Governance - Growth In Motion | RE Training

Protection of Personal Information Act (POPIA)
Data Protection and Policy

PURPOSE

Growth in Motion (GIM) places a high premium on the privacy and personal information of our clients, employees, service providers, stakeholders, business partners, learners and any other third-party with whom we engage or contract. GIM is therefore committed to ensure that it complies with the requirements of the Protection of Personal Information Act, 4 of 2013 (“POPIA”) and other potentially applicable data protection and privacy laws.

1. DEFINITIONS

In this Policy (as defined below), unless the context requires otherwise, the following capitalised terms shall have the meanings given to them —
1. “Active Processing” refers to instances where GIM has directly been provided with the Personal Information/Personal Data of Data Subjects, such as when Data Subjects submit an enquiry in respect of GIM products and/or services, or when Data Subjects provide Personal Information/Personal Data to GIM pursuant to concluding any commercial agreement(s) with GIM;
2. “Applicable Laws” mean any laws applicable to Personal Data and Personal Information and include any statute, regulation, notice, policy, directive, ruling or subordinate legislation; the common law; any binding court order, judgment or ruling; any applicable industry code, policy or standard enforceable by law; or any applicable direction, policy or order that is given by any regulator, competent authority or organ of state or statutory industry body;
3. “Bulk Registration Template” means an excel spreadsheet or similar data capturing file completed by an employer on behalf of the Data Subject for the sole purpose of registering the Data Subject for specific courses;
4. “Client” means any natural person over the age of 18 years;
5. “Competent Person” means anyone who is legally competent to consent to any action or decision being taken by any matter concerning a GIM LEARNING programme;
6. “Controller” means GIM, in circumstances where it Processes Personal Data (as defined in Article 4 of the GDPR);
7. “Cookies” means small text files that store either Non-personally Identifiable Information/Data or Personal Information/Personal Data about Data Subjects, either temporarily in connection with a Data Subjects Internet Protocol (IP) address (known as a temporary or session cookie and deleted once a Data Subject closes their browser window) or more permanently on the hard drive of a Data Subject’s device or for purposes of remembering the Website(s) settings (known as a permanent or persistent cookie, or flash cookies). GIM’s Website(s) and/or or LMS(s) may from time to time make use of sessions, persistent or flash cookies so that Data Subjects do not have to fill in the same information from page to page within our Website(s) or LMS(s) and to enhance any Data Subject’s experience of GIM’s Website and/or LMS(s). If Data Subjects elect not to receive cookies, they may be able to view some, but not all of the content on GIM Website(s) or LMS(s);
8. “Data Subject” means GIM clients or any Third-Party in respect of whom GIM Processes Personal Information/Personal Data;
9. “Embedded Scripts” means, programming code that is designed to collect information about a Data Subject’s interactions with the relevant Website(s) or LMS(s). It is temporarily downloaded onto a Data Subject’s device from GIM’s web server or a Third-Party Operator. This program is active only while a Data Subject is connected to the relevant Website(s) or LMS(s) and is deleted or deactivated thereafter;
10. “GDPR” means Regulation (EU) 2016/679 of the European Parliament and of the Council of the European Union of 27 April 2016 on the protection of natural persons with regards to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC, more commonly referred to as the General Data Protection Regulation;
11. “Inactive Processing” refers to instances where GIM has not actively been provided with the Personal Information/Personal Data of Data Subjects, and deploys Passive Processing Means to collect information from Data Subjects. These Passive Processing Means allow GIM to Process certain kinds of Non-personally Identifiable Data which can perhaps not be linked to Data Subjects;
12. “Learner” means any natural person who has concluded an agreement with GIM, either directly or indirectly through his/her employer or any other party with whom GIM has an agreement, in terms of which such learner enjoys pre-determined, tailored and personalised training courses against payment, either once-off or by way of monthly contributions;
13. “Learner Management System (LMS)” means GIM’s digital online application interface where all GIM’s learning programmes are hosted and which enables learners to manage their individual learner profile, access their study material and complete courses;
14. “LMS” means the learner management website owned and operated by GIM sourced at www.gimacademy.africa;
15. “Learner Portal” means the digital portal to which a learner has access to manage their individual profile;
16. “Non-personally Identifiable Information/Data” means any information/data which cannot be linked to Data Subjects, such as an internet domain name, the type of web browser used by a Data Subject, the type of operating system relied on by a Data Subject, the date and time of a Data Subject’s visit to GIM’s Website(s) and LMS(s) the specific pages a Data Subject may have visited, and the address of the website which a Data Subjects may have visited prior to entering or gaining access to GIM’s Website or LMS;
17. “Operator” means a person or entity who Processes Personal Information/Data for a Responsible Party;
18. “Passive Processing” means the use of technologies to facilitate the Inactive Processing of Personal Information/Personal Data, namely the use of Cookies, Web Beacons, Embedded Scripts and/or Mobile Device Identifiers;
19. “Personal Data” (as defined in Article 4 of the GDPR) means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly;
20. “Personal Information” shall have the same meaning as is given in section 1 of POPIA;
21. “Policy” means this Data Protection and Privacy Policy;
22. “POPIA” means the Protection of Personal Information Act, No 4 of 2013;
23. “Processing” means any operation or activity or any set of operations, whether or not by automatic means, concerning Personal Information/Personal Data, including:
24. the collection, receipt, recording, organisation, collation, storage, updating or modification, retrieval, alteration, consultation or use;
25. dissemination by means of transmission, distribution or making available in any other form by electronic communications or other means; or
26. merging, linking, blocking, degradation, erasure, or destruction. For the purposes of this definition, “Process” has a corresponding meaning, and the terms “Processing” and “Process” shall include instances or activities of Active Processing, Inactive or Passive Processing of Personal Information/Personal Data and/or Non-Personally Identifiable Information/Data;
27. “Regulator(s)” means any applicable regulatory authority, including the Information Regulator established in terms of POPIA;
28. “Responsible Party” means in the context of this Policy, GIM;
29. “Special Personal Information/Data” means Personal Information/Personal Data concerning, amongst other aspects contemplated in terms of section 26 Part B of POPIA, a Data Subject’s religious beliefs, race or ethnic origin, trade union Learnership, political persuasion, health or sex life, biometric data, or criminal behaviour;
30. “Third Party” means any employee, independent contractor, agent, consultant, broker, financial services provider, sub-contractor, Regulator(s), user of the GIM website(s) or LMS(s), or other representatives of GIM;
31. “Website” means the website owned and operated by GIM sourced at www.growthinmotion.co.za;
32. “Web Beacons” means small graphic images called web beacons, also known as “Internet tags” or “clear gifs,”, which Web Beacons may be deployed in the GIM Website pages and e-mail messages. Web beacons may be invisible to Data Subjects, but any electronic image inserted into a web page or e-mail can act as a Web Beacon. GIM may use web beacons or similar technologies for a number of purposes, including, without limitation, to count the number of visitors to its Website, LMS, to monitor how users navigate the Website or LMS, to count how many e-mails that GIM has sent were actually opened or to count how many particular articles or links were actually viewed by Data Subjects in certain circumstances.

2. INTRODUCTION

This Policy regulates the Processing of Personal Information/Personal Data by GIM and sets forth the requirements with which GIM undertakes to comply when Processing Personal Information/Personal Data pursuant to undertaking its operations and fulfilling its contractual obligations in respect of Data Subjects and Third Parties in general.
GIM places a high premium on the privacy of every person or organisation with whom it interacts or engages and therefore acknowledges the need to ensure that Personal Information/Personal Data is handled with a reasonable standard of care as may be expected from it. GIM is therefore committed to ensuring that it complies with the requirements of POPIA, and also with the terms of the GDPR to the extent that the GDPR applies.
The core purpose of the GDPR is recorded as protecting the Personal Information/Personal Data belonging to citizens and residents of the European Union. Therefore, although GIM operates within the Republic of South Africa, the GDPR may apply to it in certain circumstances and in such circumstances, GIM will take appropriate compliance steps. At the time of publishing this Policy, the circumstances in respect of which the GDPR may be applicable to GIM are:
1. Instances where GIM offers services to data subjects who are physically within the European Union; or
2. Instances where GIM monitors the online activities and/or behaviour of data subjects who visit GIM’s Website(s) from within the European Union.
When a Data Subject or Third Party engages with GIM, whether physically or via any digital, electronic interface such as GIM’s Website(s), Learner Portal or LMS(s), the Data Subject or Third Party acknowledges that they trust GIM to Process their Personal Information/Personal Data, including the Personal Information/Personal Data of their employees or representatives as the case may be.
When accessing GIM’s website(s) or LMS(s), Data Subjects and Third Parties have the right to object to the processing of their Personal Information/Personal Data. It is voluntary to accept the Terms and Conditions to which this Policy relates. However, GIM does require the Data Subject or Third Party’s acceptance to enable the proper use of GIM’s Website(s), Learner Portal or LMS(s).

3. PURPOSE AND APPLICATION

The purpose of this Policy is not only to inform Data Subjects about how GIM Processes their Personal Information/Personal Data, but also to establish a standard by which GIM and its employees and representatives shall comply in as far as the Processing of Personal Information/Personal Data is concerned.
GIM, in its capacity as a Responsible Party and/or Operator and/or Controller, as the case may be, shall observe and comply with its obligations under POPIA and the GDPR (as may be applicable and to the extent necessary) when it Processes Personal Information/Personal Data from or in respect of any Data Subject.

4. COLLECTING AND PROCESSING OF PERSONAL INFORMATION/PERSONAL DATA

Whenever any Data Subject creates a profile, registers for a cours(s), contacts GIM electronically, or uses one of the products, services, facilities, tools or utilities offered by GIM through its Website, Learner Portal or LMS, GIM will in effect be Processing the Data Subject’s Personal Information/Personal Data.
It may happen from time to time that GIM has collected a Data Subject’s Personal Information/Personal Data from other sources. If a Data Subject has shared their Personal Information/Personal Data with any Third Parties, GIM will not be responsible for any loss suffered by the Data Subject, their employees, or representatives (as the case may be).
When an Employer provides GIM with the Personal Information of their employees or representatives, either through the Website, Learner Portal, LMS or on a Bulk Registration Template, the Employer confirms having obtained consent to do so from their Data Subjects, and GIM will process the Personal Information/Personal Data of such Data Subjects in line with this Policy, as well as the terms and conditions to which this Policy relates.
GIM will Process Personal Information/Personal Data in order to facilitate and enhance the delivery of products and services to its Learners, foster a legally compliant workplace environment, as well as safeguard the Personal Information/Personal Data relating any Data Subjects which it in fact holds. In such an instance, the Data Subject providing GIM with such Personal Information/Personal Data will confirm that they are a Competent Person and that they have authority to give the requisite consent to enable GIM to process such Personal Information/Personal Data.
GIM undertakes to process any Personal Information/Personal Data in a manner which promotes the constitutional right to privacy, retains accountability and Data Subject participation. In supplementation of the above, GIM will process Personal Information/Personal Data for the following purposes:
1. To provide or manage any information, products and/or services requested by Data Subjects in general and/or our Learners;
2. To establish a Data Subject’s needs, wants and preferences in relation to the products and/or services provided by GIM;
3. To help GIM identify Data Subjects when they contact GIM;
4. To facilitate the delivery of products and/or services to Employers and Learners;
5. To issue certificates;
6. To activate or terminate courses;
7. To allocate to Learners unique identifiers for the purpose of securely storing, retaining and recalling such Learners’ Personal Information/Personal Data from time to time;
8. To maintain records of Data Subjects and specifically Learner records;
9. To maintain Third-Party records;
10. For reporting purposes;
11. For recruitment purposes;
12. For employment purposes;
13. For apprenticeship purposes;
14. For general administration purposes;
15. For legal and/or contractual purposes;
16. For health and safety purposes;
17. To provide compliance related information to GIM’s Clients and Learners;
18. To retain the records of Learners;
19. To monitor access, secure and manage any facilities owned or operated by GIM regardless of location in South Africa;
20. To transact with Third Parties;
21. To improve the quality of GIM’s products and services;
22. To detect and prevent money laundering;
23. To analyse the Personal Information/Personal Data collected for research and statistical purposes;
24. To help recover bad debts;
25. To transfer Personal Information/Personal Data across the borders of South Africa to another jurisdiction if reasonably required;
26. To carry out analysis and Learner profiling;
When collecting Personal Information/Personal Data from a Data Subject, GIM shall comply with the notification requirements as set out in Section 18 of POPIA, and to the extent applicable, Articles 13 and 14 of the GDPR.
GIM will collect and Process Personal Information/Personal Data in compliance with the conditions as set out in POPIA and/or the Processing principles in the GDPR (as the case may be) to ensure that it protects the Data Subject’s privacy.
GIM will not Process the Personal Information/Personal Data of a Data Subject for any purpose other than for the purposes set forth in this Policy, unless GIM is permitted or required to do so in terms of Applicable Laws or otherwise by law.

5. COLLECTING AND PROCESSING OF PERSONAL INFORMATION/PERSONAL DATA

GIM acknowledges that it may only use Personal Information/Personal Data to contact Data Subjects for purposes of direct marketing where GIM has complied with the provisions of POPIA and GDPR (where applicable) and when it is generally permissible to do so in terms of Applicable Laws.
GIM will ensure that a reasonable opportunity is given to all Data Subjects to object (opt-out) to the use of their Personal Information/Personal Data for GIM’s marketing purposes when collecting the Personal Information/Personal Data and on the occasion of each communication to the Data Subject for purposes of direct marketing.

6. STORAGE AND RETENTION OF PERSONAL INFORMATION/PERSONAL DATA

GIM will retain Personal Information/Data it has Processed, in an electronic or hardcopy file format on its own accord and/or with a Third-Party service provider appointed for this purpose (the provisions of clause 9 below will apply in this regard).
Personal Information/Personal Data will only be retained by GIM for as long as necessary to fulfil the purposes for which that Personal Information/Personal Data was collected and/or as permitted in terms of Applicable Law.
It is specifically recorded that any Data Subject has the right to object to the Processing of their Personal Information and GIM shall retain and store the Data Subject’s Personal Information/Personal Data for the purposes of dealing with such an objection or enquiry as soon and as swiftly as possible.
In amplification of the above, and in as far as the provisions of Article 17 of the GDPR are applicable to GIM’s processing of Personal Information/Personal Data of Data Subjects, any Data Subject shall have the right to procure from GIM the erasure of any Personal Information/Personal Data concerning the Data Subject. Such erasure will be given effect as soon as possibly pursuant to such a request and will be subject to the Data Subject satisfying GIM as to the applicability of any of the circumstances justifying such erasure under Article 17 of the GDPR.

7. STORAGE AND RETENTION OF PERSONAL INFORMATION/PERSONAL DATA

Where GIM is required to collect Personal Information/Personal Data from a Data Subject by law or in order to fulfil a legitimate business purpose of GIM and the Data Subject fails to provide such Personal Information/Personal Data, GIM may, on notice to the Data Subject, decline to render services without any liability to the Data Subject.

8. SECURING PERSONAL INFORMATION/PERSONAL DATA

GIM has implemented appropriate, reasonable, physical, organisational, contractual and technological security measures to secure the integrity and confidentiality of Personal Information/Personal Data, including measures to protect against the loss or theft, unauthorised access, disclosure, copying, use or modification of Personal Information/Personal Data in compliance with Applicable Laws.
In further compliance with Applicable Law, GIM will take steps to notify the relevant Regulator(s) and/or any affected Data Subjects in the event of a security breach and will provide such notification as soon as reasonably possible after becoming aware of any such breach.
Notwithstanding any other provisions of this Policy, it should be acknowledged that the transmission of Personal Information/Personal Data, whether it be physically in person, via the internet or any other digital data transferring technology, is not completely secure. Although GIM has taken all appropriate, reasonable measures contemplated in clause 8.1 above to secure the integrity and confidentiality of the Personal Information/Personal Data it Processes, in order to guard against the loss of, damage to or unauthorised destruction of Personal Information/Personal Data and unlawful access to or processing of Personal Information/Personal Data, GIM in no way guarantees that its security system is completely secure or error free. Therefore, GIM does not guarantee the security or accuracy of the information (whether it be Personal Information/Personal Data or not) which it collects from any Data Subject.
Any transmission of Personal Information/Personal Data will be solely at the own risk of the Data Subject. Once GIM has received the Personal Information/Personal Data, it will deploy and use strict procedures and security features to try to prevent unauthorised access to it. As indicated above, GIM reiterates that it restricts access to Personal Information/Personal Data to Third Parties who have a legitimate operational reason for having access to such Personal Information/Personal Data. GIM also maintains electronic and procedural safeguards that comply with the Applicable Laws to protect the Data Subject’s Personal Information from any unauthorised access.
GIM shall not be held responsible and by accepting the terms and conditions to which this Policy relates, any Data Subject agrees to indemnify and hold GIM harmless for any security breaches which may potentially expose the Personal Information/Personal Data in GIM’s possession to unauthorised access and or the unlawful Processing of such Personal Information/Personal Data by any Third Party.

9. PROVISION OF PERSONAL INFORMATION/PERSONAL DATA TO THIRD PARTIES

GIM may disclose Personal Information/Personal Data to Third-Party service providers where necessary and to achieve the purpose(s) for which the Personal Information/Personal Data was originally collected and processed. GIM will enter into written agreements with such Third-Party service providers to ensure that they comply with Applicable Laws pursuant to the Processing of Personal Information/Personal Data provided to it by GIM from time to time.
In as far as the provisions of the GDPR may be applicable to GIM’s processing of Personal Information/Personal Data, the Data Subject has the right, under the provisions of Article 20 of the GDPR, to receive any Personal Information/Personal Data which the Data Subject has provided to GIM, in a structured, commonly used and readable format, as well as to transmit that Personal Information/Personal Data to another third party. Such transmittal shall be subject to the conditions set forth in Article 20 and any transfer of a Data Subject’s Personal Information/Personal Data in this regard, will be subject to the Data Subject indemnifying GIM against any potential loss or damage which may be suffered by the Data Subject as a result of such transfer.

10. PROVISION OF PERSONAL INFORMATION /PERSONAL DATA TO THIRD PARTIES

GIM may, under certain circumstances, transfer Personal Information/Personal Data to a jurisdiction outside of the Republic of South Africa in order to achieve the purpose(s) for which the Personal Information/Data was collected and processed, including for Processing and storage by Third-Party service providers.
GIM will obtain the Data Subject’s consent to transfer the Personal Information/Personal Data to such foreign jurisdiction unless consent is not required by Applicable Law.
The Data Subject should also take note that, where the Personal Information/Personal Data is transferred to a foreign jurisdiction, the Processing of Personal Information/Personal Data in the foreign jurisdiction may be subject to the laws of that foreign jurisdiction.

11. ACCESS TO PERSONAL INFORMATION/PERSONAL DATA

A Data Subject has the right to a copy of the Personal Information/Personal Data which is held by GIM (subject to a few limited exemptions as provided for under the Applicable Law).
The Data Subject must make a written request (which can be by email) to the Information Officer designated by GIM from time to time.
GIM will provide the Data Subject with any such Personal Information/Personal Data to the extent required by Applicable Law and subject to and in accordance with the provisions of GIM’s PAIA Manual (published in terms of section 51 of the Promotion of Access to Information Act, 2000 (“PAIA”), which PAIA Manual can be sourced on GIM’s website at www.growthinmotion.co.za.
The Data Subject can challenge the accuracy or completeness of his/her/its Personal Information/Personal Data in GIM’s records at any time in accordance with the process set out in GIM’s PAIA Manual.

12. KEEPING PERSONAL INFORMATION/PERSONAL DATA ACCURATE

GIM will take reasonable steps to ensure that Personal Information/Personal Data that it Processes is kept updated where reasonably possible. For this purpose, GIM has provided a function on its Website, Learner Portal and LMS to enable Data Subjects to update their information.
GIM may not always expressly request the Data Subject to verify and update his/her/its Personal Information/Personal Data and expects that the Data Subject will notify GIM from time to time in writing:
1. of any updates or amendments required in respect of his/her/its Personal Information/Personal Data;
2. where the Data Subject requires GIM to delete his/her/its Personal Information/Personal Data; or
3. where the Data Subject wishes to restrict the Processing of his/her/its Personal Information/Personal Data.

13. COSTS TO ACCESS PERSONAL INFORMATION/PERSONAL DATA

The prescribed fees to be paid for copies of the Data Subject’s Personal Information/Personal Data are listed in GIM’s PAIA Manual referred to in clause 11.3 above.

GIM reserves the right to make amendments to this Policy from time to time.

14. COMPLAINTS TO THE INFORMATION REGULATOR

In the event that any Data Subject or Third Party is of the view or belief that GIM has Processed their Personal Information/Personal Data in a manner or for a purpose which is contrary to the provisions of this Policy, the Data Subject is required to first attempt to resolve the matter directly with GIM, failing which the Data Subject or Third Party shall have the right to lodge a complaint with the Information Regulator, under the provisions of POPIA.
The contact particulars of the Information Regulator are:
The Information Regulator (South Africa)
JD House, 27 Stiemens Street,
Braamfontein,
Johannesburg, 2001
PO Box 31533
Braamfontein,
Johannesburg, 2107

Mr. Marks Thibela
Chief Executive Officer
Tel No: +27 010 023 5207
Cell No: 082 746 4173
E-mail: inforeg@justice.gov.za

15. Contact Us

All comments, questions, concerns or complaints regarding Personal Information/Personal Data or this Policy should be emailed to GIM’s Information Officer.

Information Officer:	Estralita van Schalkwyk
Physical Address:	27 Mark Avenue, Northcliff, 2194
Telephone Number:	+27 11 477 3263
Email:	lita@growthinmotion.co.za

Deputy Information Officer:	Mary Hutchison
Physical Address:	27 Mark Avenue, Northcliff, 2194
Telephone Number:	+27 11 477 3263
Email:	mary@growthinmotion.co.za

Protection of Personal Information Act (POPIA) Data Protection and Policy

Protection of Personal Information Act (POPIA)
Data Protection and Policy