Your Privacy Matters: Greenier HR & Payroll Consulting

**Website Privacy & POPI Policy**

Your privacy is important to Greenier HR & Payroll Consulting. This policy explains Greenier HR & Payroll Consulting's privacy practices and the choices you have about the way your personal information will be dealt with. All practices are in line with Greenier HR & Payroll Consulting's SOP and the provisions of POPI.

Personal information is collected only when knowingly and voluntarily submitted.

Personal information is only used for the purpose for which it was collected and/or submitted or such secondary purposes that are related to the primary purpose.

In addition to where you have consented to the disclosure of your personal information, personal information may be disclosed in special situations where Greenier HR & Payroll Consulting has reason to believe that doing so is necessary to identify or act against anyone damaging or interfering with our rights or property, users or anyone else that could be harmed by such activities.

Greenier HR & Payroll Consulting may engage third parties to provide you with goods or services on our behalf and in such circumstances may disclose your personal information to such parties in order to provide such goods and services.

**Information Security on Our Website**

Any information that you upload on our website will be stored on a secure server and be used for limited purposes such as future communications (which you are always entitled to un-subscribe to).

Greenier HR & Payroll Consulting will not disclose, sell, rent, or disseminate your personal information to third parties without your consent unless Greenier HR & Payroll Consulting is compelled to do so by law. Greenier HR & Payroll Consulting may do so if you have granted consent thereto.

While all reasonable efforts are taken to ensure that your personal information is protected as it travels over the internet, Greenier HR & Payroll Consulting cannot guarantee the absolute security of any information you exchange with us due to reasons beyond our control.

Greenier HR & Payroll Consulting may use cookies and web beacons to facilitate improvement of our website. However, neither cookies nor web beacons collect personal information such as the user's name or email address. You may reject cookies, as most browsers permit individuals to decline same.

**POPI Compliance**

**Procurement of Personal Information**

Personal information collected by Greenier HR & Payroll Consulting and/or any of its representatives, will be collected directly from the data subject, unless:

- The information is contained or derived from a public record or has deliberately been made public by the data subject;
- The data subject or a competent person where the data subject is a child, has consented to the collection of the information from another source;
- Collection of the information from another source would not prejudice a legitimate interest of the data subject;
- Collection of the information from another source is necessary to avoid prejudice to the maintenance of the law by any public body, including the prevention, detection, investigation, prosecution and punishment of offences;
- To comply with an obligation imposed by law or to enforce legislation concerning the collection of revenue;
- For the conduct of proceedings in any court or tribunal that have commenced or are reasonably contemplated;
- To maintain the legitimate interests of Greenier HR & Payroll Consulting or of a third party to whom the information is supplied;
- Compliance would prejudice a lawful purpose of the collection; or
- Compliance is not reasonably practicable in the circumstances of the particular case.

Greenier HR & Payroll Consulting may collect Personal Data from a data subject or customer in a number of ways, namely:

- From the customer personally when engaging the services of Greenier HR & Payroll Consulting, which Personal Information may include contact details, ID numbers and/or personal banking details;
- From the customer when contacted with an enquiry or in response to a communication from Greenier HR & Payroll Consulting;
- From documents available to the public.

Personal Information must be collected for a specific, explicitly defined and lawful purpose related to a function or activity of Greenier HR & Payroll Consulting.

Steps will be taken to ensure that the data subject is aware of the purpose of the collection of the information.

Greenier HR & Payroll Consulting will take reasonably practicable steps to ensure that the personal information is complete, accurate, not missing and updated where necessary, having regard to the purpose for which the personal information is collected and further processed.

Where personal information is collected from a data subject, Greenier HR & Payroll Consulting will take reasonable practicable steps to ensure that the data subject is aware of:

- The information being collected and where the information is not collected from the data subject, the source from which it is collected;
- The name and address of the Company;
- The purpose for which the information is being collected;
- Whether or not the supply of the information by the data subject is voluntary or mandatory;
- The consequences of failure to provide the information;
- Any particular law authorising or requiring the collection of the information;
- The fact that, where applicable, Greenier HR & Payroll Consulting intends to transfer the information to a third country or international organisation and the level of protection offered to the information by that third country or international organisation;
- The recipient or category of recipients of the information;
- The nature or category of the information;
- The existence of the right of access to and the right to rectify the information collected;
- The existence of the right to object to the processing of personal information.

It will not be necessary for Greenier HR & Payroll Consulting to comply with the above where:

- The data subject or a competent person if the data subject is a child has provided consent for the non-compliance;
- Non-compliance would not prejudice the legitimate interests of the data subject;
- Non-compliance is necessary to avoid prejudice to the maintenance of the law by any public body, including the prevention, detection, investigation, prosecution and punishment of offences;
- To comply with an obligation imposed by law or to enforce legislation concerning the collection of revenue;
- For the conduct of proceedings in any court or tribunal that have commenced or are reasonably contemplated;
- In the interest of national security;
- Compliance would prejudice a lawful purpose of the collection;
- Compliance is not reasonably practicable in the circumstances of the particular case; or
- The information will not be used in a form in which the data subject may be identified, or will be used for historical, statistical or research purposes.

**Processing of Personal Information**

Personal Information will only be processed lawfully and in a reasonable manner that does not infringe the privacy of the data subject.

Personal Information may only be processed if:

- Given the purpose for which it was processed, it is adequate, relevant and not excessive;
- The data subject or a competent person where the data subject is a child consents to the processing;
- Processing is necessary to carry out actions for the conclusion or performance of a contract to which the data subject is a party;
- Processing complies with an obligation imposed by law on Greenier HR & Payroll Consulting;
- Processing protects a legitimate interest of the data subject; or
- Processing is necessary for pursuing the legitimate interest of Greenier HR & Payroll Consulting or of a third party to whom the information is supplied.

In the event that Greenier HR & Payroll Consulting appoints or authorises an operator to process any personal information on its behalf or for any reason, it will implement necessary agreements to ensure that the operator or anyone processing personal information on behalf of Greenier HR & Payroll Consulting or an operator, must:

- Process such information only with the knowledge or authorisation of Greenier HR & Payroll Consulting; and
- Treat personal information which comes to his/her/its knowledge as confidential and must not disclose it, unless required by law or in the course of the proper performance of his/her/its duties.

Greenier HR & Payroll Consulting must maintain the documentation of all processing operations under its responsibility.

**Further Processing of Personal Information**

Greenier HR & Payroll Consulting must ensure that the further processing of personal information is compatible with the purpose for which it was collected.

To assess whether further processing is compatible with the purpose of collection, Greenier HR & Payroll Consulting will take account of:

- The relationship between the purpose of the intended further processing and the purpose for which the information was collected;
- The nature of the information concerned;
- The consequences of the intended further processing for the data subject;
- The manner in which the information has been collected; and
- Any contractual rights and obligations between the parties.

The further processing of personal information will not be incompatible with the purpose of collection if:

- The data subject or competent person where the data subject is a child, has consented to the further processing of the information; or
- The information is available in or derived from a public record or has deliberately been made public by the data subject.

**Retention and Restriction of Records**

Records of personal information must not be retained any longer than necessary for achieving the purpose for which the information was collected or subsequently processed, unless:

- The retention of a record is required or authorized by law;
- Greenier HR & Payroll Consulting reasonably requires a record for lawful purposes related to its functions or activities;
- Retention of a record is required by a contract between the parties thereto; or
- The data subject or a competent person where the data subject is a child has consented to the retention of a record.

Information collected or processed initially for the purposes of historical, statistical or research value, may be retained for a period longer than contemplated above, providing Greenier HR & Payroll Consulting has appropriate measures in place to safeguard these records against uses other than what it was intended for initially.

Greenier HR & Payroll Consulting will destroy or delete a record of personal information or de-identify it as soon as reasonably practicable after Greenier HR & Payroll Consulting is no longer authorized to retain a record.

The de-identifying or deletion of a record of personal information must be done in a manner that prevents its reconstruction in an intelligible/understandable form.

In the event that Greenier HR & Payroll Consulting uses a record of personal information of a data subject to make a decision about the data subject, it must:

- Retain the record for such period as may be required or prescribed by law or a code of conduct; or
- If there is no law or code of conduct prescribing a retention period, retain the record for a period which will afford the data subject a reasonable opportunity, taking all considerations relating to the use of the personal information into account, to request access to the record.

Greenier HR & Payroll Consulting will restrict the processing of personal information if:

- Its accuracy is contested by the data subject, for a period enabling Greenier HR & Payroll Consulting to verify the accuracy of the information;
- Greenier HR & Payroll Consulting no longer needs the personal information for achieving the purpose for which it was collected or subsequently processed, but it has to be maintained for purposes of proof;
- The processing is unlawful, and the data subject opposed its destruction or deletion and requests the restriction of its use instead; or
- The data subject requests to transit the personal data into another automated processing system.

Personal information that has been restricted may only be processed for purposes of proof, or with the data subject's consent, or with the consent of a competent person where the data subject is a child, or for the protection of the rights of another natural or legal person or if such processing is in the public interest.

Where the information is restricted, Greenier HR & Payroll Consulting will inform the data subject before lifting the restriction.

**Security Safeguards**

Greenier HR & Payroll Consulting will secure the integrity and confidentiality of personal information in its possession or under its control by taking appropriate, reasonable, technical and organisational measures to prevent:

- Loss of, damage to or unauthorized destruction of personal information; and
- Unlawful access to or processing of personal information.

Greenier HR & Payroll Consulting will take reasonable measures to:

- Identify all reasonably foreseeable internal and external risks to personal information in its possession or under its control;
- Establish and maintain appropriate safeguards against the risks identified;
- Regularly verify that the safeguards are effectively implemented; and
- Ensure that the safeguards are continually updated in response to new risks or deficiencies in previously implemented safeguards.

Greenier HR & Payroll Consulting will have due regard to generally accepted information security practices and procedures which may apply to it generally or be required in terms of specific industry or professional rules and regulations.

Greenier HR & Payroll Consulting will, in terms of a written contract between Greenier HR & Payroll Consulting and the operator, ensure that the operator which processes personal information for Greenier HR & Payroll Consulting, establishes and maintains the security measures as referred to herein.

The operator will inform Greenier HR & Payroll Consulting immediately where there are reasonable grounds to believe that the personal information of a data subject has been accessed or acquired by any unauthorized person.

**Security Compromises & Breach Protocol**

Where there are reasonable grounds to believe that the personal information of a data subject has been accessed or acquired by any unauthorized person, Greenier HR & Payroll Consulting will notify:

- The Information Regulator; and
- The data subject unless the identity of such data subject cannot be established.

The notification of a breach will be made as soon as reasonably possible after the discovery of the compromise, taking into account the legitimate needs of law enforcement or any measures reasonably necessary to determine the scope of the compromise and to restore the integrity of Greenier HR & Payroll Consulting's information system.

Greenier HR & Payroll Consulting will only delay notification of the data subject if a public body responsible for the prevention, detection or investigation of offences or the Regulator determines that notification will impede a criminal investigation by the public body concerned.

The notification to a data subject will be in writing and communicated to the data subject in at least one of the following ways:

- Posted to the data subject's last known physical or postal address; or
- Sent by e-mail to the data subject's last known e-mail address; or
- Placed in a prominent position on the website of Greenier HR & Payroll Consulting; or
- Published in the news media.

The notification will provide sufficient information to allow the data subject to take protective measures against the potential consequences of the compromise, including:

- A description of the possible consequences of the security compromise;
- A description of the measures that Greenier HR & Payroll Consulting intends to take or has taken to address the security compromise;
- A recommendation with regard to the measures to be taken by the data subject to mitigate the possible adverse effects of the security compromise; and
- If known to Greenier HR & Payroll Consulting, the identity of the unauthorized person who may have accessed or acquired the personal information.

**Rights of the Data Subject**

The data subject or competent person where the data subject is a child, may withdraw his, her or its consent to procure and process his, her or its personal information, at any time, providing the lawfulness of the processing of the personal information before such withdrawal is not affected.

A data subject may object, at any time, to the processing of personal information:

- In writing, on reasonable grounds relating to his/her or its situation, unless legislation provides for such processing; or
- For purposes of direct marketing other than direct marketing by means of unsolicited electronic communications.

A data subject, having provided adequate proof of identity, has the right to:

- Request Greenier HR & Payroll Consulting to confirm, free of charge, whether or not Greenier HR & Payroll Consulting holds personal information about the data subject; and
- Request from Greenier HR & Payroll Consulting a record or a description of the personal information about the data subject held by Greenier HR & Payroll Consulting, including information about the identity of all third parties, or categories of third parties, who have, or have had, access to the information — within a reasonable time, at a prescribed fee, in a reasonable manner and format, and in a form that is generally understandable.

A data subject may, in the prescribed manner, request Greenier HR & Payroll Consulting to:

- Correct or delete personal information about the data subject in its possession or under its control that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or obtained unlawfully; or
- Destroy or delete a record of personal information about the data subject that Greenier HR & Payroll Consulting is no longer authorized to retain.

Upon receipt of such a request, Greenier HR & Payroll Consulting will, as soon as reasonably practicable:

- Correct the information;
- Destroy or delete the information;
- Provide the data subject, to his, her or its satisfaction, with credible evidence in support of the information; or
- Where an agreement cannot be reached between Greenier HR & Payroll Consulting and the data subject, and if the data subject so requests, take such steps as are reasonable in the circumstances to attach to the information an indication that a correction of the information has been requested but not been made.

Greenier HR & Payroll Consulting will inform the data subject of the action taken as a result of the request.

**Request for Disclosure**

Greenier HR & Payroll Consulting will respond promptly when the data subject requests notification of purpose of use, disclosure, correction, addition or deletion of details, and suspension of use or elimination relating to personal information held by Greenier HR & Payroll Consulting.

*This document is the proprietary property of Greenier HR & Payroll Consulting. Copying or otherwise distributing the information contained herein is a breach of confidentiality agreement.*