, national, ethnic or social origin, colour, sexual orientation, age, physical or mental health, wellbeing, disability, religion, conscience, belief, culture, language and birth of the person;
  • information relating to the education or the medical, financial, criminal or employment history of the person;
  • any identifying number, symbol, e-mail address, physical address, telephone number, location information, online identifier or other assignment to the person;
  • the biometric information of the person;
  • the personal opinions, views or preferences of the person;
  • correspondence sent by the person that is implicitly or explicitly of a private or confidential nature or further correspondence that would reveal the contents of the original correspondence;
  • the views or opinions of another individual about the person; and
  • the name of the person if it appears with other personal information relating to the person or if the disclosure of the name itself would reveal information about the person.

"Private body" means:

  • natural person who carries or has a carried on any trade, business or profession, but only in such capacity;
  • a partnership which carries or has carried any trade, business or profession;
  • any former or existing juristic person but excludes a public body.

"Public body" means:

  • any department of state or administration in the national or provincial sphere of government or any municipality in the local sphere of government; or
  • any other functionary or institution when exercising a power or performing a duty in terms of the constitution; or exercising a public power or performing a public function in terms of any legislation.

"Special personal information" means personal information concerning:

  • the religious or philosophical beliefs, race or ethnic origin, trade union membership, political persuasion, health or sex life or biometric information of a data subject; or
  • the criminal behaviour of a data subject to the extent that such information relates to the alleged commission by a data subject of any offence; or any proceedings in respect of any offence allegedly committed by a data subject or the disposal of such proceedings.

7. PRINCIPLES

All employees and persons acting on behalf of PPS will always be subject to, and act in accordance with, the following principles:

Principle 1: Accountability and open communication

PPS upholds and maintains an approach of transparency of operational procedures that controls its collection and processing of personal information. PPS is committed to complying with all applicable regulatory requirements related to the collection and processing of personal information. Reasonable measures will be taken to ensure that data subjects are notified (are at all times aware) that their personal information is being collected (directly from the data subject or from an external source e.g. media). PPS is responsible for ensuring that the data subjects are aware that:

  • Their personal information is being collected; and
  • PPS is the responsible party collecting the personal information by providing the necessary details; including specific reasons for the collection of such information.

PPS will establish and maintain a platform for data subjects who want to:

  • Enquire whether PPS holds related personal information; or
  • Request PPS to update or correct related personal information; or
  • Make a complaint concerning the processing of personal information.

Principle 2: Processing limitation

PPS will ensure that personal information under its control is processed:

  • In a fair, lawful and non-excessive manner; and
  • In a reasonable manner that does not infringe the privacy of the data subject.

PPS will inform the data subject of the reasons for collecting his/her or its personal information and obtain written consent, where required, prior to processing personal information. Alternatively, where services or transactions are concluded over the phone or electronic video feed, PPS will maintain a voice recording of the stated purpose for collecting the personal information followed by the data subject's subsequent consent, where required.

Where applicable, the data subject will be informed of the possibility that their personal information will be shared with other entities within the PPS and be provided with reasons for doing so.

Principle 3: Purpose specification

PPS will process personal information only for specific, explicitly defined and legitimate reasons. Data subjects will be informed of these reasons when collecting or recording the data subject's personal information.

Principle 4: Further processing limitation

Personal information will not be processed for a secondary purpose unless that processing is compatible with the original purpose. Therefore, where PPS seeks to process personal information it holds for purpose other than the original purpose for which it was collected, and where this secondary purpose is not compatible with the original purpose, PPS will first obtain consent from the data subject.

Principle 5: Information quality

PPS undertakes to take reasonable steps to ensure that personal information collected is complete, up to date, accurate and not misleading. This means that it may be necessary to request data subjects from time to time to update their information and confirm that it is still relevant.

Where personal information is collected or received from third parties, PPS will take reasonable steps to confirm that the information is correct by requesting the third party to confirm the accuracy of the information.

Principle 6: Security safeguards

PPS undertakes to secure the integrity and confidentiality of personal information in its possession as personal information is at great risk of loss, breach of confidentiality, corruption, hacking or theft when it is accessed or used. PPS will provide the necessary reasonable security of data and keep it in accordance with prescribed legislation.

PPS will manage the security of its filing system to ensure that personal information is adequately protected to this end, security controls will be appropriate to minimise the risk of loss, unauthorised access, disclosure, interference, modification or destruction. PPS will regularly review its security controls which will include regular testing of protocols and measures implemented to combat cyber-attacks on the PPS IT network. All hardcopy and electronic records comprising of personal information will be securely stored and made accessible only to authorised persons.

All employees' employment contracts contain contractual terms for the use and storage of employee information. Confidentiality clauses are included to reduce the risk of unauthorised disclosures of personal information for which PPS is responsible.

PPS operators are required to enter into service level agreements with PPS where both parties pledge their mutual understanding and commitment to POPIA and the lawful processing of any personal information pursuant to the agreement.

Principle 7: Processing of personal information

Personal Information will only be used for the purpose for which it was collected and agreed upon. This may include, but not limited to:

  • Provide financial products or services to members and clients and to carry out the transactions requested;
  • Provide financial services to members and clients to carry out the services requested, to maintain and constantly improve the relationship;
  • For underwriting purposes;
  • Assess and process claims;
  • Conduct credit reference searches or verification;
  • Confirm, verify and update members and client details;
  • For purposes of claims history;
  • For the detection and prevention of fraud, crime, money laundering or any other misconduct;
  • For market or customer satisfaction research;
  • For audit and record keeping purposes;
  • In connection with legal proceedings; and
  • In connection with and to comply with legal and regulatory requirements or when it is otherwise allowed by law.

Personal Information that is received via a third party for further processing, this further processing must be compatible with the purpose for which the data was initially collected.

Principle 8: Data subject participation

A data subject may request the correction or deletion of his, her or its personal information held by PPS. The process described in the PPS Group Information and Privacy Standard will be provided for data subjects who want to request the correction or deletion of their personal information.

8. RIGHTS OF DATA SUBJECTS

Where appropriate, PPS will ensure that data subjects are made aware of the rights conferred upon them as data subjects. PPS will ensure that it gives effect to the following rights:

The right to access personal information

PPS recognises that a data subject has the right to establish whether the organisation holds personal information related to him or her, including the right to request access to that personal information.

In addition, data subjects have the right to:

  • Request what personal information PPS holds about them and why;
  • Be informed on how to keep their personal information up to date.

Access to information requests can be made by email and the prescribed form, addressed to the Information Officer.

The right to have personal information corrected or deleted

A data subject has the right to request the correction or deletion of personal data that is inaccurate, incomplete, unnecessary, and excessive or where PPS is no longer authorised to retain personal information.

The right to object to the processing of personal information

The data subject has the right, on reasonable grounds to object to the process of his, her or its personal information. In such circumstances, PPS will give due consideration to the request and the requirements of POPIA. PPS may cease to use or disclose the data subject's personal information and may, subject to any statutory and contractual recordkeeping requirements, also approve the destruction of the personal information. Objecting to processing of personal information may in some instances lead to the cancellation of financial products.

The right to object to direct marketing

The data subject has the right to object to the processing of his, her or its personal information for purposes of direct marketing by means of unsolicited electronic communications.

The right to complain

The data subject has the right to submit a complaint to PPS and to the South African Information Regulator regarding an alleged infringement of any of the rights protected under POPIA and to institute civil proceedings regarding the alleged non-compliance with the protection of his/her or its personal information.

The right to be informed

The data subject has the right to be notified that his, her or its personal information is being collected by PPS where reasonable. Furthermore, the data subject has the right to be notified in any situation where PPS has reasonable grounds to believe that the personal information of the data subject has been accessed by an unauthorised person.

9. PERSONAL INFORMATION OF A CHILD

PPS undertakes to ensure that lawful processing of the personal information of a child takes place where the child is under the age of 18 and such processing is limited to the extent that consent is given or authorised by the holder of parental responsibility over the child, or other competent person or where a lawful reason exists.

10. SPECIAL PERSONAL INFORMATION

PPS undertakes to maintain processes in place to:

  • Identify special personal information held or requested, on information technology systems or other documents;
  • Ensure that special personal information is processed only when: the data subject has consented to the processing; a competent person has consented to the personal information relating to a child; processing is necessary for the establishment, exercise or defence of a right; the information has deliberately been made public by the data subject; or processing is necessary to comply with an obligation of international public interest.

11. INFORMATION OFFICERS

PPS will appoint Information Officers and where necessary, Deputy Information Officers to assist the Information Officers. The Information Officers and their deputies are responsible for ensuring compliance with POPIA and PAIA which include attending to requests for personal information, related queries and complaints made to PPS in accordance with the PPS Group Information and Privacy Standard by data subjects and the Information Regulator. Once appointed, the Information Officers will register with the South African Information Regulator established under POPIA.

12. COMPLAINTS PROCEDURE

Data subjects have the right to complain in the event where any of their rights in terms of POPIA have been infringed. PPS takes all complaints in a serious light and will address all personal information and privacy related complaints in accordance with its documented procedure.

13. PUBLICATION OF THE PPS GROUP PRIVACY POLICY

The Policy is published internally and made available to all employees on the PPS intranet. The policy is available to the public on written request to PPS through the website www.pps.co.za. Such written request can be in electronic form.

14. ACCOUNTABILITIES AND RESPONSIBILITIES FOR COMPLIANCE

All employees and management of PPS will continually be responsible for ensuring the safeguarding, protection and avoidance of any unauthorised disclosure or breach of personal information in the execution of their duties.

The PPS Boards

The PPS Boards are ultimately responsible for ensuring that PPS meets its legal obligations in terms of POPIA, regulation, directives, supervisory requirements and internal policies and supporting standards relating to the protection of personal information. Their roles and responsibilities are to:

  • approve and adopt this Policy;
  • promote a culture of personal information protection and compliance;
  • ensure that the risk of unlawful processing of personal information and data breaches are assessed and considered as part of the PPS risk assessment and strategic plans; and
  • monitor management reports on processing of personal information and data breach risks, policies, and control activities, which include obtaining assurance that the controls are effective.

Risk Committee

Risk Committee, for the purposes of this Policy, includes the Audit & Risk Committee in respect of any relevant PPS subsidiary. It is accountable for ensuring the protection of personal information, and its roles and responsibilities are to:

  • review this Policy and recommend its approval to the PPS Boards;
  • monitor compliance with the protection of personal information;
  • receive reports on unlawful processing of personal information and data breach activities; and
  • ensure that appropriate plans for corrective action are put in place following the detection or reporting of unlawful processing of personal information and data breach activities.

Chief Executive Officer (CEO) of PPS

The CEO ensures the lawful processing of personal information and is accountable to the PPS Boards for the effective operation of compliance with POPIA. The role includes to:

  • appoint Information Officers and where relevant Deputy Information Officers;
  • ensure that there is liaison and co-operation with the Information Regulator in relation to investigations;
  • ensure that an overall compliance framework is developed, implemented and monitored for the protection of personal information;
  • ensure that adequate IT and operational systems are in place and well-maintained to protect and process requests for access to information; and
  • review reports on compliance status and deficiencies and ensure that corrective action is taken.

PPS Chief Information Officer

  • Ensure that the PPS IT infrastructure, filing systems and any other devices used for processing of personal information meet acceptable standards;
  • Ensure that all electronically held personal information is kept only on designated drives and servers and uploaded only to approved cloud computing services;
  • Ensure that servers containing personal information are sited in a secure location, with access security;
  • Ensure that all electronically stored personal information is backed-up and tested regularly;
  • Ensure that all back-ups containing personal information are protected from unauthorised access, accidental deletion and malicious hacking attempts;
  • Ensure that all personal information being transferred electronically is encrypted;
  • Ensure that all servers and computers containing personal information are protected by relevant up to date security software;
  • Arrange regular IT audits to ensure that security of the PPS hardware and software systems are functioning properly, and to verify whether electronically stored personal information has been accessed or acquired by any unauthorised persons;
  • Investigate and report to the Committee any suspected data breaches;
  • Set and recommend any IT policies relating to how PPS collects, holds, shares, uses, discloses, destroys and processes personal information; and
  • Establish a process for a proper due diligence review prior to contracting with operators or any other third party service providers to process personal information on behalf of PPS.

Information Protection Committees of PPS

An Information Protection Committee (Committee) is established and will convene on an ad hoc basis as and when required or when any issues of non-compliance and data breach activity is reported or suspected, or to discuss any compliance requirement or process. The Committee oversees the implementation of the Policy and has the primary responsibility for the investigation of all suspected data breaches and acts of non-compliance as defined in the Policy, ensuring the investigation is performed by a skilled forensic expert in collaboration with the relevant business area.

The Committee must receive a Report from the investigation expert addressing at least:

  • Details of the complaint received or data breach identified;
  • Details of the manner in which the investigation was conducted;
  • Summary of the evidence found and an assessment of the strength and validity of the evidence;
  • Details of any process or other relevant shortcomings identified during the investigations and proposed mitigating action; and
  • Proposal to the Committee on proposed action to be taken.

If the investigation substantiates that a data breach has occurred or personal information has been compromised, the Committee will make an assessment in terms of the PPS Information Security Incident Management Policy and relevant standards, and where relevant will notify the Information Regulator, appropriate designated personnel within PPS, and the Chairman of the Risk Committee.

Information Officers and Deputy Information Officers

They assist the CEO and the PPS Boards in ensuring compliance with the conditions of lawful processing of personal information and data breach risk management across PPS, and are appointed according to the legal and regulatory requirements. Their responsibilities include to:

  • take steps to ensure compliance with the provisions of POPIA;
  • review information protection procedures and related policies;
  • ensure that privacy notices for internal and external purposes are developed and published;
  • ensure that PPS makes it possible for data subjects to update their personal information or submit a POPIA related complaint;
  • address employees POPIA related questions, and all POPIA related requests and complaints made by data subjects;
  • oversee the awareness training of employees and other individuals involved in the processing of personal information on behalf of PPS;
  • liaise and work with the Information Regulator in relation to ongoing investigations, arising issues and reporting;
  • ensure that personal information impact assessments are done; and
  • ensure that a PAIA and POPIA Standard is developed, implemented and maintained.

Business Unit Management of PPS

  • Ensure that compliance requirements of this policy are incorporated in business processes;
  • Establish and maintain a protection of personal information compliance culture, in conjunction with the rest of management in the business unit;
  • Ensure that employees within the business unit are adequately trained on the requirements of this Policy;
  • Ensure that regular, risk-based compliance monitoring is conducted;
  • Report on any incidents to the compliance champion and Group Compliance or Subsidiary Compliance;
  • Take action to address such incidents; and
  • Confirm compliance with this policy when required.

Compliance and subsidiary companies Compliance Officers

  • Oversee compliance across PPS;
  • Set and recommend this Policy and the Privacy Standard for approval;
  • Give guidance and advice to business on the legislative requirements;
  • Evaluate effectiveness of procedures and controls adopted to accommodate any legislative changes;
  • Accountable for statutory reporting requirements;
  • Assist with implementing procedures for reporting compliance breaches;
  • Develop systems for monitoring compliance and keep a record of all monitoring conducted;
  • Report to the risk committee, executive committee and applicable regulators; and
  • Ensure recommendations from the PPS Boards, risk committee, management and applicable regulators are attended to.

PPS Marketing

  • Maintain the protection of personal information statements and disclaimers that are displayed on the PPS website and mobile applications, including those attached to communications such as emails and electronic newsletters;
  • Keep record of processing and marketing consents received;
  • Address any personal information protection queries from journalists or media outlets; and
  • Ensure that marketing initiatives comply with POPIA.

Employees and other persons acting on behalf of PPS

  • Comply with this Policy and supporting standards.

15. POLICY ADMINISTRATION

Target audience: the PPS Boards, all PPS management and employees.

Approved and issued by: the PPS Insurance Board.

Person responsible for Policy administration: Leon du Plessis, Head of Legal & Compliance, PPS, +27 11 644 4491.

Version 1.0, valid from July 2021.

Next update required: July 2024 or when legislative changes require it.