Privacy notice

1. Who We Are

Bridging Technologies South Africa (Pty) Ltd (BT-SA) is an ICT and security infrastructure company operating in South Africa. For personal information that BT-SA determines how and why to process, BT-SA is the responsible party under the Protection of Personal Information Act 4 of 2013 (POPIA).

This Notice is provided to explain what personal information we may process, why we process it, who we may share it with, how we protect it and how you can exercise your rights.

2. Who This Notice Applies To

This Notice may apply to customers and prospective customers, suppliers and subcontractors, business contacts, visitors, website users, job applicants, employees and former employees, and other individuals or organisations that interact with BT-SA.

POPIA can protect personal information relating to natural persons and, in appropriate circumstances, juristic persons.

3. Personal Information We May Collect

The information we collect depends on your relationship with us and the reason for the interaction. We may process:

• name, identity or registration information, contact details, address, signature and correspondence;
• business contact information, employer, job title and relationship to a customer, supplier or other organisation;
• quotation, order, contract, service, project, warranty, support and complaint information;
• payment, banking, billing, tax, credit or transaction information where relevant;
• supplier, subcontractor and due-diligence information, including ownership or beneficial-ownership information where relevant;
• job-application, qualification, employment-history and screening information for applicants;
• employee and workforce information required for employment, payroll, benefits, employment equity, health and safety, performance, training, leave, discipline and related lawful purposes;
• security and technical information such as system logs, account identifiers, device information, CCTV or access-control information where used;
• website enquiries, IP/device or log information, cookies and similar technologies; and
• other information you provide to us or that we are lawfully required to collect.

4. Special Personal Information

In limited circumstances BT-SA may process special or sensitive personal information where permitted by law and necessary for a legitimate purpose. Examples may include health information for occupational health and safety or accommodation, race or ethnic-origin information for lawful employment-equity purposes, biometric or access information where used for security, and criminal-behaviour information where lawful role-based screening is justified. Access to this information is restricted and additional confidentiality controls apply.

5. How We Obtain Personal Information

We usually collect personal information directly from you, for example when you contact us, request a quotation, place an order, sign a contract, submit a website enquiry, apply for employment, visit our premises or communicate with our staff.

Where lawful and appropriate, we may also obtain information from your employer or organisation, customers, suppliers, referees, screening or verification providers, public records, government or regulatory sources, technology/security systems or other lawful sources.

6. Why We Process Personal Information

Depending on the context, we may process personal information to:

• respond to enquiries and prepare quotations or proposals;
• conclude, administer and perform contracts, orders, projects, maintenance, support and warranty obligations;
• manage customer, supplier, subcontractor and business relationships;
• process invoices, payments, credit, finance, tax and accounting records;
• perform supplier, customer or employee due diligence and verification where lawful and proportionate;
• recruit, employ, pay, train, manage and support employees and meet employment, payroll, HSE and employment-equity obligations;
• protect people, premises, systems, information and assets and investigate suspected misconduct, fraud or security incidents;
• comply with legal, regulatory, contractual, audit, insurance and customer requirements;
• manage complaints, disputes, claims and legal proceedings;
• operate, secure and improve our website, systems and services; and
• communicate about BT-SA products or services where direct marketing is permitted by law.

7. Lawful Basis and Consent

We process personal information only where there is a lawful justification under POPIA. Depending on the circumstances, this may include your consent, the conclusion or performance of a contract, compliance with a legal obligation, protection of a legitimate interest, or pursuit of a legitimate interest of BT-SA or a third party where permitted by law.

Where consent is legally required, you may withdraw it for future processing. Withdrawal does not invalidate processing that was lawful before withdrawal and does not prevent us from retaining information where another legal basis requires or permits retention.

8. Is Providing the Information Mandatory?

Some information is voluntary, while other information is necessary to enter into or perform a contract, make a payment, provide access to a site or system, comply with law, complete required due diligence or administer an employment relationship.

If required information is not provided, BT-SA may be unable to provide a quotation or service, enter into or perform a contract, make or receive payment, grant access, process an application, meet a legal obligation or complete the requested transaction.

9. Who We May Share Personal Information With

We do not disclose personal information merely because it is available to us. Where necessary and lawful, information may be shared with:

• BT-SA employees and authorised contractors who require it for their work;
• approved IT, cloud, hosting, security, payroll, accounting, banking, logistics, screening, professional-advisory or other service providers that support BT-SA;
• customers, suppliers, OEMs, subcontractors or project partners where disclosure is necessary for an authorised project, service, warranty, safety or commercial purpose;
• insurers, auditors, legal advisers and other professional advisers;
• government departments, regulators, courts, law-enforcement bodies or other authorities where required or permitted by law; and
• another party in connection with a legitimate corporate transaction, subject to appropriate confidentiality and legal safeguards.

Service providers that process personal information on our behalf are required to protect the information and use it only for authorised purposes.

10. Processing for Customers

In some engagements BT-SA may encounter or process personal information on behalf of a customer. In those circumstances, the customer may be the responsible party and BT-SA may act as an operator. BT-SA will process that information only as authorised for the agreed service and subject to applicable contractual, confidentiality and security requirements.

BT-SA personnel are not permitted to copy, retain or use customer personal information for unrelated purposes.

11. Cross-Border Processing

Some approved technology or cloud service providers may process or store information outside South Africa. Where personal information is transferred across borders, BT-SA will apply the requirements of section 72 of POPIA and appropriate contractual, legal and security safeguards.

12. How We Protect Personal Information

BT-SA uses reasonable technical and organisational safeguards proportionate to the nature and risk of the information. These may include access controls, multi-factor authentication, endpoint and network security, patching and vulnerability management, approved business systems, restricted sharing, backups, physical security, secure disposal, monitoring and staff awareness.

No security measure can eliminate all risk. If we become aware of a security compromise affecting personal information, we will investigate and make notifications required by POPIA and applicable contractual obligations.

13. How Long We Keep Personal Information

We retain personal information only for as long as reasonably necessary for the purpose for which it was collected, or for a longer period where required or permitted by law, tax or employment obligations, contract, warranty/support requirements, litigation or investigation holds, or another legitimate and lawful reason.

When information is no longer required, it will be deleted, de-identified, destroyed or otherwise disposed of securely, subject to applicable record-retention requirements.

14. Website, Cookies and Similar Technologies

Our website may use cookies, logs and similar technologies to operate and secure the site, remember preferences, understand website usage and improve the user experience. The exact technologies used may change as the website changes.

You can control many cookies through your browser settings. Disabling certain cookies may affect website functionality.

15. Direct Marketing

BT-SA may send information about its own products or services where permitted by POPIA. Where prior consent is required for unsolicited electronic marketing, we will seek that consent in the manner required by law. Existing customer details may be used only where POPIA permits this.

You may opt out of marketing communications at any time by using the unsubscribe or opt-out method provided, or by contacting us. An opt-out will be respected for future marketing subject to reasonable processing time.

16. Children’s Personal Information

BT-SA’s products and services are not directed at children. We do not intentionally collect personal information from persons under 18 for marketing purposes. Where children’s information must be processed for a lawful employment-benefit, safety, contractual or other legitimate purpose, it will be handled only where POPIA permits the processing and with appropriate safeguards.

17. Your Rights

Subject to POPIA, PAIA and other applicable law, you may have the right to:

• ask whether BT-SA holds personal information about you and request access to it;
• request correction or deletion of information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or unlawfully obtained, where the legal requirements are met;
• object to certain processing on reasonable grounds where POPIA allows an objection;
• withdraw consent where processing is based on consent;
• object to or opt out of direct marketing;
• complain to BT-SA about how your information has been handled; and
• lodge a complaint with the Information Regulator (South Africa).

We may need to verify your identity or authority before acting on a request. A request to delete information cannot require BT-SA to destroy records that we are legally entitled or obliged to retain.

18. Contact BT-SA’s Information Officer

Privacy requests, objections, complaints or questions may be directed to:

19. Complaints to the Information Regulator

If you believe that BT-SA has not resolved a privacy concern appropriately, you may lodge a complaint with the Information Regulator (South Africa). Current contact information includes:

20. Changes to this Notice

BT-SA may update this Privacy Notice when its processing activities, legal obligations, technology or business practices change. The current version will be made available through BT-SA’s website or other appropriate channels. Material changes will be communicated where reasonably necessary.