Mashatu Privacy Policy

1. INTRODUCTION
1.1 In this Policy, any reference to “we” or “us” or “our” refers to Mashatu Investments (Pty) Ltd, a registered company in South Africa.
1.2 Any reference to “you”, “your” or “user” refers to the data subject.
1.3 This Policy outlines how we process the personal information you provide to us or that we collect through other means when we provide our services or when you access our website and social media platforms.
1.4 This Policy must be read together with our website terms and conditions of use and any other contractual agreement you may have with us.
1.5 A notice will be posted on our website home page whenever the Policy amended.
1.6 Please check the website regularly to ensure that you are aware of the latest version of this Policy.

2. WHAT PERSONAL INFORMATION DO WE COLLECT?
2.1 The service we provide to you determines the exact nature of the personal information we process, and the purpose that your personal information is collected and used for. As a national distributor of standard and specialised fasteners and industrial components to key major industrial and commercial clients, the personal information we process includes the following:

• Information about you / Company, your name, identity number / company name / company registration number.
• Contact information – your email, address, phone number and physical
  address.
• Online information – cookies and IP address (your computer’s internet address), if you use our websites and/or social media channels. (Cookie information)
• Financial information – we may process information related to your business, tax details, banking details, credit card detail.
• Contractual information – details about contracts involving clients’ dietary requirements, nationality, allergies, health concerns, weight, gender, age, passport numbers and expiry dates, last point of contact prior to arrival at any facility, contact and emergency details and details of travel to and from the responsible parties premises or customers premises.

2.2 We may need consent to process your personal information. Once we have your consent for a specific purpose, you can withdraw it at any time.
2.3 Withdrawing your consent will not affect the processing that occurred before your withdrawal, and it will not affect the processing of your personal information where consent is not required.
2.4 You may object to our processing of your personal information on reasonable grounds, unless legislation provides for such processing.
2.5 If you refuse to provide us with your personal information, we may not be able to provide you with a service or would have to terminate our business relationship.
2.6 The supply of certain items of personal information, especially those collected to comply with regulation, is legally mandatory.
2.7 No information relating to children is collected to our knowledge.

3. WHY IS YOUR PERSONAL INFORMATION COLLECTED AND HOW IS IT USED?
3.1 We use your personal information to provide business process outsourcing services to you, which may include the following:

• To provide you with our services, and maintain our relationship with you;
• To meet our contractual obligations with you;
• To detect or prevent unlawful activity, fraud, money-laundering and loss;
• For risk analysis or risk management;
• To record, monitor and/or access your telephone calls (i.e. voice recordings), correspondence and electronic communications to/with us (or any of our employees, agents or contractors) in order to accurately carry out your instructions and requests, to use as evidence and in the interests of crime prevention;
• For statistical analysis and research purposes;
• For audit and record-keeping purposes;
• For purposes of proof and legal proceedings;
• To enhance your experience with us and to help us improve our service to you;
• To market our services, provided that you have not objected to receiving such marketing;
• For safety and security purposes;
• For debt recovery or debt tracing purposes;
• To execute a transaction in accordance with your request;
• To comply with our regulatory reporting obligations;
• To comply with our legal obligations, including screening of clients and visitors’ health when accessing our premises to comply with COVID-19 regulations and protocols;
• To conduct recruitment and hiring processes, which includes but is not limited to conducting criminal record and credit checks (where appropriate), the capturing of applicants details and providing status updates to job applicants’;
• To create supplier profiles on our systems, to pay suppliers, for general supplier administration and supplier database maintenance;
• To respond to your query when you contact our call centre;
• To create client profiles on our systems, to invoice clients, for general client administration and client database maintenance;
• To carry out any other reasonable business operation considering our business and the relationship between the parties; and
• For any purpose related to and compatible with the above.

4. HOW IS YOUR PERSONAL INFORMATION COLLECTED?

4.1 We are committed to respecting your privacy and to processing your personal information lawfully, transparently and securely in accordance with the Protection of Personal Information Act No. 4 of 2013 (“POPIA”).
4.2 We may collect your personal information in the following ways:

• Directly from you when you provide information electronically, telephonically or in hard copy.
• Indirectly from you when you interact with our website, social media or email addresses, which may include the collection of metadata (data about data.
• From employers who are authorised to provide us with your personal information.

4.3 We will also collect the personal information of any other person whose details
you provide to us in accordance with POPIA.

5. IS YOUR PERSONAL INFORMATION COLLECTED BY THIRD PARTIES?
5.1 Third-party information system administrators that have access to our client database, may collect personal information about you to provide us with information system or other software services.
5.2 Your personal information will never be provided to third parties without your consent. We do not control the collection or use of your personal information by third parties and this Policy does not apply to third parties. We do not accept any responsibility or liability for third-party policies or your use of a third-party app, platform, or service.

6. IS YOUR PERSONAL INFORMATION SHARED BY US?
6.1 Your personal information will only be shared with third parties or representatives if there is a legitimate reason to do so.
6.2 Your personal information may also be shared with third-party consultants to fulfil our contractual obligations to you.
6.3 We will not sell, rent, or trade your personal information to any third party.
6.4 We will disclose information when legally required to do so to comply with any relevant legislative and regulatory requirements.

7. IS YOUR PERSONAL INFORMATION TRANSFERRED
INTERNATIONALLY?
7.1 We may need to send your personal information to another country for storage or processing on our behalf by an international service provider.
7.2 We will only send your personal information to service providers in a country that does not have information protection laws similar to that of the Republic of South Africa if the recipient agrees to adhere to the principles of POPIA.

8. CCTV MONITORING
8.1. Our facilities and premises are monitored by CCTV cameras for crime prevention, quality control and general public safety.

9. IS YOUR PERSONAL INFORMATION STORED SECURELY?
9.1 We strive to protect your privacy and the confidentiality of your personal information.
9.2 Appropriate information security measures have been implemented to keep your information secure, accurate and updated.
9.3 We cannot guarantee the security of any information you transmit to us online and you do so at your own risk.
9.4 Your personal information will be held and used for as long as permitted for legal, regulatory, fraud prevention and legitimate business purposes.
9.5 We assure you that reasonable steps are taken to ensure the reliability and integrity of our employees who have access to your personal information for a specific purpose.

10. YOUR RIGHT TO ACCESS AND CORRECT YOUR PERSONAL
INFORMATION
10.1 You have the right to access your personal information held by a public or private body in terms of the Promotion of Access to Information Act (“PAIA”).
10.2 Your right to access your personal information can be exercised by contacting our Information officer
10.3 You have the right to correct any of your personal information held by us.
10.4 Your right to correct your personal information can be exercised by contacting our information officer
10.5 You are entitled to exercise the rights conferred to you under “PAIA” by sending a request to our Compliance Officer.

11. USE OF YOUR PERSONAL INFORMATION FOR MARKETING PURPOSES
11.1 If your personal information has been provided to us, you consent to us sending you information on news, trends, services, events and promotions for our own similar services.
11.2 You will always have the right to opt out of receiving such marketing when your information is collected and whenever we send you a marketing communication. You may opt out at any time by e-mailing our information officer.
11.3 Where you choose to exercise your right to opt out of direct marketing, please allow up to 15 days for us to effect that change.

12. QUERIES/COMPLAINTS
12.1 Questions, comments, concerns, and requests regarding this statement may be directed to our information officer,
12.2 If you have a complaint or concern regarding the processing of your personal information, please submit your complaint to our information officer
12.3 The contact details for our appointed Information Officer/Data Protection Officer can be found hereunder:
Name : Wendy Du Toit
Contact Number : 071 852 3082
Email : wendy@mashatu.com

Deputy Information officer:
Name : Rozanne Smith
Contact Number : 031 761 3440
Email : marketing@mashatu.com

13. DATA BREACH RESPONSE
13.1 We have appointed an incident response team within our Compliance Department to manage any data breach.
13.2 If your personal information is compromised because of a cyber-attack or some form of data incident, we will notify you of this as soon as is reasonably possible.

14. CONTACTING THE INFORMATION REGULATOR
14.1 Please allow us the opportunity to address any complaints regarding our processing of your personal information however you have the right to complain to the Information Regulator, whose contact details are:
The Information Regulator (South Africa):
Physical address: JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001
Postal address: P.O. Box 31533, Braamfontein, Johannesburg, 2017
Complaints: complaints.IR@justice.gov.za
General enquiries: inforeg@justice.gov.za