ANNEXURE C: Privacy notices 1.1 The Privacy Notice must be in plain English, in reasonably prominent type, and in a reasonably prominent position on the form or screen. Make sure it is clear who we are and give our name in full, i.e. The Department of Trade and Industry. 1.2 The Privacy Notice need not be complicated – it depends on what we intend to do with their personal information and how obvious that will be to the person. Use a simple sentence such as this if possible: the dtic will use your personal details only to process your order/application/etc. For more information read the dtic’s Privacy Policy on our website. 1.3 If necessary, provide the complete privacy notice: This Privacy Notice explains how the Department of Trade and Industry (the dtic) obtain, use, disclose and otherwise process personal information as required by the Protection of Personal Information Act (“POPIA”). 1. General Principles 1.1 the dtic respects your privacy and your personal information and will take care to protect and to keep it confidential. 1.2 the dtic will only disclose, collate and process (“use”) your personal information with your express written permission, unless we are legally required to do so. 1.3 the dtic will not use your personal information for any other purpose, other than that which we disclosed to you, unless you give your express written permission to do so, or unless the dtic is permitted or required to do so by law. 1.4 the dtic strives to ensure that personal information is kept reliable, accurate and up to date. The onus is, however, on individuals to inform the dtic if any personal information held about them is inaccurate or misleading. 1.5 the dtic will protect personal information through the use of reasonable technical and operational safeguards. 1. What is Personal Information 2.1 "Personal information" has the meaning given to it in the POPIA. Personal information means information relating to an identifiable, living, natural person, and where it is applicable, an identifiable, existing juristic person, including, but not limited to: • information relating to the race, gender, sex, pregnancy, marital status, national, ethnic or social origin, colour, sexual orientation, age, physical or mental health, well-being, disability, religion, conscience, belief, culture, language and birth of the person; • information relating to the education or the medical, financial, criminal or employment history of the person; • any identifying number, symbol, e-mail address, physical address, telephone number, location information, online identifier or other particular assignment to the person; • the biometric information of the person; • the personal opinions, views or preferences of the person AND the views or opinions of another individual about the person; • correspondence sent by the person that is implicitly or explicitly of a private or confidential nature or further correspondence that would reveal the contents of the original correspondence; and • the name of the person if it appears with other personal information relating to the person or if the disclosure of the name itself would reveal information about the person. 2.2 Personal information is therefore information the dtic collects which identifies you or can be used to identify you. 2. How we collect your Personal Information 3.1 Information will be collected directly from you where you provide the dtic with your personal details. 3.2 Personal information is collected if you do any of the actions below: • Provide information to the dtic in forms, for example when you apply for services such as permits or incentive grants; • Provide information to the dtic when you enquire via the dtic website; • Make calls to the dtic. These calls may be recorded for training, quality or business purposes; • Apply for a position to work at the dtic; • Apply or submit documentation to deliver services or products to the dtic. 3.3 With your consent, the dtic may also supplement the information that you provide with information received from other governmental bodies such as SARS. 3.4 Website usage information is collected using “cookies” which allows the dtic to collect standard internet visitor usage information. 3. Why we collect and use Personal Information 4.1 the dtic needs to collect some personal details from you to provide you with the dtic’s services and products. • To provide the dtic’s products or services to you, to carry out the transaction you requested and to maintain our relationship; • To assess and process applications and claims; • To conduct reference searches or verification; • To confirm and verify your identity or to verify that you are an authorised user for security purposes; • For operational purposes; • For the detection and prevention of fraud, crime, money laundering or other malpractice; • To conduct market research or for statistical analysis; • For audit and record keeping purposes; and • In connection with legal proceedings. 4. Protection of your Personal Information 5.1 the dtic values the information that you choose to provide and will take reasonable steps to protect your personal information from loss, misuse or unauthorised alteration. 5.2 To prevent unauthorised access, maintain data accuracy, and ensure the correct use of information, the dtic has put in place appropriate physical, electronic, and managerial procedures to safeguard and secure the information. 5.3 the dtic may, however, disclose your personal information: • Where there is a duty or a right to disclose in terms of law or industry codes; • Where the dtic believes it is necessary to protect its rights. 5. Access to or correction of Personal Information 6.1 You have the right to ask the dtic to update, correct or delete your personal information. Please note, however, that any such access requests may be subject to a payment of a legally allowable fee. 6. Data retention 1.1 the dtic will only retain personal information for as long as it is needed to carry out the purpose for which it was collected. Once the purpose for collection has been fulfilled and all contractual and/or legal requirements satisfied, the personal information will be destroyed in accordance with the dtic’s Records Management Policy. 7. How to contact the dtic 8.1 If you have questions about this Notice or believe that the dtic has not adhered to it, or need further information about the dtic’s privacy practices or wish to give or withdraw consent, exercise preferences or access or correct your personal information, please contact the dtic at the following numbers/addresses: • Customer Call Centre: