Protection of Personal Information Act (South Africa)
VUNA Exchange Ltd (Company No. 16840719), incorporated in England and Wales, is committed to full compliance with the Protection of Personal Information Act 4 of 2013 (POPIA) and its regulations. As a platform facilitating business relationships with South African BPO providers and processing personal information of South African data subjects, we recognize our responsibilities as a responsible party under POPIA.
This document outlines our POPIA compliance framework, the rights of data subjects under South African law, and our commitment to the lawful processing of personal information in accordance with the eight conditions for lawful processing.
We ensure responsible processing by:
Personal information is processed lawfully and in a reasonable manner that does not infringe privacy rights. We process information only:
Personal information is collected for specific, explicitly defined, and lawful purposes:
We do not process information for secondary purposes incompatible with original purposes unless new consent is obtained.
Further processing must be compatible with the original purpose. We assess compatibility by considering the relationship between purposes, the nature of information, consequences for data subjects, and the manner of further processing. Incompatible further processing requires new consent or legal justification.
We ensure personal information is:
Users can update their information through account settings. We verify critical information through documentation and third-party sources.
We maintain transparent documentation of processing activities, including:
This information is freely available through our Privacy Policy and on request.
We implement appropriate technical and organizational measures to secure personal information:
Data subjects have the right to:
We respond to requests within reasonable timeframes, generally within 30 days, and provide reasons for any refusal.
You have the right to be notified when your personal information is collected, including the purpose, intended recipients, whether provision is voluntary or mandatory, and consequences of refusal.
You may request confirmation of what personal information we hold, access to that information, and information about third parties who have accessed it. A prescribed fee may apply for access requests.
You may request correction of inaccurate, irrelevant, excessive, outdated, incomplete, misleading, or unlawfully obtained information. You may also request deletion where we are no longer authorized to retain it.
You may object to processing based on legitimate interests or for direct marketing purposes. We will cease processing unless we demonstrate compelling legitimate grounds that override your interests.
You have the right to lodge complaints with us or directly with the Information Regulator of South Africa regarding alleged infringements of POPIA.
POPIA recognizes certain categories as "special personal information" requiring heightened protection:
VUNA Exchange does not typically collect special personal information. If collection becomes necessary for specific purposes, we will:
POPIA provides special protections for children's personal information. VUNA Exchange is a B2B platform not directed at children under 18. We do not knowingly collect personal information from children.
If we become aware of collection from a child without appropriate parental/guardian consent, we will take steps to delete such information promptly.
POPIA Section 72 regulates transborder information flows. We transfer personal information outside South Africa only when:
For transfers to the United Kingdom and European Economic Area, we rely on adequacy determinations and standard contractual clauses ensuring equivalent protection.
In accordance with Section 22 of POPIA, if we have reasonable grounds to believe that personal information has been accessed or acquired by unauthorized persons, we will:
Report the compromise to the Information Regulator as soon as reasonably possible after discovery.
Inform affected individuals unless the Information Regulator directs otherwise, providing:
Where direct notification is not feasible or the Information Regulator determines public interest requires broader awareness, we will make public announcements through appropriate channels.
We comply with Section 69 regarding direct marketing:
When engaging third-party operators (processors) to process personal information on our behalf, we ensure:
Personal information is retained only as long as necessary for the purpose collected or required by law:
When no longer required, personal information is destroyed or de-identified using secure methods preventing reconstruction or identification. Destruction methods include secure deletion, shredding of physical documents, and cryptographic erasure.
To exercise your POPIA rights or make inquiries:
Email: informationofficer@vunaexchange.com
Email: privacy@vunaexchange.com
When submitting requests, please provide:
We will respond within a reasonable period, generally within 30 days. Access requests may be subject to prescribed fees to cover administrative costs.
If you believe we have not complied with POPIA, you may lodge a complaint with:
Information Regulator of South Africa
Website: www.justice.gov.za/inforeg
Email: inforeg@justice.gov.za
Physical Address:
JD House, 27 Stiemens Street
Braamfontein, Johannesburg, 2001
Postal Address:
P.O. Box 31533
Braamfontein, Johannesburg, 2017
We encourage you to contact us first so we can address your concerns directly before escalating to the regulator.
Vuna Exchange uses essential cookies to operate securely. With your consent, we also use analytics cookies to improve the platform during beta testing. Cookie Policy