Danko | PAIA manual

POLICY IN RESPECT OF THE PROCESSING OF PERSONAL INFORMATION IN TERMS OF THE PROTECTION OF PERSONAL INFORMATION ACT, NO 4 OF 2013, AS AMENDED
INALA PAYMENT SERVICES PROPRIETARY LIMITED
(Registration number: 2021/414313/07)

Introduction to POPI
1. The Protection of Personal Information Act, 4 of 2013 (“POPI”) is South Africa’s data protection law.
2. POPI regulates the processing, management, storage, and protection of Personal Information with a view to protecting people from harm by protecting their Personal Information, to stop their money and/or identities being stolen, and generally to protect their privacy.
The Purpose of this Policy
iNala Payment Services (Pty) Ltd (“iNala”) ensures that the conditions set out in POPI in respect of the processing of Personal Information are complied with, and this Policy explains how iNala obtains, uses, discloses and holds the Personal Information of the users of the Danko mobile app (“the App”) (“the Users”).
Important definitions in POPI
1. Several terms that are used in this document are defined in POPI. These terms are:
  1. “Data Subject”: the person to whom personal information relates. Within the context of iNala and the App, this refers to any User of the App
  2. “Direct marketing”: to approach a data subject, either in person or by mail or electronic communication, for the direct or indirect purpose of
    (a) promoting or offering to supply, in the ordinary course of business, any goods or services to the data subject; or
    
    (b) requesting the data subject to make a donation of any kind for any reason
  3. “Personal Information”: information relating to an identifiable, living, natural person, and where it is applicable, an identifiable, existing juristic person, including but not limited to
    (a) Information relating to the race, gender, sex, pregnancy, marital status, national, ethnic or social origin, colour, sexual orientation, age, physical or mental health, well-being, disability, religion, conscience, belief, culture, language and birth of the person;
    
    (b) Information relating to the education or the medical, financial, criminal or employment history of the person;
    
    (c) Any identifying number, symbol, email address, physical address, telephone number, location information, online identifier or other particular assignment to the person;
    
    (d) The biometric information of the person;
    
    (e) The personal opinions, views or preferences of the person;
    
    (f) Correspondence sent by the person that is implicitly or explicitly of a private or confidential nature or further correspondence that would reveal the contents of the original correspondence;
    
    (g) The views or opinions of another individual about the person;
    
    (h) The name of the person if it appears with other personal information relating to the person or if the disclosure of the name itself would reveal information about the person
  4. "Processing": any operation or activity or any set of operations, whether or not by automatic means, concerning personal information including
    (a) The collection, receipt, recording, organisation, collation, storage, updating or modification, retrieval, alteration, consultation or use;
    
    (b) Dissemination by means of transmission, distribution or making available in any other form; or
    
    (c) Merging, linking, as well as restriction, degradation, erasure or destruction of information and ”Process” and “Processed” shall have consistent meanings.
Processing limitation
1. iNala takes its obligations with regards to data protection and the privacy of all Users seriously, and the protection of Users’ Personal Information is important to iNala.
2. iNala is obliged to Process Personal Information in order to conduct its business, and to enable Users to use the App, but such Processing must take place only in accordance with POPI.
Processing Purpose
1. iNala is committed to processing Users’ Personal Information in a lawful, relevant and transparent manner. Accordingly, iNala Processes only Users’ Personal Information for purposes relating to usage of the App, which purposes includes the following:
  1. to enable Users to access the App, and to use its features;
  2. respond to Users’ enquiries;
  3. improve the App, its features and the Users’ experience by analysing the Personal Information for trends.
2. In addition to the Personal Information referred to in clause 5.1 above, Users who register on the App as “Tip Givers” shall be required to enter the details of a bank card from which payments made to Users who register on the App as “Tip Receivers” via the App are debited. iNala makes use of a secure payment gateway to facilitate such payments. iNala does not store the Tip Giver’s bank card details.
3. iNala is permitted to Process Users’ Personal Information on the following grounds:
  1. if the User consents thereto;
  2. if Processing is necessary for iNala to carry out actions for the conclusion or performance of a contract to which the User is party (such as the T&Cs relating to use of the App);
  3. to enable iNala to comply with legal and/or regulatory obligations imposed on it;
  4. to protect iNala’s legitimate interests without unduly affecting any User’s interests or fundamental rights and freedoms;
4. iNala Processes only the Personal Information collected directly from each User via the App.
Retention of Personal Information and Restriction of Personal Records
1. iNala retains Users’ Personal Information for as long as it may be necessary to fulfil the purpose for which it was collected (as detailed in clause 5.1 above) or to comply with legal, regulatory or internal policy requirements.
2. iNala shall restrict Processing any User’s Personal Information if:
  1. its accuracy is contested by the User in question, and for a period enabling iNala to verify the accuracy of the Personal Information;
  2. it no longer needs the Personal Information for achieving the purpose for which it was collected, but iNala will maintain such Personal Information for purposes of proof;
  3. the Processing is unlawful and the User opposes its destruction or deletion and requests iNala to restrict its use instead; or
  4. the User requests the Personal Information to be transmitted into another automated processing system.
Security Safeguards
1. iNala secures the integrity and confidentiality of Users’ Personal Information in its possession or under its control by taking appropriate, reasonable technical and organisational measures to prevent loss of, damage to, unauthorised destruction of, and unlawful access to or Processing of, Users’ Personal Information.
2. iNala has measures in place to identify all reasonably foreseeable internal and external risks to Users’ Personal Information in its possession or under its control, and has established and maintains appropriate safeguards against any identified risks. These safeguards are updated in response to new risks.
3. If it is required that any Users’ Personal Information is to be Processed by any third party, such Processing shall take place only with iNala’s knowledge and consent, and on the assurance that the Personal Information shall be treated as confidential by the third party. iNala confirms that there is a contractual agreement between it and such third parties that ensures that the third parties establish and maintain the appropriate and reasonable security measures in this regard, and that such third parties will notify iNala where there are reasonable grounds to believe that the Personal Information has bee accessed or acquired by any unauthorised person.
Information Quality
1. iNala Processes Personal Information provided to it directly by Users.
2. It is the Users’ responsibility to ensure the accuracy and completeness of their Personal Information as provided to iNala, and update such Personal Information as and when it changes.
Confirmation and Consent
1. By registering to use the App and acknowledging this Policy, a User:
  1. confirms that they are aware:
    1. of the Personal Information being collected by iNala as detailed in this Policy;
    2. of iNala’s contact information;
    3. of the purpose for which the Personal Information is being collected;
    4. that the supply of the Personal Information is voluntary, but is required to enable the User to use the App, and that failure to provide the Personal Information will result in the User being unable to register on the App and use the App;
    5. that certain Personal Information my be required by iNala in terms of particular laws authorising or requiring the collection of this Personal Information, including but not limited to the Financial Centre Intelligence Act, 38 of 2001 (“FICA”);
    6. that iNala does not intend transferring the Personal Information to a third country or international organisation, but to the extent that this may change, that iNala will do so in a manner and to a country or international organisation that provides the same or better level of protection of such
  2. Personal Information as South Africa;
    acknowledges they are aware of their rights with respect to Personal Information as set out in this Policy, and specifically to the right:
    1. to have Personal Information Processed in accordance with the conditions set out in Chapter 4 of POPI;
    2. to be notified that Personal Information is collected and if it has been accessed by an unauthorised person;
    3. to establish if iNala holds their Personal Information, and to request access to the Personal Information;
    4. to request correction, destruction or deletion of Personal Information;
    5. to object to Processing of Personal Information;
    6. not to have Personal Information Processed for purposes of direct marketing by means of unsolicited electronic communications;
    7. not to be subject, under certain circumstances, to a decision which is based solely on the basis of automated Personal Information processing intended to provide a profile of the User;
    8. to submit a complaint to the Information Regulator (www.justice.gov.za/inforeg) regarding the alleged interference with the protection of Personal Information of any User or to submit a complaint to the Regulator in respect of a determination of an adjudicator;
    9. to institute civil proceedings regarding the alleged interference with the protection of their Personal Information; and
    10. that such rights may be limited by other legislation that takes precedence over POPI;
  3. specifically consents to the Processing of their Personal Information by iNala as indicated in this Policy; and
  4. confirms that they are over the age of 18, or, in the event that they are under the age of 18, that their parent or guardian has consented to the Processing of their Personal Information as indicated in this Policy.
INFORMATION OFFICER
1. iNala’s Information Officer is:
  1. Full names: Michael James Spinks
  
  2. Phone number: 066 274 4754
  
  3. Email address: michael@inalapay.com