Privacy Policy

Protection of Personal Information (POPI) Act Policy

Introduction

Cletech Holdings (Pty) and its subsidiaries (Cletech Recruitment, Cletech Chemicals and Cletech Cares) is committed to compliance with the Protection of Personal Information (POPI) Act No.4 of 2013 and will always:

1. Sufficiently inform Data Subjects (candidates/clients/employees), the specific purpose for which we will collect and process their Personal
2. Protect Personal Information from threats, whether internal or external, deliberate or accidental, to ensure business continuation, minimise business damage and maximise business opportunities.

This Policy establishes measures, processes and standards for the protection and lawful processing of Personal Information.

The Information Officer, Nadine Clevely, is responsible for:

• Monitoring this policy;
• Ensuring that this policy is supported by appropriate processes and procedures;
• Ensuring that this policy and subsequent updates are communicated to relevant managers, representatives, staff and associates, where applicable.

The Deputy Information Officer, Desiree Mjoka, will assist the Information Officer.

All employees are responsible for adhering to this policy and for reporting any security breaches or incidents to the Information Officer or Deputy Information Officer.

Service Providers that provide IT and/or off-site data storage services to our organisation, must satisfy us that they provide adequate protection of data held by them on our behalf.

Definitions

Policy Principles

Accountability for Data to be Collected

Cletech shall take all reasonable steps to safeguard Personal Information collected from Data Subjects and will do so in accordance with the processing conditions specified in the POPI Act.

Processing Limitation

Cletech may only process Personal Information under the following conditions:

1. The Data Subject consents to the processing
2. Processing is in the legitimate interest of the Data Subject
3. Processing complies with a legal obligation imposed on Cletech
4. Processing is necessary for the conclusion or performance of a contract with the Data Subject
5. Processing is necessary for the execution of a legitimate interest of Cletech, or a third party to whom the information is

Specific Purpose

Cletech will only process Personal Information that is relevant and necessary for the following:

1. Administration of agreements
2. Providing products and services to Clients, to maintain and improve the relationship
3. Confirming, verifying and updating Data Subject details
4. Detecting and prevention of fraud, crime, money laundering and other malpractice
5. Conducting market research
6. Marketing and sales
7. In connection with legal proceedings
8. Employee administration
9. For recordkeeping and audit purposes
10. To comply with legal and regulatory requirements
11. To secure permanent or temporary employment on behalf of Candidates

Limitation on Further Processing

Cletech will not further process Personal Information in a way that is incompatible with the initial purpose for which it was collected and will only be done with the express consent of the Data Subject.

Information Quality

Cletech shall take all reasonable steps to ensure that Personal Information is complete, up to date and accurate. Cletech shall periodically review Data Subject’s records to ensure that it is correct and up to date.

Transparency/Openness

Cletech shall take all reasonable steps to ensure that Data Subjects are aware of the following:

1. What Personal Information is collected as well as the source of the information
2. The purpose of collection and processing
3. What Personal Information is voluntary or mandatory, and the consequences of a failure to provide such information
4. Whether the collection is in terms of any laws requiring such collection
5. Whether the Personal Information will be shared with any third-party

Data Security

Cletech shall implement sufficient measures to guard against the risk of unlawful access, loss or destruction of Personal Information that is held;

1. Physically
2. In our electronic database
3. By a Data Storage Service Provider
4. In any electronic devices (that will be password protected)

Cletech is committed to ensuring that information is only used for legitimate purposes with Data Subject consent and only by authorised employees of Cletech.

Participation of Individuals/ Complaints

1. Data Subjects are entitled access to, and to correct any information held by Cletech.
2. Complaints should be submitted in writing to the Information Officer or Deputy Information Officer or

Disclosure of Personal Information

Cletech may disclose a Data Subject’s personal information to any of the Cletech Holdings (Pty) Ltd group of companies or subsidiaries and/or approved third-party service providers whose services or products Data Subjects elect to use. Cletech has agreements in place to ensure that compliance with confidentiality and privacy conditions.

Cletech may also share Data Subject personal information with and obtain information about Data Subjects from third parties for reasons already discussed above.4

Cletech may also disclose a Data Subject’s information where it has a duty or a right to disclose in terms of applicable legislation, the law, or where it may be necessary in order to protect Cletech’s rights.

Operational Considerations

Monitoring

The Board/Management, Information Officer and Deputy Information Officer are responsible for ensuring adherence to Standard Operating Procedures.

All employees of Cletech associated with business activities will be trained on the regulatory requirements governing the protection of Personal Information.

Every employee currently employed within Cletech will be required to sign an addendum to their employment contracts containing the relevant consent clauses for us the use and storage of employee information, or any other action so required, in terms of the POPI Act.

Third-party service providers will be required to sign a service level agreement guaranteeing their commitment to the protection of Personal Information.

Cletech will conduct periodic reviews and audits, where appropriate, to ensure compliance with this policy and guidelines and make the necessary adjustments.

Policy Compliance

Any breach of this policy could result in disciplinary action and termination of employment.

Annexure 1 – Objection to Processing of Personal Information

OBJECTION TO THE PROCESSING OF PERSONAL INFORMATION IN TERMS OF SECTION 11(3) OF THE PROTECTION OF PERSONAL INFORMATION ACT, 2013 (ACT NO. 4 OF 2013) REGULATIONS RELATING TO THE PROTECTION OF PERSONAL INFORMATION, 2018

[Regulation 2].

Notes:

1. Affidavits or other documentary evidence in support of the objection may be
2. If the space provided in this form is inadequate, submit information as an Annexure to this Form and sign each page.
3. Complete as is applicable.