Privacy Policy

A legal disclaimer

WHO WE ARE

The purpose of this Privacy Policy is to set out why, how and when OX Promo which operates as a subsidiary of OX Promotions (Pty) Ltd, its other business units and subsidiaries (collectively “OX Promotions”) use your personal information with the aim of complying with the Protection of Personal Information Act 4 of 2013 (“POPI”).

We respect your privacy and take the protection of Personal Information with the utmost earnest. We aim to deliver sublime service every time and to do this, we require some of your Personal Information.

This Privacy Policy describes how we handle the Personal Information we collect about you and/or receive from you. By utilizing our platforms, you agree to the processing of your personal information as set out in this Privacy Policy. It is important that you read this Privacy Policy together with our terms and conditions, policies or privacy notices that OX Promo may provide from time to time when gathering or making use of your Personal Information.

Further, please pay special attention to the clauses in this Privacy Policy that become visible in identical text and style (i.e. bold) which:

May limit the liability or risk of OX Promo or a third-party.
may create liability or risk for you.
may force you as a user to compensate OX Promo or a third-party.
serves as an acceptance, by you of a fact.

This Privacy Policy applies to all users.

In this Privacy Policy, the terms -

"Personal Information", and "process/processing" have the same meanings as set out in POPI.
"we", "us" or "our" refers to each and every individual that accesses or utilizes our Platforms.
"Platforms" means OX Promo's mobile applications and websites.

B. WHAT PERSONAL INFORMATION WE COLLECT AND RECEIVE

OX Promo processes Personal Information in a method that is adequate, non-excessive, purpose specific, reasonable and relevant.

We gather Personal Information about you when you utilize our Platforms, products or services, or when you communicate with us and do so in particular when you:

engage with us on social media.
contact us, including through our platforms as a user.
have already made your personal information available in public sources (e.g social media or public posts etc.)
engage with third-parties that we communicate with for the objective of performing our business (such as regulators, government departments, service providers and partners).

We may collect the following Personal Information from or about you as one of our users:

email address.
gender.
name and surname.
online identifiers.
date of birth.
social media profiles.
identification number.
banking details where you are a subscriber to other OX Promo platforms.
location data.
mobile phone number.

You warrant that the information you have provided is current, accurate, true and correct and that does not misrepresent or impersonate any entity or person or falsely state or in any way misrepresent your affiliation with anything or anyone.

Should your Personal Information change or you desire to object to the processing of, revise and/or correct your Personal Information, you may do this as it is set out below.

Information from using the Platforms

When you utilize our platforms, we process some of your Personal Information. Depending on how you access and use the platforms, we may receive:

log information, with additional information on when, how and for how long you utilize our Platforms, products and other services, the content you view and search questions you submit.

information about the equipment you utilize to access or use our Platforms, including the specific type of device you are utilizing, how you access our Platforms, your operating system or browser and your Internet Protocol address.

the geographic location from which you accessed our Platforms, including your nearby wireless internet networks or cell towers and your device’s global positioning system signal.

information relating to support you, we may thus require information such as your query and your contact details. When you communicate with our platforms via email or phone we may collect and utilize information about you in order to provide support. Your communications with us may be recorded.

WHY DO WE NEED TO PROCESS YOUR PERSONAL INFORMATION?

We mainly use the Personal Information we collect from you to enable you access to our Platforms, products and services. We also utilize your Personal Information for other reasons, including to ensure that we abide by all the laws, to better understand you and your needs, and to notify you about other products and services you might be interested in.

We may legally process the Personal Information we collect and receive from you to:

identify you.
verify your identity if the law permits or requires it.
to pursue or protect your, our or a third party's legitimate interest.
if you have consented to us processing your Personal Information.
enter into and complete a contract or perform under a contract entered into with you.
provide you with access to and the utilization of our platforms with the aim of providing you with our products and services in order to accomplish our contractual obligations to you.
enable us to process payments.
interact with you regarding our Platform.
inform you about changes to our Platforms, services and products terms and conditions, notices or privacy policies, and any other alterations that influence our Platforms, products and services.
get feedback from you which we require in order to develop our products and services and grow our business.
abide by any legal or regulatory obligations such as financial or tax laws.
tackle research for statistical purposes. The statistics and research we obtain from this process do not include your Personal Information and cannot be linked to you, nor can you be identified from these statistics.

The law may permit us to process your personal Information when we need to:

abide by legislative, regulatory risk and compliance requirements.
to fulfil lawful information and reporting requirements requests.
to meet record-keeping obligations.
to mitigate risks, prevent, detect, investigate and report theft, corruption, money laundering, fraud and other illegal crimes or activities.
to advance fraud tools and fraud models.

We may process your Personal Information if it is required to protect or pursue ours or a third party’s legitimate interest which may include:

the daily management of our finances and business to protect our customers, service providers, employees and assets.
to provide you with the most relevant products and services and to develop and enhance our products and services and our business.
to advance, implement, monitor and enhance our business processes, systems and policies.
to manage emergencies and business continuity.
to advance, test and enhance solutions which may include connecting your Personal Information with other Personal Information acquired from public records or third-parties to better understand your needs and form solutions that meet your needs.
tailoring products and services which would factor in your utilization of third-party products and/or services.
to provide information about the products and services we offer directly or via OX Promo's partners.

to provide information about the products and services we offer directly or via OX Promo's partners.

send you information about competitions, products and services that may interest you (except if you have opted out of receiving such information). Please note that you might also receive newsletters based on your recent orders, browsing behaviour and overall interests. To unsubscribe from newsletters sent to you based on your browsing behaviour and recent orders, visit the Newsletter Subscription page or unsubscribe when receiving such a newsletter.

get feedback from you which we need to develop our products and services and otherwise enhance our business. To respond to complaints including analytics of complaints to understand trends and stop future complaints and provide compensation where necessary.

to detect, impede and report theft, money laundering, corruption, fraud and other crimes. This may include the processing of special Personal Information, such as alleged criminal behaviour or the supply of misleading, dishonest or false information when opening an account with us.

for statistical purposes, such as customer segments or market segmentation.

When we collect Personal Information from you, we will have a lawful reason or purpose to collect that Personal Information. We may utilise that same Personal Information for other purposes. We will only do this where the law permits us to, and where the objective of further processing is in line with the original purpose(s) when we collected your Personal Information.

DIRECT MARKETING

We also utilize and collect your Personal Information to inform you about products and services we think you might be interested in including co-branded products and services with our business partners. To do this, we may contact you via:

Email.
Phone.
SMS.
WhatsApp.
Social media.
Advertising through our Platforms, websites, apps or third-party websites.

If you are not our customer, or in any other occasions where the law requires, we will only market to you via electronic communications with your consent. You may at any given time request us to stop sending marketing communications to you.

USER TRACKING AND COOKIES

When you access and utilize our Platforms we may make use of various technological tools to enhance your experience on our Platforms through the use of cookies and/or user tracking.

Cookies are small text files placed on the device that you use to access and use our Platforms. These files do not have your Personal Information but permit us to associate you with a certain device.

Many websites use cookies and we use cookies to:

Make our Platforms more user friendly.
personalise your interactions with our Platform, tailor our services and plaforms to your particular needs and interests, and make sure they operate effectively on your device.
analyse Personal Information that will enable us to send you advertisement offers that might be relevant to you.
advance and enhance your business.
analyze your activity on our Platforms so that we can manage, support, improve and develop OX Promo and all of its subsidiaries for statistical and analytical purposes, and to aid us in preventing fraud.
provide marketing activities that are relevant to you, limit the number of times you see the same advertisement and measure the effectiveness of the advertisements on our Platforms and other websites, based on your online activities such as the apps and websites you utilize and content you view, and information we have about you.

By accessing and making use of our Platforms you agree to our use of cookies and/or user tracking technologies.

WHO DO WE SHARE YOUR PERSONAL INFORMATION WITH?

We do not sell your Personal Information to third parties for their marketing of any other purposes. However, where we share your Personal Information, it will be in accordance with the Protection of Personal Information Act 4 of 2013 ("POPI") and if:

You agreed to us sharing your Personal Information.
it is necessary for us to complete or perform in terms of a contract we have with you.
we have to have an accord via a legal obligation.
it is necessary to pursue or protect your, our, or a third party's legitimate interests.

We will only share your Personal Information with third-parties after ensuring that these third-parties have enough data privacy policies in place and that they have an obligation to keep your Personal Information confidential and secure.

We may provide or make your Personal Information available to:

our employees and third-party service providers who assists us to communicate with you.
our subsidiaries, delegates, affiliates or successors in title for any of the purposes identified in this policy.
payment processing service providers, banks, card schemes and other persons that assist or enable with the processing of transactions routing, authorization, reconciliation, authorization and settlement requests and the enablement of transaction processing.

internet and cloud service providers.
government officials, law enforcement, fraud detection agencies or other third parties when the disclosure of Personal Information is necessary or appropriate in relation with an investigation of intellectual property infringements, fraud or other activity that is illegal or might expose us to legal liability or to stop physical harm or financial loss, to support or report the investigation into suspected illegal activity.
people you have allowed to acquire your Personal Information, such as your bank.
Enable our service providers (under contract with us) who assist with parts of our business operations (marketing, technology services, fraud prevention etc). However, our contracts with such third parties dictate that these service providers may only utilize your Personal Information in relation with the services they perform for us and not for their own benefit and must treat such Personal Information as confidential information.
Other subsidiaries within OX Promo in order for them to send you a once-off opt-in direct marketing communication. Our Platform may also have links to other third-party websites that may collect and process your Personal Information. Other third-party websites and/or other Platforms may also have links to our Platform where they gather and process your Personal Information.

We are not responsible for the privacy practices or the content of those linked third-party websites and/or platforms including when and how they collect and process your Personal Information.

RETENTION AND RESTRICTION OF RECORDS

We keep your Personal Information for as long as:

We need it to provide our Platforms, products or services to you.
It is allowed or required by law and is in line with our internal retention policies.
It is necessary to uphold the contract between you and us.
You have agreed to us keeping your Personal Information subject to your request for us to stop processing your Personal Information.

We will keep your Personal Information for as long as is essential to achieve the purpose for which this information was collected or later processed. If your Personal Information is utilised for more than one purpose, we will keep it until the purpose with the latest period expires.

By accessing and using the Platform, you consent to us keeping records of your Personal Information for no longer than may be necessary to achieve the objective for which the information was initially collected or later processed.

SENDING YOUR PERSONAL INFORMATION OUTSIDE THE UNITED ARAB EMIRATES OR SOUTHERN AFRICA

We might transfer certain Personal Information outside the vicinity of the United Arab Emirates or Southern Africa to service providers for purposes set out above, including for data storage and back-up purposes to ensure the integrity of our systems.

When we transfer your Personal Information outside of the geographic borders of the United Arab Emirates and Southern Africa, we will ensure that we do so in line with the requirements for legal transfer outside of the United Arab Emirates and Southern Africa as set out in POPI.

By accessing and using our Platforms, you agree to us transferring your Personal Information outside of the United Arab Emirates and Southern Africa as set out in POPI.

SECURING YOUR PERSONAL INFORMATION

We secure the honesty and confidentiality of your Personal Information in our possession or under our control by taking reasonable technical, appropriate and organisational measures to prevent loss of, damage to or unauthorized destruction of Personal Information; and unlawful access to or processing of Personal Information.

In order to implement and maintain such measures, we have in place policies, related and controls processes, which are reviewed and updated on a regular basis. Our controls, policies and procedures cover for example:

Access controls and monitoring of access.
Secure storage, destruction and encryption of records of personal information.
Personal Information breach reporting and remediation.
Technical, physical and network security.

Policy Application

OX Promo's governing body (board of directors);
All employees and contractors;
All business units, departments and functional areas of OX Promo;
All contractors and suppliers; and
All persons acting on behalf of OX Promo.

Rights of Data Subjects

Where necessary, OX Promo will ensure that its customers or clients are made aware of the rights extended unto them as data subjects in terms of POPIA. OX Promo will ensure that it gives effect to the following rights as stipulated for in terms of POPIA:

a) The right to access personal information.

OX Promo recognizes that a data subject has the right to establish whether OX Promo's associates and affiliates hold personal information related to him, her or it, as well as the right to request access to that personal information.

b) The right to have personal information corrected or deleted.

The data subject has the right to request, where necessary, that his, her or its personal information must be deleted or corrected where OX Promo is no longer authorized to retain the personal information.

c) The right to object to the processing of personal information.

The data subject has the right, on reasonable grounds, to object to the processing of his, her or its personal information. In such instances, OX Promo will give due consideration to the request and the requirements of POPIA. OX Promo may stop in utilizing or disclosing the data subject’s personal information and may, subject to any contractual and statutory record keeping requirements, also approve the destruction of the personal information.

d) The right to object to direct marketing

The data subject has the right to object to the processing of his, her or its personal information for the intention of direct marketing by means of unsought electronic communications.

e) The right to complain to the information regulator

The data subject has the right to submit a complaint to the information regulator regarding an alleged violation of any of the rights protected under POPIA and to engage in civil proceedings regarding the alleged non-compliance with the protection of his, her or its personal information.

f) The right to be informed

The data subject has the right to be notified that his, her or its personal information is being collected by OX Promo. The data subject also has the right to be notified in any situation where OX Promo has reasonable ground to believe that the personal information of the data subject has been acquired or accessed by an unauthorized person.

General Guiding Principles

All contractors and employees of OX Promo and all persons acting on behalf of OX Promo will at all times be subject to, and act in line with, the following guiding principles in terms of POPIA:

ACCOUNTABILITY

a) Failure to comply with the provisions of POPIA could potentially damage OX Promo's reputation or expose OX Promo to a civil claim for damages. The protection of personal information within OX Promo is therefore the responsibility of all contractors and employees.

b) OX Promo will ensure that the provisions of POPIA and guiding principles outlined in this policy are agreed to through the encouragement of desired behaviour.

However, OX Promo will take necessary sanctions which may include disciplinary action, against those individuals who, through their negligent or intentional actions and/or omissions, fail to abide by the principles and responsibilities outlined in this policy.

c) OX Promo will ensure that the provisions of POPIA and the guiding principles outlined in this policy are adhered to via a written contract or mandate with operators to ensure that operators are contractually bound and accountable to ensuring compliance with POPIA.

Processing Limitation

a) OX Promo will ensure that personal information under its control is processed:

Only with the informed permission of the data subject (to the degree necessary).
not process special personal information except as given permission and permitted in this policy.
Only for a specifically defined objective, and
in a lawful, fair and responsible manner.

b) OX Promo will inform the data subject of the reasons for acquiring his, her or its personal information and attain written consent prior to processing the personal information. OX Promo will never share or distribute personal information between associated organizations (i.e. subsidiary companies), separate legal entities or with any individuals that are not directly involved with enabling the aim for which the personal information was originally acquired.

c) Where applicable, the data subject shall be informed of the possibility that his, her or its personal information shall be shared with other aspects of OX Promo's business and be provided with the reason for doing so.

Purpose Specification

a) All OX Promo's business units and operations are to be informed by the principle of transparency.

b) OX Promo will process personal information only for:

c) Products and services or providing advice,

d) to conduct security clearances and verify personal information details,

e) to manage and administer human resource related purposes,

f) to abide by legal and regulatory requirements, and for legitimate business purposes.

g) Data subjects agree to OX Promo processing their personal information and disclosing their personal information for providing advice, analyses, reports, products, services and for pursuing the legitimate interests of OX Promo.

h) Data subject further consent to OX Promo processing the following special personal information,

i) Trade union membership – for inter alia, facilitating and collecting payment of membership fees and determining union membership numbers within OX Promo;

j) Health – for, inter alia, providing wellness and health services;

k) Biometric information – for, inter alia, general security purposes and access control;

l) Criminal behaviour – for, inter alia, security purposes.

Information Quality

a) OX Promo will take necessary steps to ensure that all personal information collected is complete, accurate and not misleading in any way.

b) The more important it is for the personal information to be accurate (e.g. the beneficiary details of a life insurance policy are of extreme importance), the greater the effort OX Promo shall put in ensuring its accuracy.

Where personal information is received or collected from third parties, OX Promo will take precautionary steps to confirm that the information is accurate by verifying the authenticity of the information directly with the data subject or by way of independent sources.

d) Data subject will be required, through periodic notices, to send updates to the personal information where changes have occurred to their personal information.

Open Communication

a) OX Promo will take necessary steps to ensure that data subjects are notified and are at all times aware that their personal information is being collected including the purpose for which it is being attained and processed.

b) OX Promo will ensure that it initiates and maintains a “contact us” facility, for example via its websites or through an electronic helpdesk, for data subjects who would like to

Enquire whether OX Promo hold related personal information, or
request OX Promo to update or correct related personal information, or
request access to related personal information, or
make a complaint concerning the processing of its personal information.

Security Safeguards

a) OX Promo will manage the security of its filing/data record-keeping systems to ensure that personal information is properly protected. To this end, security controls will be implemented in order to minimise the risk of loss, disclosure, interference, unauthorized access, modification or destruction.

b) Security measures also need to be implemented in a context-sensitive manner. For example, the more sensitive the personal information, such as bank account details or medical information, the greater the security required.

c) OX Promo will permanently review its security controls, which will include regular testing of measures and protocols put in place to combat cyber-attacks on OX Promo’s IT network. OX Promo will ensure that all electronic and paper records comprising personal information are securely stored and made accessible only to authorized individuals.

d) All new employees will be required to sign employment contracts containing contractual terms for the storage and use of employee information as personal information. Confidentiality clauses will also be included to minimize the risk of unauthorized disclosure of personal information for which OX Promo is responsible.

e) All existing contractors and employees will, after the necessary consultation process has been followed, be required to sign an appendix to their employment agreements/contractor agreements containing the relevant consent and confidentiality clauses.

f) OX Promo operators and third-party service providers will be required to enter into service level agreements with OX Promo where both parties pledge their mutual commitment to POPIA and lawful processing of any personal information pursuant to the agreement.

Information Officers

a) OX Promo will appoint an information officer and where necessary, one or more deputy information officers to assist the information officer.

b) OX Promo's information officer is responsible for ensuring compliance with POPIA.

c) There are no legal requirements under POPIA for an organisation to appoint an information officer. Appointing an information officer is however, deemed to be a good business practice, particularly within larger organizations.

d) Once appointed, OX Promo will register the information officer with the information regulator established under POPIA prior to performing his or her duties.

Specific Duties and Responsibilities

Governing Body

a) OX Promo's governing body cannot delegate its accountability and is answerable for ensuring that OX Promo meets its legal obligation in terms of POPIA.

b) The governing body may however delegate some of its responsibility in line with the POPIA to capable individuals or management. The governing body is responsible for ensuring that:

OX Promo appoints an information officer, and where necessary, a deputy information officer;
All persons responsible for the processing of personal information on behalf of OX Promo;

<Are appropriately trained and supervised to do so;

<Understand that they are contractually required to protect personal information they come into contact with, and

<are aware that negligent or willful breach of this policy’s processes and procedures may lead to disciplinary action being taken against them.

Data subjects who want to make enquiries about their personal information are made aware of the procedure that needs to be followed should they wish to do so, and
Periodic POPIA audits are scheduled in order to accurately review and assess the avenues in which OX Promo collects, discloses, shares, uses, processes and destroys personal information.

Information Officer

OX Promo's information officer is responsible for:

a) Taking steps to ensure OX Promo's necessary compliance with the provision of POPIA;

b) Keeping the governing body updated about OX Promo's information protection responsibilities under POPIA. For example, in the instance of a security breach, the information officer must advise and inform the governing body of its obligations pursuant to POPIA;

c) Continually analyzing privacy regulations and aligning them with the OX Promo’s personal information processing procedures. This will also include reviewing OX Promo's protection procedure and related policies;

d) Ensuring that POPIA audits are conducted and scheduled on a regular basis;

e) Ensuring that OX Promo makes it suitable for data subjects who want to update their personal information or submit POPIA related complaints to OX Promo. For example, maintaining a “contact us” facility on OX Promo's website;

f) Noting any contracts entered into with employees, operators and other third parties which may have an impact on the personal information held by OX Promo. This also pertains to overseeing the amendment of OX Promo's contractor/employment contracts and other service level agreements;

g) Encouraging compliance with the conditions required for the legal processing of personal information;

h) Ensuring that employees and other persons acting on behalf of OX Promo are fully aware of the risks associated with the processing of personal information and that they stay informed about OX Promo's security controls;