POPIA Compliance

1. Introduction to POPIA Compliance

Oh8 Digital (Pty) Ltd is committed to full compliance with the Protection of Personal Information Act 4 of 2013 (POPIA). This page provides detailed information about how we comply with POPIA requirements and how you can exercise your rights as a data subject.

POPIA regulates the processing of personal information by public and private bodies to protect the privacy of individuals while balancing this with the legitimate needs of organizations to collect and use personal information.

2. Our POPIA Compliance Framework

2.1 Information Officer

2.2 Compliance Measures

• Privacy by Design: Data protection built into all systems and processes
• Staff Training: Regular POPIA training for all employees
• Technical Safeguards: Encryption, access controls, and security monitoring
• Organizational Measures: Policies, procedures, and governance frameworks

3. Lawful Basis for Processing

We process personal information based on the following lawful grounds under POPIA:

4. Your Rights as a Data Subject

Under POPIA, you have the following rights regarding your personal information:

5. How to Exercise Your Rights

5.1 Making a Request

To exercise any of your rights, please contact our Information Officer:

5.2 Request Processing

• Acknowledgment: We will acknowledge your request within 5 business days
• Verification: We may request additional information to verify your identity
• Response: We will respond within 30 days (may be extended by 30 days for complex requests)
• No Fee: Most requests are processed free of charge

5.3 Fees

We may charge a reasonable fee for excessive or repetitive requests. Any fees will be communicated before processing your request.

6. Data Processing Activities

6.1 Categories of Personal Information

7. Data Sharing and Transfers

We share personal information only with the service providers listed in our Privacy Policy, and with authorities when the law requires it. Most of those providers process data in the United States. Under section 72 we only transfer information where the recipient is bound by a contract or law giving protection substantially similar to POPIA, or where the transfer is needed to perform our contract with you.

8. Data Security Measures

• Encryption in transit (HTTPS) and at rest by our hosting providers
• Every server function checks who is calling it and which organisation they belong to
• Role-based access inside each organisation
• Driver location limited to the latest position, visible to the public only during an active delivery
• Data export and deletion tools for organisation administrators

9. Data Breach Procedures

9.1 Breach Response

In the event of a data breach, we will:

• Contain and assess the breach
• Notify the Information Regulator as soon as reasonably possible, as section 22 requires
• Notify affected data subjects as soon as reasonably possible, or the customer whose data it is when we act as their operator
• Document the breach and response actions taken
• Implement measures to prevent future breaches

9.2 Notification Content

Breach notifications will include:

• Nature and scope of the breach
• Categories and number of data subjects affected
• Likely consequences of the breach
• Measures taken to address the breach
• Contact information for further inquiries

10. Complaints and Enforcement

10.1 Internal Complaints

If you have concerns about our data processing practices, please contact our Information Officer first. We are committed to resolving complaints promptly and fairly.

10.2 Information Regulator

If you are not satisfied with our response, you have the right to lodge a complaint with the Information Regulator:

11. Regular Reviews and Updates

We regularly review our POPIA compliance measures to ensure they remain effective and up-to-date. This includes:

• Annual compliance audits and assessments
• Regular policy and procedure updates
• Staff training and awareness programs
• Technology and security updates
• Monitoring of regulatory developments

12. Contact Information