PRIVACY POLICY

INTRODUCTION

  1.  

This Privacy Policy guides the protection and management of personal information when the Bateleur Bastion Homeowners Association (“the Association”) is processing information for its operational purposes as required by the Protection of Personal Information Act, 4 of 2013 (“the Act”). Personal information is defined in the Act as information relating to an identifiable, living in natural person and where applicable, an identifiable, existing juristic person. (Referred to as “data subjects”.) This includes information such as a person’s name, birthdate, photo, or address which could cause harm if misused. In the event of any questions regarding the provisions of this policy, your rights in terms thereof or any data privacy issues, you may contact the Association’s Information Officer, being the Chairperson of the Association’s Board of Directors, for his or her attention.

PRIVACY POLICY STATEMENT

 

  1.  

The Board And Management of the Association shall establish data processing processes compliant with the Act and are committed to safeguard the personal information of all persons.

ACCOUNTABILITY

  1.  

The Association shall comply with all applicable legislation relating to personal information and will ensure that when collected and used it is done in accordance with the law. Measures will be taken to ensure that the prescripts of the Act when deciding on why and how personal information is to be processed initially as well as in the course of subsequent processing.

PROCESSING LIMITATION

  1.  

The Association shall process personal information lawfully and without infringement of data subjects’ privacy (section 9 of the Act); shall only process personal information if it is adequate, relevant and not excessive, that is, only to the extent necessary for its purposes (section 10 of the Act); shall only process information upon having obtained consent, or where needed to ensure completion of a contract with a data subject, or if obliged by any other law to do so, protecting the data subject’s legitimate interest such as giving personal information to medical staff in an emergency, or if it is in the Association’s or a third party’s legitimate interest. The Association shall allow a data subject to withdraw consent to processing or to object to processing information at any time in which event will be terminated provided that the Association is not compelled to continue doing so by law (section 11 of the Act); and shall always collect personal information directly from a data subject unless the law permits it to do so otherwise – such as where the information is publicly available or the data subject has published in information him or herself.

PURPOSE SPECIFICATION

  1.  

The Association will:

  • Not collect personal information unless it is for a specific and lawful purpose and related to its activities, ensuring that the data subject knows why it is being collected unless the law excuses it from doing so;
  • not keep a data subject’s personal information for longer than is necessary to satisfy the purpose for which it was collected and processed; but will keep such information for longer if the law requires it to do so, its activities require it, a contract with the data subject requires it to do so, or the data subject has consented thereto;
  • will keep records of any personal information used to make a decision about a data subject for any period required by law;
  • dispose of personal information records as soon as possible after it is no longer permitted to retain those records and shall do so in a way preventing the records from being reconstructed;
  • restrict the processing of personal information if:
  • accuracy of the personal information is contested by the data subject, for a period enabling the Association to verify the accuracy of the information;
  • it no longer needs the personal information for achieving the purpose for which it had been collected or subsequently processed, unless it has to be maintained for purposes of proof;
  • the processing is unlawful and the data subject opposes its destruction or deletion and requests the restriction of its use instead.
  • Summarised, the Association will only keep personal information for as long as is necessary for the purposes for which it was collected and processed and will comply with its records retention procedures as revised from time to time.

FURTHER PROCESSING LIMITATION

  1.  

If the Association engages in further processing of personal information, it will only do so if it is compatible with the original purpose for which it was collected, or if it is permitted or required by law. (Section 15 of the Act).

  1.  

Whether processing relates to sensitive personal information or the Association is not satisfied that the processing accords with the reasonable expectation of a data subject, the latter’s consent may be necessary.

INFORMATION QUALITY OF

  1.  

The Association shall keep personal information accurate and up-to-date and will take reasonably practicable steps to ensure personal information held is complete, accurate, not misleading; but data subjects are encouraged to inform the Association of personal information changes. The taking of reasonably practicable steps may include SMSs, messaging platforms, telephone calls or emails data subjects requesting them to confirm personal information being processed. (Section 16 of the Act).

OPENNESS

  1.  

Data subjects will always be informed how their personal information will be used. There will be provided with:

  • full particulars of the Association including its name, registration number, address and contact details;
  • whether the supply of the information is voluntary or mandatory;
  • the consequences of failing to provide the information;
  • the applicable laws that authorise or require the collection of information;
  • whether the Association intends on transferring the information to a third party;
  • information about a data subject’s rights in respect of their personal information including the right to access and rectify it, to object to the processing thereof, and to lodge complaints;
  • the uses and disclosures made of their personal information including the secondary uses and disclosures thereof; and
  • the recipients or categories of recipients of their personal information.
  1.  

This information must be provided before the personal information is collected from the data subject all, if not practicable at the point of collection, as soon as possible after that. If the Association obtains a data subject’s personal information from a source other than the data subject, it will disclose the source from which the information is collected when the data subject’s personal information is first recorded or, if it is to be disclosed to a third party, no longer than the time when the data is first disclosed. (Sections 17 and 18 of the Act).

SECURITY SAFEGUARDS

  1.  

The Association shall adhere to IT security safeguards and shall implement appropriate technical and organisational measures to protect personal information against accidental or unlawful destruction, being lost or damaged, and protect it against unauthorised disclosure or access, in particular where processing involves transmission of personal information over a network, and against all other unlawful forms of processing. The Association will implement and comply with breach notification policies as required by applicable data privacy laws.

  1.  

The Association shall ensure that its service providers adopt appropriate and equivalent security measures. South African law requires that where a service provider to the Association has access to a customer, employee or supplier personal information (e.g. a payroll provider), strict contractual obligations, confirmed in writing, dealing with the security of that information I imposed, consistent with the applicable laws of South Africa, to ensure that such service providers act only on the Association’s instructions when using the information, and that they have in place the technical and organisational security measures to safeguard personal information. (Sections 19 to 22 of the Act).

DATA SUBJECT PARTICIPATION

  1.  

The Association shall adhere to the data subject access request procedure and be receptive to any queries or requests made by data subjects in connection with their personal information.

  1.  

Data subjects are entitled upon written request to be supplied with a record of the personal information held about them, whether in electronic or paper records, together with certain other details such as their rights in relation to their personal information. (Known as the right of subject access in South Africa data protection law.) The Association shall follow the steps set out in the data subject access request procedure when dealing with requests from data subjects for access to their personal information. (Sections 23 to 25 of the Act).

  1.  

The Association will deal with requests to delete, rectify or block in accurate personal information or to cease processing personal information in accordance with the data subject access request procedure.

  1.  

Data subjects are entitled to request rectification, deletion, blocking or completion, as appropriate, of their personal information which is shown to be inaccurate or incomplete and, in certain circumstances, the object to the processing of their personal information. In such circumstances the Association will follow the steps set out in the data subject access request procedure.

SAFEGUARDING THE USE OF SPECIAL PERSONAL INFORMATION

  1.  

Special personal information is information relating to a data subject’s racial or ethnic origin, political opinions, religious or other beliefs, trade union membership, health, sex life, biometric information or criminal convictions. The Association will only use special personal information if it is absolutely necessary to use it. Should the Association in future be required to process special personal information, specific authorisation is required based on the type of special personal information concerned.

  1.  

Special personal information will only be used where the data subject’s express consent has been obtained, unless the Association has an alternative legitimate basis for doing so, consistent with the applicable data privacy laws. (Sections 6 to 33 of the Act.)

SAFEGUARDING THE USE OF PERSONAL INFORMATION OF CHILDREN

  1.  

The Association will only process personal information of children if it is absolutely necessary to use it. It will assess whether personal information of children is required for the proposed use and when it is absolutely necessary in the context of its operations. The Association will ensure that the personal information of children is processed in accordance with the conditions contained in this policy and applicable data privacy laws. It will only use personal information of children with the express consent of a competent person has been obtained, unless the Association has an alternative legitimate basis for doing so, consistent with the applicable data privacy laws. (Sections 34 and 35 of the Act).         

DESTRUCTION OF PERSONAL INFORMATION

20.

As soon reasonably practicable after the Homeowners Association no longer has any justification to retain the personal information it will be destroyed.  Personal Information will be considered destroyed if it cannot be reconstructed in an intelligible form.

MANAGEMENT

BATELEUR BATION HOMEOWNERS ASSOCIATION