Privacy Policy
Introduction
At Recall Africa (Pty) Ltd (“Recall Africa”, “we”, “us”, “our”), we respect your privacy and is committed to protecting your Personal Information. This policy (“Policy”) explains how we process Personal information when you enter the property of any Recall Africa client (“Recall Africa Client”).
1) IMPORTANT INFORMATION AND WHO WE ARE
We have been appointed as a security provider at the property you are attending to (“Property”). As per the nature of our business we provide certain security services to Recall Africa Clients that may involve the Processing of Personal Information. Where We Process a Data Subject (i.e. resident or visitor) Personal information on instructions from the Recall Africa Client, We will act as Operator and the Recall Africa Client will act as the Responsible Party.
We have appointed an Information Officer (IO) who is responsible for overseeing questions in relation to this Privacy Policy. If you have any questions about this Privacy Policy you can contact the Information Officer:
Information Officer: Gerard Berreiro;
Email address: gbarreiro@recallsecurity.co.za;
Other contact details and address: See our CONTACT page (click on link)
For more information see our Promotion of Access to Information Manual (PAI Manual) (click on link)
For any other questions about the processing of personal Information you can contact the Recall Africa Client (Responsible Party)
Changes to the Privacy Policy: we may change this policy from time to time without notice. The new version will apply the moment it is published on our website or incorporated by reference under any QRCode or in any of our other policies or other communications or published on any of our Services.
2) THE DATA WE COLLECT
Personal Information means information as per the Definitions. It does not include data where your identity has been removed from the data (anonymous data/de-identified information).
We may Process different kinds of Personal Information about you which we have grouped together under the following categories:
Identity Data includes first name, last name, username or similar identifier, title, date of birth and gender.
Contact Data includes billing address, physical address, email address and telephone numbers.
We also collect, use and share aggregated Data and pattern data (“Aggregate Data”) such as (but not limited to) statistical or demographic data or any purpose. Aggregated Data could be derived from your Personal Information but is not considered Personal Information in law as this data will not directly or indirectly reveal your (the data subject’s) identity. For example, we may aggregate your data to calculate the percentage of users accessing the Property or area within the Property. However, if we combine or connect Aggregated Data with your Personal Information so that it can directly or indirectly identify you, we will treat the combined data as Personal Information which will be used in accordance with this Privacy Policy.
Special Personal Information: Although we may collect video footage and images (“Footage”) collected via CCTV camares of you and your vehicle. The Footage are only used when there is an investigation under the Intended Purpose. The Footage on its own is not Personal Information, however where there is an investigation and the Footage is linked with an identifiable natural person, we will process same within the conditions of the POPIA. See the table below
Children information: we process only data subjects Personal Information with a valid driver license. Where children may accompany persons 18 years and older and we are required to Process the Children information, we will obtain the consent from a Competent Person before we process the Children Information.
Submission of Personal Information on behalf of data subject: If you provide information on behalf of someone else, then it is your responsibility to i) ensure that the necessary Consent has been obtained from the data subject before making the Personal Information available to us, ii) ensure the accuracy, quality, and legality of the Personal Information. By submitting such Personal Information on behalf of another person, you indemnify us against any Third-party claim, where such Third-party claim relates to Personal Information that has been Processed by Us without the necessary Consent or other available exception allowed by law.
If you fail to provide Personal Information: Where we need to collect Personal Information from you to access the Property and you fail to provide that data when requested, we or the Recall Africa Client may prohibit you fro entering the Property.
3) HOW IS PERSONAL INFORMATION COLLECTED?
We use different methods to collect data from and about you including through:
Direct interactions. We collect your Personal Information when you enter the Property directly from you. This may be verbally or by using certain devices to scan you driver’s license and motor vehicle license disc.
Automated technologies or interactions. On the Property we may collect CCTV Footage of you and/or your vehicle.
4) HOW WE USE YOUR PERSONAL INFORMATION
Recall Africa will not sell your Personal Information.
All Personal Information that Recall Africa may receive from you shall be dealt with as confidential information.
Recall Africa will only use Personal Information within the framework of the law and its instructions from the Recall Africa Client.
We have set out below, in a table format, a description of all the ways Recall Africa plans to use Personal Information, and which of the legal bases Recall Africa relies on to do so. We have also identified what Recall Africa’s legitimate interests are where appropriate.
If POPIA, to which Recall Africa (as Operator) is subject to, oblige Recall Africa to carry out further processing, Recall Africa shall notify the Responsible Party of these legal requirements prior to processing, and if so required under the POPIA and/ or by the Information Regulator, obtain the necessary pre-authorisation for such further processing.
Purpose/Activity (“Intended Purpose”)
Type of data
Lawful basis for processing including basis of legitimate interest
Retention Period
To register you and/or the vehicle under your control (where applicable) when you enter and/or exit a secured property of a Recall Africa Client
(a) Identity, (b) Contact, (c) Vehicle license disc / registration number
(a) Consent
(b) Pursuing the legitimate interests of the Recall Africa client and/or Recall Africa
1 month
To follow Recall Africa’s Client’s COVID 19 protocol and determine whether you can be allowed on to the Recall Africa’s client property
(a) Identity, (b) Contact, (c) Special Personal Information
(a) Consent, (b) Necessary to comply with a legal obligation, (c) Necessary for Recall Africa’s legitimate interests and the interest of other persons on the premises, (d) Required by law
2 weeks
Investigation of any incident on the Property that relates to security and management of the Property
- Identity (b) Contact and (c) Special Personal (CCTV Footage)
(a) Consent, (b) Processing is necessary for the establishment, exercise or defence of a right or
obligation in law; (c) Processing is carried out by bodies charged by law.
For duration of investigation and possible subsequent prosecution
Direct Marketing: No Personal Information is utilised for Direct Marketing Purposes.
Change of Intended Purpose
We will only use your Personal Information for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If you wish to get an explanation as to how the processing for the new purpose is compatible with the original purpose, please contact us.
If we need to use your Personal Information for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so.
Please note that we may process your Personal Information without your knowledge or Consent, in compliance with the above rules, where this is required or permitted by law.
5) DISCLOSURES OF PERSONAL INFORMATION
We may share Personal Information with the following parties:-
Responsible Party: We share the Personal Information with the Recall Africa’s Client. Sharing of the personal information is subject to our Services Agreement with the Recall Africa Client;
Internal Third parties as set out in the Definitions. Where we share Personal Information to our group (collaborating companies/ partners/ agents), we ensure your Personal Information is protected by requiring all our collaborating companies to follow this Policy when processing your Personal Information.
External Third parties as set out in the Definitions.
Third parties to whom we may choose to sell, transfer or merge all or parts of our business or our assets. Alternatively, we may seek to acquire other businesses or merge with them. If a change happens to our business, then the new owners may use your Personal Information in the same way as set out in this Privacy Policy.
We require all Third parties to respect the security of your Personal Information and to treat it in accordance with the law. We do not allow our Third-party service providers to use your Personal Information for their own purposes and only permit them to process your Personal Information for specified purposes and in accordance with our instructions.
6) INTERNATIONAL TRANSFERS
Some of our External Third parties may be based outside your country so their processing of your Personal Information could involve a transfer of data outside your country.
Whenever we transfer your Personal Information out of your country, we ensure a similar degree of protection is afforded to it by ensuring at least one of the following safeguards is implemented:
We will only transfer your Personal Information to countries that have appropriate data protection and privacy legislation to protect your Personal Information.
Where we use certain service providers, we conclude an agreement with them to confirm that your Personal Information is confidential, they can only process on our instructions and that they should establish and maintain appropriate technological and organisational measurements to protect your Personal Information.
Confirmation that the necessary pre-authorisation from the Information Regulator (only where said pre-authorisation is required by POPIA, has been obtained by the Responsible Party, i.e. section 57 of the POPIA.
By submitting your Personal Information to us, you Consent to the transfer of your Personal Information outside the borders of the Republic of South Africa.
7) DATA SECURITY
Recall Africa has put in place appropriate technological and organisational measures to prevent Personal Information from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, Recall Africa limits access to Personal Information to those employees, agents, contractors and other Third parties who have a business need to know. They will only process Personal Information on Recall Africa’s instructions, and they are subject to a duty of confidentiality.
Where Recall Africa acts as Operator, the Responsible Party must ensure that it has implement appropriate technical and organisational measures against unauthorised or unlawful processing, access, disclosure, copying, modification, storage, reproduction, display or distribution of Personal Information, and against accidental or unlawful loss, destruction, alteration, disclosure or damage of Personal Information. Other than securing the Personal Information on collection and storing the Personal Information on behalf of the Responsible Party via the Recall Africa Services, Recall Africa shall not be responsible for any other Responsible Party’s security safeguard obligations.
8) DATA RETENTION
Personal Information will only retained as per the above table, however Recall Africa may retain data subjects’ Personal Information for longer periods if required by law or in the event of a complaint or if Recall Africa reasonably believes there is a prospect of an investigation (related to the Intended Purpose) or litigation.
In some circumstances you can ask Recall Africa to delete your data: see Legal rights of data subjects below for further information.
In some circumstances Recall Africa will anonymise/ de-identify the Personal Information (so that it can no longer be associated with the data subject) for research or statistical purposes, in which case Recall Africa may use this information indefinitely without further notice to said data subject.
9) RECORDS
Recall Africa will keep detailed, accurate and up-to-date written records regarding any processing of Personal Information it carries out, including but not limited to, the access, control and security of the Personal Information and approved subcontractors, the processing purposes, categories of processing, any transfers of Personal Information to a Third-party country and related safeguards, the instructions as received from the Recall Africa client and a general description of the technical and organisational security measures and retention and destruction of Personal Information.
10) LEGAL RIGHTS OF DATA SUBJECTS
Under certain circumstances, you have the rights under POPIA to:
Request access to Personal Information (commonly known as a "data subject access request").
Request correction of the Personal Information held by the Responsible Party or Us. This enables a data subject to have any incomplete or inaccurate data We hold about the data subject corrected, though We may need to verify the accuracy of the new data provided to Us.
Object to processing of Personal Information where the Repsonsible Party or Us are relying on a legitimate interest (or those of a Third party) and there is something about your particular situation which makes you want to object to processing on this ground. In some cases, We/Responsible Party may demonstrate that it has compelling legitimate grounds to process your information which override your rights and freedoms.
Withdraw Consent at any time where We are relying on Consent to process your Personal Information. However, this will not affect the lawfulness of any processing carried out before you withdraw your Consent. If you withdraw your Consent, You will not be allowed to access to the Property. We will advise you if this is the case at the time you withdraw your Consent.
Take note of the following that will apply where Recall Africa acts as Operator and the Recall Africa Client as the Responsible Party:
Recall Africa will notify the Recall Africa Client immediately if it receives any complaint, notice or communication that relates directly or indirectly to the processing of the Personal Information or to either party's compliance with the Data Protection Legislation.
Recall Africa will notify the Recall Africa Client within 2 (two) working days if it receives a request from a Data Subject for access to their Personal Information or to exercise any of their related rights under the data protection legislation.
Recall Africa will give the Recall Africa Client its full co-operation and assistance where reaspmably possible. Recall Africa shall not be liable for the Recall Africa Client’s non-compliance of any data subject requests.
Recall Africa shall not disclose the Personal Information to you/any Data Subject or to a Third party unless written instruction has been obtained from the Responsible Party or as required by law.
Where you, as a data subject is a client/ customer/ employee of the Recall Africa Client or resident or visitor to the Property and wishes to submit a complaint or request, then we recommend that you submit it to the Recall Africa Client and only if you receive no reply to use our details as per par 1)b) above
Fee required: Apart from any prescribed fees under any applicable data protection legislation, the data subject will not have to pay a fee to access his/ her/ its Personal Information (or to exercise any of the other rights).
What we may need from the data subject: We may need to request specific information from you to help us confirm your identity and ensure your right to access the Personal Information. This is a security measure to ensure that Personal Information is not disclosed to any person who has no right to receive it.
Time limit to respond: Recall Africa tries to respond to all legitimate requests within 30 (thirty) days. Occasionally it could take Recall Africa longer than 30 (thirty) days if the data subject’s request is particularly complex or he/ she/ it has made a number of requests. In this case, Recall Africa will notify the data subject and keep him/ her/ it updated.
11) SUBCONTRACTORS
Recall Africa may authorise a Third party (subcontractor) to process the Personal Information. Were Recall Africa uses subcontractors, Recall Africa will enter into a written contract with the subcontractor that contains terms substantially the same as those set out in this Privacy Policy, in particular, in relation to requiring appropriate technical and organisational data security measures; and ii) maintain control over all Personal Information it entrusts to the subcontractor.
Recall Africa undertakes to ensure that all subcontractors who process Personal Information of data subjects, shall not amend, modify, merge or combine such Personal Information and process same as per instructions from Recall Africa.
12) PERSONAL INFORMATION BREACH (WHERE RECALL AFRICA ACTS AS OPERATOR)
Recall Africa will without undue delay notify the Recall Africa Client if any Personal Information (of the Recall Africa Client or its data subject) is lost or destroyed or becomes damaged, corrupted, or unusable and where reasonably possible assist the Recall Africa Client.
It is the Recall Africa Client’s decision on whether to notify the data subjects, supervisory authorities, regulators or law enforcement agencies about a possible data breach and whether to offer any type of remedy to affected data subjects, including the nature and extent of such remedy.
13) DEFINITIONS
Consent means any voluntary, specific and informed expression of will in terms of which permission is given for the processing of Personal Information.
Data Subject means the person to whom Personal Information relates and, in this document, refers to you as the party providing Personal Information that will be processed by Recall Africa or a relevant Third party.
Operator means a party who processes Personal Information for a Responsible Party in terms of a contract or mandate, without coming under the direct authority of that Responsible Party.
Personal Information means information as defined in the Protection of Personal Information Act 4 of 2013 (POPI Act - Click on link to view).
POPIA means the Protection of Personal Information Act 4 of 2013;
Processing means any operation or activity or any set of operations, whether or not by automatic means, concerning Personal Information, including, the collection, receipt, recording, organisation, collation, storage, updating or modification, retrieval, alteration, consultation or use, dissemination by means of transmission, distribution or making available in any other form; or merging, linking, as well as restriction, degradation, erasure or destruction of information.
Responsible Party means a public or private body or any other person which, alone or in conjunction with others, determines the purpose of and means for processing Personal Information.
Special Personal Information means information as defined under the POPI Act (Click on link to view).
THIRD PARTIES
Internal Third parties: Partners, affiliates, employees, shareholders, directors and/ or agents of Recall Africa (if applicable), acting as Operator for the Intended Purposes.
External Third parties
Authorised Users as instructed by Recall Africa Clients (Recall Africa clients acting as Responsible Parties);
Service providers acting as our Operators who provide IT and system administration services.
Service providers integrated as sub-contractors into the Recall Africa services.
Professional advisers acting as Operators or joint Responsible Parties, including lawyers, bankers, auditors and insurers who provide consultancy, banking, legal, insurance and accounting services.
The Revenue services, regulators and other authorities acting as operators or joint Responsible parties who require reporting of processing activities in certain circumstances.
Courts of law or any other authorities where the Responsible Party has an obligation under law to share the data subject’s Personal Information.