Privacy Policy

IMPORTANT: YOU MUST READ THIS POLICY

PRIVACY STATEMENT
- Your privacy is of utmost importance to us. By using our Website and our Services, you have entrusted us with your Personal Information. We value that trust. That means we are committed to protecting and safeguarding your personal data. We aim to act in your best interest, and we are transparent about the processing of your Personal Information.
- This document is a legal document. That means it is binding on you and on us. It provides both us and you, as/and the Data Subject, with various rights. It also places certain obligations and duties on you and on us. This Policy is therefore very important and, by using the Platform, you confirm that you have read this document and consider it binding on you. This document does not, however, apply to third parties. We are unable to guarantee that independent third parties adhere to the same practices as outlined herein. Your interactions with such third parties shall be subject to any terms and conditions between you and such third parties.
- We are legally obligated to provide adequate protection for the Personal Information we hold and to stop unauthorised access and use thereof. We will, on an ongoing basis, continue to review our security controls and related processes to ensure that the Personal Information remains secure.
- Generally accepted standards of technology and operational security have been implemented to protect information from loss, misuse, alteration, or destruction. Key employees are trained on information security and are required to keep Personal Information confidential and only authorised persons have access to such information.
- When we contract with third parties, we impose appropriate security, privacy, and confidentiality obligations on them to ensure that personal information that we remain responsible for, is kept secure.
- This document (Policy) describes how we use and process the Personal Information, provided in a readable and transparent manner. It also tells you what rights can be exercised in relation to Personal Information and how you can contact us. Reference is made in this document to various other documents and, where such reference is made, you are provided with an easily accessible link to view such documents.
- In line with the 8 Conditions for Lawful Procession of Personal Information as set out in POPI, we:
  - Undertake to collect and process only such Personal Information which is necessary given the Purpose, and consider the legitimate legal interests of everyone concerned, as required by POPI. We will at all times respect your right to withdraw your consent for the processing of the Personal Information;
  - Undertake to only use your Personal Information to achieve the Purpose;
  - Undertake not to share or further process your Personal Information with anyone or for any reason if not required for assisting you with your solutions or as required in terms of legislation or regulations or if it is required or necessary to render the Services;
  - Undertake to be open and transparent on the nature, extent, and reasons for processing Personal Information;
  - Undertake to safeguard and protect the Personal Information in our possession; and
  - Undertake to freely confirm what Personal Information we hold, to update and rectify the Personal Information upon request and to keep it for no longer than required and agreed.
- We might amend this Policy from time to time, so we recommend you visit this page occasionally to make sure you know where you stand. If we make any updates to this Policy that will impact you significantly, we’ll notify you about the changes before any new activities begin.

TERMS USED IN THIS POLICY

In this Policy, the following terms are used and mean what is said directly opposite it:

“Data Subject” is the natural person to whom the Personal Information relates. The Data Subject is either you, or a person on behalf of whom you are duly authorised to use the Platform, and are also referred to as “you” when it is the Data Subject themselves accessing and using the Platform;
“Hashtopic” shall mean: Hashtopic Proprietary Limited (Registration Number: 2012/095436/07), a private company duly registered and incorporated in terms of the laws of Republic of South Africa;
“Platform” shall mean: the Hashtopic website found at hashtopic.co.za and/or any ancillary service use thereon, in respect thereof, or any other software solution which we may avail in relation to the Services;
“Personal Information” shall mean: information relating to any Data Subject, including but not limited to: (i) information relating to the race, gender, sex, marital status, nationality, ethnic or social origin, colour, age, disability, language and birth of the Data Subject; (ii) information relating to the education or the medical, financial, criminal or employment history of the Data Subject; (iii) information relating to the financial affairs of the Data Subject; (iv) credit and/or debit and/or bank details and transactional data; (v) any identifying number, symbol, e-mail address, physical address, telephone number or other particular assignment to the Data Subject; (vi) correspondence sent by the person that is implicitly or explicitly of a private or confidential nature or further correspondence that would reveal the contents of the original correspondence; (vii) the views or opinions of another individual about the Data Subject; (viii) the name of the Data Subject if it appears with other personal information relating to the Data Subject if the disclosure of the name itself would reveal information about Data Subject; and/or (ix) any other information which may be treated or defined as “personal information” in terms of any applicable Laws, including Data Protection Legislation, irrespective of whether such information is in the public domain or not and irrespective of whether or not the Data Subject is in South Africa at the time of collection or processing;
“POPI” shall mean: the Protection of Personal Information Act, 4 of 2013;
“Process” shall mean: to collect, receive, record, organise, collate, store, update, modify, retrieve, alter, consult, Use, disseminate or perform any other act or action, including any other act or action which may be treated or defined as “process” or “processing” in terms of any applicable laws. The word “Processed” shall have a corresponding meaning;
“Purpose” shall mean the reason for which the Personal Information is processed, in terms of item 5;
“Services” shall mean the ordinary services Hashtopic shall provide to its clients, our normal business operations, which shall include but not be limited to website development, coding, programming, and/or other information technology-related services; and
“Use” shall mean: to use, copy, access, load, install, maintain, reproduce, modify, enhance, compile, customise, adapt, improve, process, store, alter, develop, update, upgrade, import, export, translate, convert, create derivative works, combine with other information and/or materials, and/or perform any other act and/or action, and the Periods “Uses” or “Using” shall have a corresponding meaning.

MINORS
- In the event that you and/or the Data Subject is a minor, then all consent given, and warranties provided in this Policy, from your side, is given with the express and explicit warranty that a competent person (like a parent or a guardian of the Data Subject) has provided such consent and/or warranty on behalf of the Data Subject.

WHO ARE YOU?
- If you are reading this and intending on using the Platform, you are either:
  - a person using the Platform on your own behalf; or
  - a person using the Platform on behalf of another person, being duly authorised to do so.
- If you are a Data Subject as described in item 1.1, this document applies directly to you. All warranties given, consent provided, obligations imposed, and rights afforded, are applicable directly to you. You are the Data Subject.
- If you are a person using the Platform on behalf of another person, being duly authorised to do so (as described in item 1.2), you warrant that this document and policy has been made available to the Data Subject; that any warranties given, consent provided, obligations imposed, and rights afforded, have been provided by the Data Subject; and that the Data Subject has familiarised themselves with this Policy. To that effect, you indemnify Hashtopic in the event that any consent or warranty has not been given by the Data Subject, or for any non-compliance in terms of POPI.
- Further, if you are a person using the Platform on behalf of another person, being duly authorised to do so (as described in item 1.2), you warrant that the Data Subject has consented to Hashtopic collecting the Personal Information from you, and not from the Data Subject directly.

WHY ARE WE COLLECTING AND USING THE PERSONAL INFORMATION?
- We collect Personal Information directly from Data Subjects, unless an exception is applicable (such as, for example, where the Data Subject has made the Personal Information public, or the Personal Information is contained in or derived from a public record). For the avoidance of doubt, you warrant that the obligations imposed by us, whether in terms of this Policy, statute, or otherwise, do not apply to Personal Information which is contained in or may be derived from a public record.
- We understand our obligation to make Data Subjects aware of the fact that we are Processing their Personal Information and inform them of the purpose for which we Processes such Personal Information.
- We will only Process a Data Subject’s Personal Information for a specific, lawful, and clear purpose(s) and will ensure that we make the Data Subject aware of such purpose(s) as far as possible.
- We will ensure that there is a legal basis for the Processing of any Personal Information. Further, we will ensure that Processing will relate only to the Purpose and that we will not Process any Personal Information for any other purpose(s).
- We will generally use Personal Information for purposes required to operate and manage our normal business operations and these purposes include one or more of the following non-exhaustive purposes:
  - for the purposes of providing our Services to the Data Subject from time-to-time;
  - as part of the “Know Your Customer”/“KYC” process as per the requirements of the Financial Intelligence Centre Act 38 of 2001, if applicable;
  - in order to conduct due diligence processes on our clients or prospective clients;
  - in order to comply with obligations that may be imposed on us under the Based Black Economic Empowerment Act 53 of 2003 (BEE Act) read together with the Department of Trade and Industry’s Codes of Good Practice on Broad-Based Black Economic Empowerment published in terms of Government Gazette No. 36928 on 11 October 2013 under section 9(1) of the BEE Act, as amended or reissued from time to time;
  - performing general information technology-related functions for all business functions within our organisation;
  - interacting with you on our Platform and generally monitoring your use of our Platform, including for purposes of improving the Platform;
  - in connection with internal audit purposes (i.e. ensuring that the appropriate internal controls are in place in order to mitigate the relevant risks, as well as to carry out any investigations where this is required);
  - to respond to any correspondence that the Data Subject may send to us, including via email, the Platform, or by telephone;
  - in connection with the execution of payment processing functions, including payment of our suppliers’ invoices;
  - to contact the Data Subject for direct marketing purposes subject to the provisions of clause 1 below;
  - for such other purposes to which the Data Subject may consent from time to time; and
  - for such other purposes as authorised in terms of applicable law.
- If the Personal Information is not collected by Hashtopic, for whatever reason, then the Data Subject cannot use the Platform, and cannot be registered on the Platform. The Data Subject acknowledges and warrants and understands that this is not a decision made by Hashtopic, but a necessary condition for the Use of the Platform.

WHAT DATA IS BEING COLLECTED?
- The purpose of this section of the Policy is to notify you and/or the Data Subject of what information Hashtopic shall collect from the Data Subject. You, as the Data Subject, hereby warrant, agree, and acknowledge that this Policy is a proper notification of what information is collected, who is collecting it, why it is being collected, and what the consequences are of the Personal Information not being collected.
- The information ordinarily collected by Hashtopic is the following information of the Data Subject:
  - Name and surname;
  - Business name, if applicable;
  - Registered and/or reserved company name, if applicable;
  - Geo-location, if applicable;
  - Identity document number, if applicable;
  - Registration number, if applicable;
  - Gender, if applicable;
  - Date of birth;
  - Nationality;
  - Mobile number;
  - Contact telephone number;
  - E-mail; and
  - Address and/or registered address.
- In the Use of the Platform, Hashtopic may have need to collect and Process Personal Information which may be categorised as “Special Personal Information”. To this extent, the Data Subject consents to the Processing of such Personal Information for the achievement of the Purpose.
- The Personal Information may be collected directly from the Data Subject, automatically (such as from cookies in terms of our Cookie Policy), or from third parties, as the case may be.

HOW DOES HASHTOPIC SHARE YOUR DATA WITH THIRD PARTIES?
- In achieving the Purpose, Hashtopic shares the Personal Information with the following third parties:
  - Ur-Sltn Limited;
  - Xneelo (Pty) Ltd;
  - Host Africa (Pty) Ltd;
  - Axial IT (Pty) Ltd; and
  - Users of the Platform (Users).

TRANSFER OF PERSONAL INFORMATION OUTSIDE OF SOUTH AFRICA
- The Data Subject hereby consents to, warrants that Hashtopic may, and understands that Hashtopic must, transfer the Personal Information to third parties located outside of South Africa to render the Services.
- These third parties are:
  - Ur-Sltn Limited; and
  - Users of the Platform (Users).
- Hashtopic warrants to the Data Subject that these third parties are subject to standards of data protection that upholds the principles of POPI and guarantee the protection of the Personal Information to a degree that is at least as sufficient as Hashtopic’s protection of the Personal Information.
- The Data Subject and Hashtopic agree, understand, and warrant that the transfer outlined in this item 8 is reasonably necessary to achieve the Purpose.

PERSONAL INFORMATION SHARED WITHIN HASHTOPIC CORPORATE STRUCTURE
- To the extent that it is reasonable in achieving the Purpose, the Data Subject consents to Hashtopic Processing any Personal Information, furthermore, consent to Hashtopic sharing the Personal Information referred to in this clause in the following instances:
  - with employees of Hashtopic, groups and departments within Hashtopic, Hashtopic’s agents, and sub-contractors who Process information on behalf of Hashtopic; and
  - should Hashtopic be required to do so by any law, regulation, code, or treaty.

HOW IS THE PERSONAL INFORMATION PROCESSED?
- Hashtopic’s Processing of the Personal Information shall mean to: collect, receive, record, organise, collate, store, update, modify, retrieve, alter, consult, Use, disseminate or perform any other act or action, including any other act or action which may be treated or defined as “process” or “processing” in terms of any applicable laws, the Personal Information.

HASHTOPIC’S SECURITY AND RETENTION PROCEDURES RELATING TO THE PERSONAL INFORMATION
- The Data Subject consents, acknowledges, and warrants that it is necessary and lawful, for the achievement of the Purpose, for Hashtopic to retain the Personal Information for the subsistence of the Data Subject’s registration on or use of the Platform.
- The Data Subject consents, acknowledges, and warrants that they have perused and familiarised themselves with Hashtopic’s data security policy and have taken advice on it, and consider such data security policy to be sufficient for the retention of the Personal Information.
- Should the Data Subject cease to be registered on the Platform, the Data Subjects consents to and agrees that Hashtopic may retain and Process the Personal Information for a further period of 3 years. Alternatively, if the Data Subject is not registered on the Platform but merely uses it, the Data Subjects consents to and agrees that Hashtopic may retain and Process the Personal Information for a further period of 3 years.
- Nothing in this item 11 removes the Data Subject’s right(s) to revoke their consent to the Processing of the Personal Information, and request that Hashtopic destroys and/or de-identifies the Personal Information. The Data Subject consents, acknowledges, and warrants that they have perused and familiarised themselves with Hashtopic’s data security policy and have taken advice on it, and consider the data destruction guidelines contained therein to be sufficient and appropriate.

WHAT DO YOU WARRANT TO US?

By using the Platform, you further specifically warrant to Hashtopic that the Data Subject provides the following warranties to Hashtopic:

The Data Subject has consented to the Processing;
The Data Subject, by using the Platform, becomes a customer of Hashtopic;
The Data subject considers that the Processing is done to protect a legitimate interest of the Data Subject;
The Data Subject considers that the Processing is necessary for, inter alia, Hashtopic to render the Services;
That the Processing is reasonable to achieve the Purpose;
That the Processing is the minimal amount of processing of the Personal Information that is necessary to achieve the Purpose;
The Data Subject warrants, agrees, and acknowledges that this Policy is a proper notification of what information is collected, who is collecting it, why it is being collected, and what the consequences are of the Personal Information not being collected;
The Personal Information provided to Hashtopic is accurate, correct, and that Hashtopic may rely on the information provided based on this impression;
The Data Subject warrants and guarantees that the use of the Platform is conditional on agreement to this Policy and, as such, their use of the Platform is sufficient proof of the Data Subject’s consent to the Processing; and
That any reasonable non-compliance of Hashtopic with POPI’s data notification requirements, as may happen from time-to-time, is condoned by the Data Subject.

FURTHER PROCESSING
- Hashtopic undertakes not to share or further process Personal Information with anyone or for any reason if not required for assisting the Data Subject with solutions or as required in terms of legislation or regulations.

WHAT CAN YOU DO ABOUT THE PERSONAL INFORMATION?
- You may, on using the Platform for the first time, opt in or out of receiving direct marketing from Hashtopic. This is done by checking a box marked “Marketing Consent”, which informs Hashtopic, and warrants that you request from Hashtopic, as a customer of Hashtopic, that Hashtopic may market to your directly by using the information provided to Hashtopic, and that such marketing is therefore solicited. At any time thereafter, you may opt out of receiving direct marketing from Hashtopic sending an email to that effect to Rori@hashtopic.co.za.
- You may, at any time, revoke your consent to the Processing by sending an email to that effect to Rori@hashtopic.co.za. It must be emphasised that, as soon as you revoke this consent, the Data Subject shall cease to be actively registered on the Platform, as the case may be.
- You may, at any time, contest the accuracy of the Personal Information by sending an email to that effect to Rori@hashtopic.co.za, following which the Processing thereof shall be restricted, until you provide Hashtopic with accurate and correct data. It must be emphasised that you are responsible for ensuring the accuracy of the Personal Information.
- The Data Subject has certain rights under POPIA, which includes:
  - a right of access: a Data Subject having provided adequate proof of identity has the right to: (i) request Hashtopic to confirm whether any Personal Information is held about the Data Subject; and/or (ii) request from Hashtopic a description of the Personal Information held by Hashtopic including information about Third Parties who have or have had access to the Personal Information. A Data Subject may request:
    - Hashtopic to confirm, free of charge, whether it holds any Personal Information about him/her/it; and
    - to obtain from Hashtopic the record or description of Personal Information concerning him/her/it and any information regarding the recipients or categories of recipients who have or had access to the Personal Information. Such record or description is to be provided:
      - within a reasonable time; and
      - in a reasonable manner and format and in a form that is generally understandable.
    - a right to request correction or deletion: a Data Subject may also request Hashtopic to –
      - destroy or delete a record of Personal Information about the Data Subject that Hashtopic is no longer authorised to retain records in terms of POPIA’s retention and restriction of records provisions.

On receipt of such a request, Hashtopic is required to, as soon as is reasonably practicable –

delete or destroy the information;
provide the Data Subject with evidence in support of the information; or
where the Data Subject and Hashtopic cannot reach agreement on the request and if the Data Subject requests this, Hashtopic will take reasonable steps to attach to the information an indication that correction has been requested but has not been made;

Accordingly, Hashtopic may request the Data Subject to provide sufficient identification to permit access to, or provide information regarding the existence, use or disclosure of the Data Subject’s Personal Information.
Any such identifying information shall only be used for the purpose of facilitating access to or information regarding the Personal Information.

HOW TO CONTACT HASHTOPIC
- You may contact Hashtopic at the following address(es) to direct any queries in terms of this Policy:
  - Email: Rori@hashtopic.co.za
  - Telephone: (+27) 60 969 9033
  - https://hashtopic.co.za/#Contact
- For further information, please email: Rori@hashtopic.co.za