I'Bupi Super White Maize
I’BUPI SUPER WHITE MAIZE PRIVACY POLICY AND NOTICE
I’Bupi Super White Maize is a data controller and operator in terms of the Protection of Personal Information Act 4 of 2013 (POPIA) and has developed this privacy policy / notice in order to comply with the requirements of POPIA.
1. DEFINITIONS
1.1. “Data Breach” means a breach of security leading to the accidental or unlawful
destruction, loss, alteration, unauthorised disclosure of, or access to, Personal
Information under the control of or in the possession of I’Bupi Super White Maize;
1.2. “Data Controller” means a person or entity who Processes Personal Information for a
Responsible Party in terms of a contract or mandate, without coming under the direct
authority of that Responsible Party.
1.3. “Data Subject” means the person to whom Personal Information relates;
1.4. “Direct Marketing” means to approach a person, by electronic communication, for the
purpose of promoting or offering to supply, in the ordinary course of business, any
goods or services to the Data Subject;
1.5. “Direct Marketer” means a supplier who employs Direct Marketing as an advertising
mechanism;
1.6. “Employees” means any employee of I’Bupi Super White Maize;
1.7. “GDPR” means Regulation (EU) 2016/679 of the European Parliament on the
protection of natural persons with regard to the processing of personal data and free
movement of such data (General Data Protection Regulation);
1.8. “I’Bupi Super White Maize” means I’Bupi Super White Maize, a sole proprietor
who renders Maize Milling services, and includes the terms “we”, “us”, and “our”;
1.9. “Minor child” means any natural person under the age of 18 (eighteen) years (if the
child is in South Africa) and any natural person under the age of 16 (sixteen) years (if
the child is in Europe);
1.10. “Operator” means a person or entity who Processes Personal Information for a
Responsible Party in terms of a contract or mandate, without coming under the direct
authority of that Responsible Party;
1.11. “Personal Information” means information relating to a Data Subject including but not
limited to (i) views or opinions of another individual about the Data Subject; and (ii)
information relating to such Data Subject’s –
· Race, sex, gender, sexual orientation, pregnancy, marital status, nationality, ethnic or social origin, colour, age,
physical or mental health, well-being, disability, religion, conscience, belief, cultural affiliation, language and birth;
· Education, medical, financial, criminal or employment history;
· Names, identity number and/or any other personal identifier, including any number(s), which may uniquely identify a Data Subject, account or client number, password, pin code, customer or Data Subject code or number, numeric, alpha, or alpha-numeric design or configuration of any nature, symbol, email address, domain name or IP address, physical address, cellular phone number, telephone number or other particular assignment;
· blood type, fingerprint or any other biometric information;
· personal opinions, views or preferences;
· correspondence that is implicitly or expressly of a personal, private or confidential nature (or further correspondence that would reveal the contents of the original correspondence); and
· corporate structure, composition and business operations (in circumstances where the Data Subject is a juristic person) irrespective of whether such information is in the public domain or not;
1.12 “Policy” means this Policy;
1.13 “POPIA” means the Protection of Personal Information Act 4 of 2013;
1.14 “Processing” and/or “Process” means any operation or activity or any set of operations,
whether or not by automatic means, concerning Personal Information, including –
1.14.1 the collection, receipt, recording, organisation, collation, storage, updating or
modification, retrieval, alteration, consultation or use;
1.14.2 dissemination by means of transmission,distribution or making available in
any other form by electronic communications or other means; or
1.14.3 merging, linking, blocking, degradation, erasure or destruction.
1.15 “Regulator” means the South African Information Regulator established in terms of
POPIA; or the relevant supervisory authority under the GDPR;
1.16 “Responsible Party” means a public or private body or any other person which alone or
in conjunction with others, determines the purpose of and means for Processing
Personal Information;
1.17 “Special Personal Information” means Personal Information concerning a Data
Subject’s religious or philosophical beliefs, race or ethnic origin, trade union
membership, political opinions, health, sexual life, sexual orientation, genetic
information, biometric information or criminal behaviour;
1.18 “Third Party” means any independent contractor, agent, consultant, sub-contractor or
other representative of I’Bupi Super White Maize; and
1.19 “Website” means the I’Bupi Super White Maize website currently accessible at
2. PURPOSE OF THIS POLICY
The purpose of this Policy is to inform Data Subjects about how I’Bupi Super White Maize will processes their Personal Information.
3. APPLICATION OF THIS POLICY
3.1. I’Bupi Super White Maize, in its capacity as Data Controller and/or Responsible
Party and/or Operator, shall strive to observe and comply with its obligations under
POPIA, and where relevant, the GDPR, as well as accepted information protection
principles, practices and guidelines, when it Processes Personal Information from or in
respect of a Data Subject.
3.2. This Policy applies to Personal Information collected by I’Bupi Super White Maize
and includes information collected directly from you as a Data Subject, as well as
information we collect indirectly through our Direct Marketing campaigns and online
through our websites, branded pages on Third Party platforms and applications accessed
or used through such websites or Third Party platforms which are operated by or on
behalf of I’Bupi Super White Maize.
3.3. This Privacy Policy does not apply to the information practices of Third Party
companies who we may engage with in relation to our business operations (including,
without limitation, their websites, platforms and/or applications) which we do not own
or control; or individuals that I’Bupi Super White Maize does not manage or employ. These Third Party sites
may have their own privacy policies and terms and conditions and we encourage you to read them before using
them.
4. HOW PERSONAL INFORMATION IS COLLECTED
4.1. I’Bupi Super White Maize collects Personal Information directly from Data
Subjects, unless the Data Subject has made the Personal Information public or the
Personal Information is contained in or derived from a public record and/or in some cases, from Third Parties.
4.2. I’Bupi Super White Maize will always collect Personal Information in a fair, lawful and reasonable manner to
ensure that it protects the Data Subject’s privacy and will Process the Personal Information based on legitimate
grounds in a manner that does not adversely affect the Data Subject in question.
4.3. Where I’Bupi Super White Maize obtains Personal Information from Third Parties, I’Bupi Super White Maize will
ensure that it obtains the consent of the Data Subject to do so or will only Process the Personal Information
without the Data Subject’s consent where I’Bupi Super White Maize is permitted to do so in terms of clause
4.1 above.
4.4. An example of such Third Parties include:
(i) our clients when I’Bupi Super White Maize handles Personal Information on their behalf;
(ii) credit reference agencies;
(iii) other companies providing services to I’Bupi Super White Maize; and (iv) where I’Bupi Super White
Maize makes use of publicly available sources of information
5. LAWFUL PROCESSING OF PERSONAL INFORMATION
5.1. Where I’Bupi Super White Maize is the Responsible Party, it will only Process a Data Subject’s Personal
Information (other than for Special Personal Information) where –
5.1.1. consent of the Data Subject (or a competent person where the Data Subject is a Minor Child) is
obtained;
5.1.2. Processing is necessary to carry out the actions for conclusion of a contract to which a Data Subject is
party;
5.1.3. Processing complies with an obligation imposed by law on I’Bupi Super White Maize
5.1.4. Processing protects a legitimate interest of the Data Subject;
5.1.5. Processing is necessary for pursuing the legitimate interests of I’Bupi Super White Maize or of a third
party to whom the information is supplied;and/or
5.1.6. Processing is necessary for the performance of a task carried out in the public interest or in the
exercise of official authority vested in I’Bupi Super White Maize
5.2. I’Bupi Super White Maize will make the manner and reason for which the Personal Information will be
Processed clear to the Data Subject.
5.3. Where I’Bupi Super White Maize is relying on a Data Subject’s consent as the legal basis for Processing
Personal Information, the Data Subject may withdraw his/ her/its consent or may object to I’Bupi Super White
Maize Processing of the Personal Information at any time. However, this will not affect the lawfulness of any
Processing carried out prior to the withdrawal of consent.
5.4. If the consent is withdrawn or if there is otherwise a justified objection against the use or the Processing of such
Personal Information, I’Bupi Super White Maize will ensure that the Personal Information is no longer
Processed.
6. SPECIAL PERSONAL INFORMATION AND PERSONAL INFORMATION OF CHILDREN
6.1 I’Bupi Super White Maize acknowledges that it will generally not Process Special Personal Information unless
(i) processing is carried out in accordance with the Data Subject’s explicit consent; or
(ii) information has been deliberately made public by the Data Subject; or
(iii) processing is necessary for the establishment, exercise or defence of a right or legal claim or obligation in
law); or
(iv) processing is for historical, statistical or research purposes, subject to stipulated safeguards; or – for
purposes of POPIA –
6.1.1 specific authorisation has been obtained in terms of POPIA; and for purposes of the GDPR –
6.1.2 Processing is necessary for the purposes of carrying out the obligations and exercising specific rights
of I’Bupi Super White Maize or of the Data Subject in the field of employment and social security and
social protection law;
6.1.3 Processing is necessary to protect the vital interests of the data subject or of another natural person
where the Data Subject is physically or legally incapable of giving consent;
6.1.4 processing is necessary for the establishment, exercise or defence of legal claims or whenever courts
are acting in their judicial capacity;
6.1.5 Processing is necessary for reasons of substantial public interest;
6.1.6 Processing is necessary for the purposes of preventative or occupational medicine; or
6.1.7 Processing is necessary for reasons of public interest in the area of public health.
7. PURPOSE FOR PROCESSING PERSONAL INFORMATION
7.1 I’Bupi Super White Maize will only Process a Data Subject’s Personal Information for a specific, lawful and clear
purpose (or purposes) and will ensure that it makes the Data Subject aware of such purpose(s) as far as possible.
7.2 I’Bupi Super White Maize will generally use Personal Information for purposes required to operate and manage
its normal business operations and these purposes include one or more of the following non-exhaustive
purposes –
7.2.1 For the purposes of providing its services to the Data Subject from time to time;
7.2.2 Personal Information is processed as part of the “Know Your Customer”/“KYC” process as per the
requirements of the Financial Intelligence Centre Act 38 of 2001;
7.2.3 Personal Information is processed in order to conduct due diligence processes on I’Bupi Super White
Maize Clients;
7.2.4 Personal Information is processed in order to comply with obligations imposed on the I’Bupi Super
White Maize under the Based Black Economic Empowerment Act 53 of 2003 (BEE Act) read together
with the Department of Trade and Industry’s Codes of Good Practice on Broad Based Black Economic Empowerment published in terms of Government Gazette No.36928 on 11 October 2013 under
section 9(1) of the BEE Act, as amended or reissued from time to time; Personal Information is
processed for the purposes of performing general information technology related functions for all
business functions within I’Bupi Super White Maize;
7.2.5 Personal Information is processed in connection with internal audit purposes (i.e. ensuring that the
appropriate internal controls are in place in order to mitigate the relevant risks, as well as to carry out
any investigations where this is required);
7.2.6 Personal Information is processed for employment-related purposes such as administering payroll,
assessing credit and criminal history and determining Employment Equity Act 55 of 1998 statistics;
7.2.7 To respond to any correspondence that the Data Subject may send to I’Bupi Super White Maize,
including via email, I’Bupi Super White Maize site(s) or by telephone;
7.2.8 In connection with the execution of payment processing functions, including payment of I’Bupi Super
White Maize suppliers’ invoices;
7.2.9 To contact the Data Subject for direct marketing purposes subject to the provisions of clause 10 below;
7.2.10 For such other purposes to which the Data Subject may consent from time to time; and
7.2.11 For such other purposes as authorised in terms of applicable law.
8. ACCURACY OF PERSONAL INFORMATION
8.1 I’Bupi Super White Maize will take reasonable steps to ensure that all Personal Information is kept as accurate,
complete and up to date as reasonably possible depending on the purpose for which Personal Information is
collected or further processed.
8.2 I’Bupi Super White Maize may not always expressly request the Data Subject to verify and update his/her/its
Personal Information, unless this process is specifically necessary.
8.3 I’Bupi Super White Maize, however, expects that the Data Subject will notify I’Bupi Super White Maize from time
to time in writing of any updates required in respect of his/her/its Personal Information.
9. STORAGE AND PROCESSING OF PERSONAL INFORMATION
9.1 may store your Personal Information in hardcopy format and/or in electronic format using I’Bupi Super White
Maize own secure on-site servers or other internally hosted technology. Your Personal Information may also be
stored by Third Parties, via cloud services or other technology, with whom I’Bupi Super White Maize has
contracted with, to support I’Bupi Super White Maize business operations.
9.2 I’Bupi Super White Maize Third Party service providers, including data storage and processing providers, may
from time to time also have access to a Data Subject’s Personal Information in connection with purposes for
which the Personal Information was initially collected to be Processed.
9.3 I’Bupi Super White Maize will ensure that such Third Party service providers will process the Personal
Information in accordance with the provisions of this Policy, all other relevant internal policies and procedures
and POPIA and, where relevant, the GDPR.
9.4 These Third Parties do not use or have access to your Personal Information other than for purposes specified by
us, and I’Bupi Super White Maize requires such parties to employ at least the same level of security that I’Bupi
Super White Maize uses to protect your personal data.
9.5 Your Personal Information may be Processed in South Africa or another country where I’Bupi Super White
Maize, its affiliates and their Third Party service providers maintain servers and facilities and I’Bupi Super White
Maize will take steps, including by way of contracts, to ensure that it continues to be protected, regardless of its
location, in a manner consistent with the standards of protection required under applicable law.
​
10. DIRECT MARKETING
10.1 To the extent that I’Bupi Super White Maize acts in its capacity as a Direct Marketer, it shall strive to observe,
and comply with its obligations under POPIA and, where relevant, the GDPR when implementing principles
and practices in relation to Direct Marketing.
10.2 I’Bupi Super White Maize acknowledges that it may only use Personal Information to contact the Data Subject
for purposes of Direct Marketing from time to time where it is permissible to do so.
10.3 It may use Personal Information to contact any Data Subject and/or market I’Bupi Super White Maize directly
to the Data Subject(s) if the Data Subject is one of I’Bupi Super White Maize’ existing clients, the Data Subject
has requested to receive marketing material from I’Bupi Super White Maize has the Data Subject’s
consent to market its services directly to the Data Subject.
10.4 If the Data Subject is an existing client, I’Bupi Super White Maize will only use his/ her/its Personal Information
if it has obtained the Personal Information through the provision of a service to the Data Subject and only in
relation to similar services to the ones I’Bupi Super White Maize previously provided to the Data Subject.
10.5 I’Bupi Super White Maize will ensure that a reasonable opportunity is given to the Data Subject to object to
the use of their Personal Information for I’Bupi Super White Maize marketing purposes when collecting the
Personal Information and on the occasion of each communication to the Data Subject for purposes of Direct
Marketing.
10.6 I’Bupi Super White Maize will not use your Personal Information to send you marketing materials if you have
requested not to receive them. If you request that we stop Processing your Personal Information for marketing
purposes, I’Bupi Super White Maize shall do so. We encourage that such requests to opt-out of marketing be made via forms and links provided for that purpose in the marketing materials sent to you.
11. RETENTION OF PERSONAL INFORMATION
11.1 I’Bupi Super White Maize may keep records of the Personal Information it has collected, correspondence, or
comments in an electronic or hardcopy file format.
11.2 I’Bupi Super White Maize will not retain personal information for a period longer than is necessary to achieve
the purpose for which it was collected or processed and is required to delete, destroy (in such a way that it
cannot be reconstructed) or de-identify the information as soon as is reasonably practicable once the purpose
has been achieved. This prohibition will not apply in the following circumstances –
11.2.1 Where the retention of the record is required or authorised by law;
11.2.2 I’Bupi Super White Maize requires the record to fulfil its lawful functions or activities;
11.2.3 Retention of the record is required by a contract between the parties thereto;
11.2.4 The data subject (or competent person, where the data subject is a child) has consented to such
longer retention; or
11.2.5 the record is retained for historical, research or statistical purposes provided safeguards are put in
place to prevent use for any other purpose.
11.2.6 Accordingly, I’Bupi Super White Maize will, subject to the exceptions noted herein, retain Personal
Information for as long as necessary to fulfil the purposes for which that Personal Information was
collected and/or as permitted or required by applicable law.
11.2.7 Where I’Bupi Super White Maize retains Personal Information for longer periods for statistical,
historical or research purposes I’Bupi Super White Maize will ensure that appropriate safeguards have
been put in place to ensure that all recorded Personal Information will continue to be Processed in
accordance with this Policy and the applicable laws.
11.2.8 Once the purpose for which the Personal Information was initially collected and Processed no longer
applies or becomes obsolete, I’Bupi Super White Maize will ensure that the Personal Information is
deleted, destroyed or de-identified sufficiently so that a person cannot re-identify such Personal Information.
11.2.9 In instances where we de-identify your Personal Information, I’Bupi Super White Maize may use such
de-identified information indefinitely.
12. FAILURE TO PROVIDE PERSONAL INFORMATION
12.1 Should I’Bupi Super White Maize need to collect Personal Information by law or under the terms of a contract
that I’Bupi Super White Maize may have with you and you fail to provide the Personal Information when
requested, we may be unable to perform the contract we have or are attempting to enter into with you.
12.2 In such a case, I’Bupi Super White Maize may have to decline to provide or receive the relevant services, and
you will be notified where this is the case.
13. SAFE-KEEPINGOFPERSONAL INFORMATION
13.1 I’Bupi Super White Maize shall preserve the security of Personal Information and, in particular, prevent its
alteration, loss and damage, or access by nonauthorised third parties.
13.2 I’Bupi Super White Maize will ensure the security and integrity of Personal Information in its possession or
under its control with appropriate, reasonable technical and organisational measures to prevent loss, unlawful
access and unauthorised destruction of Personal Information.
13.3 Taking into account the state of the art, the costs of implementation and the nature, scope, context and
purposes of processing as well as the risk of varying likelihood and severity for the rights and freedoms of
Data Subjects, I’Bupi Super White Maize implements appropriate technical and organisational measures to
ensure a level of security appropriate to the risk of Processing, including measures protecting any
Personal Information from loss or theft, and unauthorised access, disclosure, copying, use or modification,
including –
13.3.1 the pseudonymization and encryption of Personal Information;
13.3.2 the ability to ensure the ongoing confidentiality, integrity, availability and resilience of Processing
systems and services; the ability to restore the availability and access to Personal Information in a
timely manner in the event of a physical or technical incident; and
13.3.3 a process for regularly testing, assessing and evaluating the effectiveness of technical and
organisational measures for ensuring the security of Processing.
13.3.4 Further, I’Bupi Super White Maize maintains and regularly verifies that the security measures are
effective and regularly updates same in response to new risks.
​
14. BREACHES OF PERSONAL INFORMATION
14.1 A Data Breach refers to any incident in terms of which reasonable grounds exist to believe that the Personal
Information of a Data Subject has been accessed or acquired by any unauthorised person.
14.2 A Data Breach can happen for many reasons, which include:
(a) loss or theft of data or equipment on which Personal Information is stored;
(b) inappropriate access controls allowing unauthorised use;
(c) equipment failure;
(d) human error;
(e) unforeseen circumstances, such as a fire or flood;
(f) deliberate attacks on systems, such as hacking, viruses or phishing scams; and/ or
(g) alteration of Personal Information without permission and loss of availability of Personal Information.
14.3 I’Bupi Super White Maize will address any Data Breach in accordance with the terms of POPIA and, where
relevant, the GDPR.
14.4 I’Bupi Super White Maize will notify the Regulator and the affected Data Subject (unless the applicable law
requires that we delay notification to the Data Subject) in writing in the event of a Data Breach (or a reasonable
belief of a Data Breach) in respect of that Data Subject’s Personal Information.
14.5 I’Bupi Super White Maize will provide such notification as soon as reasonably possible and, where feasible,
not later than 72 (seventy two) hours after having become aware of any Data Breach in respect of such Data
Subject’s Personal Information.
14.6 Where I’Bupi Super White Maize acts as an ‘Operator’ and should any Data Breach affect the data of Data
Subjects whose information I’Bupi Super White Maize Processes as an Operator, I’Bupi Super White Maize
shall (in terms of POPIA and, where applicable, the GDPR) notify the relevant Responsible Party immediately
where there are reasonable grounds to believe that the Personal Information of relevant Data Subjects has
been accessed or acquired by any unauthorised person.
15. DISCLOSURE OF PERSONAL INFORMATION TO THIRD PARTY SERVICE PROVIDERS
15.1 I’Bupi Super White Maize may disclose Personal Information to Third Parties and will enter into written
agreements with such Third Parties to ensure that they Process any Personal Information in accordance with
the provisions of this Policy, and POPIA and, where relevant, the GDPR.
15.2 I’Bupi Super White Maize notes that such Third Parties may assist I’Bupi Super White Maize with the purposes
listed in paragraph 7.4 above – for example, service providers may be used, inter alia:
(i) to notify the Data Subjects of any pertinent information concerning I’Bupi Super White Maize,
(ii) or data storage and/or
(iii) to assist I’Bupi Super White Maize with auditing processes (external auditors).
15.3 I’Bupi Super White Maize will disclose Personal Information with the consent of the Data Subject or if I’Bupi
Super White Maize is permitted to do so without such consent in accordance with the applicable laws.
15.4 Further, I’Bupi Super White Maize may also send Personal Information to a foreign jurisdiction outside of the
Republic of South Africa, including for Processing and storage by Third Parties.
15.5 When Personal Information is transferred to a jurisdiction outside of the Republic of South Africa (including to
any I’Bupi Super White Maize Associated Entity), I’Bupi Super White Maize will obtain the necessary consent to
transfer the Personal Information to such foreign jurisdiction or may transfer the Personal Information where
I’Bupi Super White Maize is permitted to do so in accordance with the provisions applicable to cross-border
flows of Personal Information under POPIA and, where applicable, the GDPR.
15.6 The Data Subject should also take note that the Processing of Personal Information in a foreign jurisdiction
may be subject to the laws of the country in which the Personal Information is held, and may be subject to
disclosure to the governments, courts of law, enforcement or regulatory agencies of such other country,
pursuant to the laws of such country.
16. ACCESS TO PERSONAL INFORMATION
16.1 A Data Subject has certain rights under POPIA and, where applicable, the GDPR, including the following:
16.1.1 a right of access:a Data Subject having provided adequate proof of identity has the right to:
(i) request a Responsible Party to confirm whether any Personal Information is held about the Data
Subject; and/or
(ii) request from a Responsible Party a description of the Personal Information held by the
Responsible Party including information about Third Parties who have or have had access to the
Personal Information. A Data Subject may request:
16.1.1.1 I’Bupi Super White Maize to confirm, free of charge, whether it holds any Personal Information
about him/ her/it; and
16.1.1.2 to obtain from I’Bupi Super White Maize the record or description of Personal Information
concerning him/her/it and any information regarding the recipients or categories of recipients who
have or had access to the Personal Information. Such record or description is to be provided:
16.1.1.3 within a reasonable time; and
16.1.1.4 in a reasonable manner and format and in a form that is generally understandable.
16.1.2 a right to request correction or deletion:a Data Subject may also request I’Bupi Super White Maize to –
16.1.2.1 correct or delete Personal Information about the Data Subject in its possession or under its control
that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or obtained unlawfully;
or
16.1.2.2 destroy or delete a record of Personal Information about the Data Subject that I’Bupi Super White
Maize is no longer authorised to retain records in terms of POPIA’s and, where applicable, the
GDPR’s retention and restriction of records provisions.
16.1.2.3 On receipt of such a request, I’Bupi Super White Maize is required to, as soon as is reasonably
practicable –
16.1.2.3.1 correct the information;
16.1.2.3.2 delete or destroy the information;
16.1.2.3.3 provide the Data Subject with evidence in support of the information; or
16.1.2.3.4 where the Data Subject and Responsible Party cannot reach agreement on the request and
if the Data Subject requests this, I’Bupi Super White Maize will take reasonable steps to
attach to the information an indication that correction has been requested
but has not been made;
16.1.3 a right to withdraw consent and to object to processing: a Data Subject that has previously consented
to the Processing of his/her/its Personal Information has the right to withdraw such consent and may
do so by providing I’Bupi Super White Maize with notice to such effect at the address set out in paragraph 21. Further, a Data Subject may object, on reasonable grounds, to the Processing of
Personal Information relating to him/her/it.
16.2 Accordingly, I’Bupi Super White Maize may request the Data Subject to provide sufficient identification to
permit access to, or provide information regarding the existence, use or disclosure of the Data Subject’s
Personal Information.
16.3 Any such identifying information shall only be used for the purpose of facilitating access to or information
regarding the Personal Information.
16.4 The Data Subject can request in writing to review any Personal Information about the Data Subject that I’Bupi
Super White Maize holds including Personal Information that I’Bupi Super White Maize has collected, utilised
or disclosed, as well as the following information:
(i) the purposes of Processing;
(ii) the categories of Personal Information concerned;
(iii) where possible, the envisaged period for which the Personal Information will be stored or, if not possible,
the criteria used to determine that period;
(iv) the existence of the right to request from I’Bupi Super White Maize rectification or erasure of Personal
Information or restriction of Processing of Personal Information concerning the Data Subject or to object
to such processing;
(v) the right to lodge a complaint with the Regulator;
(vi) where the Personal Information is not collected from the Data Subject, any available information as to
their source; and (vii) the existence of automated Processing, including profiling and, at least in those
cases, meaningful information about the logic involved as well as the significance and the
envisaged consequences of such processing for the Data Subject. I’Bupi Super White Maize shall
respond to these requests in accordance with POPIA and, where applicable, the GDPR and will provide
the Data Subject with any such Personal Information to the extent required by law and any of I’Bupi
Super White Maize policies and procedures which apply in terms of the Promotion of Access to
Information Act 2 of 2000 (PAIA).
16.5 The Data Subject can challenge the accuracy or completeness of his/her/its Personal Information in I’Bupi
Super White Maize records at any time in accordance with the process set out in I’Bupi Super White Maize’
manual developed in terms of PAIA for accessing information.
16.6 If a Data Subject successfully demonstrates that their Personal Information in I’Bupi Super White Maize records
is inaccurate or incomplete, I’Bupi Super White Maize will ensure that such Personal Information is amended or
deleted as required (including by any Third Parties).
17. TIME PERIODS
17.1 I’Bupi Super White Maize will respond to each written request of a Data Subject not later than 30 (thirty) days
after receipt of such requests. Under certain circumstances, I’Bupi Super White Maize may, however, extend
the original period of 30 (thirty) days once for a further period of not more than 30 (thirty) days.
17.2 A Data Subject has the right to make a complaint to I’Bupi Super White Maize in respect of this time limit by
contacting I’Bupi Super White Maize using the contact details provided in paragraph 21 below.
18. COSTS TO ACCESS TO PERSONAL INFORMATION
The prescribed fees to be paid for copies of the Data Subject’s Personal Information are listed in the PAIA Manual.
19. USE OF WEBSITE COOKIES
19.1 Our Website uses cookies, which are small text files sent by a web server to store on a web browser. They are
used to ensure websites function properly, store user preferences when needed and collect anonymous
statistics on website usage.
19.2 You may refuse to accept cookies by activating the setting on your browser which allows you to refuse the
setting of cookies. However, if you select this setting you may be unable to access certain parts of our website.
Unless you have adjusted your browser setting so that it will refuse cookies, our system will issue cookies when
you log on to the website. If you accept a “cookie” or fail to deny the use of “cookies”, you agree that
we may use your personal information collected using “cookies” (subject to the provisions of this Policy).
Where you either reject or decline cookies, you are informed that you may not be able to fully experience the
interactive features of our Website.
20. CHANGES TO POLICY
20.1 I’Bupi Super White Maize reserves the right to make amendments to this Policy from time to time and will use
reasonable efforts to notify Data Subjects of such amendments.
20.2 The current version of this Policy will govern the respective rights and obligations between you and I’Bupi
Super White Maize each time that you access and use our Website.
21. I’BUPI SUPER WHITE MAIZE CONTACT DETAILS PHYSICAL & POSTAL ADDRESS
Physical Address: Plaas Leeuwkuil, Sannieshof, 2760
Postal Address: Plaas Leeuwkuil, Sannieshof, 2760
INFORMATION OFFICER: Chantelle Barnard - ibupimaize@gmail.com
DEPUTY INFORMATION OFFICER: Jan Barnard - ibupimaize@gmail.com
If a Data Subject is unsatisfied with the manner in which I’Bupi Super White Maize addresses any complaint with regard to I’Bupi Super White Maize Processing of Personal Information, the Data Subject can contact the office of the relevant Regulator