Data Privacy Statement
1. INTRODUCTION, PURPOSE AND APPLICATION
1.1 IBC SOLAR South Africa (Pty) Ltd (“IBC SOLAR South Africa, we, us, our”) respect your privacy and take the protection of personal information very seriously.
1.2 We are committed to protecting the privacy of all parties with whom we interact, including but not limited to, our employees, clients, visitors and service providers (“you”) in accordance with, inter alia, the Protection of Personal Information Act 4 of 2013 (“POPIA”), the European Union General Data Protection Regulation (“GDPR”) (together referred to as “the Data Protection Laws”) and ensuring that your Personal Information is used appropriately, transparently, securely and in accordance with the Data Protection Laws.
2.1 “Associates” means IBC SOLAR South Africa’s shareholders and the directors, employees and consultants of IBC SOLAR South Africa;
2.2 “Consent” means any expression of intent in the form of a declaration or any other clear confirmatory action voluntarily submitted by the Data Subject in regard to the particular case in an informed way and unmistakably, with which the Data Subject makes it understood that the Data Subject is in agreement with the processing of the personal information relation to the Data Subject;
2.3 “Data Subject” means any identified or identifiable natural or juristic person whose Personal Information is processed by the Responsible Party;
2.4 “Operator” means a natural or juristic person, authority, institution or other body which processes personal information on behalf of the Responsible Party;
2.5 “Personal information” means information of a natural or juristic person which can be used to identify that person;
2.6 “Processing” means any procedure carried out with or without the aid of automated methods, or any such sequence of procedures in connection with Personal Information, such as the gathering, recording, organising, ordering, storage, adaptation or amendment of data, the reading out of it, querying of it, use, disclosure of it by way of transmission, dissemination or any other form of provision, the comparison or linking of it, or the limitation, deletion or destruction of it;
2.7 “Profiling” means any kind of automated processing of Personal Information where such Personal Information is used to assess certain personal aspects relating to a natural or juristic person, in particular in order to analyse or predict aspects in regard to work or business performance or activities, economic position, health, personal preferences, interests, reliability, conduct, place of residence or change of location of such natural or juristic person;
2.8 “Pseudonymisation” means processing Personal Information in the case where the Personal Information can no longer be assigned to a specific Data Subject without drawing upon additional information. Such additional information that is subject to the technical and organisational measures is stored separately, and it is thus guaranteed that the Personal Information cannot be allocated to an identified or identifiable natural or juristic person;
2.9 “Recipient” means a natural or juristic person, authority, institution or other body to whom or which Personal Information is disclosed, irrespective of whether the latter is a Third Party or not;
2.10 “Responsible Party” is the natural or juristic person, authority, institution or other body which decides, either alone or together with others, for the purpose and means of processing Personal Information;
2.11 “Services” means wholesale, distribution, design and installation of Solar Photovoltaic Systems, storage and components;
2.12 “Third Party” means a natural or juristic person, authority, institution or other body other than the Data Subject, the Responsible Party, the Operator and the persons who are authorised, under the direct responsibility of the Responsible Party or the Operator, to process Personal Information.
3. NAME AND ADDRESS OF RESPONSIBLE PARTY
IBC SOLAR SOUTH AFRICA (PTY) LTD
Suite 408, The Point,
76 Regent Rd, Sea Point
8060 Cape Town
4. CONTACT DETAILS OF OUR INFORMATION OFFICER
4.1 Information Officer in accordance with POPIA
Suite 408, The Point,
76 Regent Rd, Sea Point
8060 Cape Town
Tel: +27 (0)87 470 0765
4.2 You may contact our Information Officer directly with any questions or suggestions on data privacy.
5. COLLECTION AND USE OF PERSONAL INFORMATION
5.1 Source of Personal Information
5.1.1 We may collect or obtain Personal Information about you –
22.214.171.124 directly from you;
126.96.36.199 in the course of our relationship with you;
188.8.131.52 in the course of providing Services to you or your organisation;
184.108.40.206 when you make your Personal Information public;
220.127.116.11 when you visit and/or interact with our Website or our social media platforms; or;
18.104.22.168 when you visit our offices.
5.1.2 Personal Information from other sources will be collected where it is publicly and/or commercially available.
5.2 Categories of Personal Information
5.2.1 We collect and process Personal Information only for purposes relating to the rendering of our Services to you. We may, where permitted or required to do so by applicable law, process your Personal Information without your knowledge or permission if sufficient grounds of justification are present, and we will do so in accordance with the further provisions of this Policy.
5.2.2 The categories of Personal Information we collect and process include:
22.214.171.124 personal and demographic details (e.g. name, ID number, gender, photograph, nationality, etc.);
126.96.36.199 contact details (e.g. telephone number, email address, physical address, etc.);
188.8.131.52 employment details (e.g. name of employer, job title, etc.) to the extent relevant;
184.108.40.206 financial information (e.g. financial statements, details of income and remuneration, payment details such as billing address, payment method, invoice records, etc.).
5.2.3 We also collect and process Special Personal Information, particularly information relating to race, health, criminal behaviour and biometric information. This information is collected and processed solely to enable us to render our Services to you in circumstances where the use of such information is necessary and in accordance with the Data Protection Laws.
5.3 Purpose and Legal Bases for Processing
5.3.1 We will process your Personal Information in the ordinary course of the business of providing our Services. We will primarily use your Personal Information only for the purpose for which it was originally collected. We will use your Personal Information for a secondary purpose only if such purpose constitutes a legitimate interest and is closely related to the original purpose for which the Personal Information was collected.
5.3.2 We may use your Personal Information for, amongst others –
220.127.116.11 rendering our Services to you;
18.104.22.168 complying with our obligations in terms of our mandates with you and other contractual relationships;
22.214.171.124 complying with our legal obligations and Data Protection Laws;
126.96.36.199 developing and improving our businesses, services and offerings;
188.8.131.52 statistical purposes;
184.108.40.206 relationship management and marketing purposes in relation to our Services, account management and for marketing activities in order to establish, maintain and/or improve our relationship with you and with our Service Providers;
220.127.116.11 internal management and management reporting purposes; and
18.104.22.168 safety and security purposes.
6. WEBSITE SPECIFIC COLLECTION AND USE OF PERSONAL INFORMATION
6.1 Use of Website
By visiting our website, our web server collects a series of general data and information. This general data and information is stored in the log files of the server. We may record the types and versions of browsers used, the operating system used by the accessing system, the website from which an accessing system accesses our website, the sub-websites accessed via an accessing system on our website, the date and time of access to the website, an internet protocol address (IP address), the Internet service provider of the accessing system and other similar data and information which serve to avert danger in the event of attacks on our IT systems. When using this general data and information, we does not draw any conclusions about the Data Subject. Rather, this information is needed to correctly deliver the contents of our website, to optimize the contents of our website as well as the advertising for them, to ensure the permanent functionality of our information technology systems and the technology of our website and to provide law enforcement authorities with the information necessary for criminal prosecution in the event of a cyber-attack. This anonymously collected data and information is therefore evaluated by us both statistically and with the aim of increasing data protection and data security in our company ultimately in order to ensure an optimum level of protection for the Personal Information processed by us. The anonymous data of the server log files are stored separately from all personal information provided by the Data Subject.
6.2 The option to make contact via the website
Our company’s website contains details which make it possible to make fast contact with our company electronically, as well as enable direct communication with us, which likewise comprises a general e-mail address. Should you take up contact with us via a contact form, the Personal Information transmitted will automatically be saved. Such Personal Information transmitted to the Responsible Party by a Data Subject on a voluntary basis is saved for the purposes of processing the request or taking up contact with the Data Subject. Such Personal Information is not passed on to Third Parties.
6.3 IBC SOLAR Power Calculator
The solar power calculator offered on the our website is a planning tool that can be used to calculate how much environmentally friendly solar power a PV system can generate. In addition, self-consumption with or without storage is calculated. The user needs to enter data regarding the location, condition of the roof (orientation, size, roof pitch etc.). The user can then also voluntarily enter contact data (first name, surname, e-mail address and telephone number) so that we can forward this data to a specialist partner who will then contact the user of the solar power calculator. This could be via telephone or e-mail with the user's consent. The data entered will not be stored by us, but will be forwarded to a specialist trade partner for the described purpose.
7. DISCLOSURE OF PERSONAL INFORMATION TO THIRD PARTIES
7.1 We rely on third-party service providers to perform a variety of services on our behalf. This means that we may have to share Personal Information with these Third Parties.
7.2 We may disclose your Personal Information to our Associates and Operators and Third Parties, for legitimate business purposes, in accordance with the Data Protection Laws and subject to applicable professional and regulatory requirements regarding confidentiality.
7.3 In addition, we may disclose your Personal Information –
7.3.1 if required by law;
7.3.2 to legal and regulatory authorities, upon request, or for the purposes of reporting any actual or suspected breach of applicable law or regulation;
7.3.3 to Operators (including, but not limited to, data processors), located anywhere in the world, subject to paragraph 7.4 below;
7.3.4 where it is necessary for the purposes of, or in connection with, actual or threatened legal proceedings or establishment, exercise or defence of legal rights;
7.3.5 to any relevant party for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including, but not limited to, safeguarding against, and the prevention of threats to, public security; and
7.3.6 to any relevant third party acquirer(s), in the event that we sell or transfer all or any portion of our business or assets (including, but not limited to, in the event of a reorganization, dissolution or liquidation).
7.4 If we engage an Operator to process any of your Personal Information, we recognise that any Operator who is in a foreign country must be subject to a law, binding corporate rules or binding agreements which provide an adequate level of protection similar to the Data Protection Laws. We will review our relationships with Operators we engage and, to the extent required by any applicable law in force, we will require such operators to be bound by contractual obligations to –
7.4.1 only process such Personal Information in accordance with our prior written instructions; and
7.4.2 use appropriate measures to protect the confidentiality and security of such Personal Information.
8. INTERNATIONAL TRANSFER OF PERSONAL INFORMATION
8.1 We may transfer your Personal Information to Recipients outside of the Republic of South Africa.
8.2 Subject to paragraph 7.4 above, Personal Information may be transferred outside of the Republic of South Africa provided that the country to which the data is transferred has adopted a law that provides for an adequate level of protection substantially similar to the Data Protection Laws, the Operator/Third Party undertakes to protect the Personal Information in line with the Data Protection Laws and the transfer is necessary in order to provide the Services that are required by IBC SOLAR South Africa’s clients.
9. SECURITY OF PERSONAL INFORMATION
9.1 We are obliged to provide adequate protection for the Personal Information in our possession. We implement appropriate technical and organisational security measures to protect your Personal Information that is in our possession against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, unauthorised access, in accordance with the Data Protection Laws.
9.2 In dealings with Third Parties and Recipients, we impose appropriate security, privacy and confidentiality obligations on them to ensure that the Personal Information disclosed to them is kept secure. We will ensure that anyone to whom we pass Personal Information on agrees to treat such Personal Information with the same level of protection as we are obliged to.
9.3 We will, on an on-going basis, review our security controls and related processes to ensure your Personal Information remains secure.
9.4 Where there are reasonable grounds to believe that your Personal Information that is in our possession has been accessed or acquired by any unauthorised person, we will notify the relevant regulator and you, unless a public body responsible for detection, prevention or investigation of offences or the relevant regulator informs us that notifying you will impede a criminal investigation.
9.5 Because the internet is an open system, the transmission of information via the internet is not completely secure. Although we will implement all reasonable measures to protect your Personal Information that is in our possession, we cannot guarantee the security of any information transmitted using the internet and we cannot be held liable for any loss of privacy occurring during the course of such transmission.
10. DATA ACCURACY
The Personal Information provided to us should be accurate, complete and up-to-date. Should Personal Information change, the onus is on the provider of such data to notify us of the change and provide us with the accurate data.
11. DATA MINIMISATION
We will restrict our processing of Personal Information to data which is sufficient for the fulfilment of the primary purpose and applicable legitimate purpose for which it was collected.
12. DATA RETENTION
We shall only retain and store Personal Information for the period for which the data is required to serve its primary purpose or a legitimate interest or for the period required to comply with an applicable legal requirement, whichever is longer.
13. YOUR RIGHTS
Should you wish to exercise any of your rights below, please contact our or Information Officer in South Africa or Data Privacy Officer in Germany at any time.
13.1 The right to access your personal information
You have the right to establish what Personal Information we have related to you, including the right to request access to that Personal Information.
13.2 The right to have your Personal Information corrected or deleted
You have the right to request, where necessary, that your Personal Information must be corrected or deleted where we are no longer authorised to retain your Personal Information. Please refer to Form 2 annexed hereto which is to be used for all such requests in South Africa.
13.3 The right to object and withdrawal of consent to the processing of your Personal Information
You have the right, on reasonable grounds, to object to us processing your Personal Information and to withdraw your consent for the processing of your Personal Information. In South Africa, please refer to Form 1 annexed hereto which is to be used for all such objections.
13.4 The right to object to direct marketing
You have the right to object to us processing your personal information for purposes of direct marketing by means of unsolicited electronic communications.
13.5 The right to complain to the Information Regulator
In South Africa, you have the right to submit complaints to the Information Regulator regarding an alleged infringement of any of your rights protected under POPIA.
13.6 The right to be informed
You have the right to be notified that your Personal Information is being collected. You also have the right to be notified in any situation where we have reasonable grounds to believe that your Personal Information has been accessed or acquired by an unauthorised person.
13.7 The right to data portability
You are entitled to receive your Personal Information, which has been provided to us, in a structured, up-to-date and machine-readable format. You also have the right to transmit such data to a different Responsible Party, without being hindered by us. When exercising the right to data portability, you are entitled to cause the Personal Information to be transmitted directly from one Responsible Party to another Responsible Party, if the latter is technically feasible, and as long as the rights and freedoms of other persons are not thereby impaired. In order to assert the right to data portability, the Date Subject may contact the Data Privacy Officer appointed by us at any time.
13.8 Right to file an opposition
Any person affected by the processing of Personal Information has the right, for reasons which arise from his or her particular situation, to file an opposition against the processing of Personal Information concerning the Data Subject, at any time. In the event of an opposition, our company no longer processes the Personal Information, unless we can provide evidence of mandatory grounds for the processing, worthy of protection, which outweigh the interests, rights and freedoms of the Data Subject, or the processing serves the purpose of asserting, exercising or defending legal claims.
13.9 Automated decisions in the individual case, including profiling
You have the right not to be subjected to a decision based exclusively on automated processing - including Profiling - which develops legal validity with regards to you or affects you considerably in a similar way, as long as the decision is not required for concluding or fulfilling an agreement between us and yourself, or justified by the Data Protection Laws. Should the decision regarding the conclusion or fulfilment of an agreement between us be required, or should it be taken with the express consent of the Data Subject, our company will take appropriate steps to preserve your rights and freedoms of the Data Subject, as well as your justified interests, which at least includes the right to arrange for the intervention of a person on the part of the Responsible Party, the right to explain one’s own position and the right to contest the decision.
14. DIRECT MARKETING
14.1 We may process your Personal Information for the purposes of providing you with information regarding services that may be of interest to you. You may unsubscribe for free at any time.
14.2 If you currently receive marketing information from us which you would prefer not to receive in the future please email us at info(_at_)ibc-solar.co.za.
15. DATA PRIVACY IN THE CASE OF JOB APPLICATIONS AND THE APPLICATION PROCESS
We processes Personal Information of job applicants for the purpose of executing the application procedure. The processing may also be carried out electronically. This is in particular the case if an job applicant transmits corresponding application documents to our company electronically, for example by e-mail or via a web form to be found on the website. Should our company conclude an employment contract with an applicant, the data transmitted will be saved for the purpose of handling the employment relationship, adhering to the statutory regulations. Should no employment contract with the applicant be concluded by our company, the application documents will automatically be deleted 6 (six) months after announcing the decision to turn down the application, unless such deletion is in conflict with any justified interests we may have for the processing. A justified interest, in this sense, may, for example, be an obligation to provide evidence in any proceedings under applicable legislation.
16.4 The Data Subject can at any time prevent cookies from being placed by our website by adjusting the setting of the web browser used accordingly, and thus permanently oppose the placing of cookies. Furthermore, any cookies already placed can be deleted via a web browser or other software program at any time. This is possible in all common web browsers. Should the Data Subject disable the placing of cookies in the web browser used, it will be the case that, under certain circumstances, not all functions of our website can be used in full.
17.1 We have integrated the Google Analytics component (with anonymisation function) on our website. Google Analytics is a web analytics service. Web analysis is the collection, collection and evaluation of data on the behaviour of visitors to web pages. A web analysis service collects, among other things, data on which web page a Data Subject came to a web page from (so-called referrer), which subpages of the web page were accessed or how often and for how long a subpage was viewed. A web analysis is mainly used to optimize a web site and for cost-benefit analysis of Internet advertising..
17.2 The Google Analytics component is operated by Google Inc, 1600 Amphitheatre Pkwy, Mountain View, CA 94043-1351, USA.
17.3 We use the suffix "_gat._anonymizeIp" for the web analysis via Google Analytics. By means of this addition, Google shortens and anonymizes the IP address of the Internet connection of the Data Subject when accessing our web pages from a member state of the European Union or from another contracting state of the Agreement on the European Economic Area.
17.4 The purpose of the Google Analytics component is to analyse the flow of visitors to our website. Google uses the data and information collected to evaluate the use of our website, among other things, to compile online reports for us that show the activities on our website and to provide other services in connection with the use of our website.
17.5 Google Analytics places a cookie on the information technology system of the Data Subject. What cookies are has already been explained above. By setting the cookie, Google is enabled to analyse the use of our website. Every time one of the individual pages of this website is called up, which is operated by the data controller and on which a Google Analytics component has been integrated, the Internet browser on the information technology system of the Data Subject is automatically prompted by the respective Google Analytics component to transmit data to Google for the purpose of online analysis. As part of this technical process, Google obtains knowledge of Personal Information, such as the IP address of the Data Subject, which serves Google, among other things, to trace the origin of visitors and clicks and subsequently enable commission statements.
17.6 Cookies are used to store personal information, such as access time, the location from which access came and the frequency of visits to our website by the Data Subject. Whenever you visit our website, this Personal Information, including the IP address of the Internet connection used by the Data Subject, is transmitted to Google in the USA. This Personal Information is stored by Google in the USA. Google may disclose Personal Information collected through the technical process to Third Parties.
17.7 The Data Subject can prevent the setting of cookies by our website at any time, as already described above, by means of an appropriate setting of the Internet browser used and thus permanently object to the setting of cookies. Such a setting of the Internet browser used would also prevent Google from placing a cookie on the information technology system of the Data Subject. In addition, a cookie already set by Google Analytics can be deleted at any time via the Internet browser or other software programs.
17.10 We use Webtrends Analytics, a web analytics service provided by Webtrends EMEA Acquisition ltd. / Webtrends Inc., 851 SW 6th Ave., Suite 1600, Portland, Oregon, 97206. Webtrends Analytics uses so-called "cookies", text files located on your computer which allows the analysis of use of the website by yourself. The information generated by the cookie regarding your use of this website is then transferred to our servers and stored there.
17.11 We use this information to evaluate your use of our website in order to compile reports on various website activities. The access data is collected anonymously so that you are not able to become personally identifiable. This is done in particular by the anonymisation of the IP address.
17.12 You can prevent the installation of cookies by setting your browser software accordingly; We would point out, however, that in this case you may not be able to fully utilize all the functions of this website. Data collection and storage can be cancelled at any time to prevent it from occurring in the future via the following opt-out link: ondemand.webtrends.com/support/optout.asp.
17.13 We have integrated components of YouTube on this website. YouTube is an internet video portal that allows video publishers to post video clips and other users to view, rate and comment on them free of charge. YouTube allows the publication of all types of videos, which is why complete film and television programmes, music videos, trailers or videos produced by users themselves can be called up via the Internet portal.
17.14 YouTube is operated by YouTube, LLC, 901 Cherry Ave, San Bruno, CA 94066, USA. YouTube, LLC is a subsidiary of Google Inc, 1600 Amphitheatre Pkwy, Mountain View, CA 94043-1351, USA.
17.15 Each time a YouTube component (YouTube video) is integrated into one of the individual pages of this website operated by our company, the Internet browser on the person's information technology system is automatically prompted by the respective YouTube component to download the corresponding YouTube component from YouTube. More information about YouTube can be found at https://www.youtube.com/intl/en/yt/about/. In the course of this technical procedure, YouTube and Google are informed which specific subpage of our website is visited by the Data Subject.
17.16 If the Data Subject is simultaneously logged in to YouTube, YouTube recognizes which specific subpage of our website the Data Subject is visiting by calling up a subpage containing a YouTube video. This information is collected by YouTube and Google and assigned to the respective YouTube account of the Data Subject.
17.17 YouTube and Google receive information via the YouTube component that the Data Subject has visited our website whenever the Data Subject is logged on to YouTube at the same time as accessing our website; this happens regardless of whether the clicks on a YouTube video or not. If such a transmission of this information to YouTube and Google is not desired by the Data Subject, he can prevent the transmission by logging out of his YouTube account before accessing our website.
17.18 The data protection regulations published by YouTube, which can be accessed at https://policies.google.com/privacy?hl=en, provides information about the collection, processing and use of Personal Information by YouTube and Google.
17.19 We have integrated Twitter components on our website. Twitter is a multilingual public microblogging service on which users can publish and distribute so-called tweets, i.e. short messages limited to 140 characters. These short messages are available to everyone, including people who are not registered on Twitter. The tweets are also displayed to the so-called followers of the respective user. Followers are other Twitter users who follow a user's tweets. Furthermore, Twitter makes it possible to address a broad audience via hashtags, links or retweets.
17.20 Twitter is operated by Twitter, Inc, 1355 Market Street, Suite 900, San Francisco, CA 94103, USA.
17.21 Each time an individual page of this website is called up, which has been published by our company and on which a Twitter component (Twitter button) has been integrated, the Internet browser on the person's information technology system is automatically prompted by the respective Twitter component to download the corresponding Twitter component from Twitter. More information about the Twitter buttons can be found at about.twitter.com/en/resources/buttons. As part of this technical process, Twitter is informed about which specific subpage of our website is visited by the Data Subject. The purpose of integrating the Twitter component is to enable our users to disseminate the content of this website, to make this website known in the digital world and to increase our visitor numbers.
17.22 If the Data Subject is logged in to Twitter at the same time, Twitter recognizes which specific subpage of our website the Data Subject visits with every visit to our website and for the entire duration of the respective stay on our website. This information is collected by the Twitter component and assigned to the respective Twitter account of the Data Subject by Twitter. If the Data Subject presses one of the Twitter buttons integrated on our website, the data and information thus transmitted will be assigned to the personal Twitter user account of the Data Subject and stored and processed by Twitter.
17.23 Twitter receives information via the Twitter component that the Data Subject has visited our website whenever the Data Subject is logged on to Twitter at the same time as accessing our website; this happens regardless of whether the Data Subject clicks on the Twitter component or not. If such a transmission of this information to Twitter is not desired by the Data Subject, he can prevent the transmission by logging out of his Twitter account before accessing our website.
18. AMENDMENTS TO THIS POLICY
We reserve the right to alter our security and data privacy provisions, should it be necessary due to technological developments. We will, in such cases, also adapt this Policy accordingly.
Cape Town, Revised: 30 July 2021