PRIVACY NOTICE
Elvey Group (Elvey Security Technologies, Elvey Exports, Pentagon, Elvey Projects and Global Communications).
This Privacy Notice explains how Elvey Security Technologies, Elvey Exports, Pentagon, Elvey Projects and Global Communications established in the Republic of South Africa (collectively referred to herein as the "Elvey Group" or "we") is responsible for processing your personal information, the purposes for which we process and use your personal information, the way we protect your personal information and your rights in respect of your personal information.
1. Our Commitment with your Privacy
At the Elvey Group, we are aware that all people who collaborate with us (including job candidates, employees, former employees, customers, and contractors) have the right to privacy and the protection of their personal information. Therefore, we are concerned to establish and maintain in force controls, measures and procedures that allow us to protect the personal information of all identifiable, living natural persons and identifiable existing juristic persons who interact with us in compliance with the provisions of the Protection of Personal Information Act 4 of 2013 ("POPIA"), its regulations and any other applicable regulations concerning data protection.
This Privacy Notice is intended to inform our customers, contractors, job candidates, employees, and former employees (collectively, "Data Subjects" or "you") of the privacy policies and practices that govern the Elvey Group and the rights that you enjoy.
3. Why is it important for me to read this Notice?
This Notice details how the Elvey Group use your personal information and the rights you have. Please take a minute to review this information.
This Privacy Notice provides information relevant to:
i. Any person who sends us their curriculum vitae or who in any other manner is involved in a recruitment and selection process with us (the "Candidates").
ii. Persons who are employed by the Elvey Group under an employment contract (the "Employees").
iii. Persons who may be included include students, interns, those on learnerships and apprenticeships, in-service training, etc.
iv. Any person who enters the premises and who provide personal information, including visitors, inspectors, government officials, union officials).
v. External contractors, either by providing professional services on their own or employed by any company providing services to the Elvey Group, including independent contractors, sub-contractors, agents, and expatriates (the "External Contractors"); and
vi. External customers to whom we provide services in terms of a contractual relationship. These services may be provided either directly by us or indirectly through third party sub- contractors appointed by us to provide services to our customers ("Customers").
Unless specifically stated otherwise, the term "you" in this Notice refers to any of the groups of persons referred to herein, unless a reference to a particular group is made in this Privacy Notice. Although, the purposes for processing the personal information of each of the groups referred to above may be different, in general, we are concerned to protect such information in the same manner, in compliance with POPIA. Therefore, unless specifically stated otherwise in this Notice, the terms ("you" and/or "Data Subjects") include Candidates, Employees, Contractors, Customers and/or any of the persons stated above. For purposes of clarity with our Candidates and our Contractors, it is noted that this Privacy Notice does not constitute a job offer or an employment contract, or an indication of any form of association with the group.
3. Personal information we collect from you
The Elvey Group has and will continue to assess the state of personal information to which the Group has access to, and which it stores. The Group has assessed all the personal information and determined why the information is required, for what period it is required, how and why it is processed whether it is required for further processing to third parties, how that information is safely stored, the destruction of non-relevant or complaint information, and the required consent for the information.
Once the purpose of retaining the information is no longer valid, and where necessary, it will be destroyed or deidentified.
The personal information we collect from you depends on the relationship you have with us, whether as a Candidate, an Employee, Contractor or Customer and/or any of the persons stated in item 2 above. The personal information we can request from you is listed below. The information that is collected will only be dine with a defined purpose, and the storage and destruction of it will be aligned to the policy and procedures of the group. The information can include in the following, but depending on the reason for collecting the information, will not include all the following:
A. Identification Information: In respect of natural persons, this information relates to any information that allows you to be differentiated from other natural persons. This information, where relevant, includes, amongst others: your name, gender, race, marital status, date of birth, age, biometric information, photographs, passport number, drivers’ license, location information, online identifier, and personal identification number. In respect of juristic persons, this information includes, amongst others: the company name, the company registration number, the company tax number, the company VAT registration number, the company's corporate structure, its directors, shareholders and members, the company's composition, and business operations. Depending on the purpose for which we require the identification information, we may request copies of any associated credentials.
B. Contact Information: In respect of natural persons, this information, where relevant, relates to information that allows us to keep in touch with you. This information could include your home address, work address, e-mail, private phone number or other phone number contact, such as cellphone number. In respect of juristic persons, this information relates to information that allows us to keep in touch with you. This information could include the company's physical addresses, the company's telephone numbers, telefax numbers, email addresses and website address.
C. Employment Information: In respect of natural persons, employees, independent subcontractors, interns, students, in-service trainees, etc. this information, where relevant, relates to information concerning your previous employment or current employment, your title and position, whether in our company or the company in which you work; working experience, professional experience, information relating to your spouse or partner and to your children, information related to training that you have taken, evaluations, professional profile, disciplinary actions, the reasons for the termination of your employment contract and your criminal behavior to the extent that such information relates to the commission of an alleged offence or to any proceedings in respect of which you are alleged to have committed an offence, among others.
D. Academic Information: In respect of natural persons, this information, where relevant, relates to information that allows us to know your professional orientation, including: your schooling, educational background, specialization, level of specialization, degrees, certificates, and recognition among others relevant to the position under application or the possibility of promotion to another position within the group.
E. Financial Information: In respect of natural persons, this information relates to the relevant information regarding the financial information of the individual obtained directly from that person, who includes banking details, tax registration number, medical aid and/or provident fund details, etc. In respect of juristic persons, this information relates to the company's banking account details and associated identifiers, credit ratings, payment history and financial standing, including statements of account, among others.
F. Health information: Generally, where relevant, we will obtain a psychological assessment of our Candidates and Contractors through psychometric tests or another similar test. We may also require to be furnished with an employee’s pregnancy status for the purposes of determining maternity leave. We will also collect information pertaining to your physical or mental health or disability if you are an Employee, in the event of incapacity or disability investigations, or the inherent requirement of the job require such an investigation.
G. Biometric data: In some cases, the fingerprints, photographs and signatures of the Employees and some Contractors are obtained to allow them access to certain facilities for attendance, security and health and safety purposes.
H. Electronic Records: This information includes, where relevant, certain information that is obtained when you access our website or access our facilities and include: (i) data that is obtained through cookies on our websites, such as IP address with which you accesses the website, user preferences, type of browser, activity on the site, and previously visited page; (ii) records of images and/or voice obtained through video
surveillance systems, which are obtained when you visit our facilities; and (iii) in the case of employees, electronic records that are obtained when the Employee uses our computer systems (including equipment and telecommunication networks and IT systems). The latter information may include access to electronic, network or communications equipment, the use of such systems and tools (including the Elvey Group's e- mail and the Internet) and its geolocation. Employee activity on their devices may be monitored for the purpose of maintaining your safety, as well as the Elvey Group's safety, the safety of its employees and assets; and to monitor compliance with our policies or the law and for internal or external investigations when it is suspected that an Employee may have committed an action contrary to our policies or applicable laws.
I. Information on trade union affiliation: Information that allows us to identify a person's membership to a specific union for the purposes of legislative and administrative compliance.
J. Events Information: If we are hosting an event, we may request you to furnish us with information, where relevant, pertaining to any special dietary requirements/allergies, any special assistance needs (hearing, sight, or physical impairment), travel arrangements, the name and age of your child/children (collected through parents or guardians attending events) and if applicable, your speaker biography.
K. Service Information: This information relates to your views of our services, your use of our services and your experience of our services. We use this information to initiate service improvements and changes to our services.
L. Special Personal Information: Some of the personal information described in sections "A", "C", "F", "G", "H", "I" and "J" of clause 3 above is considered to be "special personal information" in terms of POPIA. The special or sensitive Personal Information, that we collect is limited to:
i. information pertaining to race or ethnic origin which is required by us for compliance with the Employment Equity Act 55 of 1998 and the Broad-based Black Economic Empowerment Act 53 of 2003.
ii. information pertaining to physical or mental health or disability, and which is required by us for compliance with the Occupational Health and Safety Act 85 of 1993, the Employment Equity Act 55 of 1998, the Health Act 63 of 1997 and the Consolidated Directions on Occupational Health Safety Measures in Certain Workplaces, 2020 ("COVID Regulations") published in terms of the Disaster Management Act 57 of 2002.
iii. biometric information; (iv) trade union membership.
iv. your religion; and
v. information relating to criminal behavior to the extent that such information relates to the alleged commission of an offence or to proceedings in respect of the alleged commission of an offence.
The Elvey Group does not intend to collect any special or sensitive Personal Information that is prohibited by local law and without your prior consent, where required.
4. Authorization to contact third parties (personal or professional references)
The Elvey Group may contact third parties related to you in the following cases:
i. Employees: Employees will be requested, where relevant, to provide contact and identification information of their family members or of a third party for emergency contact purposes. The information is collected to ensure the accuracy of information received.
ii. Candidates: We may request to be furnished with, where relevant, the contact and identification information of your previous employers, confirmation of qualification and experience. The information is collected to ensure the accuracy of information received.
Where we request such information, we request you to ensure that the third-party data you provide is accurate, complete, and correct, verifiable, and has the permission of the third party to disclose it and is up to date.
5. Means through which we obtain your personal information
The Elvey Group may obtain a Candidate's personal information through different means:
• Personally, from the Candidate during the recruitment process.
• Indirectly from the Candidate, for example, where the Elvey Group or the Candidate makes use of the services of a third-party recruiter.
• Relevant information from publicly available records social media and correspondence between the Elvey Group and the Candidate.
The Elvey Group may obtain an Employees’ personal information through different means:
• Personally, from the Employee during the recruitment process and during the employment relationship, as well as through the disclosure of relevant and consented information by the employee.
• Directly, through different means including our intranet, phone, monitoring or video surveillance systems and the Company's IT platforms and applications of the Elvey Group.
• Indirectly from the Employee, for example, by receiving reports or information, which is provided to us by companies that we hire, to perform different tests and examinations regarding our Employees, or information stored in public access sources.
• Relevant information from publicly available records social media and correspondence between the Elvey Group and the Employee.
The Elvey Group may obtain an External Contractor's personal information through different means:
• Personally, from the External Contractor during the contracting process and during the contract relationship. Indirectly from the External Contractor, for example where the External Contractor is appointed as a sub-contractor by a third party who contracts directly with the Elvey Group for the provision of services to the Elvey Group, with consent from the subcontractor.
The Elvey Group may obtain a customer’s, client, or suppliers’ personal information through different means:
• Personally, from the Customer, client, or suppliers during the contracting process and during the contract relationship.
• Directly from the Customer's, client, or suppliers’ employees and/or representatives during the contracting process and during the contract relationship.
• Indirectly from publicly available records and information pertaining to the Customer, client, or suppliers.
6. Purposes for which the Company processes your personal data.
Although the purposes may vary according to the legal relationship that you have with the Elvey Group, in general, your personal data is used for the following purposes:
a. In the case of Candidates, the personal information is requested to evaluate the competencies of the Candidate and the suitability of the Candidate for the advertised position. In general, the information is used to manage the recruitment and selection process. Where the Elvey Group obtains special personal information from Candidates, client, or suppliers we will ask you to give your consent.
i. In the case of the Employees:
ii. for the proper administration of the employment relationship, including to confirm and maintain the Employee's employment record and to pay the Employee's salaries and benefits.
iii. for the administration of benefits.
iv. for the identification of the Employee's skills, aptitudes and competencies and for the evaluation of his/her professional performance.
v. to support the Employee in case of accidents and generate the corresponding internal reports.
vi. to evaluate the Employees' use of the facilities, information and communications infrastructure of the Elvey Group and the equipment that the Elvey Group makes available to the Employee as work tools or the Employee's devices that the Elvey Group allows the Employee to connect to the Elvey Group's network, also as a working tool; the monitoring is carried out in order to protect our computer systems, assets, assets, intellectual property assets and the security of the Elvey Group, and its employees (including also the integrity, working conditions and assets of our employees);
vii. to verify and audit our employees’ compliance with our internal policies, and prevailing and relevant legislation including ensuring that Employees have appropriate health conditions that enable them to perform their work.
viii. to carry out investigations or internal audits for purposes of compliance, quality or investigation of inappropriate or illegal conduct, among others.
i. to manage the relationship with the trade union to which the Employee belongs and to provide the trade union with the information required of the Employee, when applicable.
ii. to manage the activities that are necessary to comply with labor legislation; and
iii. occasionally the Employee's information may be used for the Elvey Group's publicity or internal communications
b. In the case of External Contractors:
i. expatriates and independent contractors, for the management of the expatriate's or independent contractor's assignment in the Elvey Group as well as for compliance with applicable legislation and internal policies.
ii. in the case of third-party sub-contractors, the personal information is processed for the purposes of compliance with internal policies (access to facilities, compliance with security and quality policies, etc.) and applicable legislation. In certain specific cases the third parties and agencies that support us may conduct more specific certification tests with consent. The rules, regulations, procedure and POPIA compliance of third parties is not the responsibility of the Elvey Group.
c. In the case of Customers, clients, and suppliers: For relevant information, contractual and relationship management purposes, and business purposes, including data analysis, audits, developing and improving products and services, identifying usage trends, and determining the effectiveness of promotional campaigns, and enhancing, improving, or modifying our service. Relevant personal information is also obtained from Customers, clients and suppliers for risk management, compliance with our legal and regulatory obligations and for fraud detection, prevention, and investigation, including “know your customer”, anti-money laundering, conflict and other necessary onboarding and ongoing customer checks, due diligence and verification requirements, credit checks, credit risk analysis, compliance with sanctions procedures or rules, and tax reporting. We also process the relevant personal information of our customers for to provide, and perform our obligations with respect to, the services or otherwise in connection with fulfilling instructions and to send administrative information to clients, such as changes to our terms, conditions, and policies.
d. We also process the personal information of Candidates, Employees, External Contractors and Customers to comply with laws and regulations (including any legal or regulatory guidance, codes, or opinions), and to comply with other legal process and law enforcement requirements (including any internal policy based on or reflecting legal or regular guidance, codes, or opinions).
In addition, the personal information of Candidates, Employees, External Contractors and Customers is processed for event management and execution to ensure that all participants have a safe and enjoyable experience, to provide notifications concerning the event, provide analysis to improve our events and develop new events, determine their overall effectiveness, enhance products and services, and to operate and expand our business activities.
7. Transfers of personal data
The Elvey Group may communicate or transfer your personal data to different entities for the purposes established in this Notice. These transfers are made to the extent that they are necessary for the maintenance or fulfillment of the contractual relationship between the Elvey Group and you. Any of the transfers referred to below may be national or international, however any international transference of personal information will require specific personal consent.
a. Data referrals
The Elvey Group may refer all or part of your personal information to service providers to support us in a particular process. These suppliers include, for example: (i) companies that provide us with a recruitment and selection service; (ii) accounting or computer companies that support us to pay the payroll; (iii) companies, or laboratories that perform psychometric, psychological, medical, clinical studies, among others; (iv) offices that support us in accounting, legal and immigration matters; (v) insurance agents, insurance companies, medical aid companies and pension scheme administrators; and (vi) companies that provide us with information technology outsourcing and management services as well as cloud hosting services. Before transferring information to these suppliers, we make sure to sign contracts that oblige these companies to commit themselves to protect your personal information. The Elvey Group will not deal with any company’s which do not confirm adherence to the POPIA.
b. Transfers of personal data to our affiliates
Since the Elvey Group is part of an international group, the personal information of Candidates, Employees, External Contractors and Customers may be communicated or transferred to other companies of our same corporate group. Our affiliates make reasonable efforts to implement measures and policies for the protection of the personal information of our Candidates, Employees,
External Contractors and Customers. These policies are consistent with POPIA and are designed to comply with the provisions of the laws on personal data protection in each country. Where the data protection laws of a country might not provide a level of protection equivalent to the laws in South Africa, and if the Elvey Group discloses Personal Information to any of its affiliates in such countries, we will establish and/or confirm that, prior to receiving any Personal Information, such affiliates will provide an adequate level of protection for Personal Information, including appropriate technical and organizational security measures. International transference of personal information will require specific personal consent.
c. Transfers of personal data to third parties
Your personal information may be communicated or transferred to third parties different from the entities referred to in clause 8(b) above. Where your personal information is transferred by us to a third party outside of South Africa, we will address any applicable requirement to assure an adequate
level of data protection before transferring your personal information by assuring the implementation of binding corporate rules, or the execution of appropriate data transfer agreements. International transference of personal information will require specific personal consent.
8. Your Privacy Rights
All our Employees, Candidates External Contractors and Customers, clients and suppliers may always, have a right to request from the Elvey Group access to their personal information or the correction of such personal information. Likewise, you may request us to delete or erase your personal information. You may also object to the Elvey Group processing your personal information for specific purposes and you may revoke any consent previously granted to the processing of your personal information (the "Data Subject Rights"). Your Data Subject Rights may be subject to limitations detailed in applicable laws. Your rights in terms of the POPIA include to be informed if someone is collecting your personal information, to be informed if your personal information has been accessed by an unauthorized person, to access, correct, amend, and destroy your own personal information, object to having your personal information being processed and to withdraw your consent, or object to information being stored or processed.
To exercise your Data Subject Rights, you must send the Elvey Group a request addressed to the following email address: itsupport@elveygroup.com. Employees may also send queries or complaints in connection with their privacy rights to our Information Officer to this email address hr@elveygroup.com or as set out in item 12 below.
In case you decided to exercise your Data Subject Rights, our Information Officer may inform you of: (i) the information that you will need to provide for identification purposes as well as the documents you may need to enclose with your request; (ii) the expected timeframe for receiving a response from us regarding your request; (iii) how to submit your request, including the forms that you will be required to use, if available; and
(iv) the form in which we will deliver your information to you (which usually may be copies of documents or digital files).
In terms of POPIA, you are entitled to approach the South African courts and you can lodge a complaint with South Africa's Information Regulator in respect of any alleged interference with the protection of your personal information. The contact details of South Africa's information regulator are as follows:
Physical address: JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001
Postal address: P.O. Box 31533, Braamfontein, Johannesburg, 2017
Email address: complaints.IR@justice.gov.za
9. Available options for you to limit the use or disclosure we make of your personal information
As a Candidate, Contractor or Employee, client, or supplier, you may at some point wish to explore whether there are ways to limit the way we use or disclose your personal information in any particular way
i. a Candidate may request that we do not send him/her emails informing him/her of vacancies; or
ii. an ex-employee could request that we not mention him, etc. In these cases, or any other where you wish to explore what forms exist for us not to process your personal information for any particular purpose, please contact us at the above email address. Our Information Officer will let you know what options you have.
10. Security measures
The Elvey Group adopts the necessary technical, administrative, and physical security measures in terms of POPIA , for the protection of your personal information. We also oblige our service providers and suppliers to comply with the security measures required by POPIA to protect your personal information.
11. Changes to the Privacy Notice
The Elvey Group reserves the right to modify or update this Privacy Notice at any time. The modified notice will be posted on our website, on our intranet or will be sent via email, or via any other means of communication. You can verify that the Notice has been modified with reference to the date of the last update. In case the Elvey Group makes a substantial change in the processing of your personal information, we will let you know through a notification to your email or announcing these changes on our website. Any changes made to our Privacy Notice will take effect the day after it is posted on our website. If you do not agree with the modifications, please contact our Information Officer.
12. Information Officer and Deputy Information Officers:
Company: Elvey Group
Contact Number: 011 401 6700
Physical Address: 27 Greenstone Place, Greenstone Hill, Lethabong, 1609
Postal Address: P O Box 27088, Benrose, 2011
Information Officer: Jaco Moolman – CEO – jaco@elveygroup.com
Deputy Info Officer: Carlos Esteves – Financial Department – carlos@elveygroup.com
Deputy Info Officer: Michelle Willemse – Debtors Department – michelle@elveygroup.com
Deputy Info Officer: Riaan Louw – Creditors Department – riaan@elveygroup.com
Deputy Info Officer: Jerry Nematswerane – Information Technology – jerry@elveygroup.com
Deputy Info Officer: Lynette Cockeran – HR and Payroll Department – lynette@elveygroup.com
Deputy Info Officer: Tasha Smith – Sales and Marketing Department – tasha@elveygroup.com
Deputy Info Officer: Valerie Bingham – Procurement Department – valerie@elveygroup.com
Deputy Info Officer: Cal Preston – Technical Department – cal@pentagon.africa