Privacy Policy

Introduction to POPI
- The Protection of Personal Information Act, 4 of 2013 (“POPI”) is South Africa’s data protection law.
- POPI regulates the processing, management, storage, and protection of Personal Information with a view to protecting people from harm by protecting their Personal Information, to stop their money and/or identities being stolen, and generally to protect their privacy.

The Purpose of this Policy

TSO ensures that the conditions set out in POPI in respect of the processing of Personal Information are complied with, and this Policy explains how TSO obtains, uses, discloses and holds Users’ Personal Information.

Important definitions in POPI
- Several terms that are used in this policy are defined in POPI. These terms are:

3.1.1.	“*Data Subject*”	the person to whom personal information relates. Within the context of TSO and the App, this refers to any User* of the App*
3.1.2.	“*direct marketing”*	to approach a data subject, either in person or by mail or electronic communication, for the direct or indirect purpose of – (a) promoting or offering to supply, in the ordinary course of business, any goods or services to the data subject; or (b) requesting the data subject to make a donation of any kind for any reason
3.1.3.	“*Personal Information*”	information relating to an identifiable, living, natural person, and where it is applicable, an identifiable, existing juristic person, including but not limited to – (a) Information relating to the race, gender, sex, pregnancy, marital status, national, ethnic or social origin, colour, sexual orientation, age, physical or mental health, well-being, disability, religion, conscience, belief, culture, language and birth of the person; (b) Information relating to the education or the medical, financial, criminal or employment history of the person; (c) Any identifying number, symbol, email address, physical address, telephone number, location information, online identifier or other particular assignment to the person; (d) The biometric information of the person; (e) The personal opinions, views or preferences of the person; (f) Correspondence sent by the person that is implicitly or explicitly of a private or confidential nature or further correspondence that would reveal the contents of the original correspondence; (g) The views or opinions of another individual about the person; (h) The name of the person if it appears with other personal information relating to the person or if the disclosure of the name itself would reveal information about the person
3.1.4.	"*Processing*"	any operation or activity or any set of operations, whether or not by automatic means, concerning personal information including – (a) The collection, receipt, recording, organisation, collation, storage, updating or modification, retrieval, alteration, consultation or use; (b) Dissemination by means of transmission, distribution or making available in any other form; or (c) Merging, linking, as well as restriction, degradation, erasure or destruction of information and ”Process” and “Processed” shall have consistent meanings.

Processing limitation
- TSO takes its obligations with regard to data protection and the privacy of all Users seriously, and the protection of Users’ Personal Information is important to TSO.
- TSO is obliged to Process Personal Information in order to conduct its business, and to enable Users to use the App, but such Processing must take place only in accordance with POPI.
Processing Purpose
- TSO is committed to processing Users’ Personal Information in a lawful, relevant and transparent manner. Accordingly, TSO Processes only Users’ Personal Information for purposes relating to usage of the App, which purposes includes the following:
  - to enable Users to access the App, and to use its features;
  - respond to Users’ enquiries;
  - improve the App, its features and the Users’ experience by analysing the Personal Information for trends.
- TSO is permitted to Process Users’ Personal Information on the following grounds:
  - if the User consents thereto;
  - if Processing is necessary for TSO to carry out actions for the conclusion or performance of a contract to which the User is party (such as the T&Cs relating to use of the App);
  - to enable TSO to comply with legal and/or regulatory obligations imposed on it;
  - to protect TSO’s legitimate interests without unduly affecting any User’s interests or fundamental rights and freedoms;
- Save for the Personal Information of employees supplied to TSO by the employer when registering to use the App (or at any time thereafter while the employer is subscribed to use the App), TSO Processes only the Personal Information collected directly from each employee via the App.
Retention of Personal Information and Restriction of Personal Records
- TSO retains Users’ Personal Information for as long as it may be necessary to fulfil the purpose for which it was collected (as detailed in clause 1 above) or to comply with legal, regulatory or internal policy requirements.
- TSO shall restrict Processing any User’s Personal Information if:
  - its accuracy is contested by the User in question, and for a period enabling TSO to verify the accuracy of the Personal Information;
  - it no longer needs the Personal Information for achieving the purpose for which it was collected, but TSO will maintain such Personal Information for purposes of proof;
  - the Processing is unlawful and the User opposes its destruction or deletion and requests TSO to restrict its use instead; or
  - the User requests the Personal Information to be transmitted into another automated processing system.

Security Safeguards
- TSO secures the integrity and confidentiality of Users’ Personal Information in its possession or under its control by taking appropriate, reasonable technical and organisational measures to prevent loss of, damage to, unauthorised destruction of, and unlawful access to or Processing of, Users’ Personal Information, in compliance with POPI as well as the implementation of appropriate data security measures, including but not limited to, data encryption, password policies, domain-based security policies, antivirus software, firewall(s), authentication and authorisation with the principle of “least privilege” applied, as well as ongoing training of staff in respect of security issues. .
- TSO has measures in place to identify all reasonably foreseeable internal and external risks to Users’ Personal Information in its possession or under its control, and has established and maintains appropriate safeguards against any identified risks. These safeguards are updated in response to new risks.
- TSO has adopted a Disaster Recovery Plan (“the DRP”) to address any and all security breaches. In terms of the DRP, immediate action is taken to assess the breach, and to resolve the issue. Such action includes communication with affected parties immediately, removing access to affected computer systems from the Internet and stop services, securing the network and scanning for and removing any viruses, malware and ransomware, analysing affected systems and determining the root cause of the breach, repairing the issue that caused the breach, removing vulnerable or malicious software and creating code fixes for bespoke software, vulnerability testing to ensure that the breach has been resolved, taking any necessary action to prevent a similar breach from recurring, and restoring access to the system(s).
- TSO has processes in place to ensure the completeness and accuracy of Personal Information during collection thereof, and at all stages thereafter.
- If it is required that any Users’ Personal Information is to be Processed by any third party, such Processing shall take place only with TSO’s knowledge and consent, and on the assurance that the Personal Information shall be treated as confidential by the third party. TSO confirms that there is a contractual agreement between it and such third parties that ensures that the third parties establish and maintain the appropriate and reasonable security measures in this regard, and that such third parties will notify TSO where there are reasonable grounds to believe that the Personal Information has bee accessed or acquired by any unauthorised person.
Information Quality
- TSO Processes Personal Information provided to it directly by Users.
- It is the Users’ responsibility to ensure the accuracy and completeness of their Personal Information as provided to TSO, and update such Personal Information as and when it changes.
Confirmation and Consent
- By registering to use the App and acknowledging this Policy, a User:
  - confirms that they are aware:
    - of the Personal Information being collected by TSO as detailed in this Policy;
    - of TSO’s contact information;
    - of the purpose for which the Personal Information is being collected;
    - that the supply of the Personal Information is voluntary, but is required to enable the User to use the App, and that failure to provide the Personal Information will result in the User being unable to register on the App and use the App;
    - that certain Personal Information may be required by TSO in terms of particular laws authorising or requiring the collection of this Personal Information, including but not limited to the Financial Centre Intelligence Act, 38 of 2001 (“FICA”);
    - that TSO does not intend transferring the Personal Information to a third country or international organisation, but to the extent that this may change, TSO will do so in a manner and to a country or international organisation that provides the same or better level of protection of such Personal Information as South Africa;
  - acknowledges they are aware of their rights with respect to Personal Information as set out in this Policy, and specifically to the right:
    - to have Personal Information Processed in accordance with the conditions set out in Chapter 4 of POPI;
    - to be notified that Personal Information is collected and if it has been accessed by an unauthorised person;
    - to establish if TSO holds their Personal Information, and to request access to the Personal Information;
    - to request correction, destruction or deletion of Personal Information;
    - to object to Processing of Personal Information;
    - not to have Personal Information Processed for purposes of direct marketing by means of unsolicited electronic communications;
    - not to be subject, under certain circumstances, to a decision which is based solely on the basis of automated Personal Information processing intended to provide a profile of the User;
    - to submit a complaint to the Information Regulator (justice.gov.za/inforeg) regarding the alleged interference with the protection of Personal Information of any User or to submit a complaint to the Regulator in respect of a determination of an adjudicator;
    - to institute civil proceedings regarding the alleged interference with the protection of their Personal Information; and
    - that such rights may be limited by other legislation that takes precedence over POPI;
  - specifically consents to the Processing of their Personal Information by TSO as indicated in this Policy; and
  - confirms that they are over the age of 18, or, in the event that they are under the age of 18, that their parent or guardian has consented to the Processing of their Personal Information as indicated in this Policy.
- TSO and the Users shall not create or maintain data which are derivatives of Personal Information except for the purpose as specified in these T&Cs, or as authorised by each of them in writing.
- To the extent that TSO shall process data in the European Union, it shall do so in compliance with the General Data Protection Regulation (“GDPR”), or any law that may supercede it.
- TSO does not require prior authorisation from any supervisory authority in respect of data privacy.
- At any and all times during which TSO is Processing Personal Information, it shall:
  - comply with POPI, and not, by act or omission, place any Data Subject in violation of any applicable privacy or security law;
  - implement and maintain appropriate and reasonable technical and organisational security measures to prevent a data security breach, including, without limitation, a breach resulting from or arising out of the Parties’ internal use, Processing or other transmission of Personal Information, whether between or among the Parties’ subsidiaries and affiliates or any other person or entity acting on behalf of the Parties;
  - assign an employee who will be responsible for implementing and maintaining the technical and organisational security measures required in terms of this Agreement and, upon the Data Subject’s request, provide evidence that it has established and maintains such technical and organisational security measures governing the Processing of Personal Information;
  - safely secure and encrypt all Personal Information during storage or transmission.

INFORMATION OFFICER
- TSO’s Information Officer is:

Full names:	Lucia Caruso McMullan
Phone number:	082 336 5214
Email address:	lucia@thesumof.co.za