popia

 

Thank you for providing the details. Here’s an updated version of the POPIA Compliance Policy for UAESA (PTY) LTD with the contact information included:

UAESA (PTY) LTD – POPIA COMPLIANCE POLICY

1. Introduction

This Protection of Personal Information Act (POPIA) Compliance Policy outlines UAESA (PTY) LTD’s commitment to ensuring the protection of personal information and compliance with the Protection of Personal Information Act, No. 4 of 2013 (POPIA). This policy applies to all employees, contractors, agents, and third-party service providers who process personal information on behalf of UAESA (PTY) LTD, in any capacity.

2. Purpose

The purpose of this policy is to ensure that UAESA (PTY) LTD processes personal information in a manner that respects the privacy of individuals and complies with applicable data protection laws. This policy provides the framework for the collection, use, storage, and protection of personal information in a manner that is transparent, lawful, and fair.

3. Scope

This policy applies to all personal information that is processed by UAESA (PTY) LTD in its operations, including but not limited to:

  • Client Information: Personal details of clients, customers, and contractors.
  • Employee Information: Personal details of employees and job applicants.
  • Third-Party Information: Personal details of suppliers, service providers, and other third parties.

4. Definitions

  • Personal Information: Any information that can identify a person, including but not limited to name, contact details, identification numbers, or any other detail that may identify an individual.
  • Processing: The collection, use, storage, modification, dissemination, and destruction of personal information.
  • Data Subject: The individual whose personal information is being processed.
  • Responsible Party: UAESA (PTY) LTD, as the entity responsible for determining the purposes and means of processing personal information.

5. Compliance Principles

In line with POPIA, UAESA (PTY) LTD will uphold the following eight principles in the processing of personal information:

  1. Accountability: UAESA (PTY) LTD accepts full responsibility for ensuring that personal information is processed in compliance with POPIA, and this responsibility is extended to all employees, contractors, and third-party service providers.

  2. Processing Limitation: Personal information will only be collected for legitimate, specified purposes and will not be processed further in a manner that is incompatible with those purposes.

  3. Purpose Specification: Personal information will only be collected for specific, explicitly defined, and lawful purposes. The data subject will be informed of the purpose for which their personal information is being collected at the time of collection.

  4. Further Processing Limitation: Personal information will not be processed in a way that is incompatible with the original purpose for which it was collected, unless the data subject has been informed and provided consent.

  5. Information Quality: Personal information will be accurate, complete, and up-to-date. Reasonable steps will be taken to ensure that inaccurate personal information is corrected or destroyed.

  6. Openness: UAESA (PTY) LTD will ensure transparency in its processing of personal information by providing clear and accessible privacy notices to data subjects. The company will inform data subjects of the purposes for which their data is being collected and processed.

  7. Security Safeguards: UAESA (PTY) LTD will implement appropriate technical and organizational measures to protect personal information against unauthorized or unlawful processing, loss, destruction, or damage. This includes encryption, access control, and secure data storage.

  8. Data Subject Participation: Data subjects have the right to access their personal information, correct inaccuracies, or request the deletion of their data in accordance with the provisions of POPIA.

6. Responsibilities

  • Data Protection Officer (DPO): A designated DPO will oversee the implementation of this policy and ensure compliance with POPIA. The DPO will be responsible for monitoring compliance, conducting internal audits, and advising the organization on data protection matters.
  • Employees: All employees are required to handle personal information in accordance with this policy and report any instances of non-compliance or data breaches to the DPO.
  • Third-Party Service Providers: All third-party service providers who process personal information on behalf of UAESA (PTY) LTD must enter into data processing agreements that ensure compliance with POPIA and the protection of personal information.

7. Collection and Use of Personal Information

  • Legitimate and Lawful Collection: Personal information will be collected only for specific, lawful business purposes and with the data subject’s consent where necessary.
  • Minimal Data Collection: Only the minimum amount of personal information necessary for the intended purpose will be collected.
  • Notification to Data Subjects: Data subjects will be informed of the purpose for which their personal information is being collected at the time of collection.

8. Storage and Retention

  • Retention Period: Personal information will be stored only for as long as necessary to fulfill the purpose for which it was collected or to comply with legal or regulatory obligations.
  • Secure Storage: Personal information will be stored in secure systems that are protected from unauthorized access, loss, or theft.

9. Security Measures

  • Data Protection: UAESA (PTY) LTD will implement robust physical, technical, and organizational measures to ensure the security and confidentiality of personal information.
  • Data Encryption: Sensitive personal information will be encrypted both in transit and at rest, where applicable.
  • Access Control: Access to personal information will be restricted to authorized personnel only, based on the principle of least privilege.

10. Rights of Data Subjects

Data subjects have the following rights under POPIA:

  • Right to Access: Data subjects have the right to request access to their personal information held by UAESA (PTY) LTD.
  • Right to Correction: Data subjects have the right to request the correction of any inaccurate or incomplete personal information.
  • Right to Deletion: Data subjects have the right to request the deletion of their personal information, subject to certain exceptions under POPIA.
  • Right to Object: Data subjects have the right to object to the processing of their personal information under specific circumstances.

11. Data Breach Response

  • Immediate Notification: In the event of a data breach, UAESA (PTY) LTD will promptly notify the Information Regulator and any affected data subjects as required by POPIA.
  • Breach Investigation: A thorough investigation will be conducted to assess the extent of the breach, mitigate its effects, and prevent future occurrences.

12. Third-Party Data Processors

  • Data Processing Agreements: All third-party service providers who process personal information on behalf of UAESA (PTY) LTD will be required to sign data processing agreements that stipulate their obligations under POPIA and ensure the safeguarding of personal information.
  • Due Diligence: UAESA (PTY) LTD will conduct due diligence to ensure that third-party service providers have appropriate data protection policies in place.

13. Training and Awareness

  • Employee Training: All employees will receive regular training on the principles of data protection and the requirements of POPIA.
  • Ongoing Awareness: UAESA (PTY) LTD will promote a culture of data privacy and security within the organization by providing ongoing awareness and education.

14. Monitoring, Auditing, and Compliance

  • Internal Audits: Regular audits will be conducted to assess compliance with this policy and identify any areas of improvement.
  • Non-Compliance: Any violations of this policy will be addressed in accordance with the company’s disciplinary procedures.

15. Review and Updates

This policy will be reviewed annually, or as necessary, to ensure ongoing compliance with POPIA and any changes in applicable laws or regulations.

Contact Information

For further information regarding this policy or any concerns related to the processing of personal information, please contact: