Privacy Policy

CCJR (Pty) Ltd Privacy Policy 

CCJR (Pty) Ltd recognises its obligation to comply with the requirements of the Protection of Personal Information Act 4 of 2013 (POPIA). 

Statement 1: Accountability 

CCJR (Pty) Ltd recognises itself as a responsible party under POPIA and as an operator in respect of persons, and other corporate entities who make use of our services and products. Due care and security of personal information as well as compliance with applicable laws will be adopted across CCJR (Pty) Ltd, regardless of the role that CCJR (Pty) Ltd plays. 

Statement 2: Processing Limitation 

All personal information collected and used by CCJR (Pty) Ltd is done so lawfully and in a reasonable way that does not infringe on the privacy rights of data subjects. As far as possible, the principle of minimality (adequate, relevant and necessary) is upheld for all business activities – where the minimum set of data or information is processed to achieve the purpose. 

Statement 3: Purpose Specification 

At all times, personal information is to be used for specific purposes only. Data subjects are to be made aware, by CCJR (Pty) Ltd or the relevant responsible party if not CCJR (Pty) Ltd, of the purposes for which CCJR (Pty) Ltd collects and uses their personal information at the point where it is collected or during any future interactions with the data subject. 

Suitable records management policies, processes, standards and guidelines are developed to ensure appropriate retention, restriction, archival, deletion and destruction of records of personal information. Records of personal information are only kept for as long as a data subject has a relationship with CCJR (Pty) Ltd, or as otherwise permitted by law or a contractual agreement, following which they are suitably disposed of, as fair as reasonably possible, or otherwise securely archived for historical or evidentiary purposes. 

Statement 4: Further Processing 

Any additional processing of personal information across CCJR (Pty) Ltd must be compatible with the original purpose(s) for which it was collected. 

Statement 5: Information Quality 

CCJR (Pty) Ltd will take reasonable steps to ensure that all personal data and information is kept accurate, complete, up to date and not misleading as is necessary for the purposes for which it is processed. Data enrichment or remediation from third-party sources is permitted provided that an appropriate assessment has been done by the CCJR (Pty) Ltd. 

Where personal information is collected, the data subject is made aware of at least the following: 

• What the personal information will be used for 

• Consequences of the failure to provide this information 

• Any laws which authorise such collection or processing 

• If information will be transferred to third parties or across international borders 

• The rights they have in terms of their personal information 

• If any of the information will be used for automated decision-making and profiling, suitable logic surrounding such processing and any consequences of such automated processing 

Statement 6: Security Safeguards 

CCJR (Pty) Ltd establishes, reviews and maintains adequate technical and organisational security measures to deal with the confidentiality and integrity of personal information in its possession and to manage associated risks. 

CCJR (Pty) Ltd establishes due diligence procedures for assessing the use of third-party service providers, and these procedures are always adhered to when the third party will process or have access to personal information. Where CCJR (Pty) Ltd uses third parties to process personal information, if applicable under POPIA, consent will be obtained from any responsible parties. 

Statement 7: Data Subject Participation 

Appropriate channels and mechanisms will be established such that data subjects can freely gain access to and correct their personal information, or exercise any rights that they have under applicable privacy and data protection laws. 

Statement 8: Third-party Management 

Third parties may undergo risk assessments and further due diligence requirements dependent on the services that they will provide to CCJR (Pty) Ltd, the types, sensitivity and volumes of personal information to be processed by the third party (if any), and the risk and potential impact posed to any data subjects by such processing. 

Standard contractual agreements for all third parties will include privacy, data protection, information security and data handling clauses.