Protection of Personal Information Policy

• PAIA The Promotion of Access To Information Act
• POPIA The Protection of Personal Information Act
• SAHRC South African Human Right Commission

• Body An organisation or person (private body means a private organisation or person).
• Competent person A person who is competent to provide consent on behalf of a child.
• Consent The consent of the data subject unless otherwise indicated.
• Data subject A person about whom data or information is held by another person or body.
• Information This usually refers specifically to personal information collected about a data subject.
• Record An instance of data about a data subject which is held by a person or body.
• Requester A person requesting information from a body.
• Personal information Information that identifies and describes a data subject.

BOOK / DOCUMENT AUTHOR / PUBLISHER / AUTHORISED BY

• POPI (The protection of personal information act) The Government Gazette /  www.gov.za
• PAIA Act (The promotion of access to information act) The Government Gazette /  www.gov.za
• The Constitution of South Africa The department of Justice and Constitutional Development / justice.gov.za
• General reference to public information The department of Justice and Constitutional Development / justice.gov.za
• General reference to public information The South African Human Rights Commission / sahrc.org.za

1. Persons’ right to privacy is properly balanced against the right of access to information (POPIA as it relates PAIA).
2. Important interests are protected, which includes the free flow of information within South Africa and across international borders. 
3. The manner in which personal information may be processed is regulated. This is done by establishing conditions that are in harmony with international standards and lawful processing of information. 
4. Clients are provided with their rights and given access to remedies to protect their personal information.
5. Voluntary and compulsory measures are established, promoted, and enforced to fulfil the rights of our clients. 

1. Information that is entered into a record that is processed by non-automated means (i.e. processed by humans) and forms part of a filing system (or will in future). 
2. Information processed in South Africa and not simply forwarded through South Africa.
3. Vulcan Risk Solutions (Pty) Ltd may only process (and therefore by extension request and store) information if it meets the requirements.

• Minimality: The purpose for which information is processed is adequate, relevant, necessary, and not excessive. 
• Necessity: The purpose for which information is processed is necessary to carry out the actions required by a contract (e.g. the learner and training organisation contract, the consultancy contract , etc.). 
• Purpose: Information is only to be processed for specific, explicitly defined, and lawful purposes that are related to a function of Vulcan Risk Solutions (Pty) Ltd, and the data subject is made aware of the purpose (except where provisions are made in section 18(4) of the act). 
• Lawfulness: The purpose for which information is processed is to meet the requirements of a law. 
• Consent: The person whose information is processed provides consent. This applies to a “data subject” (a person), or “the competent person” (a person who can legitimately provide consent on behalf of a child).

• Accountability: Vulcan Risk Solutions (Pty) Ltd is responsible for ensuring conditions for lawful information processing and processing of information is carried out in a reasonable manner that does not infringe on the privacy of the data subject.
• Burden of proof: Vulcan Risk Solutions (Pty) Ltd is responsible for providing proof that consent was given by the data subject.
• Consent: The data subject provides consent. This applies to a “data subject” (a person), or a “competent person” (a person who can legitimately provide consent on behalf of a child).
• Withdrawal of consent: The data subject can withdraw their consent at any time provided that withdrawal does not affect other provisions in the act. 
• Objection: A data subject may object to the processing of their data at any time if the objection is done in prescribed manner, is on reasonable grounds, or is to exclude themselves from unsolicited electronic communications.
• Direct marketing: Processing information in the context of direct marketing is prohibited unless:
  • The data subject has given consent in the prescribed manner or form, or is a customer.
  • The data subject has been given reasonable opportunity to object without charging them, or giving them unnecessary admin to do so, and correspondence they receive has an address of the sender on it for the data subject to send their objections to.  
  • Vulcan Risk Solutions (Pty) Ltd has obtained the contact details of the data subject in the context of the sale of a product or service.
  • Vulcan Risk Solutions (Pty) Ltd has obtained the data subject’s contact details for the purpose of marketing Vulcan Risk Solutions (Pty) Ltd’s own similar products and services.
  • Vulcan Risk Solutions (Pty) Ltd has gained consent from a new data subject whose consent Vulcan Risk Solutions (Pty) Ltd did not previously have, but may only request it once and not keep requesting it. 
• Collecting information: Vulcan Risk Solutions (Pty) Ltd must collect data directly (rather than indirectly) from the data subject except where: 
  • The information is contained in or derived from a public record deliberately made by the data subject. 
  • The data subject has given consent.
  • Collecting the data from another source would not prejudice a legitimate interest of the data subject or where collection of the data is to comply with a law, to collect revenue, or is in the interest of national security. 
• Retaining information: Vulcan Risk Solutions (Pty) Ltd is not to retain information longer than what is necessary to achieve the purpose for which the information was collected, unless: 
  • Retention periods are required by law, or for lawful purposes related to Vulcan Risk Solutions (Pty) Ltd’s functions or activities.  
  • Consent is given by the data subject or a competent person.
  • Records are stored for historical or statistical research purposes, and there are sufficient means in place to ensure they are also safeguarded against other use.
• Deletion or destruction of information: Once information has served its purpose, it is to be deleted (thoroughly) after Vulcan Risk Solutions (Pty) Ltd is no longer authorised to retain it.
• Restrictions: Vulcan Risk Solutions (Pty) Ltd is to restrict processing of information if the data subject contests its accuracy or wants it transferred to a different automated system, or if it is unlawful to process it, or if it is no longer necessary to process it. 
  • This is true except where the information is stored and only processed for the purpose of proof, is in public interest, is processed with the data subject’s consent, or is processed for the protection of the rights of another person (natural or legal).  
• Further processing: There is a limitation on the further processing of personal information. Further processing must take into account the mandate, reasons, and purposes for processing it in the first place. 
• Information quality: Vulcan Risk Solutions (Pty) Ltd is to take reasonable and practicable steps to ensure personal information collected is complete, accurate, current, and not misleading. 
• Openness: The data subject is to be made aware of:
  • The information being collected (about them) and where it is collected from (if not being directly collected).
  • The purpose for the collection of information. 
  • The name and address of the party (i.e. Vulcan Risk Solutions (Pty) Ltd) collecting the information. 
  • The purpose for which the information is collected.
  • Whether or not the data subject has to supply the information (is it mandatory or optional), and the consequences of not supplying it.
  • The laws and legislations that authorise, mandate, condone, prohibit, or permit the collection of the information.
  • Disclosure where the information will be transferred to a third party, with information about the protection of the information afforded under that third party. 
• Data security: Vulcan Risk Solutions (Pty) Ltd is to have due regard for the security of the information collected to ensure it is safe from being lost or damaged, and safe from unlawful access. Generally accepted or industry specific information security practices are to be applied. Vulcan Risk Solutions (Pty) Ltd is to identify internal and external security risks and safeguard information accordingly. 
• Operator responsibility: When information is processed by an operator (i.e. staff of Vulcan Risk Solutions (Pty) Ltd) the operator is to treat the information as confidential and s to have signed a contract with Vulcan Risk Solutions (Pty) Ltd establishing the security of the information will not be compromised (as per section 19 of the act). In case of unauthorised access of information (or grounds to believe this has happened) Vulcan Risk Solutions (Pty) Ltd, the data subject, and the regulator are to be notified in the prescribed way, unless the act provides for otherwise (in section 22)
• Access: A data subject may request information about the personal information Vulcan Risk Solutions (Pty) Ltd may or may not have about them as follows: 
  • A data subject will need to provide identification when enquiring about whether or not Vulcan Risk Solutions (Pty) Ltd has information about them. Vulcan Risk Solutions (Pty) Ltd will need to respond to this request free of charge.
  • The data subject may further request Vulcan Risk Solutions (Pty) Ltd provide the record or a description of the data held, including identification of any 3rd parties who have had access to the information. Vulcan Risk Solutions (Pty) Ltd is to do this within a reasonable time, in a reasonable manner and format that is understandable, and may be done at a prescribed fee. 
  • Any fees charged as above are to be disclosed beforehand, and Vulcan Risk Solutions (Pty) Ltd can request deposit is paid in advance. 
  • Vulcan Risk Solutions (Pty) Ltd may and must disclose or refuse to disclose information based on the provisions of the acts. 
• Correcting and deleting: On the data subject’s request, Vulcan Risk Solutions (Pty) Ltd is to correct or delete personal information that is inaccurate, irrelevant, excessive, out-dated, incomplete, misleading, unlawful, or information Vulcan Risk Solutions (Pty) Ltd is no longer authorised to hold. If the data subject requests it Vulcan Risk Solutions (Pty) Ltd is to, as soon as possible, correct, destroy, or delete the information and provide credible evidence thereof. 
• Change disputes: If there is a dispute regarding the correcting and deleting information the information must be accompanied with an indication that the information was requested to be changed but was not. 
• Prohibition: Vulcan Risk Solutions (Pty) Ltd may not process information regarding religious beliefs, race or ethnic origin, trade union membership, political persuasion, health or sex life, biometric information, or criminal behaviour when the behaviour is only alleged. This is subject to the “general authorisation” and “specific authorisation” sections that follow.
• General Authorisation: Prohibition as above does not apply where:

1. Hazard and Risk Analysis and Reporting
2. Awareness material and document supply and creation of related products and services
3. Training in Incident Management System and Wildfire Preparedness
4. Personal Protective Equipment and Load Bearing Equipment design and manufacture

• Learning material and learner information and documents marketed by Vulcan Risk Solutions (Pty) Ltd.
• Products and services information including descriptions of products, and pricing structures.
• Contact details of Vulcan Risk Solutions (Pty) Ltd.
• “About us” information about the director and ethos of Vulcan Risk Solutions (Pty) Ltd.
• Guidance information pertaining the industry and environment this organisation operates in (articles on the website).
• Various marketing material and promotional material. 

• Contact information (clients, clients’ staff, suppliers, quality assurers)
• CV information (clients, clients’ staff)
• Financial information (clients)
• Organisation inception, structure, and management information (clients)
• Business and organisational planning information (clients)
• Marketing information (clients, suppliers)
• Lease agreements (clients)
• Project progress (clients, clients’ staff, quality assurers)
• Buying trends and spending information (clients, suppliers)
• Guidance information (provided to all)
• Policies and procedures (clients, clients’ staff, suppliers, quality assurers)
• Learning material (provided to all)
• Emails (all)

• The record is required for the exercising or protection of any rights
• The requester complies with the procedural requirements of PAIA and Vulcan Risk Solutions (Pty) Ltd.
• Access is not refused as per the provisions of PAIA.
• The above reasons are valid provided that the record requested by the requester contains information about that requester (or the person on whose behalf the requester is requesting information).

• The public body: The organisation that is a public organisation, which the requester is requesting information from.
• The information officer: The applicable and relevant person in the above organisation who the requester is requesting information from.
• Identification information about the record: Info on the record being requested to enable the public official to identify it (e.g. document number, or other identifying information about the record)
• Identification of the requester: The person requesting information and filling in this form; their identification information.
• Preferred form / type: The format in which the information is to be accessed (print, electronic, media etc.)
• Language:  The language the information is preferred to be in (e.g. English, Afrikaans, Xhosa, Zulu etc.). 
• Postal address: The address of the requester (e.g. the person or organisation represented by the person filling in this form).
• Who the information is requested on behalf of: if requesting information on behalf of another, the identification of that person. 
• Proof of the above: If the information is requested on behalf of another, proof of that.  
• Note: If there is a reason this form cannot be filled in (e.g. disability or illiteracy), information from the public body can be requested orally, and the public body is to reduce the request to the prescribed form (e.g. written) and provide a copy of that to the requester. 
• Note: The public body has a duty to assist requester as per section 19 of PAIA. Fees may be charged as per section 22 of PAIA. 
• Note: The public body may transfer the request (to a more relevant public body) within 14 days maximum, to the public body that is relevant, within the provisions of section 20 of PAIA.  If information is not provided within 90 days it is deemed as a refusal of the request. 
• Note: If the public body cannot find the record or states it does not exist, they will need to affirm this by way of affidavit or affirmation.

• Deposit: No deposits are payable, only full payment for each request type. 
• Hourly rate: R50 per hour for time reasonably required to attend to requests. 
• Request fee: R50 per request.
• Lodging of appeal: R50 per appeal lodged.
• Photocopies (text only): R1.20 per page.
• Pages of documents held in electronic form: R0.80.
• Copy of audio record: R10 per megabyte or part thereof.
• Copy of video record: R80 per gigabyte or part thereof.

• The requester makes the request using the prescribed form which is available in this manual.
• The requester makes payment for the request as per the fee structure. 
• The form (format) in which the record is to be given is noted and the requester informed. 
• Right of access is duly adhered to by this organisation, and the requester has access to information about rights of access as per this manual which they can review.
• The requester is given the forms and access to information about their right to appeal the fee structure if they wish to appeal.

• Vulcan Risk Solutions (Pty) Ltd will give the requester a written response that indicates the decision made to approve or refuse a request for information with reasons why. 
• Vulcan Risk Solutions (Pty) Ltd will give such notice within 30 days of the request. 
• Vulcan Risk Solutions (Pty) Ltd allows itself an additional 30 days (maximum) to review a request if it is complex or needs further consideration. Reason for any extension will be given to the requester. 

• The privacy of a third party who is a natural person.
• The commercial information of a third party including a public body.
• Confidential information of a third party. 
• Safety of an individual and protection of property.
• Protection of research information. 

• The fees charged 
• The form of access granted (e.g. electronic document when printed version is requested)
• Refusal of the requester’s request for access to a record
• The decision to extend the initial 30 day period to grant access
• The form in which the record is granted

• Lodge the appeal within 30 days of receiving the decision made by Vulcan Risk Solutions (Pty) Ltd.
• Send the request as per the email or physical address details of Vulcan Risk Solutions (Pty) Ltd as they are disclosed in this document.
• Describe and identify the subject of the appeal and state reasons for the appeal or complaint. 
• Provide proof of payment of the prescribed appeals fee.
• Use the prescribed form for the appeal.
• Specify the postal address or email address for Vulcan Risk Solutions (Pty) Ltd to respond to on the matter.

• Higher Education Act No. 101 of 1997.
  • Accounting records.
    
• Basic Conditions of Employment Act No. 75 of 1997
  • Employee personal information.
    
• Broad Based Black Economic Empowerment Act No. 53 of 2003
  • BEE records (e.g. of BEE activities this organisation is involved in.
    
• Employment Equity Act No. 55 of 1998
  • Records relating to the workforce and equity plans.
    
• Companies Act No. 71 of 2008
  • Company related documents and records, CIPC document etc.
    
• Compensation for Occupational Injuries and Health Diseases Act No. 130 of 1993
  • Record of employee wages, time worked, overtime etc.
    
• Consumer Protection Act No. 68 of 2008
  • Transactional information (clients and suppliers).
    
• Electronic Communications and Transactions Act No. 25 of 2002
  • Email communicative information.
    
• Labour Relations Act No. 66 of 1995
  • Employee disciplinary records.
    
• Occupational Health and Safety Act No. 85 of 1993
  • Health and safety records.
    
• Prevention and Combating of Corrupt Activities Act No. 12 of 2004
  • Records of bribery and corruption.
    
• Regulation of Interception of Communications and Provision of Communication Related Information Act No. 70 of 2002 (“RICA”)
  • Client identification information.
    
• Skills Development Act no. 97 of 1998
  • Learnership information.
    
• Unemployment Insurance Act No. 30 of 1996
  • UIF payment information