Data Privacy Statement
1. INTRODUCTION, PURPOSE AND APPLICATION
1.1 IBC SOLAR South Africa (Pty) Ltd (“IBC SOLAR South Africa, we, us, our”) respect your privacy and take the protection of personal information very seriously.
1.2 We are committed to protecting the privacy of all parties with whom we interact, including but not limited to, our employees, clients, visitors and service providers (“you”) in accordance with, inter alia, the Protection of Personal Information Act 4 of 2013 (“POPIA”), the European Union General Data Protection Regulation (“GDPR”) (together referred to as “the Data Protection Laws”) and ensuring that your Personal Information is used appropriately, transparently, securely and in accordance with the Data Protection Laws.
1.3 This Data Privacy Policy (“this Policy”) explains how we protect and use your information, irrespective of whether you are a natural or juristic person, which can be used to identify you.
2. DEFINITIONS
2.1 “Associates” means IBC SOLAR South Africa’s shareholders and the directors, employees and consultants of IBC SOLAR South Africa;
2.2 “Consent” means any expression of intent in the form of a declaration or any other clear confirmatory action voluntarily submitted by the Data Subject in regard to the particular case in an informed way and unmistakably, with which the Data Subject makes it understood that the Data Subject is in agreement with the processing of the personal information relation to the Data Subject;
2.3 “Data Subject” means any identified or identifiable natural or juristic person whose Personal Information is processed by the Responsible Party;
2.4 “Operator” means a natural or juristic person, authority, institution or other body which processes personal information on behalf of the Responsible Party;
2.5 “Personal information” means information of a natural or juristic person which can be used to identify that person;
2.6 “Processing” means any procedure carried out with or without the aid of automated methods, or any such sequence of procedures in connection with Personal Information, such as the gathering, recording, organising, ordering, storage, adaptation or amendment of data, the reading out of it, querying of it, use, disclosure of it by way of transmission, dissemination or any other form of provision, the comparison or linking of it, or the limitation, deletion or destruction of it;
2.7 “Profiling” means any kind of automated processing of Personal Information where such Personal Information is used to assess certain personal aspects relating to a natural or juristic person, in particular in order to analyse or predict aspects in regard to work or business performance or activities, economic position, health, personal preferences, interests, reliability, conduct, place of residence or change of location of such natural or juristic person;
2.8 “Pseudonymisation” means processing Personal Information in the case where the Personal Information can no longer be assigned to a specific Data Subject without drawing upon additional information. Such additional information that is subject to the technical and organisational measures is stored separately, and it is thus guaranteed that the Personal Information cannot be allocated to an identified or identifiable natural or juristic person;
2.9 “Recipient” means a natural or juristic person, authority, institution or other body to whom or which Personal Information is disclosed, irrespective of whether the latter is a Third Party or not;
2.10 “Responsible Party” is the natural or juristic person, authority, institution or other body which decides, either alone or together with others, for the purpose and means of processing Personal Information;
2.11 “Services” means wholesale, distribution, design and installation of Solar Photovoltaic Systems, storage and components;
2.12 “Third Party” means a natural or juristic person, authority, institution or other body other than the Data Subject, the Responsible Party, the Operator and the persons who are authorised, under the direct responsibility of the Responsible Party or the Operator, to process Personal Information.
3. NAME AND ADDRESS OF RESPONSIBLE PARTY
IBC SOLAR SOUTH AFRICA (PTY) LTD
Suite 603, The Point,
76 Regent Rd, Sea Point
8060 Cape Town
www.ibc-solar.co.za
4. CONTACT DETAILS OF OUR INFORMATION OFFICER
4.1 Information Officer in accordance with POPIA
Fredrik Hagelberg
Suite 603, The Point,
76 Regent Rd, Sea Point
8060 Cape Town
South Africa
Tel: +27 (0)87 470 0765
Fredrik.Hagelberg@ibc-solar.co.za
5. COLLECTION AND USE OF PERSONAL INFORMATION
5.1 Source of Personal Information
5.1.1 We may collect or obtain Personal Information about you –
5.1.1.1 directly from you;
5.1.1.2 in the course of our relationship with you;
5.1.1.3 in the course of providing Services to you or your organisation;
5.1.1.4 when you make your Personal Information public;
5.1.1.5 when you visit and/or interact with our Website or our social media platforms; or;
5.1.1.6 when you visit our offices.
5.1.2 Personal Information from other sources will be collected where it is publicly and/or commercially available.
5.2 Categories of Personal Information
5.2.1 We collect and process Personal Information only for purposes relating to the rendering of our Services to you. We may, where permitted or required to do so by applicable law, process your Personal Information without your knowledge or permission if sufficient grounds of justification are present, and we will do so in accordance with the further provisions of this Policy.
5.2.2 The categories of Personal Information we collect and process include:
5.2.2.1 personal and demographic details (e.g. name, ID number, gender, photograph, nationality, etc.);
5.2.2.2 contact details (e.g. telephone number, email address, physical address, etc.);
5.3.2.3 employment details (e.g. name of employer, job title, etc.) to the extent relevant;
5.2.2.4 financial information (e.g. financial statements, details of income and remuneration, payment details such as billing address, payment method, invoice records, etc.).
5.2.3 We also collect and process Special Personal Information, particularly information relating to race, health, criminal behaviour and biometric information. This information is collected and processed solely to enable us to render our Services to you in circumstances where the use of such information is necessary and in accordance with the Data Protection Laws.
5.3 Purpose and Legal Bases for Processing
5.3.1 We will process your Personal Information in the ordinary course of the business of providing our Services. We will primarily use your Personal Information only for the purpose for which it was originally collected. We will use your Personal Information for a secondary purpose only if such purpose constitutes a legitimate interest and is closely related to the original purpose for which the Personal Information was collected.
5.3.2 We may use your Personal Information for, amongst others –
5.4.2.1 rendering our Services to you;
5.3.2.2 complying with our obligations in terms of our mandates with you and other contractual relationships;
5.3.2.3 complying with our legal obligations and Data Protection Laws;
5.3.2.4 developing and improving our businesses, services and offerings;
5.3.2.5 recruitment;
5.3.2.6 statistical purposes;
5.3.2.7 relationship management and marketing purposes in relation to our Services, account management and for marketing activities in order to establish, maintain and/or improve our relationship with you and with our Service Providers;
5.3.2.8 internal management and management reporting purposes; and
5.3.2.9 safety and security purposes.
6. WEBSITE SPECIFIC COLLECTION AND USE OF PERSONAL INFORMATION
6.1 Use of Website
By visiting our website, our web server collects a series of general data and information. This general data and information is stored in the log files of the server. We may record the types and versions of browsers used, the operating system used by the accessing system, the website from which an accessing system accesses our website, the sub-websites accessed via an accessing system on our website, the date and time of access to the website, an internet protocol address (IP address), the Internet service provider of the accessing system and other similar data and information which serve to avert danger in the event of attacks on our IT systems. When using this general data and information, we does not draw any conclusions about the Data Subject. Rather, this information is needed to correctly deliver the contents of our website, to optimize the contents of our website as well as the advertising for them, to ensure the permanent functionality of our information technology systems and the technology of our website and to provide law enforcement authorities with the information necessary for criminal prosecution in the event of a cyber-attack. This anonymously collected data and information is therefore evaluated by us both statistically and with the aim of increasing data protection and data security in our company ultimately in order to ensure an optimum level of protection for the Personal Information processed by us. The anonymous data of the server log files are stored separately from all personal information provided by the Data Subject.
6.2 The option to make contact via the website
Our company’s website contains details which make it possible to make fast contact with our company electronically, as well as enable direct communication with us, which likewise comprises a general e-mail address. Should you take up contact with us via a contact form, the Personal Information transmitted will automatically be saved. Such Personal Information transmitted to the Responsible Party by a Data Subject on a voluntary basis is saved for the purposes of processing the request or taking up contact with the Data Subject. Such Personal Information is not passed on to Third Parties.
6.3 IBC SOLAR Power Calculator
The solar power calculator offered on the our website is a planning tool that can be used to calculate how much environmentally friendly solar power a PV system can generate. In addition, self-consumption with or without storage is calculated. The user needs to enter data regarding the location, condition of the roof (orientation, size, roof pitch etc.). The user can then also voluntarily enter contact data (first name, surname, e-mail address and telephone number) so that we can forward this data to a specialist partner who will then contact the user of the solar power calculator. This could be via telephone or e-mail with the user's consent. The data entered will not be stored by us, but will be forwarded to a specialist trade partner for the described purpose.
7. DISCLOSURE OF PERSONAL INFORMATION TO THIRD PARTIES
7.1 We rely on third-party service providers to perform a variety of services on our behalf. This means that we may have to share Personal Information with these Third Parties.
7.2 We may disclose your Personal Information to our Associates and Operators and Third Parties, for legitimate business purposes, in accordance with the Data Protection Laws and subject to applicable professional and regulatory requirements regarding confidentiality.
7.3 In addition, we may disclose your Personal Information –
7.3.1 if required by law;
7.3.2 to legal and regulatory authorities, upon request, or for the purposes of reporting any actual or suspected breach of applicable law or regulation;
7.3.3 to Operators (including, but not limited to, data processors), located anywhere in the world, subject to paragraph 7.4 below;
7.3.4 where it is necessary for the purposes of, or in connection with, actual or threatened legal proceedings or establishment, exercise or defence of legal rights;
7.3.5 to any relevant party for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including, but not limited to, safeguarding against, and the prevention of threats to, public security; and
7.3.6 to any relevant third party acquirer(s), in the event that we sell or transfer all or any portion of our business or assets (including, but not limited to, in the event of a reorganization, dissolution or liquidation).
7.4 If we engage an Operator to process any of your Personal Information, we recognise that any Operator who is in a foreign country must be subject to a law, binding corporate rules or binding agreements which provide an adequate level of protection similar to the Data Protection Laws. We will review our relationships with Operators we engage and, to the extent required by any applicable law in force, we will require such operators to be bound by contractual obligations to –
7.4.1 only process such Personal Information in accordance with our prior written instructions; and
7.4.2 use appropriate measures to protect the confidentiality and security of such Personal Information.
8. INTERNATIONAL TRANSFER OF PERSONAL INFORMATION
8.1 We may transfer your Personal Information to Recipients outside of the Republic of South Africa.
8.2 Subject to paragraph 7.4 above, Personal Information may be transferred outside of the Republic of South Africa provided that the country to which the data is transferred has adopted a law that provides for an adequate level of protection substantially similar to the Data Protection Laws, the Operator/Third Party undertakes to protect the Personal Information in line with the Data Protection Laws and the transfer is necessary in order to provide the Services that are required by IBC SOLAR South Africa’s clients.
9. SECURITY OF PERSONAL INFORMATION
9.1 We are obliged to provide adequate protection for the Personal Information in our possession. We implement appropriate technical and organisational security measures to protect your Personal Information that is in our possession against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, unauthorised access, in accordance with the Data Protection Laws.
9.2 In dealings with Third Parties and Recipients, we impose appropriate security, privacy and confidentiality obligations on them to ensure that the Personal Information disclosed to them is kept secure. We will ensure that anyone to whom we pass Personal Information on agrees to treat such Personal Information with the same level of protection as we are obliged to.
9.3 We will, on an on-going basis, review our security controls and related processes to ensure your Personal Information remains secure.
9.4 Where there are reasonable grounds to believe that your Personal Information that is in our possession has been accessed or acquired by any unauthorised person, we will notify the relevant regulator and you, unl