PURPOSE

This Privacy Policy applies to personal information that Just Brands Africa (PTY) Ltd, Reg. 2013/228381/07, (‘Just Brands Africa’ or ‘Company’) may process in regard to any or all of the services contemplated by this notice directly, through and to the benefit of the platform TOPICX, or contracted third party affiliates which will be collected.

This policy also serves to protect the Company from compliance risks associated with the protection of personal information which includes:

Breaches of confidentiality

Failing to offer choice to Data subjects to choose how and for what purpose their information is used for

Reputational damage

The policy also demonstrates the Company’s commitment to protecting the privacy rights of Data subjects.

SCOPE

This document applies to the Company’s Board of Directors, all employees, contractors, suppliers, clients, persons acting on behalf of the company and all potential and existing Data subjects.

INTRODUCTION

The Protection of Personal Information Act, 4 of 2013 (‘POPIA’) requires the Company to inform Data subjects as to how their personal information is used, collected, disclosed and destroyed.

The Company is committed to compliance with POPIA and other applicable legislation, protecting the privacy of Data subjects and ensuring that their personal information is used appropriately, transparently and securely.

This policy is made available on the Company’s website https://topicx.co.za/ and should be read in conjunction with the Company’s Website Privacy Notice.

DEFINITIONS

PERSONAL INFORMATION

Personal information means information relating to an identifiable, living, natural person, and where it is applicable, an existing, identifiable juristic person and may include but is not limited to:

information relating to the race, gender, sex, pregnancy, marital status, nationality, ethnic- or social-origin, colour, sexual orientation, age, physical or mental health, well-being, disability, religion, conscience, belief, culture, language and birth of the person;

information relating to the education or the medical, financial, criminal or employment history of the person; any identifying number, symbol, e-mail address, physical address, telephone number, location information, online identifier or other particular assignment to the person; the biometric information of the person; the personal opinions, views or preferences of the person; correspondence sent by the person that is implicitly or explicitly of a private or confidential nature or further correspondence that would reveal the contents of the original correspondence; information regarded as confidential business information; the views or opinions of another individual about the person; and the name of the person if it appears with other personal information relating to the person or if the disclosure of the name itself would reveal information about the person.

DATA SUBJECT

This refers to the natural or juristic person to whom personal information relates, such as employees, clients, delegates, sub-contractors or a company that supplies the Company with goods or services.

BREACH

A breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed.

PROCESSING

A breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed.

RIGHTS OF DATA SUBJECTS

The Company will ensure that it makes Data subjects aware of their rights as appropriate and specifically with regards to the following:

THE RIGHT TO ACCESS PERSONAL INFORMATION

Data subjects have the right to establish whether the Company holds personal information related to them, including the right to request access to that personal information.

THE RIGHT TO HAVE PERSONAL INFORMATION CORRECTED OR DELETED

Data subjects also have the right to ask the Company to update, correct or delete their personal information on reasonable grounds.

THE RIGHT TO OBJECT TO THE PROCESSING OF PERSONAL INFORMATION

Data subjects have the right on reasonable grounds, to object to the processing of their personal information.

The Company will consider such requests and the requirements of POPIA and may cease to process such personal information and may, subject to statutory and contractual record-keeping requirements, also destroy the personal information.

THE RIGHT TO OBJECT TO DIRECT MARKETING

Data subjects have the right to object to their personal information being used for the purposes of direct marketing by means of unsolicited electronic communications.

THE RIGHT TO COMPLAIN TO THE INFORMATION REGULATOR

Data subjects have the right to submit a complaint to the Information Regulator regarding infringements of any of their rights protected under POPIA and to institute civil proceedings against alleged non-compliance with the protection of their personal information.

THE RIGHT TO BE INFORMED

Data subjects have the right to be informed that their personal information is being collected by the Company and should also be notified in any situation where the Company reasonably believe that the personal information of data subjects has been accessed by unauthorised person/s.

GENERAL PRINCIPLES

All employees and persons acting on behalf of the Company will be subject to the following guiding principles:

ACCOUNTABILITY

Compliance failure could damage the reputation of the company and its shareholder, the Company. The Company could also be exposed to a civil claim for damages. The protection of personal information is therefore everybody’s responsibility.

The Company will take appropriate steps including disciplinary action against individuals who through intentional or negligent actions and/or omissions fail to comply with this policy.

PROCESSING LIMITATION

The Company collects personal information directly from Data subjects only as pertains to business requirements. The type of information will depend on the need for which it is collected and will be processed for that purpose only. Just Brands Africa (PTY) Ltd will inform Data subjects as to what information is mandatory or deemed optional, as far as possible.

Personal information will only be used for the purpose for which it was collected, intended and as agreed. This may include:

Registering delegates on training courses;

Issuing certificates to delegates upon successful completion of training courses;

Processing claims received from subcontractors;

Issuing tax certificates to subcontractors;

Recruitment activities of students and employees;

Record keeping and payment of employees;

Administration of employment benefits;

Recording and payment of suppliers;

Confirming, verifying and updating client information;

For registration purposes with statutory bodies (CIPC, SARS) and institutions (banks);

Contractual obligations;

In connection with legal proceedings;

In connection with and to comply with legal and regulatory requirements or when allowed by law;

For audit and reporting purposes; and

Marketing activities as provided in POPIA and the Consumer Protection Act 68 of 2008 (‘CPA’).

According to Section 10 of POPIA, personal information may only be processed if the purpose for which it is processed is adequate, relevant and not excessive. Certain conditions must be met for the Company to process personal information as in Section 11 of POPIA. These are listed below:

Data subjects consent to the processing – consent is obtained during early stages of the relationship.

Processing is necessary – personal information is required to facilitate the provision of services to the Data subject or for the conclusion of a contract to which the Data subject is a party.

The Company is under obligation by law.

The legitimate interest of the Data subject is protected – it is in their best interest to provide the personal information.

Processing is in the best interest of the Company – in order to provide our services to the Data subject.

SPECIFIC DUTIES AND RESPONSIBILITIES

BOARD OF DIRECTORS

The Company’s Board of Directors is ultimately accountable for ensuring that the Company meets its obligations under POPIA. The Board of Directors may however delegate some of its responsibilities to management or other capable individuals.

CHIEF EXECUTIVE OFFICER

The Chief Executive Officer is by virtue of the position, appointed automatically as Information Officer in terms of the Promotion of Access to Information Act and POPIA and may authorise any person in the Company to act as the Information Officer of the Company. The CEO however retains the responsibility and accountability for any powers or the functions authorised to that person and has the right to amend and/or withdraw any of these powers, duties and responsibilities.

THE COMPANY’S INFORMATION OFFICER IS RESPONSIBLE FOR THE FOLLOWING:

Taking steps to ensure the Company’s reasonable compliance to POPIA;

Reviewing the Company’s information protection procedures and policies;

Ensuring that the Company makes it convenient for Data subjects to communicate with the

Company regarding their personal information;

Encourage compliance with the lawful processing of personal information;

Ensure that employees and persons acting on behalf of the Company are aware of the risks associated with the processing of personal information;

Ensure that employees are trained in the processing of personal information;

Address employees’ POPIA-related questions;

Address POPIA-related requests and complaints made by the Company’s Data subjects; and Act as contact point for the Information Regulator on issues pertaining to the processing of personal information.

THE COMPANY’S EXECUTIVE MANAGER IN CHARGE OF INFORMATION TECHNOLOGY IS RESPONSIBLE FOR:

Ensuring that the Company’s IT infrastructure and any other devices used for processing personal information meet acceptable security standards;

Ensuring that servers containing personal information are sited in a secure location;

Ensuring that all electronically stored information is backed up and tested on a regular basis; Ensuring that all back-ups are protected from unauthorised access, accidental deletion and malicious hacking attempts;

Ensuring that information being transferred electronically is encrypted;

Ensuring that all servers and computers containing personal information are protected by a firewall and the latest security software;

Performing regular IT audits to ensure that the security of the Company’s hardware and software systems are functioning properly;

Performing regular IT audits to verify whether electronically stored personal information has been accessed or acquired by unauthorised persons; and

Performing a proper due diligence review prior to contracting with third-party providers to process personal information on the Company’s behalf.

EMPLOYEES AND OTHER PERSONS ACTING ON BEHALF OF THE COMPANY ARE RESPONSIBLE FOR:

Keeping all personal information that they come into contact with secure by taking precautions and complying with this policy;

Ensuring that personal information is kept in as few places as is necessary;

Ensuring that personal information is encrypted prior to sharing the information electronically; Ensuring that all devices such as computers, flash drives, etc. are password protected and never left unattended (refer to the Company’s Electronic Communications policy); Ensure that computer screens and other devices are switched off when not in use; Ensure that removable storage devices such as external drives that contain personal information are locked away securely when not being used;

Ensure that where personal information is stored on paper, that such hard copies are kept in a secure place where unauthorised persons are not able to access it;

Ensure that where personal information has been printed out, that the printouts are not left unattended where unauthorised individuals could see them;

Take reasonable steps to ensure that personal information is stored only for as long as it is needed or required;

Undergo POPIA awareness training from time to time.

Employees and other persons acting on behalf of the company will under not circumstances:

Process personal information where it is not a requirement to perform their workrelated duties; Save copies of personal information directly to their own private computers or mobile devices; and

Share personal information informally.

DATA BREACH PROCEDURE

REPORTING A POSSIBLE BREACH

Any employee who becomes aware of a possible breach of Personal Information must immediately inform their line manager and the Information Officer and/or the Deputy Information Officers.

The employee must ensure to retain any evidence they have in relation to the breach and provide a written statement setting out any relevant information relating to the suspected data breach using the Data Breach Record.

Employees may not attempt to investigate the suspected breach themselves and must not notify the affected data subjects. The data breach team will investigate and assess the suspected breach and will determine who will be notified and how.

RESPONSE PLAN

The Company’s CEO,the Information Officer, or designated deputy Information Officer will assemble a team to investigate, manage and respond to the data breach.

The breach team will then:

Make an urgent preliminary assessment of what data have been lost, why and how.

Take immediate steps to contain the breach and recover any lost data.

Undertake a full and detailed assessment of the breach.

Record the breach in the company’s data breach register.

Notify the Information Regulator, if necessary.

Notify affected data subjects, if necessary.

Put in place any measures to address it and to mitigate its possible adverse effects and to prevent further breaches.

DATA BREACH REGISTER

The company will maintain a register of all personal data breaches regardless of whether or not it is notifiable to the Information Regulator. The register will include a record of:

The facts relating to the breach including the cause, what happened and what personal data were effected; the effects of the breach; and the remedial actions Just Brands Africa (PTY) Ltd have taken.

NOTIFICATION TO THE INFORMATION REGULATOr

Not all personal data breaches have to be notified to the Information Regulator. The breach will only have to be notified if it is likely to result in a risk to the rights and freedoms of data subjects and this will be assessed by the company on a case-by-case basis.

NOTIFICATIONS TO DATA SUBJECTS

The data breach team will consider several factors in determining the notifications to individuals affected by the data breach including but not limited to:

Contractual obligations;

Risk of identity theft or fraud because of the type of information lost such as contact details, bank information or identity numbers;

Risk of physical harm;

Risk of hurt, humiliation or damage to reputation if the information includes medical or disciplinary records; and

Number of data subjects affected.

Affected individuals must be notified without unreasonable delay, unless such notification will impair a criminal investigation. Notices must be in plain language and include basic information such as what happened, type of information involved, steps being taken, steps individuals should take and contact information.

DISCIPLINARY ACTION

The Company may recommend appropriate legal or disciplinary action to be taken against any employee found to be implicated in any non-compliant activity outlined within this policy.

Any gross negligence or intentional mismanagement of personal information will be considered a serious form of misconduct under the Company’s Disciplinary code and may lead to dismissal.

Examples of actions that may be taken subsequent to an investigation include:

A recommendation to commence with disciplinary action

A referral to law enforcement agencies for criminal investigation Recovery of funds in order to limit any damages caused.

How to contact us

Information Officer:

Francois van Louw
E: francois@jbafrica.com
T: +27 73 102 4961

Deputy Information Officers:

Nicholas Manuel
E: nick@jbafrica.com
T: +27 76 546 7153

Ben Henning
E: ben@jbafrica.com
T: +27 63 802 2173

Nicholas Curtis
E: nicholas@jbafrica.com
T: +27 81 454 9493

This Privacy Notice applies to personal information that Just Brands Africa (PTY) Ltd, Reg. 2013/228381/07, (‘Just Brands Africa’) may process in regard to any or all of the services contemplated by this notice directly, through and to the benefit of the platform TOPICX, or contracted third party affiliates which will be collected through this website: https://topicx.co.za/ (‘website‘).

Just Brands Africa is committed to deal responsibly with your personal information. Just Brands Africa provides you with this privacy notice in order for you to make an informed decision about whether you want to use our website or not and/ or provide your personal information. The use of the website and the provision of any personal information is of your own volition.

Please note that by using our website you implicitly consent to this privacy notice and should you provide any personal information then you will be asked to make your consent explicit.

If you do not consent to this privacy notice and proceed using the website, you consent will be taken as implicit.

DEFINITION OF PERSONAL INFORMATION:

According to the Protection of Personal Information Act No. 4 of 2013 (hereinafter referred to as ‘POPIA’), Personal information means information relating to an identifiable, living, natural person, and where it is applicable, an identifiable, existing juristic person, including, but not limited to –

Information relating to the race, gender, sex, pregnancy, marital status, nationality, ethnic-or social-origin, sexual orientation, age, physical or mental health, well-being, religion, conscience, belief, culture, language and birth of the person;

Information relating to the education or the medical, financial, criminal or employment history of the person;

Any identifying number, symbol, e-mail address, physical address, telephone number, location information, online identifier or other particular assignment to the person;

The biometric information of the person;

The personal opinions, views or preferences of the person;

Correspondence sent by the person that is implicitly or explicitly of a private or confidential nature or further correspondence that would reveal the contents of the original correspondence;

The views or opinions of another individual about the person; and

The name of the person if it appears with other personal information relating to the person or if the disclosure of the name itself would reveal information about the person.

HOW JUST BRANDS AFRICA (PTY) COLLECTS, SHARES AND STORES INFORMATION:

To the extent permissible under POPIA and any other applicable law, Just Brands Africa collects, shares and stores information about you and any other party whose detail you provide to us when you:

use our online services; this may include your name (including business name), address, email address and telephone number; register to use our applications; provide us with testimonials; and interact with us using social media.

The list above is non-exhaustive and may form the basis for any incidental processing deriving thereof.

HOW JUST BRANDS AFRICA (PTY) USES YOUR INFORMATION:

Just Brands Africa (PTY) will only use personal information that you provide through this website for the purposes for which you provided it. To the extent permissible by law and POPIA, Just Brands Africa (PTY) uses your information to:

provide any information or services that you have requested; manage and administer your use of the services you have asked us to provide; manage our relationship with you (for example, customer services and support activities); detect and prevent illegal or prohibited activities or to otherwise protect our legal rights

(including liaison with law enforcement agencies for these purposes); contact you to see if you would like to take part in our customer research; deliver electronic communications to you which may be useful to you, based on your use of our services; and assist Just Brands Africa improve the functionality and content of the website.

SECURING YOUR INFORMATION

Just Brands Africa has reasonable security measures in place to protect your personal information from loss, misuse, unauthorised access, being altered or being destroyed and Just Brands Africa regularly checks our systems for vulnerabilities.

SOCIAL MEDIA PLATFORMS AND EXTERNAL LINKS

Our website makes use of links to other platforms such as Google, Facebook, Twitter, and the like, and you should be aware that those platforms are governed by their own privacy procedures that Just Brands Africa has no control over.

CHILD USERS

Just Brands Africa (PTY) may amend this privacy notice at any time. The amended privacy notice will be posted on this website and the current notice will replace all previous versions of this notice. It is your responsibility to make yourself familiar with the content of this notice when you visit our website.

CHANGES TO THE PRIVACY NOTICE

The Just Brands Africa (PTY) Ltd may provide links to other websites or resources. This does not imply Just Brands Africa (PTY) Ltd’s endorsement of such sites. Just Brands Africa (PTY) Ltd does not have any control over these websites and will, therefore, not be liable for any damages whatsoever arising from the utilisation of these websites by users.

Just Brands Africa (PTY) Ltd does not prohibit third-party sites to link to publicly visible content on this website. However, it is expressly prohibited for any third party to frame any page on this website in any way whatsoever without the prior written approval of Just Brands Africa (PTY) Ltd.

HOW TO CONTACT US

Information Officer:

Francois van Louw
E: francois@jbafrica.com
T: +27 73 102 4961

Deputy Information Officers:

Nicholas Manuel
E: nick@jbafrica.com
T: +27 76 546 7153

Ben Henning
E: ben@jbafrica.com
T: +27 63 802 2173

Nicholas Curtis
E: nicholas@jbafrica.com

This Privacy Notice applies to personal information that Just Brands Africa (PTY) Ltd, Reg. 2013/228381/07, (‘Just Brands Africa’) may process in regard to any or all of the services contemplated by this notice directly, through and to the benefit of the platform TOPICX, or contracted third party affiliates which will be collected through this website: topicx.co.za.

Just Brands Africa is committed to deal responsibly with your personal information. Just Brands Africa provide you with this privacy notice in order for you to make an informed decision about whether you want to use our website or not and/ or provide your personal information. The use of the website and the provision of any personal information is of your own volition.

Please note that by using our website you implicitly consent to this privacy notice and should you provide any personal information then you will be asked to make your consent explicit.

If you do not consent to this privacy notice and proceed using the website, you consent will be taken as implicit.

Definition of Personal Information

According to the Protection of Personal Information Act No. 4 of 2013 (hereinafter referred to as ‘POPIA’), Personal information means information relating to an identifiable, living, natural person, and where it is applicable, an identifiable, existing juristic person, including, but not limited to –

Information relating to the race, gender, sex, pregnancy, marital status, nationality, ethnic-or social-origin, sexual orientation, age, physical or mental health, well-being, religion, conscience, belief, culture, language and birth of the person;

Information relating to the education or the medical, financial, criminal or employment history of the person;

Any identifying number, symbol, e-mail address, physical address, telephone number, location information, online identifier or other particular assignment to the person;

The biometric information of the person;

The personal opinions, views or preferences of the person;

Correspondence sent by the person that is implicitly or explicitly of a private or confidential nature or further correspondence that would reveal the contents of the original correspondence;

The views or opinions of another individual about the person; and

The name of the person if it appears with other personal information relating to the person or if the disclosure of the name itself would reveal information about the person.

How Just Brands Africa (PTY) collects, shares and stores information

To the extent permissible under POPIA and any other applicable law, Just Brands Africa collects, shares and stores information about you and any other party whose detail you provide to us when you:

use our online services; this may include your name (including business name), address, email address and telephone number; register to use our applications; provide us with testimonials; and interact with us using social media.

The list above is non-exhaustive and may form the basis for any incidental processing deriving thereof.

How Just Brands Africa (PTY) uses your information

Just Brands Africa (PTY) will only use personal information that you provide through this website for the purposes for which you provided it. To the extent permissible by law and POPIA, Just Brands Africa (PTY) uses your information to:

provide any information or services that you have requested; manage and administer your use of the services you have asked us to provide; manage our relationship with you (for example, customer services and support activities); detect and prevent illegal or prohibited activities or to otherwise protect our legal rights

(including liaison with law enforcement agencies for these purposes); contact you to see if you would like to take part in our customer research; deliver electronic communications to you which may be useful to you, based on your use of our services; and assist Just Brands Africa improve the functionality and content of the website.

Securing your information

Just Brands Africa has reasonable security measures in place to protect your personal information from loss, misuse, unauthorised access, being altered or being destroyed and Just Brands Africa regularly check our systems for vulnerabilities.

Securing your information

Our website makes use of links to other platforms such as Google, Facebook, Twitter, and the like, and you should be aware that those platforms are governed by their own privacy procedures that Just Brands Africa has no control over.

Securing your information

A child user is under the age of 18 years who is not legally competent, without the assistance of a competent person, to take any action or decision in respect of any matter concerning him- or herself.

A competent person is any person who is legally competent to consent to any action or decision being taken in respect of any matter concerning a child. The child’s parent or legal guardian would qualify as a competent person.

In order for the child to complete the registration process, which will be an agreement in this instance, required on this website, he or she will need to get the consent of a competent person. Consent by a competent person will usually be given before or at the time of agreement, but it may also be given afterwards by the parent’s or guardian’s subsequent ratification of the agreement. The agreement is then validated retroactively.

The child user’s consent can be withdrawn after the child user reaches the age of 18 years and above. The withdrawn consent has to be in writing and directed to Just Brands Africa (PTY) Ltd, Reg. 2013/228381/07, at [insert email address/ physical address] to action within reasonable time. The withdrawn consent can be wholly or in part in which case it needs to be specific to the particular action connected to the consent being withdrawn.

The child user loses the right to set aside the agreement where the child or any person acting on his or her behalf, by act or omission, led the Just Brands Africa (PTY) Ltd, Reg. 2013/228381/07, to believe that he or she had an unfettered legal capacity to agreement, or attempted to obscure or suppress the fact that the capacity was absent.

Changes to the Privacy Notice

Just Brands Africa (PTY) may amend this privacy notice at any time. The amended privacy notice will be posted on this website and the current notice will replace all previous versions of this notice. It is your responsibility to make yourself familiar with the content of this notice when you visit our website.

How to contact us

Information Officer:

Francois van Louw
E: francois@jbafrica.com
T: +27 73 102 4961

Deputy Information Officers:

Nicholas Manuel
E: nick@jbafrica.com
T: +27 76 546 7153

Ben Henning
E: ben@jbafrica.com
T: +27 63 802 2173

Nicholas Curtis
E: nicholas@jbafrica.com
T: +27 81 454 9493