1.1 V & S Innovation (Pty) Ltd (registration number 2017/404736/07) (hereinafter referred to as "V & S"), in order to carry out its goals and business objectives as an items-ordering and cashless-payments company, does and will on an ongoing basis collect, store, transfer and use personal information.
1.2 The Protection of Personal Information Act 4 of 2013 (hereinafter referred to as "POPIA") aims to give effect to the constitutional right to privacy by introducing measures that regulate every step of how personal information belonging to both individuals and juristic entities is collected, stored, transferred and used by both private and public bodies, from the moment of collection until the moment of destruction, in order to ensure that personal information is processed and managed in a fair, transparent and secure manner.
1.3 V & S is committed to protecting individuals’ and juristic entities’ right to privacy and, in consequence, undertakes to responsibly process personal information in line with the provisions of POPIA. V & S does this not only to comply with the provisions of POPIA, but also to protect its reputation, as well as to be a good corporate citizen.
1.4 The purpose of this policy is to create a general framework aimed at setting out the manner in which V & S processes personal information.
1.5 This Privacy Policy is applicable to all of V & S’s electronic platforms and facilities, including but not limited to social-media platforms, websites, applications and emails.
1.6 This Privacy Policy is also applicable to all of V & S’s employees, clients, vendors, contractors, suppliers and any other third parties whose personal information may be collected, stored, transferred, used or processed in any other way by V & S.
1.7 This Privacy Policy must be read together with the Online Terms and Conditions and General Legal Terms available on V & S’s website at www.vands.co.za.
The following definitions apply to this policy:
3.1 V & S undertakes to process the personal information of the Client to the extent, and in such manner as is necessary, to provide the services agreed upon and in accordance with the written instructions of the Client, unless required to do otherwise by law.
3.2 V & S further undertakes, at all times, to reasonably process personal information and is accordingly committed to processing personal information in an adequate, relevant and non-excessive manner.
3.3 V & S will accordingly process the personal information of its Clients for the following purposes:
3.3.1 to act on or respond to instructions or requests for the provision of any of V & S’s products and/or services;
3.3.2 to process orders, sales and delivery of items;
3.3.3 to fulfil any contractual obligations and/or responsibilities which may arise in terms of a contract entered into with V & S as a Responsible Party, Operator or Contracting Party in any other capacity;
3.3.4 to comply with any compulsory obligations and/or responsibilities under South African laws and regulations, including but not limited to POPIA, FICA, the POCDATARA Act, the CPA, UIF and the Companies Act;
3.3.5 for human resources and labour relations purposes in the case of prospective, existing and former employees;
3.3.6 for market research, analytical and statistical purposes;
3.3.7 for general administrative purposes;
3.3.8 for audit and record-keeping purposes;
3.3.9 for the purpose of identifying and promoting other products and services which might be of interest to Clients;
3.3.10 for business transaction purposes such as, but not limited to, a merger, acquisition or any form of sale of assets;
3.3.11 for the purpose of helping us improve and customise the Client’s website experience, which will include but is not limited to the processing of personal information in the form of HTTP cookies; and
3.3.12 for any other purpose related to the functions and activities of V & S.
3.4 In order to perform the purposes described above, V & S may from time to time share a Client’s personal information with the following parties:
3.4.1 V & S’s employees, on a need-to-know basis;
3.4.2 V & S’s suppliers and vendors, on a need-to-know basis;
3.4.3 V & S’s carefully selected business partners who provide products and services which may be of benefit to a Client, on a need-to-know basis;
3.4.4 V & S’s operators, such as service providers and agents who perform services on behalf of V & S, on a need-to-know basis and in terms of a V & S operator agreement.
3.5 V & S does not share or process Clients’ personal information with any third parties not described in clause 3.4 above, unless:
3.5.1 V & S is legally obliged to provide such information to comply with an obligation imposed by law;
3.5.2 it is necessary for the purpose of fulfilling the contractual obligations of a contract entered into between the Client and V & S;
3.5.3 it is necessary for pursuing the legitimate interests of V & S or of a third party to whom the information is supplied;
3.5.4 it is necessary in order to protect a legitimate interest of the Client; or
3.5.5 the consent of the Client has been obtained.
3.6 Under all the above-mentioned circumstances, V & S will take reasonable measures to ensure that such personal information is only provided to the recipient if such recipient undertakes to keep the personal information secure and confidential.
3.7 The duty of security and confidentiality held by the recipient will continue even after the termination or expiry of their services.
3.8 V & S is committed to ensuring that the personal information that it processes is obtained directly from its Clients.
3.9 Notwithstanding the provisions of clause 3.8, V & S may and will process personal information not obtained directly from its Clients in the following circumstances:
3.9.1 the personal information is contained in or derived from a public record, or has deliberately been made public by the Client;
3.9.2 the Client (or a competent person where the Client is a minor) has consented to the collection of the information from another source;
3.9.3 the collection of the personal information from another source would not prejudice a legitimate interest of the Client;
3.9.4 the collection of the information from another source is necessary to comply with an obligation imposed by law;
3.9.5 the collection of the information from another source is necessary for the purpose of proceedings in any court of law or tribunal that has commenced or is reasonably contemplated;
3.9.6 the collection of the information from another source is necessary to maintain the legitimate interest of V & S or of a third party to whom the information is supplied;
3.9.7 obtaining the personal information directly from the Client would prejudice the lawful purpose for which it is collected; or
3.9.8 obtaining the personal information directly from the Client is not reasonably practicable.
3.10 The personal information of Clients may also be further processed, but only in accordance with, or in a manner compatible with, the purpose for which the personal information was obtained as provided for in clause 3.3 above.
3.11 If a Client discloses their personal information to a third party, such as an entity which operates a website linked to the V & S App or anyone other than V & S, V & S SHALL NOT BE LIABLE FOR ANY LOSS OR DAMAGE, HOWSOEVER ARISING, SUFFERED BY THE CLIENT AS A RESULT OF THE DISCLOSURE OF SUCH INFORMATION TO THE THIRD PARTY. V & S is unable to regulate or control how third parties use personal information.
4.1 V & S has appointed and registered the following person as Information Officer:
Name: Timothy Strang
Contact details: tim@vands.co.za
4.2 V & S has appointed and registered the following person as Deputy Information Officer:
Name: Nakoshia Naidoo
Contact details: nakoshia@vands.co.za
4.3 The duties of the Information Officer include the following:
4.3.1 to encourage compliance, by V & S, with the conditions for the lawful processing of personal information;
4.3.2 to comply with any requests made to V & S pursuant to POPIA;
4.3.3 to work with the Information Regulator in relation to investigations;
4.3.4 to ensure compliance by V & S with the provisions of POPIA;
4.3.5 to ensure that a compliance framework is developed, implemented, monitored and maintained;
4.3.6 to ensure that a personal information impact assessment is done to ensure that adequate measures and standards exist to comply with the conditions for the lawful processing of personal information;
4.3.7 to ensure that a manual is developed, monitored, maintained and made available as prescribed in PAIA;
4.3.8 to ensure that internal measures are developed together with adequate systems to process requests for information or access thereto; and
4.3.9 to ensure that internal awareness sessions are conducted regarding the provisions and Regulations of POPIA, codes of conduct, and information obtained from the Regulator.
4.4 The Information Officer has the authority to designate and delegate any power and duty to a Deputy Information Officer.
4.5 The Information Officer shall, upon request by any person, provide copies of the manual to that person upon the payment of a fee.
5.1 V & S has implemented the appropriate technical and organisational security measures required to protect all personal information which it holds, from and against unauthorised access, accidental or wilful manipulation, and loss or destruction.
5.2 While V & S takes all reasonable efforts to safeguard the personal information which it holds, it cannot be held responsible for any loss or unauthorised processing of personal information which is beyond V & S’s reasonable control.
5.3 V & S’s website may contain links to other websites outside of V & S’s control. Accordingly, V & S is not responsible for the content, privacy or security of these other third-party-controlled websites.
5.4 V & S has placed cookies on its website which may make contact with a Client’s device to help make V & S’s social-media and electronic-platform website better.
5.5 V & S makes use of social plugins of social networks such as Facebook, YouTube, Twitter, Instagram, LinkedIn and Google. Kindly note that V & S has no influence on, or control over, the extent of the data retrieved by the social-network interfaces, and V & S can accordingly not be held responsible or liable for any processing or use of personal information transmitted via these social plugins.
5.6 For information on the purpose and extent of the data retrieval by the social network concerned, and about the rights and settings which are available to protect the personal information of the Client, please refer to the privacy policy provided by the social network concerned.
6.1 V & S will not retain the personal information of Clients for longer than is necessary for achieving the purpose for which the information was collected, stored, transferred, used or processed in any other way.
6.2 Personal information obtained for any of the purposes set out in clause 3.3 will be retained for as long as there is an active and existing relationship between V & S and the Client.
6.3 The personal information of inactive former Clients will be retained only when it is required or authorised by law, for any lawful purposes related to V & S’s functions or activities, by a contract between V & S and the former Client, by consent of the former Client, or a competent person where the information relates to a minor.
6.4 Should there be no valid reason as set out in 6.3 for retaining the personal information of former Clients, the record of personal information will be destroyed, deleted or alternatively de-identified.
6.5 The destruction or deletion of a record of personal information in terms of clause 6.4 will be done in a manner that prevents its reconstruction in an intelligible form.
6.6 V & S will not process personal information if its accuracy is contested by the Client.
7.1 A Client, having provided adequate proof of identity, may request V & S to confirm, free of charge, whether or not V & S holds personal information about the Client.
7.2 A Client, having provided adequate proof of identity, may also request the record or description of the personal information about the Client that is held by V & S. This record or description of the record will be provided within a reasonable time, at a prescribed fee.
7.3 Whilst V & S will take reasonably practicable steps to ensure the integrity and accuracy of a Client’s personal information, this may not at all times be possible. It is accordingly the responsibility of the Client to update V & S of any changes to their personal information.
7.4 Clients have the right to access, or request a correction or deletion of, any personal information which V & S may have, and where applicable may ask V & S to update any inaccuracies in such personal information. Any such request must be made by completing the appropriate form and submitting it to the Information Officer.
7.5 Clients have the right to request the destruction or deletion of any record of personal information which V & S may have. Any such request must be made by completing the appropriate form and submitting it to the Information Officer.
8.1 If V & S collects, stores, transfers, uses or processes in any way the personal information of a minor, it will do so only with the consent of the minor’s parent or legal guardian, unless the processing is necessary for the establishment, exercise or defence of a right or obligation in law.
9.1 V & S will not transfer personal information about a Client to a third party who is in a foreign country, unless the third party who is the recipient of the information is subject to a law, binding corporate rules or binding agreement which provide an adequate level of protection that is the same or substantially similar to the level of protection offered by POPIA.
9.2 V & S may also transfer the personal information of a Client to a third party who is in a foreign country in the following circumstances:
9.2.1 where the Client consents to the transfer;
9.2.2 where the transfer is necessary for the performance of a contract between the Client and V & S; or
9.2.3 where the transfer is for the benefit of the Client and it is not reasonably practicable to obtain the consent of the Client to that transfer, and if it were reasonably practicable to obtain such consent, the Client would be likely to give it.
10.1 A Client may at any time withdraw their consent to the processing of any of their personal information held by V & S.
10.2 Clients have the right to request the withdrawal of their consent to the processing of any personal information held by V & S. Any such request must be made by completing the appropriate form and submitting it to the Information Officer.
10.3 The lawfulness of the processing of personal information before the withdrawal of consent will not be affected.
11.1 V & S shall notify the Client within a reasonable time, in writing, and shall place notice on its website, if it becomes aware or has reasonable grounds to believe that the personal information of Clients has been accessed or acquired by unauthorised persons.
11.2 V & S undertakes further to promptly take action, at its own reasonable expense, to investigate any such suspected breach and to identify, prevent and mitigate the effects of any such breach.
11.3 V & S will, as soon as is reasonably possible after the discovery of the compromise provided for in clause 11.1, in writing and in accordance with the provisions of POPIA, notify the Information Regulator.
12.1 V & S reserves the right to, and may from time to time, update or amend this Privacy Policy.
12.2 If material amendments are made to how personal information is collected, stored, transferred, used or processed in any other way, this Privacy Policy will be updated and notices will be provided where appropriate.
12.3 Any general updates or amendments of this Privacy Policy will be published as such on the V & S website.
12.4 By continuing to use the V & S website or any of V & S’s other services following any updates or amendments, the Client will be deemed to have agreed to such changes.
12.5 Clients are advised to visit and re-read this Privacy Policy on a regular basis.
13.1 Should a Client believe that V & S has used their personal information contrary to this Privacy Policy, the Client has the right to lodge a complaint with the Information Regulator.
13.2 Notwithstanding the provisions of clause 13.1, V & S encourages Clients to first follow internal complaints processes in order to resolve the complaint. In this regard, Clients are encouraged to contact the Information Officer.