POPI Privacy Policy

1. Our commitment to your privacy

We undertake to manage personal information responsibly in accordance with the Protection of Personal Information Act 4 of 2013 (POPIA). We aim to be transparent about the information we collect, why we collect it and how it is processed.

We collect and process information that is adequate, relevant and necessary for the stated purpose, take steps to keep it accurate, and do not retain it longer than required for that purpose or by applicable law.

2. Information we collect

We collect and process information relating to your PPE requirements, preferences, transactions and financial obligations to ZDI. The information required depends on the service or transaction involved. Wherever possible, we distinguish between required and optional information.

We collect information directly from you or, with your prior written approval, from a third party. With your consent, we may supplement information you provide with information received from other providers to support a consistent, personalised service.

Why we use your information

• To understand your needs, conduct due diligence and, where applicable, assess affordability for requested transactions.
• To provide products and services and carry out transactions you request.
• To assess and process reservations, exchanges, claims and queries, and maintain relevant transaction histories.
• To confirm, verify and update your details and establish that you are an authorised user for security purposes.
• To respond to enquiries, provide assistance and maintain our relationship with you.
• To conduct market or customer-satisfaction research and process information for marketing purposes in accordance with applicable law.
• For audit, record-keeping, legal proceedings and lawful regulatory or government requirements.
• To communicate about ZDI services and regulatory matters that may affect you.

Processing may be based on your consent, the requirements of a contract, a legal obligation or another lawful ground, including the protection or pursuit of legitimate interests where permitted by POPIA.

3. Sharing and disclosure

We may share personal information where necessary to assist with a transaction, provide products or services you elect to use, or meet a lawful obligation. Recipients may include approved product suppliers, third-party service providers, subsidiaries or joint-venture companies where applicable.

We may use software or online platforms to process information for applications, claims or business management, subject to POPIA requirements. We seek to ensure that relevant suppliers and service providers are bound by confidentiality and privacy obligations.

Disclosure may also take place where required or permitted by law, in connection with legal proceedings, or where lawfully necessary to protect ZDI’s rights. Employees have a duty to keep company and client information confidential.

4. Safeguarding personal information

We undertake to protect personal information through appropriate technological and organisational measures. We review safeguards to address reasonably foreseeable risks, prevent loss or damage, and protect against unauthorised access or unlawful processing.

Our policy provides for confidentiality obligations, staff awareness, off-site electronic backups and privacy commitments from relevant service providers. Where a security compromise requires notification, we will notify the Information Regulator and affected individuals as required by law.

5. Your rights and requests

You may contact us to request access to the personal information we hold about you, or ask us to update, correct or delete information on reasonable grounds, subject to applicable legal requirements.

You may withdraw consent or object to processing where POPIA permits. We will assess the request and any lawful grounds or retention obligations that apply. We take reasonable steps to verify your identity before disclosing information or making changes.

Requests for company records under the Promotion of Access to Information Act 2 of 2000 (PAIA) must follow the applicable prescribed process. Contact the Information Officer for the relevant forms, requirements and any applicable fees.

6. Retention and destruction

We retain records for the purposes for which they were collected and for applicable statutory retention periods. Retention requirements apply to both paper and electronic records.

When records are eligible for disposal, our policy provides for authorised destruction and confidential handling, including shredding paper records. Records may also be kept in approved off-site storage facilities.

7. Changes to this policy

Our policy is reviewed as needed or at least annually. Please check our website periodically for updates. Material changes will be communicated directly or published on our website.

9. Information Regulator

You may contact ZDI to discuss privacy questions or concerns. You also have the right to lodge a complaint with the Information Regulator.

Website: inforegulator.org.za
General enquiries: [email protected]
POPIA complaints: [email protected]
Telephone: 010 023 5200

View the Regulator’s complaint process →