Disclaimer
DISCLAIMER
NOTE: This e-mail message and all attachments thereto contain confidential information intended for the addressee of this mail. If you are not the addressee (a) you may not disclose, copy, distribute or take any action based on the contents hereof; (b) kindly inform Sturrock and Robson IT Administrator srithelpdesk@sturrocksa.co.za immediately and destroy all copies hereof. Any copying, publication or disclosure of this message, or part hereof, in any form whatsoever, without Sturrock and Robson’s express written consent, is prohibited. No opinion expressed or implied by sender necessarily constitutes the opinion of Sturrock and Robson. This message does not constitute a guarantee or proof of the facts mentioned herein. No Employee or intermediary is authorised to conclude a binding agreement on behalf of Sturrock and Robson, or any of its subsidiary companies, by e-mail without the express written confirmation by a duly authorised representative of Sturrock and Robson. Sturrock and Robson processes your data in accordance with Generally Accepted Data Privacy Principles, We encourage you to consult our Privacy Policy, where the details of such processing are set out.
HOW LONG WE WILL STORE YOUR PERSONAL INFORMATION
The length of time that we will store your data will depend on the ‘legal basis’ for why we areusing that data, as follows:
| Legal basis | Length of time |
|---|---|
| Where we use/store your data because it is necessary for the performance of the contract between you and us. | We will use/store your data for as long as it is necessary for the performance of the contract between you and us. |
| Where we use/store your data because it is necessary for us to comply with a legal obligation to which we are subject. | We will use/store your data for as long as it is necessary for us to comply with our legal obligations. |
| Where we use/store your data because it is necessary for our legitimate business interests. | We will use/store your data until you ask us to stop. However, if we can demonstrate the reason why we are using/storing your data overrides your interests, rights and freedoms, then we will continue to use and store your data for as long as it is necessary for the performance of the contract between you and us (or, if earlier, we no longer have a legitimate interest in using/storing your data). |
| Where we use/store your data because you have given us your specific, informed and unambiguous consent. | We will use/store your data until you ask us to stop. |
To determine the appropriate retention period for personal information, we consider the amount, nature and sensitivity of the personal information, the potential risk of harm from unauthorised use or disclosure of your personal information, the purposes for which we process your personal information and whether we can achieve those purposes throughother means, and the applicable legal requirements.
YOUR RIGHTS
You have various legal rights in relation to the information you give us, or which we collect about you, as follows:
- You have a right to access the information we hold about you, together with various information about why and how we are using your information, to whom we may have disclosed that information, from where we originally obtained the information and for how long we will use your information.
- You have the right to ask us to rectify any information we hold about you that is inaccurate or incomplete.
- You have the right to ask us to erase the information we hold about you (the ‘right to be forgotten’). Please note that this right can only be exercised in certain circumstances and, if you ask us to erase your information and we are unable to do so, we will explain why not.
- You have the right to ask us to stop using your information where: (i) the information we hold about you is inaccurate; (ii) we are unlawfully using your information; (iii) we no longer need to use the information; or (iv) we do not have a legitimate reason to use the information. Please note that we may continue to store your information, or use your information for the purpose of legal proceedings or for protecting the rights of any other person.
- You have the right to ask us to transmit the information we hold about you to another person or company in a structured, commonly used and machine -readable format. Please note that this right can only be exercised in certain circumstances and, if you ask us to transmit your information and we are unable to do so, we will explain why not.
- Where we use/store your information because it is necessary for our legitimate business interests, you have the right to object to us using/storing your information. We will stop using/storing your information unless we can demonstrate why we believe we have a legitimate business interest which overrides your interests, rights and freedoms.
- Where we use/store your data because you have given us your specific, informed and unambiguous consent, you have the right to withdraw your consent at any time.
- You have the right to object to us using/storing your information for direct marketing purposes.
If you wish to exercise any of your legal rights, please contact us by writing to the address at the top of this policy, or by emailing us at dataprotection@sturrockandrobson.com
You also have the right, at any time, to lodge a complaint with the Information Commissioner’s Office for personal information processed in the UK or the Information Regulator for personal information processed in SA at inforeg@justice.gov.za if you believe we are not complying with the laws and regulations relating to the use/storage of the information you give us, or that we collect about you.
AUTOMATED DECISION -MAKING
We do not use automated decision making processes.
THIRD PARTY LINKS
Our website may include links to third -party websites, plug -ins and applications. Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control these third -party websites and are not responsible for their privacy statements. When you leave our website, we encourage you to read the privacy notice of every website you visit.
CHANGES TO OUR POLICY
Any changes we make to our policy in the future will be posted on our website and, where appropriate, notified to you by email. Please check our website frequently to see any updates or changes to our policy.
CONTACT
We have appointed Data Protection Officer / Information Officers who are responsible for overseeing questions in relation to the Privacy Policy. Questions, comments and requests regarding this policy are welcomed and should beaddressed to us by writing to the address at the top of this
policy, or by emailing us at dataprotection@sturrockandrobson.com
STURROCK AND ROBSON GROUP BINDING CORPORATE RULES
OBJECTIVE AND SCOPE
- Binding Corporate Rules(“BCRs”) are legally binding and enforceable internal rules and policies for data transfers within multinational group companies. BCRs permit multinational companies to transfer personal information internationally within the same corporate group to countries that do not provide an adequate level of protection for personal data as required under the Protection of Personal Information Act, 2013 (“POPIA”) or other relevant data protection laws, such as General Data Protection Regulation (“GDPR”).
- The aim of Sturrock and Robson S.à r.l. (the “Company“) is to apply uniform, adequate and global data protection and privacy standards for the handling of personal information of data subjects throughout the Company, its affiliated companies, subsidiaries, partnerships joint ventures, successors and assigns, and their directors, officers and employees (collectively, the “Group”).
- These BCRs are corporate directives that apply to the processing and/or transferring of Personal Information by the Group.
DEFINITIONS
- Personal information means information relating to an identifiable, living, natural person, and where it is applicable, an identifiable, existing juristic person. An identifiable person is an individual or entity who can be identified, directly or indirectly, based upon the information collected about the individual (“Personal Information”).
- A User in these BCRs refer to the person to whom Personal Information relates and that has utilised a Service provided by a Group entity or provided a Service to a Group entity or been employed within the Group. The term Service applies to a service and/or product offered / procured by a Group entity by the Company for use by a User.
- Processing means any operation or activity or any set of operations, whether or not by automatic means, concerning personal information, including the
– collection, receipt, recording, organisation, collation, storage, updating or modification, retrieval, alteration, consultation or use;
– dissemination by means of transmission, distribution or making available in any other form; or
– merging, linking, as well as restriction, degradation, erasure or destruction of information. - The Group does not during the ordinary course of business process Personal Information revealing the religious or philosophical beliefs, race or ethnic origin, trade union membership, political persuasion, health or sex life or biometric information or criminal records of a User (“Special Personal Information”). However, should the processing of ‘special category’ data or “special personal” information be required, this will be conducted only with your consent, upon disclosure of the purposes for which such ‘special category’ data or “special personal” information is processed or if we are required to do so to comply with obligations imposed on us by law to exercise a legal right, or for making or defending legal claims.
APPLICATION OF LAWS
- With varying legal requirements throughout the world relating to data protection, these BCRs establish a consistent set of requirements to help ensure the appropriate use of User Personal Information.
- All Group entities are obliged to comply with these BCRs when processing the Personal Information of Users. Additionally, all employees of the Group entities should follow these BCRs.
- These BCRs are global User Personal Information processing directives for the Group. Collection and processing of User Personal Information shall occur in accordance with the Service’s term and conditions, the law applicable to the User and the directives established by these BCRs. Where the applicable law is more protective than the directives set out in these BCRs, the Group entities will process User Personal Information in accordance with the applicable law. If the applicable law provides for a lower level of protection, the directives of the BCRs shall apply. Where an employee of the Group is not sure which of the two is more protective, they must email dataprotection@sturrockandrobson.com for clarity.
- Where a Group entity has reason to believe that an applicable law may prevent compliance with the BCRs resulting in a substantial effect on the protections provided by the BCRs, the Group entity will promptly inform the Company Information Officer at dataprotection@sturrockandrobson.com
PURPOSE OF PROCESSING PERSONAL INFORMATION
- Each Group entity must ensure that the Groups privacy policy adequately discloses the nature and type of Personal Information processed and transferred by each entity.
- Where the Group entity transfers Personal Information to a third party, the Group’s privacy policy must describe the security safeguards in place to protect the Personal Information. Processing of Personal Information must be limited to the purposes and conditions described in the privacy policy and in any other agreement with the User. Further processing in a way incompatible with those purposes will not take place unless a User is notified and consent is received according to applicable law.
- The privacy policy shall be accessible via a link in a prominent location of each entity and/ or provided when the Services are rendered according to applicable law regarding the processing of Personal Information.
CONDITIONS FOR PROCESSING PERSONAL INFORMATION
The Group observes the following conditions for the lawful processing of Personal Information (the “Conditions”):
- Condition 1 – Accountability:
– The party collecting the Personal Information must ensure it is done so lawfully, fairly and in a transparent manner. - Condition 2 – Processing Limitation:
– Personal Information can be collected or stored only if it is necessary for, or directly related to, a lawful, explicitly defined purpose and does not intrude on the privacy of the User to an unreasonable extent.
– Personal Information must be collected directly from and with the consent of the User. - Condition 3 – Purpose Specification:
– Users must be informed of the purpose of any such collection and of the intended recipient of the Personal Information at the time of collection.
– Personal Information must not be kept for any longer than is necessary for achieving the purpose for which it was collected. - Condition 4 – Further Processing Limitation:
– Personal Information must not be distributed in any way which is incompatible with the purpose for which it was collected. - Condition 5 – Information Quality:
– Reasonable steps must be taken to ensure that the Personal Information processed is accurate, up to date and complete. - Condition 6 – Openness:
– The User whose information you are collecting must be aware that the Company and/or Group is collecting and processing their Personal Information.
– They must be notified of the fact either before or as soon as reasonably possible after collection of the Personal Information, even if you get it from a third party. - Condition 7 – Security Safeguards:
– Appropriate technical and organisation measures have to be taken to safeguard the User against the risk of loss, damage, destruction of or an authorised access to Personal Information. - Condition 8 – Data Subject Participation:
– Users are allowed the right to access their Personal Information and have a right to demand correction of such information should it turn out to be inaccurate. - Adherence to the Conditions may be limited in certain cases to the extent necessary to meet national security, public interest, or law enforcement requirements.
TRANSFERRING AND SHARING PERSONAL INFORMATION
- The Group entities share Personal Information in the normal course and scope of business with other the Group entities worldwide to facilitate the Services, prevent fraud, provide joint content and Services.
- The Group entities may transfer Personal Information to other Group entities worldwide when there is a legitimate business need, sufficient technical and organizational security measures exist and the recipient has complied with the BCRs or provides an adequate level of protection when processing Personal Information.
- The Group entities may share Personal Information with third party processors (such as service providers or vendors) worldwide who help with their business operations. The Group’s Privacy Policy further describes the types of third parties the Company may share Personal Information with and under what circumstances. Contracts with third party processors require sufficient technical and organisational security measures, limit the use of Personal Information to purposes defined by the Company and retain control of Personal Information where applicable. Agreements with third party processors provide for legal remedies in the event of a breach of the agreement.
- According to applicable law, treaties or applicable international conventions, the Group entities may share Personal Information with law enforcement, regulatory authorities or other third parties when: required as a matter of law; it is necessary to protect the Company’s rights; it is necessary to keep the Services free from abuse; or there is a legitimate purpose (e.g., to prevent imminent physical harm, financial loss or to report suspected illegal activity).
- The Group entities may disclose Personal Information to other third parties for the third party’s own purposes in accordance with the User’s instructions or with the unambiguous informed consent of the User (where permissible under applicable law).
SECURITY, CONFIDENTIALITY AND AWARENESS TRAINING
- The Group uses physical, technical and organisational security controls commensurate with the amount and sensitivity of the Personal Information to prevent unauthorised access, use, loss, destruction and damage. The Group uses encryption, firewalls, access controls, Antivirus, Anti-Malware Software, operational security, and physical security controls and standards and other procedures to protect Personal Information from unauthorized access. Physical and logical access to electronic and hard copy files is further restricted based upon job responsibilities and business needs.
- The Group conducts privacy and information security awareness training to emphasise and inform employees of the need to protect and secure Personal Information. Access to Personal Information shall determine the need for additional training relating to specific policies as well as these BCRs.
- A copy of these BCRs and other relevant privacy and security related policies and procedures are available to employees at any time.
USER RIGHTS
- Users must be afforded the following rights in relation to their Personal Information:
– The right to request the Group to confirm whether or not it holds any of the Users Personal Information;
– The right to request the Group to amend incorrect or incomplete Personal Information;
– The right to object to, or require the Group to stop, processing their Personal Information, for example where the processing of the Personal Information is no longer necessary;
– The right to request the Group require us to erase your Personal Information;
– Where the processing of User’s Personal Information is based solely on their consent, Users may withdraw that consent;
– Users may opt out of marketing related e-mail communication at any time; or
– The User may receive from the Group the Personal Information we hold about them, which they have provided to the Group including for the purpose of the Users transmitting that Personal Information to another responsible party. - Please note that the above rights are not absolute, and the Group may be entitled to refuse
requests where exceptions apply.
DIRECT MARKETING
- The Group does not sell Personal Information to third parties for their marketing purposes without the User’s prior consent.
- With the exception to those Users who have selected not to receive certain communications, the Group may use Personal Information to target communications to Users based on their interests according to applicable law.
COMPLAINT HANDLING PROCESS
- If a User wishes to exercise any of their legal rights, they may contact the Group by emailing the Group at dataprotection@sturrockandrobson.com
- If a User has a complaint and you remains dissatisfied with how their complaint has been dealt with by the Group, the Group’s anonymous outsourced Speak Up line as detailed in the Whistleblowing policy should be used. You also have the right, at any time, to lodge a complaint with the Information Commissioner’s Office for personal information processed in the UK or the Information Regulator for personal information processed in SA at inforeg@justice.gov.za if you believe we are not complying with the laws and regulations relating to the use/storage of the information you give us, or that we collect about you.
LIABILITY AND THIRD PARTY BENEFICIARY RIGHTS
- The Group will comply with these BCRs. The BCRs are binding obligations and failure to follow them may result in employee disciplinary action, including termination and other penalties as provided by law.
- The Global Information Officer Brian Rushe, as advised by the applicable Group privacy team, accepts responsibility for and agrees to oversee the Group’s adherence to the BCRs and shall help take the necessary action to remedy the acts of noncompliance relating to these BCRs.
- The Global Information Officer Brian Rushe, will investigate claims of non-compliance to determine if a violation of the BCRs has occurred. If the violation is confirmed, the Global Information Officer and other relevant officials within the Group shall work together to address and resolve the violation within a commercially reasonable time.
- The enforcement rights and mechanisms described above are in addition to other remedies or rights provided by the Group or available under applicable law.
AUDIT PROCEDURES
- To help ensure compliance with the BCRs, the Company reviews, on a regular basis, Personal Information processing activities and practices or recommends that the Company’s internal audit team conduct a review of the identified activities and practices.
- The internal audit team shall, if necessary, require an action plan to ensure compliance with the BCRs. To the extent that internal audit or other internal departments do not resolve matters adequately, the Company may appoint independent external auditors for further resolution.
- The Company shall review and address matters relating to non-compliance with the BCRs identified in the course of a review or upon notice by a Group entity, User, employee or other individual. Audit findings are available to relevant data protection authorities upon request. The Company will redact portions of the audit to ensure confidentiality of proprietary or otherwise company confidential information. Further, the Company will only provide audit findings relating to privacy.
MODIFICATIONS OF THE BCRs
- The Company reserves the right to modify the BCRs as necessary in accordance with its internal procedures and applicable laws.
- Changes to the BCRs shall be applicable to all existing entities bound by the BCRs on the effective date of implementation. Newly formed or acquired entities shall be bound by the BCRs or guarantee an adequate level of protection prior to processing Personal
Information. - The Company will provide notice of material changes to Users in accordance with their Service preferences and/or shall post the revised BCRs on the Group Website and on select external websites accessible by Users. Revisions to the BCRs are effective on their respective effective dates, set out in the BCRs but only after the Company notifies the User and/or posts the revised BCRs.