Privacy Policy

The Promotion of Access to Information Act, 2000 (PAIA), as amended by the Protection of Personal Information Act 4 of 2013 (POPIA), gives certain parties the right to approach private and public bodies to request, rectify or delete information held by them, which is required in the exercise and/or protection of their rights.

On request, the private and/or public body is obliged to release such information unless the relevant Acts expressly state that the records containing such information may or must not be released.

The Protection of Personal Information Act was enacted to give effect to the constitutional right to privacy, by safeguarding personal information when processed by Daphbrio Cabling Trading And Projects (Pty) Ltd, subject to justifiable limitations.

In this document, clause headings are for convenience and shall not be used in its interpretation unless the context clearly indicates a contrary intention. An expression which denotes any gender includes the other genders; a natural person includes an artificial or juristic person and vice versa; and the singular includes the plural and vice versa.

• The Business / Entity — Daphbrio Cabling Trading And Projects (Pty) Ltd.
• Client — a natural or juristic person who or which receives services from the entity.
• Consent — any voluntary, specific and informed expression of will in terms of which permission is given for the processing of personal information.
• Data Subject — the person to whom personal information relates.
• Employee — any person who works for, or provides services to, or on behalf of the entity, and receives or is entitled to receive remuneration.
• Head — in relation to a juristic person, the chief executive officer or equivalent officer, or any duly authorised officer of such juristic person.
• Information Officer — the head of the entity as contemplated in section 1 of POPIA and PAIA.
• PAIA — the Promotion of Access to Information Act No. 2 of 2000 (as amended), together with any regulations published thereunder.
• POPIA — the Protection of Personal Information Act 4 of 2013, together with any regulations published thereunder.
• Personal Information — information relating to an identifiable, living, natural person, and where applicable an identifiable, existing juristic person, including but not limited to: race, gender, sex, marital status, national, ethnic or social origin, age, physical or mental health, well-being, disability, religion, belief, culture, language and birth; education, medical, financial, criminal or employment history; any identifying number, symbol, e-mail address, physical address, telephone number, location information, online identifier; biometric information; personal opinions, views or preferences; private or confidential correspondence; and the name of the person where it appears with other personal information relating to the person.
• Private Body — a natural person who carries on any trade or business in such capacity, a partnership, or any former or existing juristic person other than a public body.
• Public Body — any state department or functionary as defined in POPIA.
• Record — any recorded information, regardless of the form or medium, including the information specifically defined and prescribed in POPIA.
• Regulator — the Information Regulator established in terms of section 39 of POPIA.

The Human Rights Commission has compiled a guide, as contemplated in section 10 of PAIA, containing information to assist any person who wishes to exercise any right as contemplated in PAIA. The guide is available on the SAHRC website (www.sahrc.org.za).

Any queries in this regard should be directed to the South African Human Rights Commission PAIA Unit, Research and Documentation — Telephone: 011 877 6300; Telefax: 011 484 0582; E-mail: paia@sahrc.org.za; Website: www.sahrc.org.za.

No notice is published in terms of Section 51(1)(b)(ii) of PAIA.

Daphbrio Cabling Trading And Projects (Pty) Ltd maintains such information and documents as may be required in accordance with, but not limited to, the legislation listed in Annexure “A” of the manual, including the Basic Conditions of Employment Act, Companies Act, Employment Equity Act, Labour Relations Act, Occupational Health and Safety Act, Skills Development Act, Skills Development Levies Act, Tax on Retirement Funds Act, Compensation for Occupational Injuries and Diseases Act, Unemployment Insurance Act and Value Added Tax Act, together with any regulations enacted in terms of those Acts.

The manual includes, as Annexure “B”, a list of the subjects in terms of Section 51(1)(e) as amended on which the entity holds records and the categories into which the stated subjects fall. These include records relating to financial, HR and employee, client and contract, tender and procurement, IT and network infrastructure projects, health and safety, as well as access control records including CCTV footage.

• All requests should be made on the prescribed form (Annexure “C” of the manual). The form is also available from the website of the Human Rights Commission, the Department of Justice and Constitutional Development (www.doj.gov.za), or the Information Regulator (www.inforegulator.org.za).
• The prescribed form shall be submitted to the head of the entity and/or Information Officer.
• The same procedure applies if the requestor is requesting information on behalf of another person or on behalf of a permanent employee of the entity.
• The head of the entity / Information Officer, as soon as reasonably possible and within thirty days after the request has been received, shall decide whether or not to grant the request.
• The requestor will be notified of the decision in the manner indicated by the requestor and in the prescribed form (Annexure “I” of the manual).
• If access is granted, the entity will advise the requestor of the access fee to be paid for the information, the format in which access will be given, and the fact that the requestor may lodge a complaint with the Information Regulator or an application with a court of competent jurisdiction against the fee charged, the format of access, or the form of access granted.
• After access is granted, actual access to the record requested will be given as soon as reasonably possible.
• If the request for access is refused, the requestor will be advised thereof in writing, with adequate reasons for the refusal and notice of the right to lodge a complaint with the Information Regulator or an application with a court of competent jurisdiction.
• Grounds for refusal shall comply with the provisions of Chapter 4 of PAIA.
• If the head of the entity (or the Information Officer) fails to respond within thirty days after a request has been received, it may be deemed, in terms of section 58 read together with section 56(1) of PAIA, that the request was refused.
• The Head of Body / Information Officer may extend the period of thirty days once for a further period of thirty days as prescribed in Section 57 of PAIA, in which case the requestor shall be informed thereof before the expiry of the first 30-day period.

The entity undertakes to take all reasonable steps to find any record. If all reasonable steps have been taken and there are reasonable grounds for believing that the record is in the entity's possession but cannot be found, or does not exist, the Head of the Entity and/or the Information Officer shall notify the requestor, by way of an affidavit or affirmation, that it is not possible to give access to the requested record. The affidavit or affirmation shall provide a full account of all the steps taken to find the record or to determine its existence. Such notice shall be regarded as a decision to refuse a request for access to the record concerned for the purposes of PAIA. If the record is later found, the requestor shall be given access in the manner stipulated in the prescribed form, unless access is refused on a ground stipulated in the manual and in terms of PAIA.

Should information be requested in terms of the provisions of PAIA regarding a third party, the entity will adhere to the provisions of sections 71 to 74 of PAIA (as amended). The entity shall be obliged in certain circumstances to advise third parties of requests lodged in respect of information applicable to or concerning such third parties. In considering the application and providing information, the entity shall act in accordance with Chapter 5 of PAIA.

Should the request be granted, a notice shall be given to the third party stating the reasons for granting the request and that the third party has the right to lodge a complaint with the Information Regulator or an application with a court of competent jurisdiction against the decision of the entity within 30 (thirty) days after the notice is given. The requestor shall be given access to the information after the expiry of that period, unless a complaint and/or application is lodged within it.

The fee structure for requests prescribed under PAIA is available from the Government Gazette, or at the website of the Department of Justice and Constitutional Development (www.doj.gov.za) as well as the SAHRC website (www.sahrc.org.za).

Conditions for lawful processing of personal information to which the entity shall adhere, in general, are as follows:

• Accountability: the entity shall have an obligation to ensure that there is compliance with POPIA in respect of the processing of personal information.
• Processing limitation: personal information shall be collected directly from a data subject to the extent applicable, shall only be processed with the consent of the data subject, and shall only be used for the purposes for which it was obtained.
• Purpose specific: personal information shall only be processed for the specific purpose for which it was obtained and shall not be retained for any longer than is needed to achieve such purpose.
• Further limitations: further processing of personal information shall be compatible with the initial purpose for which the information was collected.
• Information quality: the entity shall ensure that personal information held is accurate and updated regularly, and that the integrity of the information is maintained by appropriate security measures.
• Openness: there shall be transparency between the data subject and the entity.
• Security safeguards: the entity shall take reasonable steps to ensure that adequate safeguards are in place so that personal information is processed responsibly and is not unlawfully accessed.
• Data subject participation: the data subject shall be made aware that their information is being processed and must have provided their informed consent to such processing.

Personal information shall only be processed for a specific purpose. The purposes for which the entity processes personal information are set out in Annexure “D” of the manual, and include providing and administering services to clients, administering employment, and complying with legal and regulatory obligations.

As per section 1 of POPIA, a data subject may either be a natural or a juristic person. Annexure “E” of the manual sets out the various categories of data subjects on whom the entity processes personal information and the types of personal information relating thereto. These include clients and prospective clients (contact details and project requirements), employees and prospective employees (personal, financial and employment information), suppliers and service providers (contact and payment details), as well as special personal information such as race and ethnic origin where lawfully required.

The entity shall make personal information available to the recipients or categories of recipients set out in Annexure “F” of the manual as prescribed by the relevant Acts. These may include professional advisers, regulatory and public bodies where required by law, and service providers who process information on the entity's behalf.

• A data subject may lodge an objection to Daphbrio Cabling Trading And Projects (Pty) Ltd against the processing of personal information.
• Such objection must be clearly set out in the prescribed Form 1 (Annexure “G” of the manual), which must be delivered to the entity.
• Should a valid objection have been lodged, the entity shall no longer process such personal information.
• Provided a data subject has provided adequate proof of identity, the entity shall confirm whether it holds personal information of such data subject and provide access to such information within a reasonable time, at a prescribed fee (if applicable), and in a reasonable manner and format that is generally understandable.
• Should a fee be applicable, the entity shall provide the data subject with a written estimate of the fee before providing the service, and may, at its discretion, request a deposit of such estimated fee.
• Access to records shall be done as set out in this manual.

A data subject may request the entity to correct or delete personal information in its possession or control that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading, or which was obtained unlawfully. A data subject may further request the entity to destroy or delete a record of personal information which the entity may no longer be authorised to retain as set out in Section 14 of POPIA.

Section 14 of POPIA determines that records of personal information must not be retained any longer than is necessary for achieving the purpose for which the information was collected or subsequently processed, unless: retention is required or authorised by law; the responsible party reasonably requires the record for lawful purposes related to its functions or activities; retention is required by a contract between the parties; or the data subject (or a competent person, where the data subject is a child) has consented to the retention. The entity shall retain records beyond these periods only for historical, statistical or research purposes, and only where appropriate safeguards against use for any other purposes have been established.

Should a data subject request correction and/or destruction and/or deletion of a record of personal information, the data subject shall use the prescribed Form 2 (Annexure “H” of the manual), delivered to the entity.

In terms of Section 72 of POPIA, personal information may only be transferred out of the Republic of South Africa: if the recipient is subject to a law, binding corporate rules or a binding agreement which provides adequate levels of protection equivalent to those prescribed in POPIA; if the data subject consents to the transfer; if the transfer is necessary for the performance of a contract between the data subject and the entity, or for the implementation of pre-contractual measures taken in response to the data subject's request; if the transfer is necessary for the performance of a contractual obligation between the entity and a third party, in the interests of the data subject; or if the transfer is for the benefit of the data subject, it is not reasonably practicable to obtain consent, and the data subject would likely provide such consent.

The entity may from time to time allow transborder flow of personal information, but shall comply strictly with the guidelines prescribed by POPIA.

The entity shall ensure that up-to-date technology is employed to ensure the confidentiality, integrity, and availability of the personal information under its care, and shall take appropriate reasonable technical and organisational measures to prevent loss of, damage to or unauthorised destruction of personal information and unlawful access to or processing of personal information.

The entity shall take all reasonable steps to:

• Identify all reasonably foreseeable internal and external risks to personal information in its possession or under its control;
• Establish and maintain appropriate safeguards against the risks identified;
• Regularly verify that the safeguards are effectively implemented; and
• Ensure that the safeguards are continually updated in response to new risks or deficiencies in previously implemented safeguards.

Measures shall include firewalls; virus protection software and update protocols; logical and physical access control; and secure setup of the hardware and software making up the IT infrastructure.

The entity shall implement suitable measures to prevent unauthorised persons from gaining access to data processing equipment or filing systems. Persons having access to data shall have prior authorisation from the entity, shall be subjected to and informed of the provisions of this manual and the relevant Acts, and shall undertake to be bound by confidentiality by signing an agreement to that effect. Hard copies of data shall be kept in a secure location and shall not be accessible to unauthorised persons. Suitable measures shall be implemented to prevent personal information from being read, copied, altered or deleted by unauthorised persons during transmission or transport.

The deletion and destruction of data shall be done under the supervision of the entity, in such a manner that any reconstruction in an intelligible form afterwards will not be possible, and shall be disposed of in a secure manner.

The entity undertakes to only process special personal information if: processing is carried out with the consent of a data subject; processing is necessary for the establishment, exercise or defence of a right or obligation in law; processing is necessary to comply with an obligation of international public law; or processing is for historical, statistical or research purposes to the extent that the purpose serves a public interest and is necessary for that purpose, it appears impossible or would involve a disproportionate effort to ask for consent, and sufficient guarantees are provided that the processing does not adversely affect the individual privacy of the data subject to a disproportionate extent.

Special personal information may further be processed where the information has deliberately been made public by the data subject, or where the relevant provisions of POPIA relating to religious and philosophical beliefs, race or ethnic origin, union membership, political persuasion, health or sex life, and criminal behaviour or biometric information are complied with. Should the entity in future undertake specific processing of special information, it shall develop and adopt a suitable framework and policy to regulate such processing.

Daphbrio Cabling Trading And Projects (Pty) Ltd does not process information of children. Should the entity, depending on any current and future undertakings, be involved in the processing of personal information relating to children, it undertakes that such processing shall at all times adhere strictly to the provisions of POPIA — carried out with the consent of a competent person; necessary for the establishment, exercise or defence of a right or obligation in law; necessary to comply with an obligation of international public law; or for historical, statistical or research purposes under the conditions described above — and that it shall adhere to any conditions imposed by the Regulator from time to time. Should the entity in future undertake such processing, it shall develop and adopt a suitable framework and policy to regulate it.

The entity does not process information as stipulated in the sections referred to in this heading. In the event that the entity does involve itself with the processing of such information in future, it undertakes to obtain prior authorisation from the Regulator in terms of Section 57 of POPIA before: processing any unique identifiers of data subjects for a purpose other than the one for which the identifier was specifically intended at collection, with the aim of linking the information together with information processed by other responsible parties on criminal behaviour or on unlawful or objectionable conduct; processing information on criminal behaviour or on unlawful or objectionable conduct on behalf of third parties; processing information for the purposes of credit reporting; or transferring special personal information or the personal information of children to a third party in a foreign country that does not provide an adequate level of protection.

• This manual is available for inspection by the general public upon request, during office hours and free of charge, at the offices of Daphbrio Cabling Trading And Projects (Pty) Ltd.
• Copies of the manual may be made subject to the prescribed fees.
• The manual is also posted on our website, www.daphbrio.co.za.
• This manual may be updated from time to time.