Dear Candidate

The Protection of Personal Information Act 4 of 2013(“POPIA”) has now come into effect.

POPIA regulates the processing, management, storage, and protection of personal information in order to protect an individual's right to privacy and prevent identity theft, amongst others.

As part of the DBSA’s ongoing POPIA compliance, please refer to the following Privacy Statement.

The Privacy Statement sets out:
• Information which we may collect from you.
• How we collect information.
• How we may use, transfer and disclose your information.

As a Responsible Party, the DBSA continues on a journey to identify and minimise the data protection risks from processing personal information. Your personal information is secure with us.


For further queries, please contact our POPIA Deputy Information Officer, at POPIA@DBSA.ORG.
 

Development Bank of Southern Africa Limited
Privacy Policy(including personal information processing consent) (“Policy”)

Introduction
For purposes of this Policy:

“Applicable Laws” means, local, foreign and international laws, regulations, treaties and codes, for example: Administrative Laws, Financial and Tax Laws, Labour Laws, Employment Equity Laws and Health and Safety Laws.

“Employee” or “you” means any prospective, new or existing employee of the DBSA; and
“DBSA”, “Bank” or “we” means the Development Bank of Southern Africa Limited.
 

This Policy sets out how your personal information will be used by the DBSA and applies to any information, including personal and special personal information, you give to the DBSA, or which the DBSA may collect from third parties. It is important that you read this Policy carefully before submitting any personal information to DBSA. By submitting any personal information to the DBSA you provide consent to the processing of your personal information as set out in this Policy. The provisions of this Policy are subject to mandatory, unalterable provisions of Applicable Laws; Please do not submit any personal information to the DBSA if you do not agree to any of the provisions of this Policy.If you do not consent to the provisions of this Policy, or parts of the Policy, the DBSA will not be able to engage with you and / or enter into any subsequent relationship with you.

How to contact us
If you have any comments or questions about this Policy, please contact Kim Sanderson, the Deputy Information Officer at POPIA @DBSA.ORG.

Amendment of this Policy
We may amend this Policy from time to time for any of the following reasons:
• To provide for the introduction of new systems, methods of operation or services;
• To comply with changes to any legal or regulatory requirement;
• To ensure that our Policy is clearer and more favourable to you;
• To rectify any mistake that might be discovered from time to time; and / or
• For any other reason which we, in its sole discretion, may deem reasonable or necessary.

Any such amendment will come into effect and become part of any employment contract that you have with the DBSA, when notice is given to you of the change by publication on our intranet. It is your responsibility to check the intranet often.

Privacy and indemnity
DBSA takes your privacy and the protection of your personal information very seriously, and we will only use your personal information in accordance with this Policy and Applicable Laws. It is important that you take all necessary and appropriate steps to protect your personal information yourself(for example, by ensuring that all passwords and access codes are kept secure).

We have implemented reasonable technical and operational measures to keep your personal information secure.

You hereby indemnify and hold DBSA harmless from any loss, damages or injury that you may incur as a result of any unintentional disclosures of your personal information to unauthorized persons or the provision of incorrect or incomplete personal information to the DBSA.

Information which we may collect about you
• Your contact information, such as name, alias, address, identity number, passport number, security number, phone number, cell phone number, vehicle make and registration number, social media user ID, email address, and similar contact data, serial numbers of equipment, details regarding the possession of dangerous weapons, and other contact information including details of your previous employers, memberships or affiliations, including professional bodies and trade unions, and similar data, which are required for various legitimate interest, contractual and / or lawful reasons pertaining to your application for employment or actual employment with the DBSA.

• Career, education, and employment related information, such as job preferences or interests, work performance and history, salary history, nationality and immigration status, demographic data, professional licensure information and related compliance activities, accreditations and other accolades, education history(including schools attended, academic degrees or areas of study, academic performance, and rankings), and similar data, which are required for contractual or employment related matters or which are required to comply with Applicable Laws.

• Sensitive, or special categories of personal information, which are required in order to protect legitimate interests, comply with legal obligations or public legal duties, or in order to accommodate you in our workplaces, such as your race, disability-related information(Employment Equity related), religion(correct and fair treatment related), sexual and medical history including any medical conditions(to comply with laws and related to correct and fair treatment issues), trade union matters(to comply with Applicable Laws and related to correct and fair treatment issues), and financial, credit, deviant and criminal history, (to protect our legitimate interests and to perform risk assessments), as well as children’s details(benefits related) and biometric information, such as images, fingerprints and voiceprints.Such biometric information is required in order

to provide you with access to our facilities, give you access to our ICT infrastructure, for security monitoring purposes as well for other lawful reasons pertaining to your employment with the DBSA.

• Demographic information, such as country, preferred language, age and date of birth, marriage status, gender, physical characteristics, personal or household financial status and metrics, and similar data, which are required for various legitimate interests, as well as contractual and / or lawful reasons pertaining to your actual employment with the DBSA.

• Public issued Identity Information, such as government - issued identification information, tax identifiers, social security numbers, other government - issued identifiers, and similar data, which are required to comply with Applicable Laws and public duties as well for other lawful reasons pertaining to your employment with the DBSA.

• Tax and financial Information, banking details, and tax registration number and status, which are required to perform contractual matters and / to comply with tax laws and public duties.

• ICT information, including ICT security-related information(including ICT user names and passwords, authentication methods, and roles), and similar data, which are required for various legitimate interests, contractual and / or lawful reasons pertaining to your actual employment with the DBSA.

• Health history and records, which is classified as special personal information, such as medical status and history, examinations, blood type, medical aid history, disability-related information, biometrics, medicals, psychometrics and similar data, which are required for contractual or employment related matters or which are required to comply with Applicable Laws and public duties.

• Social media and online activities and presence, such as information placed or posted in social media and online profiles, online posts, and similar data, which are required for contractual or employment related matters or which are required to comply with Applicable Laws and public duties.

We may require you to provide additional personal information, in order for us to meet our legal or regulatory obligations.

Where you provide us with the personal information of third parties you should take steps to inform the third party that you need to disclose their details to us, identifying us. We will process their personal information in accordance with this Policy.

How we collect information
You may provide personal information to us, as follows:

Direct collection: you provide personal Information to us when you:
• interact with us;
• enquire about, or apply for a position within the DBSA, including requesting, or signing up for information;
• express an interest in working with us or apply for a job or position or bursary, learnership or sponsorship with us;
• take up a job or position with us;
• conclude a contract with us;
• communicate with us by phone, email, chat, in person, or otherwise;
• complete a questionnaire, or other information request form.

Automatic collection: we collect personal information automatically from you when you:
• search for, visit, interact with, or use our websites, applications, mobile applications, or social media portals or platforms;
• access, use, or download content from us;
• open emails or click on links in emails or advertisements from us;
• Otherwise interact or communicate with us.

Collection from third parties: we collect personal information about you from third parties, such as:
• recruitment or employment agencies, previous employees and colleagues;
• your previous employer;
• Regulatory Bodies, professional or industry organizations and certification / licensure agencies that provide or publish personal information related to you;
• third parties and affiliates who deal with or interact with us or you;
• service providers and business partners who work with us and that we may utilize to deliver services;
• SAP, Home Affairs, Credit bureaus and other similar agencies;
• Government agencies, Regulatory Bodies and others who release or publish public records;
• Other publicly or generally available sources, such as social media sites, public and online websites, open databases, and data in the public domain.

Use of information collected
We may use, transfer and disclose your personal information for the purposes of:

• Employment: potential - legitimate purpose: To conduct and communicate with you regarding recruiting and human resource administration, to manage recruitment including legal eligibility for work and vetting.

• Due diligence purposes - legitimate purpose: To carry out ongoing due diligence exercises including obtaining and verifying your details and / or credentials, such as receiving and verifying your identity, education, qualifications and employment history,

medical and health history and related records, financial, credit and tax status and history, and / or any employee performance related history.

• Employment: actual - to contract with you: To conclude an employment contract with you, to manage hires, promotion and succession planning; and to conduct and communicate with you regarding your employment and to perform human resources administration, financial administration, comply with Labour, Tax and Employment Equity laws, management and organizational administration, training, and skills development, including performance assessments and disciplinary matters.

• Employment benefits -legitimate purpose and to manage the contract: To manage your benefits, including administering remuneration, relocation, insurance, payroll, pensions/ provident funds and other employee benefits and tax, including disclosure to others such as payroll providers, accountants, occupational health providers, insurers, pensions / provident fund administrators, hosting service providers and legal advisers;

• Operational issues -compliance with law and to manage the contract: To communicate, enforce and ensure you comply with policies, including in relation to claims, disciplinary actions or legal requirements and conducting investigations and incident response, including reviewing your communications in these situations in accordance with relevant internal policies and Applicable Laws;

• Occupational health - compliance with laws: To manage occupational health and absence and fitness for work and notifying family members in emergencies;

• Travel - contractual: To facilitate business travel, travel-related support including conference attendance, bookings, and emergency support services;

• Employment equity - compliance with laws: To monitor equal employment opportunities, in respect of diversity categories including but not limited to age, gender, ethnicity, nationality, religion, disability, sexual orientation, and marital or family status;

• IR and Labour relations - compliance with laws: To manage membership to trade unions and collective agreements for administering collective employee arrangements where these are in place;

• Communications - legitimate purpose: To make contact with you and to communicate with you generally or in respect of our requirements, or instructions, or to respond to you in order to comply with your specified or general instructions.

• Risk assessment, fraud detection and anti-bribery and corruption matters - legitimate purpose: For internal and external auditing, assurance and risk management purposes; to carry out organizational and enterprise wide risk assessments, and to conduct internal and external investigations, in order to

• Legal obligation and public duties: To comply with the law and our legal obligations, including to register with Regulatory Bodies, obtain and hold permits and certificates, register for VAT, Tax, PAYE, SDL, COIDA and UIF etc, to submit reports or provide various notices or returns, to litigate and / or to respond to a request or order from a SAP official, investigator or court official, Regulatory Body, or public authority.

• Security purposes -legitimate purpose and to comply with laws: To permit you access to our offices, facilities, manufacturing or parking areas, as well as to controlled areas, for the purposes of monitoring via CCTV, your interaction and access in and from our facilities described above, and for general risk management, security and emergency incident control purposes as well as for providing ICT access and support and for employee authentication and for data and cybersecurity purposes.

• Advertising, marketing, public relations and related communications- legitimate purpose: For the purposes of advertising, marketing, public relations, via publications and references including images and photographs and video footage on our website, social media platforms, marketing material and brochures, advertising, PR campaigns and related communications.

• For internal research and development purposes – legitimate purpose: For statistical analysis and research purposes in the context of employment, including predictive modelling and people planning.

Disclosure of your information
Your personal information may be shared with our agents, sub-contractors, Regulatory Bodies and auditors as well as selected third parties who process the information on our behalf.

We may also disclose your personal information to third parties when we are entitled or obliged to do so under Applicable Law.

We may transfer your information to an agent, sub-contractor or third party who carries on business in another country, including one which may not have data protection laws similar to those of the Republic.If this happens, we will ensure that anyone to whom we pass your information agrees to treat your information with the same level of protection as if we were dealing with it.

If you do not wish us to disclose this information to third parties, please contact us at the contact details set out above.We may, however, then not be able to engage with you and/or enter into any subsequent relationship with you.

Retention of your information
We may retain your personal information indefinitely, unless you object, in which case we will only retain it if we are permitted or required to do so in terms of Applicable Laws. However, as a general

rule, we will retain your information in accordance with retention periods set out in Applicable Laws, unless we need to retain it for longer for a lawful purpose.

Access to, correction and deletion of your personal information

You may request details of personal information which we hold about you under the Protection of Personal Information Act 4 of 2013 (“POPIA”) or about third parties where your rights are affected by such information under the Promotion of Access to Information Act 2 of 2000 (“PAIA”). Fees to obtain a copy or a description of such personal information are prescribed in terms of PAIA.Confirmation of whether or not we hold personal information about you may be requested free of charge.

You may request the correction of personal information DBSA holds about you.Please ensure that the information we hold about you is complete, accurate and up to date.The onus is on you to advise the DBSA of any changes to your personal information, as and when these may occur.

You have a right in certain circumstances to request the destruction or deletion of and, where applicable, to obtain restriction on the processing of personal information held about you. If you wish to exercise this right, please contact us using the contact details set out above.

You have a right to object on reasonable grounds to the processing of your personal information.

For more information in this regard please read our PAIA manual.

Complaints
Should you believe that we have utilised your personal information contrary to Applicable Laws, you undertake to first attempt to resolve any concerns with us.

If you are not satisfied with such process, you may have the right to lodge a complaint with the Information Regulator, using the contact details listed below:

Tel: 012 406 4818
Fax: 086 500 3351
Email: inforeg @justice.gov.za.