Privacy Policy

This privacy policy (“Privacy Policy”) sets out the basis which World Macadamia Organisation NPC (“WMO”, “we”, “us”, or “our”) may collect, use, disclose or otherwise process personal data in accordance with the Protection of Personal Information Act 4 of 2013 (“POPIA”).

This Privacy Policy applies to personal data in our possession or under our control, including personal data in the possession of organisations which we have engaged to collect, use, disclose or process personal data for our purposes.

It is important that you read this Privacy Policy together with any other privacy policy or fair processing notice we may provide on specific occasions when we are collecting or processing personal data about you, so that you are fully aware of how and why we are using your personal data. This Privacy Policy supplements the other notices and is not intended to override them.

We do not process the data of minors. Do not provide us with any such personal data, as it will constitute an immediate and automatic breach of this Privacy Policy.

Personal data

As used in this Privacy Policy:

“member” means an individual who (a) has contacted us through any means to find out more about our services, or (b) may, or has, entered into a contract with us to join our organisation or for the supply of any goods or services by us; and

“personal data” means data, whether true or not, about a person (both natural and juristic) who can be identified: (a) from that data; or (b) from that data and other information to which we have or are likely to have access.

Other terms used in this Privacy Policy shall have the meanings given to them in POPIA (where the context so permits).

Collection, use and disclosure of personal data

How we collect your data

We will only use your personal data when the law allows us to and for legitimate reasons, which you hereby expressly understand and consent to. Most commonly, we will use your personal data in the following circumstances:

• where we have your express consent to do so;
• where we need to consult with you or perform on the service contract we are about to enter

into or have entered into with you;

• where it is necessary for our legitimate business interests (or those of a third party) and your

interests and fundamental rights do not override those interests; and/or

• where we need to comply with a legal or regulatory obligation.

Note that we may process your personal data for more than one lawful ground depending on the specific purpose for which we are using your personal data.

Personal data we collect about you

We may collect, use, store, and transfer (“process”) different kinds of personal data about you, which you provide to us directly or when you use our services or website which we have grouped together as follows:

• Identity Data including full name or the information about your company such as company

registration details, and company address.

• Contact Data including email address, physical/registered addresses, and contact phone

numbers.

• Financial Data including bank account details.
• Transaction Data including details about payments to and from you, contracts, contractual

terms, contract fees, signups, subscriptions, invoices and other details of products and services you have obtained from us or provide to us.

• Marketing and Communications Data including your preferences in receiving notices and

marketing from us and our third parties and your communication preferences as well as details of which communications were sent to you and how they were sent.

We also collect, use, and share Aggregated Data for any purpose. Aggregated Data may be derived from your personal data but is not considered personal data in law as this data does not directly or indirectly reveal your identity. However, if we combine or connect Aggregated Data with your personal data so that it can directly or indirectly identify you, we treat the combined data as personal data which will be used in accordance with this Privacy Policy.

Where we need to collect personal data by law, or under the terms of a contract we have with you and you fail to provide that data when requested, we may not be able to perform in terms of the contract we have or are trying to enter into with you. In this case, we may have to cancel our agreement with you, but we will notify you if this is the case at the time.

Purposes for which we process personal data

We may collect and use your personal data for any or all of the following purposes:

a. performing obligations in the course of or in connection with our provision of the goods and/or

services requested by you;

b. verifying your identity;

c. responding to, handling, and processing queries, requests, applications, complaints, and

feedback from you;

d. managing your relationship with us;

e. processing payment or credit transactions;

f. complying with any applicable laws, regulations, codes of practice, guidelines, or rules, or to

assist in law enforcement and investigations conducted by any governmental and/or regulatory authority;

g. any other purposes for which you have provided the information;

h. transmitting to any unaffiliated third parties including our third-party service providers and

agents, and relevant governmental and/or regulatory authorities, whether in South Africa or abroad, for the aforementioned purposes; and

i. any other incidental business purposes related to or in connection with the above.

Disclosure of Personal Data

We may disclose your personal data:

a. where such disclosure is required for performing obligations in the course of or in connection

with our provision of the goods and services requested by you; or

b. to third party service providers, agents and other organisations we have engaged to perform

any of the functions with reference to the above-mentioned purposes.

In this regard we may disclose your personal data with the parties set out below for the purposes set out above:

• Internal third parties including other entities or parties in the WMO group.
• External third parties such as:
• Authorised third parties under contract with us who need your personal data in order to

contact and transact with you pursuant to your use of our services;

• Service providers such as social media platforms, cloud storage providers, and marketing

providers;

• South African or other national governments and/or their respective authorities pursuant to

our adherence with anti-corruption and crime-fighting legislation amongst others; and/or

• Professional advisers including lawyers, bankers, auditors and insurers who provide

consultancy, banking, legal, insurance and accounting services as required.

• Third parties to whom we may choose to sell, transfer, or merge parts of our organisation.

Alternatively, we may seek to acquire other organisations or merge with them. If a change happens, we may continue to use your personal data in the same way as set out in this Privacy Policy.

We require all third parties to respect the security of your personal data and to treat it in accordance with the law. We do not allow our third-party service providers to use your personal data for their own purposes and only permit them to process your personal data in accordance with our instructions and standards

Withdrawing your consent

The consent that you provide for the collection, use and disclosure of your personal data will remain valid until such time it is being withdrawn by you in writing. You may withdraw consent and request us to stop collecting, using and/or disclosing your personal data for any or all of the purposes listed above by submitting your request in writing or via email to our Information Officer at the contact details provided below.

Upon receipt of your written request to withdraw your consent, we may require reasonable time (depending on the complexity of the request and its impact on our relationship with you) for your request to be processed and for us to notify you of the consequences of us acceding to the same, including any legal consequences which may affect your rights and liabilities to us.

In general, we shall seek to process your request within thirty (30) business days of receiving it.

Whilst we respect your decision to withdraw your consent, please note that depending on the nature and scope of your request, we may not be in a position to continue providing our goods or services to you and we shall, in such circumstances, notify you before completing the processing of your request. Should you decide to cancel your withdrawal of consent, please inform us in writing.

Please note that withdrawing consent does not affect our right to continue to collect, use and disclose personal data where such collection, use and disclose without consent is permitted or required under applicable laws.

Access to and correction of personal data

If you wish to make (a) an access request for access to a copy of the personal data which we hold about you or information about the ways in which we use or disclose your personal data, or (b) a correction request to correct or update any of your personal data which we hold about you, you may submit your request in writing or via email to our Information Officer at the contact details provided below.

Please note that a reasonable fee may be charged for an access request. If so, we will inform you of the fee before processing your request.

We will respond to your request as soon as reasonably possible. In general, our response will be within thirty (30) days. Should we not be able to respond to your request within thirty (30) days after receiving your request, we will inform you in writing within thirty (30) days of the time by which we will be able to respond to your request. If we are unable to provide you with any personal data or to make a correction requested by you, we shall generally inform you of the reasons why we are unable to do so (except where we are not required to do so under POPIA).

Protection of personal data

To safeguard your personal data from unauthorised access, collection, use, disclosure, copying, modification, disposal or similar risks, we have introduced appropriate administrative, physical and technical measures such as up-to-date antivirus protection, encryption, use of privacy filters, and disclosing personal data both internally and to our authorised third-party service providers and agents only on a need-to-know basis.

You should be aware, however, that no method of transmission over the Internet or method of electronic storage is completely secure. While security cannot be guaranteed, we strive to protect the security of your information and are constantly reviewing and enhancing our information security measures.

Accuracy of personal data

We generally rely on personal data provided by you (or your authorised representative). To ensure that your personal data is current, complete and accurate, please update us if there are changes to your personal data by informing our Information Officer in writing or via email at the contact details provided below.

Retention of personal data

We may retain your personal data for as long as it is necessary to fulfil the purpose for which it was collected, or as required or permitted by applicable laws.

We will cease to retain your personal data or remove the means by which the data can be associated with you, as soon as it is reasonable to assume that such retention no longer serves the purpose for which the personal data was collected and is no longer necessary for legal or business purposes.

Transfers of personal data

We may process and store personal data outside of the country where it was collected.

By registering with us, you consent to the transfer of your personal data and we will take steps to ensure that your personal data continues to receive a standard of protection at least comparable to that provided by POPIA.

Our internal staff may be located in New Zealand and may access personal data collected and stored in other countries as part of their daily work. When our staff process data, they only do so using internal, authorised IT equipment that strictly complies with all internally defined protection and security requirements. All our employees undergo the necessary training to comply with data protection obligations and to ensure secure data processing.

Whenever we may transfer your personal data out of your country of residence, we will ensure a similar degree of protection is afforded to it by ensuring at least one of the following safeguards is implemented:

• We will only transfer your personal data to countries that have appropriate data protection

legislation in place similar to that of South Africa; and/or

• Where we contract with another party, we will use specific contracts/clauses which ensure

personal data is processed and secured lawfully.

You are welcome to contact us if you want further information regarding the sharing of your personal data.

Marketing

We strive to provide you with choices regarding certain personal data uses, particularly around marketing and advertising. To manifest your rights attached to any marketing sent to you as an existing member or service provider, please use the in-built prompts provided on those communications, or contact us.

You will receive marketing communications from us if you have requested our services, requested information from us, or provided us with your details in any other circumstance and, in each case, have not opted-out of receiving that marketing.

You can ask us to stop sending you marketing messages at any time by using the built-in prompts or contacting us and requesting us to cease or change your marketing preferences. Where you opt-out of receiving these marketing messages, this opt-out will not apply to other personal data of yours which we process for another lawful basis or necessary communications we send when you use our services.

Third-Party Marketing

Whilst we may use your personal data within our organisation, we will request your consent before we share your personal data with any entity outside of WMO for marketing purposes. Please consider all sign-up forms before submission to ensure you are aware of any and all marketing consents for both us and our sponsors.

Data protection officer

You may contact our Data Protection Officer if you have any enquiries or feedback on our personal data protection policies and procedures, or if you wish to make any request, in the following manner:

Tina Herbison – tina@worldmacadamia.com

Registered address: World Macadamia Organisation NPC, 51 Lebombo Street, Ashlea Gardens, Pretoria, Gauteng 0181, South Africa.

You have the right to make a complaint at any time to the Information Regulator’s Office or any other applicable data regulator. We would, however, appreciate the chance to deal with your concerns before you approach any such regulator, so please contact us in the first instance.

Effect of privacy policy and changes to privacy policy

This Privacy Policy applies in conjunction with any other notices, contractual clauses and consent clauses that apply in relation to the collection, use and disclosure of your personal data by us.

We may revise this Privacy Policy from time to time without any prior notice. You may determine if any such revision has taken place by referring to the date on which this Privacy Policy was last updated. Your continued use of our services constitutes your acknowledgement and acceptance of such changes.

Specific information

Website

Every time you visit our website, technical information is collected for the contributions to the subject of information security, information (also referred to as server log files) is automatically collected by us or the webspace provider.

Among other information this includes: website name, file, date, data volume, web browser and web browser version, operating system, the domain name of your Internet provider, the referrer URL (the page from which you accessed our offer) and the IP address.

Without this information, it would not be technically possible to deliver and display the website content. In this respect, collecting data is absolutely necessary. Furthermore, we use this information for statistical purposes. They help us to optimise our services and technology. We also reserve the right to check the log files in case of suspected illegal use of our services.

We do not track our members over time and across third party websites to provide targeted advertising and therefore does not respond to Do Not Track (DNT) signals.

Cookies

Our website uses cookies. Cookies are text files that are stored on your computer by the server. They contain information about the browser, the IP address, the operating system and the Internet connection. We will not pass on this data to third parties or link it to personal data without your consent.

Cookies have two main purposes. They help us make it easier for you to navigate through our services and they also enable the website to be displayed correctly. They are not used to spread viruses or to open programs.

Please note that cookies may be necessary to provide you with certain features available on our website and thus if you disable the cookies on your browser you may not be able to use those features, and your access to our website will therefore be limited. If you do not disable “cookies”, you are deemed to consent to our use of any personal data collected using those cookies, subject to the provisions of this Privacy Policy and our other policies or terms.

Integrating third-party services and content

Our range includes content, services and services from other suppliers. For example, this might be videos, graphics or images from other websites. For this data to be retrieved and displayed in your browser, transmitting the IP address is absolutely necessary. The providers (hereinafter referred to as “third-party providers”) detect the IP address of the respective user.

Third-Party Links

Our website may include links to third-party platforms, plug-ins, and applications. Clicking on those links or enabling those connections may allow third parties to collect or share information about you. We do not control these third-party platforms and are not responsible for their privacy statements or terms. When you leave our website, or engage with such third parties, we encourage you to read the privacy policy of every third-party you engage with.

Contact form

If you contact us via the online contact form or by email, we will save the information you provide, your IP address and the time it was sent. This allows us to answer your request and ask possible follow- up questions.

Google Analytics

This website uses the standard analysis tool “Google Analytics” of Google Inc. (“Google”). Google Analytics uses cookies (text files that are stored on the computer). The generated information about the use of the website is transmitted to an American server of Google and stored for further processing. With your privacy in mind, we have extended Google Analytics with the option “anonymizeIP” so that all data is collected anonymously. The default IP address provided by your browser will not be merged with other data provided by Google. In exceptional cases, the full IP address will be transmitted and truncated on a Google (US) server.

The data collected by Google Analytics is evaluated to generate reports on user activity and to optimize your user experience. To contradict the storage of the cookies, please make the appropriate setting in your browser. Please note that you can only use other areas of this website to a limited extent.

Job applications

If you apply for a position with us, we process your personal data as a Responsible Party. Providing your personal data is necessary for an application to proceed. You are entitled to the data subject rights outlined in this document. We process your personal data to take steps prior to employment at your request. Any additional processing beyond this application process is based on another, separately declared legal basis.

Application process

Our application process is mostly conducted by email and includes following steps:

a. Letter of motivation

b. Curriculum vitae

c. Description of your qualification and education

d. Attestation of your qualification and education

The extent of your application documents is determined by you. We will only collect data necessary to proceed with the application process.

If we invite you to an interview, we collect further personal data encompassing your personal interests and particulars of your professional aspirations and qualification.

Transfer of application data

We share your application data within our organisation with persons involved in the application process: human resources managers, subject matter experts and potential superiors.

Storage and record keeping

If you enter into an employment contract with us, we keep your application data until the conclusion of that contract’s retention periods.

If we do not close an employment contract, we keep your application data for twelve months. If you want to receive updates on open positions, you may grant us your separate, written consent to do so.

Your legal rights

You have rights in relation to your personal data and how we are able to process it. Please contact us to find out more about, or manifest, these rights:

• request access to your personal data;
• request correction of your personal data;
• request erasure of your personal data;
• object to the processing of your personal data;
• request a restriction of processing your personal data;
• request transfer of your personal data; and/or
• right to withdraw consent.

You will not have to pay a fee to access your personal data (or to exercise any of the other rights). However, we may charge a reasonable fee if your request is clearly unfounded, repetitive, or excessive. Alternatively, we may refuse to comply with your request in these circumstances.

We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal data (or to exercise any of your other rights). This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response.

We try to respond to all legitimate requests within one month. Occasionally, it may take us longer than a month if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated.

For users with citizenships from jurisdictions other than South Africa, please note that we comply with South African data protection laws when processing your personal data as we are a South African entity. Should foreign law be applicable to your use of the services and/or the website in any way, including how we may process your personal data, please contact us and we will gladly engage with you on your rights.