This statement may be amended by the OBA at any point in time without giving prior notice.

INTRODUCTION

This privacy statement sets out the approach of the OBA, comprising OBA.africa, to processing personal information within the OBA environment and how the privacy of personal information is kept secure within the OBA.

The term “personal information” describes any information relating to an identified or identifiable person (“data subject”), as contemplated in the Protection of Personal Information Act, No 4 of 2013 (“POPI”). The term “processing” describes the activity of collecting, transferring, storing, modifying or deleting personal information as contemplated in POPI.

STATEMENT

OBA recognises the importance of lawfully processing and securing of personal information (“privacy measures”) as an essential element of public trust. We strive to be a of trusted companies and expect each company within the OBA to implement responsible privacy measures, in compliance with POPI.

APPLICATION

The requirements and principles set out herein are not exhaustive, but serve to illustrate the spirit and intent in which the OBA seeks to conduct its business with respect to personal information. Adhering to privacy measures is a shared responsibility, and applies equally to all employees within the OBA.

PRIVACY PRINCIPLES

When collecting, storing, transferring or deleting any personal information and when crafting standard operating procedures to process personal information, our approach within the OBA is informed by the following general privacy principles:

Principle 1: Notice

We should offer appropriate notice to all data subjects about our data privacy practices, to allow data subjects to understand what privacy measures are in place with respect to their personal information and for what reason such personal information is being processed.

Principle 2: Individual Control

We should have measures in place to honour data subjects’ choices about their personal information and should support data subjects’ desire to control their personal information, to the extent that it is legally required. We should also be responsive to their requests within the bounds of technical feasibility and reasonability.

Principle 3: Respect for Context

We should recognise that data subjects’ expectations about the fair and ethical use of their personal data are informed by the context in which their personal information was first collected. Where legally required, we seek permission before using personal information for new purposes that are incompatible with the original context in which they were collected, to avoid an unwelcome surprise.

Principle 4: Limited Sharing

We should limit unnecessary personal information sharing with third parties. We should only allow sharing under controlled circumstances. Specifically, we should only share with third parties if the personal information will be protected subject to the same standards that we use ourselves, and where the sharing is consistent with the data subjects’ reasonable expectations.

Principle 5: Retention

We should retain personal information only for as long as we need it.

Principle 6: Security

We should ensure that appropriate security measures are in place to protect and limit the processing of personal information. Although no systems can ever be rendered invulnerable to attack, we should ensure that known threats are accounted for and that we implement administrative, technical, personnel and physical measures to safeguard personal information against loss, theft and unauthorised uses or modifications.

Principle 7: Government

We should engage and cooperate with the Information Regulator responsibly. It is important to ensure that we

have procedures in place to report security compromises and handle government requests with transparency.

Questions about our Privacy Statement addressed to the OBA’s Information Officer, which you may contact by email: popia@openbox.africa