Privacy policy.

Privacy and Protection of Personal Information  (POPI)

for

Open Access Energy (Pty) Ltd and its subsidiaries and trading divisions

(hereinafter referred to as OA Energy)

1. Introduction

1.1 OA Energy provides a variety of energy technology solutions in the course of which it enters into data transactions which includes the processing, use, disclosure and collection of some Personal Information about its employees, clients, customers, partners and members of the public.  It is obligated to comply with POPI.

1.2  OA Energy is committed to processing data, and specifically Personal Information, in an open, transparent and responsive manner.

2. Purpose and Scope

2.1 This Policy applies to OA Energy, all of its subsidiaries, affiliates, business partners, trade divisions and employees, including Operators.

2.2 The purpose of this Policy is to demonstrate OA Energy’s commitment to safeguarding the Personal Information of all persons, including juristic persons, with whom it interacts and to ensure that OA Energy and its employees comply with the requirements imposed by POPI.

2.3 In particular, the purpose is to establish an institution wide policy that will provide direction with respect to the manner of compliance, give effect to the right of privacy and at the same time, balance the right to privacy against other rights such as the right of access to information, the right to protect important interests such as the free flow of information, regulate the manner in which Personal Information may be processed and establish measures to ensure respect for, and to promote, enforce and fulfil the rights protected.

2.4 The Policy sets out the objectives and directives on applicable protocols within OA Energy to maintain and uphold to the legal requirements and conditions as set out in Chapter 3 of POPI, including the safeguards pertaining to information transactions and specifically when processing Personal Information. OA Energy has aligned and developed its data protection strategies with its statutory obligation to effectively implement the reasonable and necessary technical, structural and organisational measures and operational controls in accordance with the relevant national data legislation and internationally recognised information and communication technology (ICT) standards and recommendations.

2.5 OA Energy is resolute in processing data in an open, lawful and transparent way. This Policy sets out the processes and procedures to align OA Energy’s business strategy and the applicable national legislation, i.e. POPI, in terms of processing Personal Information when it is collected, stored, used, disclosed and destroyed.

2.6 OA Energy will only Process data for the clear, precise and specific purpose for which it is collected from the Data Subject.

2.7 The Policy has application to all stakeholders.  It applies to all employees, service providers and administrators and any person handling Personal Information of customers, suppliers and employees of OA Energy.

2.8 The Policy has application to all information transactions where data is processed, including but not limited to data being exchanged and/or transmitted and which may constitute and/or include Personal Information.

2.9 Parties to an information transaction must therefore understand and comply with this Policy. In the event that a party to such a transaction does not understand any part of this Policy, or has any questions regarding data compliance protocols, that party must approach the Information Officer of the relevant OA Energy Entity.

2.10 Data and Personal Information shall only be collected from Data Subjects who have business dealings with OA Energy for, inter alia, administrative needs, conducting of business operations, and for legislative data compliance and risk analysis.

3.Definitions

In this Policy:

3.1 “Consent” means any voluntary, specific and informed expression agreeing to the processing of Personal Information;

3.2  “Data Subject” means the person to whom the Personal Information relates and in relation to OA Energy, Data Subject would include employees, customers, service providers and administrators and any other individual with whom OA Energy may interact, from time to time, whether or not such person is a natural person or a juristic person;

3.3 “Access Energy” means OA Energy’s free solution which, inter alia, enables municipalities and utilities to access smart meters, collect and interpret data, apply tariffs and bill customers in a single interface;

3.4 “De-identify”, in relation to Personal Information of a Data Subject, means to delete information that:

(a)identifies the Data Subject;

(b) can be used or manipulated by reasonably foreseeable method to identify the Data subject; or

(c)can be linked by a reasonable foreseeable method or other information that identifies a Data Subject,

and “De-identified” has a corresponding meaning;

3.5 “Energy Pro” means OA Energy’s peer-to-peer wheeling solution that, inter alia, uses smart meter data acquired using Access Energy to enable accurate multilateral wheeling transactions;

3.6 “Information Officer” in accordance with section 1 of PAIA means, in respect of any OA Energy Entity: 

(a) the chief executive officer or equivalent officer of that OA Energy Entity or any person duly authorised by that officer; or

(b) the person who is acting as such or any person duly authorised by such acting person;

3.7 “OA Energy” means OA Energy (Pty) Ltd, registration number 2021/109590/07, and includes any and all of OA Energy’s affiliates, business partners, Operators, subsidiaries and trading divisions, including each OA Energy Entity;

3.8 “OA Energy Entity” means each of those entities recorded in Annexure F;

3.9 “OA Energy’s Solutions” means all of OA Energy’s solutions, including Access Energy and Energy Pro;

3.10 “Operator” means a person who processes Personal Information for or on behalf of OA Energy in terms of a contract or mandate, without coming under the direct authority of OA Energy;

3.11  “PAIA” means the Promotion of Access to Information Act;

3.12        “Personal Information” means information that could be used to identify a Data Subject and includes:

(a) race, gender, sex, pregnancy, marital status, national or ethnic origin, colour, sexual orientation, age, physical or mental health, disability, religion, conscience, belief, culture, language;

(b)  education, medical history, financial history, criminal history, employment history;

(c) any identifying number, symbol, email address, physical address, telephone number, location information, online identifier or other particular assignment to a person (such as postal address);

(d)biometric information, including physical, psychological or behavioural characterisation including blood typing, finger printing, DNA analysis, retinal scanning and voice recognition;

(e) opinions, views, preferences of the Data Subject and opinions or views of another person about the Data Subject;

(f) correspondence; and

(g) a name;

3.13 “Policy” means this Data Privacy Policy;

3.14 “POPI” means the Protection of Personal Information Act, 4 of 2013;

3.15 “Processing”, as it relates to processing of Personal Information, means any operation or activity, whether or not by automatic means, including:

(a) collecting, receipt, recording, organising, collating, storage, updating, modification, retrieval, alteration, consultation or use;

(b) dissemination by means of transmission, distribution, or making available in any form;

(c) merging, linking, degrading, erasure or destruction

and “Process” shall have the corresponding meaning;

3.16 “Record” means any recorded Personal Information, regardless of its form or medium, including any writing, electronic information, label, marking, image, film, map, graph, drawing, tape and that is in the possession, or under control, of a Responsible Party, irrespective of whether it has been created by the Responsible Party or not and regardless when it came into existence;

3.17 “Regulator” means the information regulator established in terms of section 39 of POPI;

3.18 “Responsible Party” means OA Energy, or an Operator, who engages in the act of Processing Personal Information;

3.19 “Special Personal Information” means personal information concerning:

(a) the religious or philosophical beliefs, race or ethnic origin, trade union membership, political persuasion, health or sex life or biometric information of a Data Subject; or

(b) the criminal behaviour of a Data Subject to the extent that such information relates to:

(i) the alleged commission by a Data Subject of any offence; or

(ii) any proceedings in respect of any offence allegedly committed by a Data Subject or the disposal of such proceedings; and

3.20 “Unique Identifier” means any identifier that is assigned to a Data Subject and is used by OA Energy for the purposes of its operations and which uniquely identify the Data Subject in relation to OA Energy.

4. Lawful Processing of Information

4.1 OA Energy collects and receives information from a number of sources, including the following:

(a) directly from the Data Subject;

(b) during the course of OA Energy’s interactions with the Data Subject;

(c) when the Data Subjects uses any of OA Energy’s Systems;

(d) when the Data Subject visits and/or interacts with OA Energy’s website(s) or any other social media platforms or information technology services;

(e)  from publicly available sources; or

(f) from a third party who is authorised to share that information.

4.2 Personal Information may also be generated in the course and scope of OA Energy’s operational activities and in the fulfilment of obligations and duties as specified in contracts with its customers, service providers, business partners and if applicable, any other party, including Operators, to an information transaction where Personal Information is being transferred. OA Energy’s processing protocols are aligned with the conditions set out in Chapter 3 of POPI.

4.3 OA Energy may Process the Personal Information for, inter alia, the following purposes:

(a) to verify the Data Subject’s identity;

(b) to assess, enter into and/or perform in terms of a contract with the Data Subject, including analysing and reporting to a Data Subject who has used any of OA Energy’s Systems;

(c) for training and assessment purposes;

(d) for audit and record-keeping purposes;

(e)  to confirm the Data Subject’s credit worthiness and suitability as a customer or supplier;

(f) to comply with legal, regulatory and/or contractual obligations;

(g) to undertake security and monitoring the measures;

(h) to provide advertising, marketing and the media services to the Data Subject;

(i) to defend any legal claims in connection with the Data Subject contract with the relevant OA Energy or for OA Energy to establish, bring or pursue a claim against the Data Subject; or

(j) otherwise for OA Energy’s legitimate interests or those of a third party.

4.4  Where it is lawful and practicable for OA Energy to allow it, the Data Subject has the right not to identify himself when dealing with OA Energy.  However, if the Data Subject does not provide OA Energy with his/her Personal Information, it may impact OA Energy’s ability to engage with the Data Subject and/or provide services to the Data Subject.

4.5 Chapter 3 of POPI stipulates 8 (eight) provisions for the lawful Processing of information namely accountability, processing limitation, purpose specification, further processing, information quality, openness, security safeguards and Data Subject participation.

4.6 Any employee, service provider or administrator must ensure that:

(a) all Personal Information of employees, service providers and stakeholders is Processed in accordance with the 8 (eight) standards for the lawful Processing of information; and

(b) no Special Personal Information or Personal Information concerning a child is Processed unless the express prior consent of a competent person is first obtained. In the event that either of these categories of information is required to be Processed and it is not possible to first obtain prior written consent, the matter shall be referred to the Information Officer for direction.

4.7 Failure to adhere to these provisions may result in disciplinary or other action being taken.

4.8 In the course of information transactions, certain information may be collected by OA Energy which may be held and labelled as Special Personal Information. Special Personal Information will only be collected where necessary for the purpose for which it is being collected and with the Data Subject’s Consent, unless such collection is demanded and/or authorised by law.

5. Rights of Data Subjects

5.1 OA Energy respects a Data Subject’s right to have his or her or its Personal Information Processed lawfully.

5.2 Data Subjects have the right:

(a) to be notified that Personal Information about him, her or it is being collected or that his, her or its Personal Information has been accessed or acquired by an authorised person;

(b) to establish whether OA Energy holds Personal Information of that Data Subject and to request access thereto;

(c) to request, where necessary, the correction, destruction or deletion of his, her or its Personal Information;

(d) to object, on reasonable grounds relating to his, her or its particular situation to the Processing of his, her or its Personal Information;

(e) to object to the Processing of his, her or its Personal Information at any time for the purposes of direct marketing;

(f) not to be subject, under certain circumstances, to a decision which is based solely on the basis of automated Processing of his, her or its Personal Information intended to provide a profile of such a person;

(g)to submit a complaint to the Regulator regarding the alleged interference with the protection of his, her or its Personal Information; and

(h) to institute civil proceedings regarding the alleged interference with the protection of his, her or its Personal Information.

5.3 To the extent that the legal basis for OA Energy to process a Data Subject’s Personal Information is informed consent, the Data Subject has the right to withdraw such consent at any time. If the Data Subject’s consent is required for further transactions, then such a request must be clear, concise and specific to the use of the service or product for which it is provided.

5.4 Consent, whenever it is obtained, should cover all Processing activities carried out for a specific purpose or purposes. When the Processing has multiple purposes, Consent should be given for each such purpose.

5.5 Withdrawal of Consent will not affect the lawfulness of Processing which occurred prior to such withdrawal.

5.6 All Data Subjects participating in information transactions with OA Energy are entitled to exercise any of their rights by clear, concise communication by email to the Information Officer.

5.7 Data Subjects furthermore have the right to object to Processing of their Personal Information for scientific or historical research purposes or statistical purposes on grounds relating to such Data Subject’s situation or circumstances, unless the Processing is necessary for the performance of a task which is carried out for reasons of public interest.

6. Accountability

6.1 OA Energy holds ultimate responsibility to ensure that the provisions of POPI are complied with for the collection, retention, dissemination and use of the Personal Information.

6.2 This places substantial and ultimate accountability on OA Energy, employees, service providers and administrators to ensure that Personal Information is processed in a lawful manner.

6.3 OA Energy remains responsible for the Processing of information regardless of whether or not the information is passed on to a third party (such as an administrator) or not; provided that agreements must be concluded with those third parties in terms of which they agree to be bound by and comply with the requirements of this Policy and of POPI. Notwithstanding this, OA Energy’s website may contain links to other websites. OA Energy will not be held liable for the privacy controls of third-party websites. Data Subjects may be associated with a unique identifier, which may leave traces which, when combined with other information received by the third-party websites, could be used to create profiles of the Data Subjects and identify them.

6.4 In order to ensure that the provisions of POPI are adhered to by employees, service providers and Operators, OA Energy Entity will appoint an Information Officer, and register the Information Officer with the Regulator.  

6.5 A substantial amount of Personal Information is in electronic form. Employees, service providers and administrators of OA Energy are responsible for information technology and providing the tools to manage and safeguard information.

6.6 Employees, managers, supervisors, service providers and administrators are accountable to OA Energy to report any breaches in data security and to ensure that any risks of breaches are identified and reported.

7. Processing Limitation

7.1 The Personal Information must be processed lawfully and in a reasonable manner, which does not infringe the privacy of the Data Subject.

7.2 The notion of reasonableness incorporates the requirements of balance and proportionality. Employees, service providers and administrators must therefore take into account the interests and reasonable expectations of Data Subjects as well as all of the provisions which are incorporated in these conditions.

7.3 The Processing must be adequate, relevant and not excessive given the purpose for which it is processed.

7.4 Subject to the provisions of section 11(1) of POPI, the Data Subject must consent to the processing of the Personal Information. The consent must be voluntary and clear, however, it does not have to be in writing. Employees, service providers and administrators must ensure that the Data Subject has provided consent when they request Personal Information.

7.5 The Data Subject may at any time withdraw consent, on reasonable grounds, to the processing of its Personal Information.  If a Data Subject withdraws consent, the Personal Information must be deleted or De-identified so that it will no longer be associated with that Data Subject.

7.6 The Processing must be necessary to carry out the actions for the conclusion or performance of a contract to which the Data Subject is a party.

7.7 The Processing must protect a legitimate interest of the Data Subject, and the Processing must be necessary for pursuing the legitimate interest of OA Energy.

7.8 The Personal Information must be collected directly from the Data Subject, except if:

(a) the Personal Information is a matter of public record;

(b) the Data Subject has consented to the collection of the Personal Information from another source;

(c) the collection of the Personal Information from another source would not prejudice a legitimate interest of the Data Subject;

(d) the collection of the Personal Information is necessary by law;

(e) compliance would prejudice a lawful purpose of the collection; or

(f) compliance is not reasonably practicable in the circumstances.

8. Purpose Specification

8.1 The collection of the Personal Information must be for a specific expressly defined purpose, such as for Processing a potential employee or customer’s application, and further examples of which are recorded in clause 4.3 above.

8.2 The purpose of the collection and Processing of Personal Information influences every aspect of the processing of the information, the manner of its collection, periods of retention, further processing, disclosure to third parties and any further issues which may apply.

8.3 While OA Energy will have a duty to notify the Regulator of its purposes and functions, the factor determining the purpose for the collection of Personal Information will always be the specified purpose communicated to the Data Subject.

8.4  The Data Subject must be made aware of the purpose. This enables the Data Subject to make an informed decision as to whether the Personal Information should be made available to the Responsible Party. The purpose for the collection of the Personal Information should be explained to the Data Subject, either telephonically or by the relevant inclusion in the customer application form and/or trading terms and conditions. Examples of the purposes for which Personal Information is obtained are recorded in clause 4.3 above.

8.5 Records of Personal Information must not be retained any longer than is necessary for achieving the purpose for which the information was collected or Processed. OA Energy will determine, with regard to the circumstances surrounding the collection of the Personal Information, the length of time personal records are to be kept for and implement procedures in order to ensure that records are destroyed or De-identified when no longer required.

8.6 The Data Subject must consent in the event that the Personal Information is kept for a period which is longer than necessary for achieving the purpose for which the information was collected. This can be done by way of a contractual arrangement such as provision to this effect in the customer application form and/or trading terms and conditions.

8.7 Where Personal Information is disclosed to Operators as referred to in clauses 13.3 and 13.4 below, such disclosure will only be insofar as is reasonably necessary for the maintenance and completion of business and operational functions.

8.8 OA Energy will ensure that its Vendor Application Process document and Customer Contracts are in compliance with the contents of this Policy and the relevant data legislation.

9. Further Processing

9.1 Any further processing of the Personal Information must be compatible with the purpose for which the Personal Information was initially collected.

9.2 For example, if OA Energy collects Personal Information for the purposes of providing services to a customer, the information cannot be Processed further for the purpose of profiling and marketing products to that customer. The only exception to this is if the Data Subject consents to such use.

9.3 To assist in determining whether further Processing is compatible with the initial purpose of collection, the employee, service provider or administrator must take account of:

(a) the relationship between the purpose for which the Personal Information was originally collected and the intended purpose of any further Processing;

(b) the nature of the Personal Information concerned;

(c)  the consequences of further processing;

(d) the manner in which the Personal Information was collected; and

(e) contractual rights and obligations between the parties.

9.4 Personal Information may be Processed by OA Energy where necessary for the establishment, exercise or defence of legal claims, whether in court proceedings or in an administrative or out-of-court procedure. The legal basis for such Processing is the Responsible Party’s legitimate interest in the protection and assertion of the Responsible Party’s rights, a Data Subject’s rights and the legitimate interest(s) of any other person(s).

9.5 Personal Information may be Processed by OA Energy where necessary for the purposes of obtaining or maintaining insurance coverage, managing risks, or obtaining professional advice. The legal basis for such Processing is the legitimate interest of OA Energy in diligently protecting its business from risk.

9.6 Financial transactions relating to the OA Energy websites and services may be handled by its payment service providers such as recognised financial institutions. OA Energy will share transaction data with such service providers only to the extent necessary for the purposes of processing payments, refunding of payments, and dealing with complaints and queries relating to payments and refunds.

10. Information Quality

10.1 The employee, service provider or administrator responsible for the Processing of the Personal Information must take reasonable steps to ensure that the Personal Information remains complete, is accurate, is not misleading and is updated where necessary.

10.2 In essence, this condition requires that appropriate Personal Information security measures safeguarding the integrity of the Personal Information be employed.

11. Openness

11.1 The Personal Information must be Processed in a transparent and fair manner.

11.2 The Data Subject must be provided with information which allows the Data Subject to be aware that Personal Information is being collected, the identity of the Responsible Party, the purpose for the collection of the information and whether the supply of the information by the Data Subject is voluntary or mandatory.

11.3 Further, the party responsible for the Processing of the information, whether it be the employee, service provider, Operator or administrator, must maintain all documentation of the Processing operations.

12. Security Safeguards

12.1 OA Energy, as well as all Responsible Parties, undertake to ensure that the appropriate controls are in place to ensure that confidential, internal and Personal Information is disclosed only to those who are authorised and who have a legitimate business related need for such access.

12.2  OA Energy will take all reasonable steps to establish and maintain sufficient security controls, technological and organisational, to ensure that all Personal Information which is Processed by OA Energy is protected against unauthorised alteration, destruction and/or access that may change the integrity of the Personal Information and that it is backed up and stored in a format which is readily accessible by OA Energy.

12.3 The back up solution utilised by OA Energy is designed and based on the principles of lawful Processing and retention policies as set out in the relevant data legislation.

12.4 The party responsible for the Processing of the Personal Information, if not OA Energy (but an Operator), must ensure that the integrity of the Personal Information remains secure against loss, destruction or unlawful access.

12.5 Any service provider, administrator or third-party Processing Personal Information for OA Energy, must do so only with the knowledge and express authorisation of OA Energy and must treat the Personal Information as strictly confidential.

12.6 Employees, managers, supervisors, service providers and administrators have a duty to ensure that Personal Information is not mislaid or inadvertently disclosed by, for example, leaving it displayed on a computer screen or leaving printouts at the printer.

12.7 Any Personal Information which is Processed or accessed outside the office premises of OA Energy must be encrypted to guard against theft.

12.8 Where Personal Information is to be moved to another country in order for business activities to be conducted, the interested and/or authorised parties must consult with their departmental manager, the Data Subject(s) concerned, as well as the Information Officer in order to ensure compliance with POPI and any further applicable legislation, with particular reference to Consent and jurisdictional complications.

12.9 Should OA Energy receive unsolicited Personal Information, it will assess whether it is Personal Information which it is entitled or authorised to collect and Process. If the Personal Information is that which OA Energy is authorised to collect and Process, it will treat this Personal Information in accordance with the principles set out in this Policy. If the Personal Information is not capable of being collected and Processed by OA Energy, it shall destroy or De-Identify the Personal Information as soon as is practicable.

12.10 OA Energy’s automated information technology back-up solution is designed and implemented in accordance with accepted and effective security standards and controls and daily monitoring alerts. In the event of data which is no longer to be retained, and when lawfully able to do so, it will be destroyed and De-Identified as soon as practicably possible and/or upon specific request by completion of the requisite Form 2, a copy of which is attached to this Policy as Annexure D.

12.11 All hard copies of documents must be shredded once the documents are no longer required.

12.12 Once the Personal Information is no longer required or no longer authorised, the records must be destroyed, deleted or De-identified. Records may be kept longer for historical, statistical or research purposes and the appropriate safeguards must be implemented against the use of the records for any other purposes, provided that the consent of the Data Subject is obtained.

13. Disclosure of Information

13.1 The Responsible Parties shall make all reasonable efforts to ensure that the parties to information transactions agree on non-disclosure provisions and consent to transactions which are within the scope of his/ her/ its specific mandate.

13.2 OA Energy will not use or disclose Personal Information for purposes other than the purpose for which it was collected (the “Primary Purpose”) unless:

(a) the Data Subject has consented to the use or disclosure;

(b) the secondary use or disclosure is related to the Primary Purpose, in the case of Personal Information which is not Special Personal Information, or is directly related to the Primary Purpose, in the case of Personal Information which is Special Personal Information; or

(c) it is otherwise required or authorised by or under law or a court/tribunal order.

13.3 It may at times be necessary for OA Energy to disclose Personal Information to third parties, including Operators and/or service providers and as may be permitted or required by law. Where this is the case, OA Energy will enter into a written agreement with the Responsible Party and/or third party.

13.4 An agreement such as that referred to in clause 13.3 must contain an assurance from the Operator or service provider, as the case may be, that such Operator or service provider will, at a minimum, subscribe, match and adhere to the same prescriptions and restrictions pertaining to the processing of Personal Information as is required by the relevant data legislation and this Policy, and that it has adequate or equivalent infrastructure and organisational measures in place which are in accordance with accepted industry standards, and that it will Process Personal Information in strict accordance with an issued mandate and specified instructions from OA Energy only.

13.5 OA Energy reserves the right to disclose Personal Information to any member of the group of companies which comprises OA Energy, together with all of its subsidiaries, partners and affiliates.

13.6 If the recipient of Personal Information is not OA Energy (including its related entities, subsidiaries and trading divisions) then such recipient must be verified as a legitimately interested party and confirm whether the Personal Information is required for the legitimate performance of tasks within the competence of the recipient. The grounds for the request must be verified by OA Energy, as well as the recipient’s competence to receive the Personal Information.

13.7 The necessity of the transmission of Personal Information as referred to in clause 13.6 will be evaluated together with the recipient’s organisational and technical security safeguards and measures as required by law and by this Policy.

13.8 OA Energy may disclose Personal Information to its insurers and/or professional advisors insofar as is reasonably necessary for the purposes of obtaining or maintaining insurance coverage, managing risks, obtaining professional advice, or for the establishment, exercise or defence of legal claims, whether in court proceedings or in an administrative or out-of-court procedure.

13.9 Operators must enter into a data transfer agreement which is subject to limitations on the condition of further Processing and secondary Processing regarding the obtaining of Consent from the Data Subject.

13.10 All requests for confidential, internal or Personal Information which originate from a person or entity outside of OA Energy must be forwarded to the Information Officer or any such duly authorised and appointed representative.

13.11 All requests for confidential, internal or Personal Information which fall outside of the standard business practice or procedure, and which originate from an employee of OA Energy, must be forwarded to the human resources department of OA Energy for employee authentication and thereafter to the Information Officer and/or the employee’s line manager as may be necessary for final authorisation.

13.12 Requests referred to in clause 13.11 must be reasonably considered by the Information Officer and/or the employee’s line manager, as the case may be, and further directives must be issued on the approval thereof.

14. Data Subject Participation

14.1 The Data Subject has the right to request OA Energy to confirm, free of charge, whether OA Energy holds Personal Information about the Data Subject.

14.2 The Data Subject may request OA Energy to provide it with a description of the Personal Information held by it or by a third party within a reasonable time. Any fees charged for providing the Data Subject with the information required shall not be excessive. OA Energy should also advise the Data Subject that the Personal Information may be corrected upon request.

14.3 The Data Subject has a right to access the Personal Information and request a correction or deletion of the Personal Information. OA Energy, employees, service providers and administrators each have a duty to investigate the request and to respond thereto. Any such request must be forwarded to the Information Officer or his or her duly authorised representative.

14.4 Where the Data Subject is an employee, any requests to correct Personal Information must be directed at the Data Subject’s line manager, the human resources department of OA Energy and the Information Officer.

14.5 If there are circumstances where OA Energy believes that the information is accurate and no agreement between the Data Subject and OA Energy can be reached to amend the information, OA Energy is obliged to link the Personal Information in dispute in such a manner that it will always be read with an indication that the correction of the Personal Information has been requested by the Data Subject, but has not been made.

14.6 In instances where changes have been made which may impact on decisions taken using Personal Information, POPI imposes a duty on OA Energy to advise, if reasonably practical, any third parties to whom the information may have been disclosed.

14.7 OA Energy, as a Responsible Party, will only use Personal Information for direct marketing with the Data Subject’s Consent. Such Consent will be obtained either:

(a)  in writing, by requesting completion of a prescribed form which must be returned to OA Energy via email at legalnotices@openaccess.energy. A copy of the prescribed Form 4 is attached to this Policy as Annexure E; or

(b) electronically, by requesting the Data Subject to tick an electronic box on email, or otherwise, it being recorded that the relevant provisions of Form 4 (Annexure E) are to be complied with.

14.8 Data Subjects retain the right to object to OA Energy’s processing of Personal Information for direct marketing purposes. If such an objection is made, OA Energy will cease to process such Data Subject’s Personal Information.

15. Breach of Policy

15.1 Failure to comply with the rules and standards set out in this Policy, and those policies which have been incorporated by reference herein, may be regarded as a transgression of company policy and must be reported to the relevant Information Officer.

15.2 Incidents of any breach of this Policy must be reported immediately to the relevant Information Officer by email. The Information Officer must investigate the breach as soon as practically possible and notify the Regulator as may be appropriate, necessary and applicable.

15.3 Where there are reasonable grounds to believe that Personal Information has been accessed, acquired, destroyed or altered by any unauthorised person, the Responsible Party must notify the Regulator and the Data Subject(s), unless the identity of the Data Subject(s) cannot be established.

15.4 Where there are reasonable grounds to believe that Personal Information has been accessed, acquired, destroyed or altered by any unauthorised person, notifications will be actioned and sent to the Data Subject(s) concerned, unless the identity of the Data Subject(s) cannot be established, in which case a notification shall be published on OA Energy’s website and sent to all relevant parties via email or otherwise. Such notification must be sent via email, as soon as is reasonably possible after discovery of the compromise and to enable a Data Subject to take pre-emptive measures as may be available and/or appropriate, taking into account the legitimate needs of law enforcement and any measures which may be necessary to determine the scope of the compromise and to restore the integrity of the Responsible Party’s Records.

16. Policy Maintenance

• OA Energy shall review this Policy at least every (3) three years or more frequently as needed to respond to changes in the regulatory and legislative environment, as well as technological advancement in privacy protection.

Annexure A: Rights of Data Subjects

Section 5 of POPI states that a Data Subject has the right to have his, her or its Personal Information Processed in accordance with the conditions for the lawful Processing of Personal Information, including the right:

· to be notified that:

• Personal Information about them is being collected as provided for in terms of section 18; or

• their Personal Information has been accessed or acquired by an unauthorised person as providedfor in terms of section 22;

• to establish whether a Responsible Party holds Personal Information of that Data Subject and to request access to their Personal Information as provided for in terms of section 23;

• to request, where necessary, the correction, destruction or deletion of their personal information as provided for in terms of section 24;

• to object, on reasonable grounds relating to their particular situation to the processing of their personal information as provided for in terms of section 11(3)(a);

• to object to the processing of their personal information: 

• at any time for purposes of direct marketing in terms of section 11(3)(b); or

• in terms of section 69(3)(c)

• not to have his, her or its personal information processed for purposes of direct marketing by means of unsolicited electronic communications except as referred to in section 69(1); 

• not to be subject, under certain circumstances, to a decision which is based solely on the basis of the automated processing of their personal information intended to provide a profile of such person as provided for in terms of section 71; 

• to submit a complaint to the Regulator regarding the alleged interference with the protection of the personal information of any Data Subject or to submit a complaint to the Regulator in respect of a determination of an adjudicator as provided for in terms of section 74; and 

• to institute civil proceedings regarding the alleged interference with the protection of his, her or its personal information as provided for in section 99.

Annexure B: POPIA Guide to OA Energy Employees

The following principles for the protection of personal information of Data Subjects must be applied by all OA Energy employees: 

1. Email addresses of participants on group emails must be blind copied to prevent unauthorised distribution of email addresses;

2. Internal email trails must be removed from emails when communicating externally;

3. Employee and customer information may not be used for purposes other than those of OA Energy;

4. Confidential information must be locked away;

5. Confidential information must not be left on unattended desks or on printers;

6. No personal information may be forwarded to a third party without the express written permission of the Data Subject;

7. Third party service providers responsible for the protection of information must sign and agree to this policy.

 
Annexure C: Information Officer’s Responsibilities

1.  Attending on this Policy and POPI is to occur at regular intervals so that all employees are made aware of the Policy and POPI.

2.  Each new employee will be required to sign an employment contract containing relevant consent clauses for the use and storage of employee information or any other action so required in terms of POPI.

3.  Every employee currently employed by OA Energy will be required to sign an addendum to their employment contract containing relevant consent clauses for the use and storage of employee information, or other action, as so required, in terms of POPI.

4. OA Energy archived client information which is stored onsite which is also governed by POPI, and access to these areas is limited to authorised personnel.

5.  Where OA Energy supplies other third party service providers with Personal Information, they will be required to sign a service level agreement guaranteeing their commitment to POPI.

6. All electronic files or data are backed up by the OA Energy IT division which is also responsible for system security that protects third party access and physical threats.

OA Energy has prepared a manual in terms of PAIA. The manual has been placed on OA Energy’s website and made available at OA Energy’s principal place of business.

FORM 2

REQUEST FOR CORRECTION OR DELETION OF PERSONAL INFORMATION OR DESTROYINGOR DELETION OF RECORD OF PERSONAL INFORMATION IN TERMS OF SECTION 24(1) OF THE PROTECTION OF PERSONAL INFORMATION ACT, 2013 (ACT NO. 4 OF 2013)

REGULATIONS RELATING TO THE PROTECTION OF PERSONAL INFORMATION, 2018

[Regulation 3]

Note:

1.  Affidavits or other documentary evidence as applicable in support of the request may be attached.

2.  If the space provided for in this Form is inadequate, submit information as an Annexure to this Form and sign each page.

3. Complete as is applicable.

Mark the appropriate box with an "x".

Request for:

1. Correction or deletion of the personal information about the data subject which is in possession or under the control of the responsible party.

2. Destroying or deletion of a record of personal information about the data subject which is in possession or under the control of the responsible party and who is no longer authorised to retain the record of information.

(A) DETAILS OF THE DATA SUBJECT

Name(s) and surname / registered name of data subject: 

Unique identifier/ Identity Number:

                                                                               


Residential, postal or business address:

Contact number(s):

Fax number / E-mail address:

 (B) DETAILS OF RESPONSIBLE PARTY

Name(s) and surname / registered name of responsible party:

Residential, postal or business address:

Contact number(s):

Fax number/ E-mail address:

(C) INFORMATION TO BE CORRECTED/DELETED/ DESTRUCTED/ DESTROYED

(D) REASONS FOR *CORRECTION OR DELETION OF THE PERSONAL INFORMATION ABOUT THE DATA SUBJECT IN TERMS OF SECTION 24(1)(a) WHICH IS IN POSSESSION OR UNDER THE CONTROL OF THE RESPONSIBLE PARTY ; and or

REASONS FOR *DESTRUCTION OR DELETION OF A RECORD OF PERSONAL INFORMATION ABOUT THE DATA SUBJECT IN TERMS OF SECTION 24(1)(b) WHICH THE RESPONSIBLE PARTY IS NO LONGER AUTHORISED TO RETAIN.

(Please provide detailed reasons for the request)

Signed at .......................................... this ...................... day of ...........................20………...

...........................................................................

Signature of data subject/ designated person

Annexure E: Form 4

FORM 4

APPLICATION FOR THE CONSENT OF A DATA SUBJECT FOR THE PROCESSING OF PERSONAL INFORMATION FOR THE PURPOSE OF DIRECT MARKETING IN TERMS OF SECTION 69(2) OF THE PROTECTION OF PERSONAL INFORMATION ACT, 2013 (ACT NO.

4 OF 2013)

REGULATIONS RELATING TO THE PROTECTION OF PERSONAL INFORMATION, 2018

[Regulation 6]

 TO:                                                                                                                                                                   (Name of data subject)

FROM:                                                                                 

Contact number(s):                                                                                

Fax number:                                                                                   

E-mail address:                                                                                 

(Name, address and contact details of responsible party) 

Full names and designation of person signing on behalf of responsible party:

.............................................................

Signature of designated person

Date:                                          

PART B

I,                                                                                 (full names of data subject) hereby:

Give my consent.

To receive direct marketing of goods or services to be marketed by means of electronic communication.

SPECIFY GOODS or SERVICES:

SPECIFY METHOD OF COMMUNICATION:          

FAX:                                                                                

E - MAIL:                                                                                

SMS:                                                                                

OTHERS – SPECIFY:                                                                                

Signed at ....................................... this ...................... day of .......................... 20 .....

………………………………………………………………

Signature of data subject

 Annexure F: OA Energy Entities

1. Open Access Energy (Pty) Ltd;

2. Opacc Kapital (Pty) Ltd;

3. Cleanvest Energy (Pty) Ltd;