Book a court

PAIA & POPI Policy (“The Policy”)

This is the Constantia Tennis Club’s(“the Club”) policy in terms of the Protection of Personal Information  Act, No. 4 of 2013 (“POPIA”) and the Promotion of Access to Information Act, No. 2 of 2000 (“PAIA”) (“the  Policy”). 

This Policy applies to the business of the Club wherever it is conducted, it applies to its Members, paid  staff, guests, volunteers and associates of the Club upon the premises of the Club and towards the Club’s  general business, tennis and Member management conduct. 

A: PAIA Policy 

  1. PAIA is an act that was passed to give effect to the constitutional right, held by everyone in South  African, of access to information which is held by the State or by another person (including the  Club) and which is required for the exercise or protection of any right. Where a request is made  in terms of PAIA, the body to which the request is made is obliged to give access to the requested  information, except where the Act expressly provides that the information may or must not be  released. It is important to note that PAIA recognises certain limitations to the right of access to  information, including, but not exclusively, limitations aimed at the reasonable protection of  privacy, commercial confidentiality, and effective, efficient, and good governance and in a manner  which balances that right with any other rights, including such rights contained in the Bill of Rights  in the Constitution. 
  2. One of the main requirements specified in PAIA is the compilation of an information manual that  provides information on both the types and categories of records held by a private body. This  Policy serves as the Club’s Information Manual. This Policy is compiled in accordance with Section  51 of PAIA and the Schedule to POPIA. It is intended to give a description of the records held by  and on behalf of the Club, to outline the procedure to be followed and the fees payable when  requesting access to any of these records in the exercise of the right of access to information, with  a view of enabling requesters to obtain records which they are entitled to in a quick, easy, and  accessible manner. This Policy is available for public inspection at the physical address of the Club,  free of charge. 
  3. The Club only keeps the Personal Information of the Member as defined in the POPIA Policy  below. Members shall at all reasonable times have access to such data and the Club shall within 

a reasonable time provide a Member with that Personal Information and shall charge no fee to  provide it. 

B: POPIA Policy 

Note: POPIA compliance is still in its infancy. The procedures and guidelines in this Policy are drafted using  the best available guidance from the Information Regulator as of 1 July 2021 and hence this Policy is  Version 1.0. The Club notes that it will amend this document should practices and procedures change in  due course. 

Introduction 

  1. POPIA is intended to balance two competing interests. These are: 

(a) our individual constitutional rights to privacy (which requires our Personal Information to  be protected); and 

(b) the needs of our society to have access to and to process (work with) our Personal  Information for legitimate purposes, including the purpose of doing business. 

  1. This Policy sets out the framework for our Clubs compliance with POPIA. Where reference is made  to the “processing” of Personal Information, this will include any activity in which the information  is worked with, from the time that the information is collected, up to the time that the information  is destroyed, regardless of whether the information is worked with manually, or by automated  systems. 

Purpose 

  1. The purpose of this policy is to enable the Club to: 

(a) comply with the law in respect of the data it holds about individuals (known as Data  Subjects in the POPIA); 

(b) follow good reasonable commercial practice; & 

(c) protect the Club’s staff and other individuals. 

Club Undertakings 

  1. The Club will always: 

(a) comply with both the law and good practice; 

(b) respect individuals’ rights;

(c) be open and honest with individuals whose data is held; & 

(d) provide training and support for staff who handle personal data, so that they can act  confidently and consistently with regards to PAIA and POPIA. 

  1. POPIA aims to ensure that the legitimate concerns of individuals about the ways in which their  data may be used are considered. In addition to being open and transparent, the Club will seek to  give individuals as much choice as is possible and reasonable over what data is held and how it is  used. 
  2. The Club undertakes to follow POPIA at all relevant times and to process Personal Information  lawfully and reasonably, so as not to infringe unnecessarily on the privacy of our Members and  the Club recognises that its first priority under the POPIA is to avoid causing harm to individuals.  In the main this means: 

(a) the Club undertakes to process information only for the purpose for which it is intended,  to enable us to do our work, as agreed with our Members; 

(b) keeping information securely in the right hands; 

(c) retention of good quality information; 

(d) whenever necessary, the Club shall obtain consent to process Personal Information; (e) where the Club does not seek consent, the processing of our Members Personal  Information will be following a legal obligation placed upon us, or to protect a legitimate  interest that requires protection; 

(f) the Club shall stop processing Personal Information if the required consent is withdrawn,  or if a legitimate objection is raised; 

(g) the Club shall retain records of the Personal Information the Club has collected for the  minimum period as required by law unless the Member has furnished their consent or  instructed us to retain the records for a longer period; 

(h) the Club shall destroy or delete records of the Personal Information (so as to de-identify  the Member) as soon as reasonably possible after the time period for which the Club uses  said data (please note that the Club keeps Member’s information after they have left the  Club in case they should re-join or move to another club, this is kept on the Sage Cloud  Accounting system to which the Club subscribes and is fully POPIA compliant, for a  maximum of 3 years); 

(i) the Club undertakes to ensure that the Personal Information which the Club collects and  processes is complete, accurate and not misleading and up to date; 

(j) the Club undertakes to retain the physical file and the electronic data related to the  processing of the Personal Information; & 

(k) the Club undertakes to take special care with our Member’s bank account details and the  Club is not entitled to disclose or procure the disclosure of such banking details to any  third party, save for the Club’s bank and the Member’s bank, purely for purposes of  executing a debit order.

  1. The Club shall collect Personal Information directly from the Member unless: (a) the information is of public record; 

(b) the Member has consented to the collection of their Personal Information from another  source; 

(c) the collection of the information from another source does not prejudice the Member; (d) the information to be collected is necessary for the maintenance of law and order or  national security; 

(e) the information is being collected to comply with a legal obligation, including an  obligation to SARS; 

(f) the information collected is required for the conduct of proceedings in any court or  tribunal, where these proceedings have commenced or are reasonably contemplated; (g) the information is required to maintain our legitimate interests; or 

(h) where requesting consent is not reasonably practical in the circumstances. 

  1. The Club shall restrict the processing of Personal Information: 

(a) where the accuracy of the information is contested, for a period sufficient to enable us to  verify the accuracy of the information; 

(b) where the purpose for which the Personal Information was collected has been achieved  and where the Personal Information is being retained only for the purposes of proof; or (c) where the Member requests that the Personal Information be transmitted to another  automated data processing system. 

  1. According to POPIA ‘‘Personal Information’’ means information relating to an identifiable, living,  natural person, and where it is applicable, an identifiable, existing juristic person. The POPIA,  which has more specific examples if you need them, can be found at the following link:  https://popia.co.za/section-1-definitions/

The Club collects the following information from its Members (Personal Information): 

  • name 
  • residential address 
  • email address 
  • telephone/cell number 
  • gender 
  • date of birth 
  • possibly details of other tennis club memberships 
  • banking details (where debit orders are implemented)

Non-Personal Information 

  1. The Club may automatically collect non-Personal Information about a Member such as the type  of internet browsers a Member may use. The Club may also aggregate details which a Member  has submitted to our website (for example, the products or services they are interested in). They  cannot be identified from this information and it is only used to assist the Club in providing an  effective service by the Club. 

Key Risks 

  1. The Club has identified the following potential key risks, which this Policy is designed to address: (a) breach of confidentiality (information being given out inappropriately); 

(b) insufficient clarity about the range of uses to which data will be put — leading to Data  Subjects (our Members) being insufficiently informed; 

(c) failure to offer choice about data use when appropriate; 

(d) breach of security by allowing unauthorised access; 

(e) harm to individuals if personal data is not up to date; & 

(f) third party data operator contracts. 

Member’s Rights 

  1. The Members of the Club hold the following specific rights: 

(a) in cases where the Member’s consent is required to process their Personal Information,  this consent may be withdrawn. 

(b) in cases where the Club processes Personal Information without consent to protect a  legitimate interest, to comply with the law or to pursue or protect our legitimate  interests, the Member has the right to object to such processing; and 

(c) all Members are entitled to lodge a complaint regarding our application of POPIA with the  Information Regulator. 

Security Safeguards 

  1. In order to secure the integrity and confidentiality of the Personal Information in our possession,  and to protect it against loss or damage or unauthorised access, the Club must continue to  implement the following security safeguards: 

(a) our business premises where records are kept must remain protected by access control,  burglar alarms and if possible, armed response;

(b) archived files must be stored behind locked doors and access control to these storage  facilities must be implemented; 

(c) all the user terminals on our internal computer network and our servers / PC’s / laptops  must be protected by passwords which must be changed on a regular basis. This also  applies to all cloud data storage modalities; 

(d) our email infrastructure must comply with industry standard security safeguards (the club  shall deal directly with its service provider in this regard); 

(e) if necessary, vulnerability assessments shall be carried out on our digital infrastructure to  identify weaknesses in our systems and to ensure the Club has adequate security in place; (f) the Club must use an internationally recognised firewall to protect the data on its local  servers, and the Club must run antivirus protection at least every week to ensure its  systems are kept updated with the latest patches; 

(g) Club volunteers and staff must be trained to carry out their duties in compliance with  POPIA, and this training must be ongoing; 

(h) it must be a term of the contract with every staff member that they must maintain full  confidentiality in respect of all of our Members’ affairs, including our Members’ Personal  Information; 

(i) employment contracts for staff whose duty it is to process a Member’s Personal  Information, must include an obligation on the staff member: (1) to maintain the Club’s  security measures, and (2) to notify their manager/supervisor immediately if there are  reasonable grounds to believe that the Personal Information of a Member has been  accessed or acquired by any unauthorised person; 

(j) the processing of the Personal Information of Club volunteers and staff members must  take place in accordance with the rules contained in the relevant labour legislation; & (k) the digital work profiles and privileges of staff who have left our employ must be properly  terminated. 

These security safeguards must be verified on a regular basis to ensure effective implementation,  and these safeguards must be continually updated in response to new risks or deficiencies. 

Security Breaches 

  1. Should it appear that the Personal Information of a Member has been accessed or acquired by an  unauthorised person, the Club must notify the Information Regulator and the relevant Member/s,  unless the Club is no longer able to identify the Member/s. This notification must take place as  soon as reasonably possible. 
  2. Such notification must be given to the Information Regulator first as it is possible that they, or  another public body, might require the notification to the Member/s be delayed.
  3. The notification to the Member must be communicated in writing in one of the following ways,  with a view to ensuring that the notification reaches the Member: 

(a) by email to the Member’s last known email address; 

(b) by publication on the Club’s website, or in the news media; or 

(c) as directed by the Information Regulator 

  1. This notification to the Member must give sufficient information to enable the Member to protect  themselves against the potential consequences of the security breach, and must include: (a) a description of the possible consequences of the breach; 

(b) details of the measures that the Club intends to take or have taken to address the breach; (c) the recommendation of what the Member could do to mitigate the adverse effects of the  breach; & 

(d) if known, the identity of the person who may have accessed, or acquired the Personal  Information. 

Correction of Personal Information 

  1. A Member is entitled to require the Club to correct or delete Personal Information that the Club  has, which is inaccurate, irrelevant, excessive, out of date, incomplete, misleading, or which has  been obtained unlawfully. 
  2. A Member is also entitled to require the Club to destroy or delete records of Personal Information  about the Member that the Club is no longer authorised to retain. 
  3. Upon receipt of such a lawful request, the Club must comply as soon as reasonably practicable: (a) in the event that a dispute arises regarding the Member’s rights to have information  corrected, and in the event that the Member so requires, the Club must attach to the  information, in a way that it will always be read with the information, an indication that  the correction of the information has been requested but has not been made; & (b) the Club must notify the Member who has made a request for their Personal Information  to be corrected or deleted what action the Club have taken as a result of such a request. 

Special Personal Information 

  1. Special rules apply to the collection and use of information relating to a person’s religious or  philosophical beliefs, their race or ethnic origin, their trade union membership, their political  persuasion, their health or sex life, their biometric information, or their criminal behaviour.
  2. The Club shall not process any of this special Personal Information without the Member’s consent,  or where this is necessary for the establishment, exercise or defence of a right or an obligation in  law. 
  3. Having regard to the nature of the Club’s work, it is unlikely that the Club will ever have to process  special Personal Information (save for that of minors), but should it be necessary the guidance of  the Information Officer must be sought. 
  4. The Club may only process the Personal Information of a minor if the Club has the consent of the  child’s parent or legal guardian. 

Information Officer 

  1. Our Information Officer is the Club’s nominated Chairman or is a Committee Member nominated  and authorised by the Club’s Management Committee. Our Information Officer’s responsibilities  include: 

(a) encourage and ensure overall compliance with POPIA; 

(b) encourage compliance with conditions for the lawful processing of Personal Information; (c) deal with requests made by the Information Regulator or data subjects (individuals); (d) work with the Regulator in relation to investigations conducted in accordance with the  relevant provisions of POPIA; 

(e) develop, implement and monitor a compliance framework; 

(f) ensure that a personal information impact/risk assessment is performed to guarantee  that adequate measures and standards exist within the entity; 

(g) develop, monitor, maintain and make available a PAIA manual; 

(h) develop internal measures and adequate systems to process requests for access to  information; & 

(i) ensure that internal awareness sessions are conducted regarding the provisions of POPI,  the regulations and any codes of conduct or information obtained from the Regulator. 

  1. In the event that our Information Officer is not the Club’s nominated Chairman, such person must  register with the Information Regulator prior to taking up their duties. 
  2. In carrying out his/her duties, our Information Officer must ensure that: 

(a) this Policy is implemented; 

(b) that this Policy is developed, monitored, maintained, and made available; 

(c) that internal measures are developed together with adequate systems to process  requests for information or access to information;

(d) that internal awareness sessions are conducted regarding the provisions of POPIA, the  Regulations, codes of conduct or information obtained from the Information Regulator;  and 

(e) that copies of this Policy are provided to persons at their request. 

  1. Guidance notes on Information Officers have been published by the Information Regulator and  our Information Officer must familiarise himself / herself with the content of these notes. 29. A Member can rest assured that unless the Club is legally obliged to share their Personal  Information, the Club will only share so much of a Member’s Personal Information as is needed  by the authority that requires it, and we will only do so when it is necessary for the Club to do its  work for the Member.  
  2. Should a Member have any concerns with the way in which the Club is processing their Personal  Information, such Member should inform the Information Officer and if not satisfied with the  remedy be entitled to lodge a complaint with the Information Regulator, whose contact details  are: 

33 Hoofd Street, Forum III, 3rd Floor, Braampark 

P.O Box 31533, Braamfontein, Johannesburg, 2017 

Complaints email: complaints.IR@justice.gov.za 

General enquiries email: inforeg@justice.gov.za 

Staff Training & Acceptance of Responsibilities 

  1. The Club’s Information Officer will ensure that all staff and Club volunteers who have access to  any kind of Personal Information will have their responsibilities outlined during their induction  procedures. Continuing training will provide opportunities for staff to explore POPIA issues  through training, team meetings, and supervision. Procedure for staff signifying acceptance of  policy will ensure that all staff sign acceptance of this Policy once they have had a chance to  understand the Policy and their responsibilities in terms of the policy and the POPIA. 

Direct Marketing 

  1. The Club may only carry out direct marketing (using any form of electronic communication) to  Members if: 

(a) they have been given an opportunity to object to receiving direct marketing material by  electronic communication at the time that their Personal Information was collected; &

(b) they did not object then or at any time after receiving any such direct marketing  communications from the Club. 

  1. The Club may only approach Members using their Personal Information if the Club has obtained  their Personal Information in the context of providing services associated with our business to  them and the Club may then only market Club services to them. 
  2. The Club may approach a person to ask for their consent to receive direct marketing material only  once, and the Club may not do so if they have previously refused their consent. 35. All direct marketing communications must disclose a Member’s identity and must contain an  address or opt-out functionality, to which the Member may send a request that the  communications cease. 

Transborder Information Flows 

  1. The Club may not transfer a Member’s Personal Information to a third party in a foreign country,  unless: 

(a) the Member consents to this, or requests it; 

(b) such third party is subject to a law, binding corporate rules or a binding agreement which  protects the Personal Information in a manner similar to POPIA, and such third party is  governed by similar rules which prohibit the onward transfer of the Personal Information  to a third party in another country; 

(c) the transfer of the Personal Information is required for the performance of the contract  between ourselves and the Member; 

(d) the transfer is necessary for the conclusion or performance of a contract for the benefit  of the Member entered into between the Club and the third party; or 

(e) the transfer of the Personal Information is for the benefit of the Member and it is not  reasonably possible to obtain their consent and that if it is possible the Member would  be likely to give such consent. 

Offences & Penalties 

  1. POPIA provides for serious penalties for the contravention of its terms. For minor offences, a guilty  party can receive a fine or be imprisoned for up to 12 months. For serious offences, the period of  imprisonment rises to a maximum of 10 years. Administrative fines for the Club can reach a  maximum of R10 million.
  1. Breaches of this Policy will also be viewed as a serious disciplinary offence by employees and Club  volunteers. 
  2. It is therefore imperative that the Club complies strictly with the terms of this Policy and protects  our Member’s Personal Information to international standard. 
  3. This Policy shall be governed by and construed in accordance with the laws of South Africa.