1. INTRODUCTION

ARRB Systems SA (Pty) Ltd t/a ARRB Systems Africa (“ASA” or “we” or “us”) cares about your Personal Information and privacy. We are committed to protect and respect your privacy. We are committed to process your Personal Information in line with the Protection of Personal Information Act, 4 of 2013 (“POPIA”), the Constitution of the Republic of South Africa, 1996 and any other relevant data protection laws. This privacy notice explains, amongst other things, what Personal Information we collect, when and why we collect it, how we use it, the conditions under which we may disclose it to others and how we keep it secure.

2. WHO DOES THIS PRIVACY NOTICE APPLY TO?

This privacy notice applies to you and your staff as ASA’s customer if you have and / or will supply ASA with your Personal Information or Personal Information of your staff.

3. WHAT PERSONAL INFORMATION DO WE COLLECT?

We collect different types of Personal Information for specific purposes relating to our Customers, their representatives and staff. POPIA defines Personal Information as information relating to an identifiable, living, natural person, and where it is applicable, an identifiable, existing juristic person.

Depending on the specific purpose, we may collect the following Personal Information: names and surnames, identity numbers, contact information (e.g., telephone numbers and email addresses), physical address, company registration number, bank account details, contractual information, and other Personal Information which we use to provide you with access to our services, to help us improve our offerings and certain other purposed listed below.

Where you provide ASA with information relating to third parties, it is your responsibility to inform such individuals about the processing of their Personal Information by ASA for the purposes and in the manner described in this privacy notice. You must also inform them about their rights of access, rectification and deletion in accordance with applicable law and must obtain their consent, where necessary, to the processing and transfer of their Personal Information before you provide it to ASA.

4. WHY DO WE COLLECT YOUR PERSONAL INFORMATION?

ASA only collects and processes Personal Information for a lawful and specific purpose. We may collect your Personal Information:

• to provide our services to you;
• to carry out transactions you request;
• to maintain our relationship and inform you about products and services which are of interest to you;
• to help improve the quality of our services;
• to help recover debts;
• to perform background checks on customers;
• to enable ASA to comply with a variety of laws and regulatory requirements laws which are applicable to the goods and services which ASA provides and offers; or
• in limited instances and where required, based on your consent for us to collect and process your Personal Information.

5. HOW DO WE COLLECT YOUR PERSONAL INFORMATION?

We collect your Personal Information in any of these instances:

• when you call our offices and provide us with your details;
• when you provide us with your Personal Information when we conclude a contract with you;
• when you submit a proposal or bid in response to an RFP or RFQ, or an unsolicited proposal or bid; or
• when you visit our website https://arrbsystems.com and submit your contact details and a query.

6. WHO DO WE SHARE YOUR PERSONAL INFORMATION WITH?

ASA may share your Personal Information with some of its affiliate companies. ASA may disclose and / or discuss relevant aspects of your Personal Information with certain persons on a need-to-know basis, such as ASA’s employees, services providers, and other third parties who may be involved in the delivery of products and services to you.

Should ASA disclose your Personal Information to this restricted list of persons, it will be done on a confidential basis and subject to the recipients of the Personal Information agreeing to comply with the provisions of POPIA and other applicable data privacy laws. ASA will never sell your Personal Information. Should there be a change in ownership or structure of ASA, the successor, purchaser or new entity is required by law to process your Personal Information in line with POPIA requirements.

7. HOW DO WE PROTECT YOUR PERSONAL INFORMATION?

Protecting your Personal Information is important to us. We make sure that we put in place adequate security safeguards to protect your Personal Information under our control. Only authorised personnel will have access to your Personal Information. We make sure there is restricted access to certain Personal Information such as your bank account information and financial information.

We exercise appropriate due diligence in the selection of any third-party Service Provider, advisors or any third-party to whom your Personal Information may be transferred as contemplated in this privacy notice. We require appropriate contracts that such third parties maintain adequate security measures to safeguard Personal Information, and process Personal Information only for the specific purpose for which it was provided.

8. HOW LONG DO WE KEEP YOUR PERSONAL INFORMATION?

We will only retain Personal Information for as long as it is necessary to fulfil the purposes required by law and / or this privacy notice. We will retain your Personal Information if we are required or authorised by law. We may retain your Personal Information in physical or electronic records at our discretion. We have in place a Data Retention and Destruction Policy which contains further information on the kinds of records we retain and the retention periods.

9. DO WE TRANSFER YOUR PERSONAL INFORMATION TO OTHER COUNTRIES?

We may transfer your Personal Information to third-party Service Providers with whom we engage business or whose services or products we elect to use, including cloud services hosted in international jurisdictions.

Before transferring Personal Information across borders, we take steps to ensure that the third party who is the recipient of the information is located in a country which provides an adequate level of protection for your Personal Information or that there is an agreement or binding corporate rules which satisfies the applicable requirements for the transfer of Personal Information across borders.

10. WHAT ARE YOUR RIGHTS?

Your rights under POPIA include the following:

• The right to be notified when your Personal Information is being collected or processed.
• The right to request us, where necessary, to correct, destroy or delete a record of your Personal Information.
• The right to object, on reasonable grounds, to the processing of your Personal Information.
• The right to object to the processing of your Personal Information for purposes of direct marketing, including by way of unsolicited communications.
• The right not to be subject, in certain circumstances, to a decision which is based solely on the automated processing of your Personal Information.
• The right to submit a complaint to the Information Regulator if you believe that your rights relating to your Personal Information have been infringed or you believe that an independent adjudicator who may be resolving your complaint to us has not decided the matter correctly; and
• The right to institute civil proceedings against us if you believe that your rights relating to your Personal Information have been infringed.

11. DO WE MAKE UPDATES TO THIS PRIVACY NOTICE?

Yes. We may update this privacy notice if it is necessary to stay compliant with relevant laws. We encourage you to review this privacy notice frequently to stay informed on how we process your Personal Information.

12. HOW TO CONTACT US ABOUT THIS PRIVACY NOTICE

If you have questions and / or comments about our privacy notice or need to protect any of your rights set out in this privacy notice, please contact our information officer on email address [email protected] or telephone number +27 31 700 2500.

A data subject has a right of access to any personal information which ASA may have and where applicable may ask ASA to correct inaccuracies to any such personal information. Any access request must be done via the procedure stipulated in ASA’s PAIA manual, which is accessible on our website.

The physical address of our Head Office is 10 Kyalami Road, Park 2000, Westmead, Pinetown, 3610, KwaZulu-Natal, South Africa.

1. INTRODUCTION

ARRB Systems South Africa t/a ARRB Systems Africa (“ASA” or “we” or “us”) cares about your Personal Information and privacy. We are committed to protect and respect your privacy. We are committed to process your Personal Information in line with the Protection of Personal Information Act, 4 of 2013 (“POPIA”), the Constitution of the Republic of South Africa, 1996 and any other relevant data protection laws. This privacy notice explains, amongst other things, what Personal Information we collect, when and why we collect it, how we use it, the conditions under which we may disclose it to others and how we keep it secure.

2. WHO DOES THIS PRIVACY NOTICE APPLY TO?

This privacy notice applies to you and your staff as ASA’s supplier if you have and / or will supply ASA with your Personal Information or Personal Information of your staff.

3. WHAT PERSONAL INFORMATION DO WE COLLECT?

We collect different types of Personal Information for specific purposes relating to our suppliers, their representatives and staff. POPIA defines Personal Information as information relating to an identifiable, living, natural person, and where it is applicable, an identifiable, existing juristic person.

Depending on the specific purpose, we may collect the following Personal Information: names and surnames, identity numbers, contact information of your key personnel(e.g., telephone numbers and email addresses), physical and postal address, company registration number, bank account details, contractual information, your company B-BBEE certificates or affidavits, information relating to equity ownership, including name, surname, identity number, copy of identity documents, gender and ethnic class of your shareholders, licensing and regulatory information, tax related information (e.g., VAT numbers, tax clearance certificates), financial statements or company records including policies, contracts and reports.

Where you provide ASA with information relating to third parties, it is your responsibility to inform such individuals about the processing of their Personal Information by ASA for the purposes and in the manner described in this privacy notice. You must also inform them about their rights of access, rectification and deletion in accordance with applicable law and must obtain their consent, where necessary, to the processing and transfer of their Personal Information before you provide it to ASA.

4. WHY DO WE COLLECT YOUR PERSONAL INFORMATION?

ASA only collects and processes Personal Information for a lawful and specific purpose. We may collect your Personal Information:

• to include you in our supplier database and conclude a contract with you, or perform our contractual obligations with you, such as payment of invoices, providing you with access to certain facilities or infrastructure that you need to provide goods or render services;
• to exercise our legitimate interests such as obtaining independent verification of your details, to screen suppliers and manage risks;
• to enable ASA to comply with a variety of laws such as tax laws, labour laws and other business laws which are applicable to the goods and services which ASA provides and offers; or
• in limited instances and where required, based on your consent for us to collect and process your Personal Information.

5. HOW DO WE COLLECT YOUR PERSONAL INFORMATION?

We collect your Personal Information in any of these instances:

• when you call our offices and provide us with your details;
• when you submit a proposal or bid, unsolicited or in response to an RFP or RFQ;
• when responding to customer queries;
• when you provide us with your Personal Information when we conclude a contract with you;
• when we collect your Personal Information from a third party such as information provided to us when we conduct criminal record checks or verification checks; or
• when you visit our website https://arrbsystems.com and submit your contact details and a query.

6. WHO DO WE SHARE YOUR PERSONAL INFORMATION WITH?

ASA may share your Personal Information with some of its affiliate companies. ASA may disclose and / or discuss relevant aspects of your Personal Information with certain persons on a need-to-know basis, such as ASA’s employees, relevant regulators, governmental bodies, and specific third parties for onboarding and vetting of new suppliers. Should ASA disclose your Personal Information to the restricted list of persons, it will be done on a confidential basis and subject to the recipients of the Personal Information agreeing to comply with the provisions of POPIA and other applicable data privacy laws. ASA will never sell your Personal Information. Should there be a change in ownership or structure of ASA, the successor, purchaser or new entity is required by law to process your Personal Information in line with POPIA requirements.

7. HOW DO WE PROTECT YOUR PERSONAL INFORMATION?

Protecting your Personal Information is important to us. We make sure that we put in place adequate security safeguards to protect your Personal Information under our control. Only authorised personnel will have access to your Personal Information. We make sure there is restricted access to certain Personal Information such as your bank account information and financial information.

We exercise appropriate due diligence in the selection of any third-party supplier, advisors or any third-party to whom your Personal Information may be transferred as contemplated in this privacy notice. We require appropriate contracts that such third parties maintain adequate security measures to safeguard Personal Information, and process Personal Information only for the specific purpose for which it was provided.

8. HOW LONG DO WE KEEP YOUR PERSONAL INFORMATION?

We will only retain Personal Information for as long as it is necessary to fulfil the purposes required by law and / or this privacy notice. We will retain your Personal Information if we are required or authorised by law. We may retain your Personal Information in physical or electronic records at our discretion. We have in place a Data Retention and Destruction Policy which contains further information on the kinds of records we retain and the retention periods.

9. DO WE TRANSFER YOUR PERSONAL INFORMATION TO OTHER COUNTRIES?

We may transfer your Personal Information to our third-party service providers with whom we engage business or whose services or products we elect to use, including cloud services hosted in international jurisdictions.

Before transferring Personal Information across borders, we take steps to ensure that the third party who is the recipient of the information is located in a country which provides an adequate level of protection for your Personal Information or that there is an agreement or binding corporate rules which satisfies the applicable requirements for the transfer of Personal Information across borders.

10. WHAT ARE YOUR RIGHTS?

Your rights under POPIA include the following:

• The right to be notified when your Personal Information is being collected or processed.
• The right to request us, where necessary, to correct, destroy or delete a record of your Personal Information.
• The right to object, on reasonable grounds, to the processing of your Personal Information.
• The right to object to the processing of your Personal Information for purposes of direct marketing, including by way of unsolicited communications.
• The right not to be subject, in certain circumstances, to a decision which is based solely on the automated processing of your Personal Information.
• The right to submit a complaint to the Information Regulator if you believe that your rights relating to your Personal Information have been infringed or you believe that an independent adjudicator who may be resolving your complaint to us has not decided the matter correctly; and
• The right to institute civil proceedings against us if you believe that your rights relating to your Personal Information have been infringed.

11. DO WE MAKE UPDATES TO THIS PRIVACY NOTICE?

Yes. We may update this privacy notice if it is necessary to stay compliant with relevant laws. We encourage you to review this privacy notice frequently to stay informed on how we process your Personal Information.

12. HOW TO CONTACT US ABOUT THIS PRIVACY NOTICE

If you have questions and / or comments about our privacy notice or need to protect any of your rights set out in this privacy notice, please contact our information officer on email address [email protected] or telephone number +27 31 700 2500.

A data subject has a right of access to any personal information which ASA may have and where applicable may ask ASA to correct inaccuracies to any such personal information. Any access request must be done via the procedure stipulated in ASA’s PAIA manual, which is accessible on our website.

The physical address of our Head Office is 10 Kyalami Road, Park 2000, Westmead, Pinetown, 3610, KwaZulu-Natal, South Africa.