Effective July 2021
1. Scope of Policy
This privacy statement shall apply throughout Ngubane firms and its related entities within the network firm as follows Ngubane Partnership (Durban) and any related entity herein after referred to as Ngubane (Durban) and Ngubane & Company (Johannesburg) Incorporated Reg No : 2010/016757/21 and Ngubane & Company Management Consultants ( Johannesburg) (Pty) Ltd Reg No 2010 / 016825 / 07 herein after referred to as Ngubane (Johannesburg). These firms are collectively referred to as Ngubane.
The Protection of Personal Information (“POPI”) Act emanates from Section 14 of the Constitution of the Republic of South Africa, 1996, which section provides that everyone has the right to privacy, and it includes a right to protection against the unlawful collection, retention, dissemination and use of personal information.
The POPI Act has been promulgated to regulate, in harmony with the international standards, the processing of personal information by public and private bodies in a manner that gives effect to the right to privacy, subject to justifiable limitations that are aimed at protecting other rights and important interests.
Ngubane is committed to protecting the privacy of personal information of our data subjects. The information you share with us as a data subject allows us to provide you with the best experience with our services, or as a stakeholder of Ngubane.
The purpose of this policy is to inform all data subjects about the type of personal information Ngubane collects and the ways in which it is collected, used, shared, protected and stored. By accessing Ngubane’s website and subsequently providing information, or when you provide us with your personal information directly, you indicate your acceptance of this policy.
It is important that you take all necessary and appropriate steps to protect your data yourself (for example, by ensuring that all passwords and access codes are kept secure).
Ngubane has dedicated policies and procedures in place to protect all personal information collected and processed by us. Please read below for more information on how we collect, process, use and disclose personal information.
|Name of entity||Ngubane (Johannesburg)||Ngubane (Durban)|
|Registered addresses:|| Woodmead Estate Office Park,
1 Woodmead Drive, Sandton, 2091
|29 Richefond Circle,
Ridgeside, Umhlanga Ridge, 4139
|Information officers and contact details|
|Ngubane (Johannesburg)||Nomathamsanqa Ashom
Tell: 011 254 0800
|Ngubane (Durban)||Felicia Nomsuka
Tell: +27 31 307 4794
3. Collection, processing and retention of data subjects
Personal data may either be collected directly from you, as data subject, or it may be collected from other sources such as:
- Public records.
- From another source, where the collection of the information will not prejudice your legitimate interests.
- From another source where the collection of the information is necessary:
- To comply with an obligation imposed by law or
- To maintain our legitimate interests or the legitimate interests of a third party to whom the information is supplied.
Where information is not collected directly from you as a data subject, we will take reasonable steps to inform you of the fact that the information was collected and will be processed.
You must not send us personal information about someone else without first getting his or her consent for it to be used and disclosed in the ways set out in this terms and conditions. This is because we will assume he or she has consented although we may still ask for confirmation from them. Where you do give us information about someone else, or someone else discloses a connection with you, that information may be taken into account with your other personal information.
3.1 Prospective employees
In applying for this position you may provide us with personal information as part of the application process. Most of the personal data we collect as part of our recruitment process is provided by you such as:
- Contact details (name, email, telephone number);
- Areas of interest;
- Username and password to apply for a role;
- CV, experience, education, academic and professional qualifications;
- Information provided as part of interviews and assessments;
- Diversity and equal opportunities data e.g gender; national, ethnic or social origin; colour; age; disability;
- Pre-employment screening information if your application is successful;
- Information about your and your immediate family’s financial relationships if your application is successful; and
- Bank account details if your application is successful.
We create personal data in connection with our recruitment activities such as:
- Interview and assessment results and feedback; and
- Offer details.
We may also obtain personal information while performing the required background check, reference check and credit check if relevant from other public or legal sources.We obtain personal data from third party sources such as:
- References from your named referees.
- Information from your referrer (where applicable);
- Results of screening checks (depending on the role applied for) e.g criminal history, alleged commission of offence and proceedings in respect of these offences;
- Verification of information provided during the recruitment process by contacting relevant third parties (for example, previous employers, education and qualification providers) or using publicly available sources (for example, to verify your experience, education and qualifications); and
- Information from social media sites that you are a member of about your engagement with our recruitment campaigns.
Purpose for processing
- Provided for possible employment purposes.
- Possible employment purposes including background checks, reference checks, criminal record checks, Home Affairs checks and qualification checks.
- Communication on Possible employment purposes.
If your application is successful we retain relevant personal data as part of your employee record should you accept our offer of employment. If your application is unsuccessful, we retain and use the information you provided to Ngubane as part of your application for a reasonable period of time to deal with any matter which may arise in connection with your application, for purposes of contacting you regarding other employment opportunities and for our legitimate business purposes. Your personal information will be kept for a minimum period allowed per legislation in order for us to comply with all legal requirements.
3.2 Employees – Staff, Directors/Partners and Contractors
We collect personal data concerning our own personnel (partners, staff and individual contractors) to administrate the employment relationship and manage our business.
Please refer to our privacy statement available on Ngubane Intranet for information on why and how personal data is collected and processed in relation to your role with Ngubane.
In order for us to provide you with the best service, we need to collect and process personal information from you as a customer.
Where we need to process personal data to provide professional services, we ask our clients to provide the necessary information to the data subjects regarding its use. Our clients may use relevant sections of this privacy statement or refer data subjects to this privacy statement if they consider it appropriate to do so.
The categories of personal data processed by us in relation to the services we provide are generally include:
- Personal details (e.g. name, age/date of birth, gender, marital status, country of residence);
- Contact details (e.g. email address, contact number, physical and postal address);
- Financial details (e.g. salary and other income and investments, benefits, tax status); and
- Job details (e.g. role, grade, experience and performance information).
For certain services or activities, we may process special categories of personal data (such as in performing client credit checks and providing tax services, which involve us processing government identification documents that may contain biometric data or data revealing racial or ethnic origin or as part of an audit of an organisation in the health sector).
Generally, we collect personal data from our clients or from third parties when providing services to the relevant client.
Purpose for processing
- To provide the services as set out in the engagement letter.
- To market similar services or relevant events to the client.
- Complying with a requirement of law, regulation or professional body of which we are a member.
- To communicate with clients, and to carry out instructions and requests.
- To create client contact data base.
- Administering, managing and developing our businesses and services.
- Communication of information with the data subject.
- Personal opinion is applicable when an audit of a process is being carried out.
- Improving and developing our services.
- Security, quality and risk management activities.
Ngubane will keep your personal information confidential at all times, however, you agree and consent that Ngubane may:
- Communicate with you electronically in relation with the service or product being provided (email, fax, telephone or through any other relevant or secured electronic platform).
- Obtain any relevant personal information, from any person or institution, necessary to comply with the agreement between you and Ngubane.
- Obtain credit information from any person or institution where necessary.
- Verify the information provided herein and to contact other third party for purposes of the same.
- Disclose personal information to regulatory or government agencies in accordance with the relevant legislation or directive.
- Use personal information to market new or other products of the company which may be suitable or relevant to you.
Ngubane is required to comply with various different legislative retention periods, which leads to different retention requirements. We retain the personal data processed by us for as long as necessary for the purpose for which it was collected. Personal data may be held for longer periods where extended retention periods are required by law or regulation and in order to establish, exercise or defend our legal rights.
In order for us to do business with you as our service provider, we need to collect and process personal information from you as a supplier. This information will consist of the following:
- Contact details such as e-mail address; postal and physical address; telephone number;
- Information for BBBEE purposes e.g. Race and nationality;
- ID number trough Company registration certificates.
Purpose for processing
- Registration purposes,
- To manage and maintain your accounts with us.
- To give effect to and enforce any contract which may exist.
- Complying with any requirement of law, regulation or a professional body of which we are a member.
- Security, quality and risk management activities e.g. automated email scans for harmful attachments.
Ngubane is required to comply with various different legislative retention periods, which leads to different retention requirements. We retain the personal data processed by us for as long as is considered necessary for the purpose for which it was collected. Personal data will be retained about our contacts at our suppliers for as long as it is necessary for the purposes set out above (e.g. for as long as we have, or need to keep a record of, a relationship with a contact, which is for the duration of our relationship with a contact or their organisation). Personal data may be held for longer periods where extended retention periods are required by law or regulation and in order to establish, exercise or defend our legal rights.
We require visitors to our offices to sign in at reception and we keep that record of visitors for a short period of time. Our visitor records are securely stored and only accessible on a need to know basis (e.g. to look into an incident).
Individuals screened for COVID 19.
We require our visitors to complete certain personal information such as health history, name, contact details and ID number when entering our offices for COVID 19 Screening purposes.
The personal information collected is necessary to comply with the COVID 19 screening as required by the Disaster management Act and supplementary regulations and directives. This information will be kept confidential unless disclosure is required by law. E.g. should a positive case be identified. This information will be stored for a period of five years and thereafter be destroyed. If you do not provide the information as required, we can limit or refuse you access to the premises.
3.5.1 CCTV Monitoring
The premises of Ngubane is monitored by CCTV footage. This footage is only processed for the legitimate purposes of promoting security and safety of our personnel and members of the public, preventing and detecting crime and establishing, exercising and defending legal claims. We do not share the footage with external parties, however we may disclose CCTV images to law enforcement bodies as requested and permitted by law.
CCTV recordings are typically automatically overwritten after a short period of time unless an issue is identified that requires investigation (such as a theft).
Where the legal basis for us processing your personal information is consent as above, it will be included in the contract or agreement concluded with you. This consent may be withdrawn at any time, however this withdrawal of consent will not make processing we undertook before your withdrawal unlawful. You will not suffer any detriment for withdrawing your consent.
Where the legal basis for processing is for the proper performance of the contract, and you fail to provide us with the information or request us to stop processing this information, it may create limitations on our performance of the contract or agreement.
5. Sharing information
In processing your personal information, we may share it with third party processors under an operator’s agreement. These include but are not limited to:
- Payment processors.
- Email management and distribution tools.
- Data storage providers.
- Server hosts.
As an operator, these service providers will not be able to process or use your data for any reason other than to provide the service as required by us. It is our policy to use only third party operators that are bound to maintain appropriate levels of security and confidentiality, to process personal information only as instructed by Ngubane, and to flow those same obligations down to their sub-processors.
6. Information transfers
We may transfer to, and store personal information we collect about you, in countries other than South Africa. These countries may not have the same data protection laws as South Africa, and in this instance we will only transfer the information if we have consent from you, or it is necessary for the performance or conclusion of a contract between us. Countries we may transfer data to includes:
|Foreign country||Reason for transfer of data|
|Canada||Caseware cloud server host is in this country|
7. Information Security
We have implemented generally accepted standards of technology and operational security to protect personal information from loss, misuse, alteration or destruction.
We require all staff, (Partners and/or Directors and employees) to keep personal information confidential and only authorised staff have access to this personal information.
We will retain your personal information in accordance with our data retention policy which sets out data retention periods required or permitted by applicable law.
Although we use appropriate security measures once we have received your personal data, the transmission of data over the internet (including by e-mail) is never completely secure. We endeavor to protect personal data, but we cannot guarantee the security of data transmitted to or by us.
8. Cookies Notice
Cookies help us remembering you for your next visit and understanding how you are interacting with our Services in order to improve and customize your browsing experience. You can set your browser to not accept cookies, but this may limit your ability to use the services.
9. Email Disclaimer
This e-mail may be privileged, is confidential and may only be read by the addressee. If you have received this in error, please delete it from your computer and network and notify us by return e-mail. Any views expressed in this e-mail are not those of Ngubane unless they are business related and sent by someone duly authorised to express them.
No opinions, advice or undertakings are valid unless they emanate from a partner, or director of Ngubane or one of its associated entities. Whilst Ngubane employs reasonable precautions, it cannot guarantee that this e-mail and any attachments are virus free and it will not be liable for any virus related losses or damage caused to the recipient of this e-mail.
- Let us know if you would like to unsubscribe from Ngubane marketing.
- Please submit a request to exercise a legal right in relation to your personal data, or an enquiry if you have a question or complaint about the handling of your personal data.
- Request to delete your Ngubane mail account. This process may take up to 30 days.
- For anything else, please refer to our contact us page.
- Download POPI Act: CLICK HERE
You may also contact us at the following postal address:
Woodmead Estate Office Park, Building 13 Ground Floor, 1 Woodmead Dr, Woodmead, Sandton, 2191