Access to Information, Privacy and Data Protection Terms

1 INTRODUCTION

1.1These Privacy and Data Protection Terms ("these Terms") are issued by The Shard (Pty) Ltd, a private company registered under the company laws of the Republic of South Africa with registration number 2013/161809/07 (hereinafter referred to as "The Shard").

1.2These Terms set out the manner in which The Shard collects, processes, stores, discloses and protects Personal Data, and apply to:

1.2.1Personal Data which The Shard processes as a Responsible Party, including in respect of visitors to its websites, business contacts, suppliers, job applicants and the Users of its Platforms; and

1.2.2Client Data which The Shard processes as an Operator on behalf of the Client in terms of a Client Agreement.

1.3These Terms shall be read in conjunction with any agreement concluded between The Shard and a Client for the provision of the Services (a "Client Agreement").

1.4In the event of a conflict between the provisions of these Terms and the provisions of a Client Agreement, the provisions of the Client Agreement shall prevail, save to the extent that these Terms afford greater protection to Personal Data, in which event these Terms shall prevail.

1.5The rights to privacy and access to information are fundamental constitutional rights regulated and given statutory protections by the Protection of Personal Information Act (2013) and the Promotion of Access to Information Act (2000).

1.6The purpose of the policy is to ensure that the company gives effect to the spirit, purport and latter of these legal instruments.

2 APPLICATIONS

2.1The policy is applicable and binding on the company, its clients in relation to information, electronic or otherwise, relating to it and / or any of its employees, clients or other persons acquired because of such persons’ relations with the company.

2.2In the event of a conflict between the provisions of this policy and of a contract / agreement entered with any of the company’s clients the provisions of that contract / agreement entered with the client or employee shall prevail.

3 ACCESS TO INFORMATION HELD BY THE COMPANY

3.1The right to access information is a fundamental constitutional right and persons in the Republic, be they juristic or natural persons, have the right to access information held by either a public or a private body.

3.2The company’s chief executive officer shall be its information officer and any person, juristic or natural, requesting information in the company’s possession shall direct such a request to the chief executive officer.

3.3The company’s chief executive officer shall provide such information to the extent that doing so will not be in contravention of any clause hereof or of any provision of the Protection of Personal Information Act.

4 DEFINITIONS AND INTERPRETATION

4.1In these Terms, unless the context indicates a contrary intention:

4.1.1clause headings are inserted for convenience of reference only and shall not be taken into account in the interpretation of these Terms;

4.1.2words in the singular include the plural, and vice versa;

4.1.3any reference to an enactment is a reference to that enactment as amended or replaced from time to time;

4.1.4the words "includes" and "including" shall be construed as being followed by the words "without limitation"; and

4.1.5any reference to "days" is a reference to calendar days, unless the reference is expressly to Business Days.

4.2In these Terms the following expressions and words have the meanings assigned to them:

4.2.1"Affiliate" means any company which controls, is controlled by, or is under common control with The Shard;

4.2.2"Business Day" means any day other than a Saturday, Sunday or public holiday as gazetted by the government of South Africa from time to time;

4.2.3"Client" means any organisation which has concluded a Client Agreement with The Shard;

4.2.4"Client Agreement" bears the meaning assigned to it in clause 1.3;

4.2.5"Client Data" means data provided by the Client to The Shard, including Personal Data, and stored on any system managed by The Shard, which relates to the Client and third parties;

4.2.6"Confidential Information" means all information relating to a Party's business activities, financial affairs, products, services, clients, Intellectual Property, data and know how, which becomes known to the other Party;

4.2.7"Data Protection Legislation" means POPIA and any other legislation enacted to protect personal, commercial and governmental data from unauthorised access, alteration, destruction or use;

4.2.8"Data Subject" means the person to whom Personal Data relates;

4.2.9"Information Officer" means the information officer of The Shard registered with the Information Regulator in terms of POPIA;

4.2.10"Information Regulator" means the Information Regulator established in terms of section 39 of POPIA;

4.2.11"Intellectual Property" means any copyright, rights in databases, data, know how and other intellectual property rights, whether or not registered;

4.2.12"Operator" bears the meaning assigned to it in POPIA, being a person who processes Personal Data for a Responsible Party in terms of a contract or mandate, without coming under the direct authority of that party;

4.2.13"Party" means The Shard or the Client, and "Parties" shall have a corresponding meaning;

4.2.14"Personal Data" means personal information as defined in POPIA, being information relating to an identifiable, living, natural person and, where applicable, an identifiable, existing juristic person;

4.2.15"Platforms" means the software platforms owned and operated by The Shard and made available to the Client as part of the Services, including the Contract Management Tool and the Budget and Costing System;

4.2.16"POPIA" means the Protection of Personal Information Act 4 of 2013, together with its regulations;

4.2.17"Processing" bears the meaning assigned to it in POPIA, and "process" and "processed" shall have corresponding meanings;

4.2.18"Responsible Party" bears the meaning assigned to it in POPIA, being the party which alone or together with others determines the purpose of and means for processing Personal Data;

4.2.19"Security Compromise" means any reasonable grounds to believe that Personal Data has been accessed or acquired by an unauthorised person, as contemplated in section 22 of POPIA;

4.2.20"Services" means the services provided by The Shard to the Client in terms of a Client Agreement, including access to the Platforms;

4.2.21"Special Personal Data" means special personal information as contemplated in section 26 of POPIA, including information concerning health, religious or philosophical beliefs, race or ethnic origin, trade union membership, political persuasion, sex life, biometric information and criminal behaviour;

4.2.22"Staff" means any director, employee, agent, consultant, contractor or other representative of The Shard or its subcontractors involved in providing the Services; and

4.2.23"User" means any person authorised by the Client to access and use a Platform.

5 ROLES OF THE PARTIES

5.1The Shard shall act as the Responsible Party in relation to Personal Data collected and processed for its own business purposes, including the administration of User accounts, the management of its relationships with the Client, suppliers and business contacts, recruitment, marketing, and the security of its systems.

5.2In relation to Client Data, The Shard shall act as an Operator and the Client shall act as the Responsible Party. The Client shall determine the purposes and means by which The Shard processes Client Data.

5.3A Data Subject whose Personal Data forms part of Client Data shall, in the first instance, direct any related enquiry, request or complaint to the Client. If The Shard receives any such enquiry, request or complaint, it shall refer the matter to the Client in accordance with clause 13.4.

6 PERSONAL DATA COLLECTED

6.1The Shard shall collect only Personal Data that is adequate, relevant and not excessive in relation to the purpose for which it is processed, and may collect the following categories of Personal Data:

6.1.1in relation to Users: name, work email address, mobile number (used for one time PINs and for notifications by email, SMS or WhatsApp), role, log in records, IP address, and an audit record of each document or record viewed, changed, downloaded or shared;

6.1.2in relation to the Client, suppliers and their representatives: name, designation, organisation, contact details, billing and banking details for payment purposes, and tax and B BBEE compliance details;

6.1.3in relation to business contacts: name, designation, organisation, contact details and marketing preferences;

6.1.4in relation to visitors to The Shard's websites: IP address, browser and device information, pages viewed, and cookie data;

6.1.5in relation to job applicants: curriculum vitae, qualifications, employment history, references and, where a background check is required by law, identification details; and

6.1.6in relation to visitors to The Shard's premises: name and times of entry and exit.

6.2The Shard collects Personal Data from the following sources: directly from the Data Subject; from the Client or the Data Subject's employer; from recruitment agencies and referees; and from publicly available sources.

6.3The Shard does not intentionally collect Special Personal Data, or the Personal Data of children, for its own purposes. Where Client Data includes Special Personal Data, such as the medical records of the Client's employees, The Shard shall process such data strictly in accordance with the Client's instructions and clause 11.

7 PURPOSES AND LAWFUL BASIS OF PROCESSING

7.1The Shard shall process Personal Data, as Responsible Party, only for a specific, explicitly defined and lawful purpose, or for a further purpose compatible therewith as contemplated in sections 13 and 15 of POPIA.

7.2The Shard shall process Personal Data for the following purposes and on the following lawful bases in terms of section 11 of POPIA:

7.2.1to provide the Services and operate the Platforms, including User authentication, notifications and support, being processing necessary for the conclusion or performance of a Client Agreement;

7.2.2for invoicing, accounting, tax, B BBEE and procurement compliance, being processing necessary to comply with an obligation imposed by law and for the performance of a Client Agreement;

7.2.3to secure its systems, maintain audit trails and prevent fraud, being processing necessary to comply with an obligation imposed by law and to pursue the legitimate interests of The Shard and the Client;

7.2.4to improve the Services by way of usage statistics which do not identify any Data Subject or the Client, being processing necessary to pursue the legitimate interests of The Shard;

7.2.5to send marketing communications, publications and event invitations, subject to clause 14.1;

7.2.6to consider applications for employment, with the consent of the applicant and as necessary to take steps prior to the conclusion of a contract; and

7.2.7to establish, exercise or defend legal rights and to resolve disputes, being processing necessary to protect the legitimate interests of The Shard.

8 PROCESSING OF CLIENT DATA

8.1The Parties record that, as between them, all Client Data, in whatever form or medium, constitutes the Intellectual Property of the Client, and that all right, title and interest in and to the Client Data vests in and remains with the Client.

8.2In processing Client Data, The Shard shall:

8.2.1process Client Data only with the knowledge or authorisation of the Client, in accordance with the Client's instructions (having regard to the Data Protection Legislation), or as required by law;

8.2.2treat Client Data as Confidential Information of the Client and not disclose it except in accordance with the Client's instructions or as required by law;

8.2.3disclose Client Data only to those of its Staff who are actively involved in the provision of the Services, and then only on a "need to know" basis, and ensure that such Staff are aware of The Shard's obligations under these Terms and the Data Protection Legislation and are notified that any unauthorised processing or disclosure may lead to disciplinary action or the termination of their engagement;

8.2.4not sell Client Data, nor use it for marketing, nor make it available to any other client of The Shard, nor use it to develop or train any artificial intelligence model for the benefit of any person other than the Client;

8.2.5reasonably cooperate with the Client and provide such information as the Client may reasonably require to comply with its obligations under the Data Protection Legislation, including in responding to requests from Data Subjects; and

8.2.6enter into a data transfer agreement where the Client (acting reasonably) considers this necessary in order to comply with the Data Protection Legislation.

8.3Notwithstanding clause 8.2.4, The Shard may compile statistics regarding the use of the Platforms, provided that such statistics do not identify, and cannot reasonably be used to identify, the Client or any Data Subject.

8.4For the avoidance of doubt, The Shard's right to provide the same or similar services to other persons shall not entitle The Shard to use, modify, disclose or otherwise exploit Client Data.

8.5The Client acknowledges that the Platforms are designed to support its obligations as a public institution, and that accordingly records are marked as expired or terminated rather than deleted, changes to records are subject to approval, and all actions are recorded in an audit log.

9 DISCLOSURE AND SUBCONTRACTING

9.1The Shard shall not sell, rent or trade Personal Data. The Shard may, however, disclose Personal Data to the following recipients, and then only to the extent necessary:

9.1.1its hosting, technology and messaging service providers, including providers of email, SMS and WhatsApp notification services, as listed in Annexure A;

9.1.2its marketplace and distribution partners, provided that such disclosure shall be limited to the business contact and billing details required to process an order;

9.1.3its professional advisors, including its auditors, attorneys and insurers;

9.1.4its Affiliates, including its office in Nairobi, Kenya, strictly on a "need to know" basis;

9.1.5any government, regulatory or other authority, court or law enforcement agency, where such disclosure is required by law; and

9.1.6a successor to The Shard's business, provided that Client Data shall not be disclosed to such successor without the prior written consent of the Client.

9.2The Shard shall not subcontract the processing of Client Data to any third party without the prior written approval of the Client. Any approved third party shall conclude a confidentiality agreement with the Client and shall be bound by written terms no less protective of Client Data than these Terms. The Shard shall remain liable to the Client for all processing performed by such third party.

10 TRANSBORDER TRANSFERS

10.1The Shard shall host Client Data within the Republic of South Africa.

10.2The Shard shall not transfer Personal Data to a third party in a foreign country unless the transfer is permitted under section 72 of POPIA, including where:

10.2.1the recipient is subject to a law, binding corporate rules or a binding agreement that provides an adequate level of protection substantially similar to that afforded by POPIA;

10.2.2the Data Subject has consented to the transfer; or

10.2.3the transfer is necessary for the performance of a contract between the Data Subject and The Shard.

10.3Notwithstanding clause 10.2, The Shard shall not transfer Client Data outside the Republic of South Africa without the prior written approval of the Client.

11 SECURITY SAFEGUARDS AND SECURITY COMPROMISES

11.1The Shard shall take appropriate, reasonable technical and organisational measures and physical security measures to prevent the unauthorised or unlawful processing of Personal Data and the accidental loss or destruction of, or damage to, Client Data, as contemplated in section 19 of POPIA. Such measures shall include:

11.1.1encryption of Personal Data in transit and at rest;

11.1.2User authentication by password and one time PIN;

11.1.3role based access controls, such that each User has access only to the records required for that User's role;

11.1.4audit logs recording the viewing, amendment, download and sharing of each record;

11.1.5watermarking of documents exported or shared from the Platforms;

11.1.6read only access links for external parties, which expire automatically on the date set by the Client;

11.1.7regular backups and tested recovery procedures; and

11.1.8confidentiality undertakings from, and training of, its Staff.

11.2Should The Shard, as Operator, have reasonable grounds to believe that a Security Compromise has occurred in respect of Client Data, The Shard shall notify the Client in writing (which shall include by way of email) immediately, and in any event within 48 (forty eight) hours of becoming aware thereof, as contemplated in section 21(2) of POPIA. Such notice shall set out the nature and extent of the Security Compromise, the measures taken or proposed to address it, and the contact details of the person responsible at The Shard.

11.3Should a Security Compromise occur in respect of Personal Data for which The Shard is the Responsible Party, The Shard shall notify the Information Regulator and the affected Data Subjects as soon as reasonably possible after its discovery, in accordance with section 22 of POPIA.

11.4The Shard shall reasonably cooperate with the Client in investigating and remedying any Security Compromise affecting Client Data and in any notification which the Client is required to make.

12 RETENTION, RETURN AND DESTRUCTION

12.1The Shard shall not retain Personal Data for longer than is necessary to achieve the purpose for which it was collected, unless retention is required or authorised by law, as contemplated in section 14 of POPIA.

12.2Without derogating from the generality of clause 12.1, The Shard shall retain the following records for the periods set out below:

12.2.1Client Data, including audit logs: for the duration of the relevant Client Agreement and in accordance with the Client's retention instructions;

12.2.2its contracts, invoices and accounting records: for 7 (seven) years, as required by company and tax law;

12.2.3the Personal Data of business contacts held for marketing purposes: until the earlier of the Data Subject's objection to such processing and the expiry of 24 (twenty four) months after the last interaction;

12.2.4the Personal Data of unsuccessful job applicants: for 12 (twelve) months, unless the applicant consents to a longer period; and

12.2.5records of visitors to its premises: for 3 (three) months.

12.3On termination of a Client Agreement, The Shard shall return all Client Data to the Client in the format in which it was received and, at the Client's election, shall destroy all remaining copies thereof, save to the extent that retention is required by law.

12.4The Shard shall destroy, delete or anonymise Personal Data that is no longer required, in a manner that prevents its reconstruction in an intelligible form.

12.5The confidentiality obligations in these Terms shall survive the termination of a Client Agreement for a period of 3 (three) years.

13 RIGHTS OF DATA SUBJECTS

13.1Subject to POPIA, a Data Subject shall be entitled to:

13.1.1request confirmation of whether The Shard holds Personal Data about the Data Subject, and a record thereof;

13.1.2request the correction, updating or deletion of Personal Data that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or obtained unlawfully;

13.1.3object, on reasonable grounds, to the processing of Personal Data based on legitimate interests;

13.1.4object at any time to the processing of Personal Data for direct marketing;

13.1.5not be subject to a decision which results in legal consequences for the Data Subject and which is based solely on the automated processing of Personal Data; and

13.1.6lodge a complaint with the Information Regulator.

13.2Requests in terms of clause 13.1 shall be made in writing to the Information Officer. The Shard shall respond within 30 (thirty) days of receipt and may require reasonable proof of identity before doing so.

13.3Requests for access to records may also be made in terms of The Shard's manual published under the Promotion of Access to Information Act 2 of 2000, in which event the prescribed fees may apply.

13.4Should The Shard receive a request from a Data Subject in respect of Client Data, The Shard shall refer the request to the Client within 5 (five) Business Days of receipt and shall not respond to the Data Subject save on the Client's instructions.

14 DIRECT MARKETING, COOKIES, MINORS AND AUTOMATED PROCESSING

14.1The Shard shall send direct marketing communications only to a Data Subject who has consented thereto, or to an existing client in respect of The Shard's own similar services, in accordance with section 69 of POPIA. Each communication shall include a means by which the Data Subject may opt out free of charge.

14.2The Platforms use only those cookies which are strictly necessary for User authentication and session security. The Shard's websites use analytics cookies only with the consent of the visitor. A visitor may block or delete cookies through browser settings, which may affect the functionality of the websites.

14.3The Services are directed at organisations and are not intended for persons under the age of 18 (eighteen) years. The Shard does not knowingly collect Personal Data of children.

14.4The Platforms may automatically extract information from documents uploaded by Users, including tender numbers, service provider names, contract values and dates. All information so extracted shall be reviewed and approved by a User before it is saved, and no decision which results in legal consequences for a Data Subject shall be based solely on such automated processing.

14.5Any third party artificial intelligence service used by The Shard to process Client Data shall be subject to clause 9.2 and shall be contractually bound not to retain Client Data beyond the processing request nor to use Client Data to train its models.

15 AMENDMENT, INFORMATION OFFICER AND COMPLAINTS

15.1The Shard may amend these Terms from time to time to reflect changes in the law or in its practices and shall publish the amended Terms on its website, together with the date on which they take effect. The Shard shall give the Client written notice of any material amendment at least 30 (thirty) days before its effective date. No amendment shall reduce the protection afforded to Client Data under these Terms or a Client Agreement unless agreed in writing and signed by both Parties.

15.2Any request, enquiry or complaint in respect of these Terms shall be addressed in writing to:

Information Officer: [Name]

The Shard (Pty) Ltd

Building B, 2nd Floor, 1 Sturdee Avenue, Rosebank, Johannesburg, 2196

Email: [privacy@theshard.co.za]

Telephone: +27 (0) 87 049 2302

15.3The Shard shall use its best endeavours to resolve any complaint within 30 (thirty) days of receipt. Should a Data Subject not be satisfied with The Shard's response, the Data Subject may lodge a complaint with the Information Regulator at inforegulator.org.za, enquiries@inforegulator.org.za or POPIAComplaints@inforegulator.org.za.

15.4Any dispute between The Shard and the Client arising from these Terms shall be resolved in accordance with the dispute resolution provisions of the relevant Client Agreement, and these Terms shall be governed by the law of the Republic of South Africa.

ANNEXURE A: SERVICE PROVIDERS

The Shard uses the following service providers in the provision of the Services, in terms of clause 9.1.1: