Citra Privacy Policy

South African Privacy Policy

In accordance with the Protection of Personal Information Act, 2013.

Introduction

The Protection of Personal Information Act 4 of 2013 serves the purpose of giving effect to the
constitutional right to privacy by ensuring information is processed responsibly to prevent security
breaches, theft, and discrimination. At CITRA Development 1, we value your trust and endeavour to uphold
the provisions of The Act for your protection and peace of mind. The Act sets out requirements for the
processing of Personal Information, which CITRA Development 1 in this policy echoes. This policy will give
you insight into how CITRA Development 1 processes and protects the Personal Information you provide us
with through your various interactions with us.

Herein some definitions to assist you in navigating the document:

“The Act” is The Protection of Personal Information Act 4 of 2013
“Responsible Party” is the person or entity that processes information on behalf of a Data Subject,
in this case, CITRA Development 1 or any of its subsidiaries.
“Data Subject” is any person that provides a Responsible Party with their Personal Information.
“Operator” is any person who processes information of a Responsible Party in terms of a contract or
mandate. An example of this is where a Responsible Party outsources a function of their business to
a third party.
“Personal Information” is all information which may be considered to be personal in nature or
information about an identifiable natural and/or existing juristic person (where applicable) in terms
of the Electronic Communications and Transactions Act 25 of 2002 (ECTA), the Consumer Protection
Act 68 of 2008 (CPA) and the Protection of Personal Information Act 4 of 2013 (POPIA).

What is Personal Information, and what Personal Information do we collect about you?

According to The Act, ‘Personal Information’ means information relating to an identifiable, living, natural
person, and where it is applicable, an identifiable, existing juristic person.

Identity data: Name and registration number of your company or entity if you are a legal person,
first name and surname and identity number if you are a natural person or the representative of a
legal person.
Contact data: Address, email address, contact number.
Financial data: Bank account and card details.
Transaction data: Details about payments and products/services you have purchased from us.
Technical data: Includes IP address, your login data, browser type and version, time zone setting and
location, browser plug-in types and versions, operating system and platform and other technology
on the devices you use to access this website. As well as information about your visit, including the
full URLs, clickstream to, through and from our website (including date and time), products you
viewed or searched for, page response times, errors, length of visits to certain pages, page
interaction information (such as scrolling, clicks, and mouse-overs) and methods used to browse
away from the page.
Profile data: Username and password, purchases or orders made by you, your interests,
preferences, feedback and survey responses.
Usage data: Information about how you use our website, products and services.
Marketing and communications data: Your preferences in receiving marketing from us and our third
parties and your communication preferences.

Acceptance of our policy

By using our services, you understand that we will collect and use your Personal Information as indicated in
this policy.

You have the right to decline consent and/or if provided, to withdraw consent at any time. This will not
affect the lawfulness of the processing prior to the withdrawal of your consent. At any time, you can request
that we stop using your Personal Information for direct marketing purposes.

Where we need to collect Personal Information under the terms of a contract we have with you and you fail
to provide that data when requested, we may not be able to perform the contract we have with you.

How do we collect your Personal Information?

Direct interactions

By way of filling in forms, email or telephone correspondence, purchasing or subscribing to
products/services, and via our website.

Automated technologies or interactions

We automatically collect technical data about your equipment, browsing actions and patterns as you use
our website. We collect this Personal Information by using cookies and other similar technologies.

How do we use your or your Data Subject’s Personal Information?

We will only use your Personal Information when the law allows us to. We will most likely use your Personal
Information in the following circumstances:

Agents

We employ other companies and individuals to perform functions on our behalf. Examples include analysing
data, providing marketing assistance, processing payments, and providing customer service. They have
access to Personal Information needed to perform their functions, but may not use it for any other purpose.

Business transfers

In the event of the purchase or restructuring of the whole or part of our business, certain intellectual
property, including our customer’s information, may be transferred to another party in the normal course of
business.

Credit purposes

If we receive, compile, retain or report any account or Personal Information pertaining to you or your
financial position, we will protect the confidentiality of that information, and in particular, will:

Use that information only for a purpose permitted or required in terms of the National Credit Act 34
of 2005 (South Africa), other national legislation or applicable provincial legislation; and
Report or release that information only to you, or to another person to the extent permitted or required by the National Credit Act, other national legislation or applicable provincial legislation; or as directed by:
- Your instructions; or
- An order of a court or the South African National Credit Tribunal.
- Work-related information

For the purposes of registration or application related to our committees and Council operations, we will request details regarding your employer (current and/or former), past work experience and additional,
related details. This will include your CV, work experience, work positions and responsibilities.

Website

We will only use your Personal Information for the purposes for which we collected it unless we reasonably
consider that we need to use it for another reason. We may process your Personal Information without your
knowledge or consent in compliance with The Act, where this is required or permitted by law.

Social media data

We may provide social media features that enable you to share information with your social networks and
to interact with us on various social media sites. Your use of these features may result in the collection or
sharing of information about you, depending on the feature. We encourage you to review the privacy
policies and settings on the social media sites you use to make sure you understand the information that is
collected, used, and shared by those sites.

Other unique identifying information

Examples of other unique information that we collect from you include product serial numbers, the
information you provide when you interact in-person, online or by phone or mail with our services centres,
help desks or other customer support channels, your written, voice or video responses to customer surveys
or contests or additional information you have provided to us to facilitate delivery of services and to
respond to your inquiries.

Marketing

We will provide you with choices regarding certain Personal Information uses, particularly around marketing
and advertising. You might receive marketing communications from us if you have requested information or
purchased services from us. You can ask us to stop sending you marketing messages at any time by
following the opt-out links on any marketing message sent to you.

We generally encourage the use of browser settings and tools to limit browser cookies in order to protect
your privacy. In addition, we may set your browser to refuse all or some browser cookies or to alert you
when websites set or access cookies. If you disable or refuse cookies, please note that some parts of our
website may become inaccessible or not function properly.

International transfers

In the event that we send Personal Information outside of South Africa (including if such information is
hosted offshore), we will ensure that it takes all reasonable steps to ensure that it complies with all
applicable laws in this regard, including The Act.

How secure is our data?

We have put into place appropriate security measures to prevent your Personal Information from being
accidentally lost, used or accessed in an unauthorised way, altered or disclosed, such as password
protection, two-factor authentication, device control policies and other stringent security measures.
This is in addition to the physical security measures adopted to ensure that it takes all appropriate,
reasonable technical and organisational measures to prevent:

I. loss of, damage to, or unauthorised destruction of Personal Information, and
II. unlawful access to or processing of Personal Information.

We have a stringent security policy in place that every officer, employer and supplier of CITRA Development
1 must adhere to.

Cookies

The website uses small text files, called cookies, which are automatically stored on a device when users
access and use certain features of this website. As cookies are unique, we can use them to distinguish users
from each other. If you refuse to accept cookies or change your device’s cookie settings, you may not be
able to use all of the website’s features.

Updating of Privacy Policy

We reserve the right to update, modify or amend this policy from time to time with or without notice. You
therefore agree and undertake to review the policy whenever you visit the website. Save as expressly
provided to the contrary in this policy, any amended version of the policy shall supersede and replace all
previous versions thereof.

What are your legal rights?

It is important to note that you have rights in relation to your Personal Information. You have the right to
contact us at any time to request to:

Confirm that it holds your Personal Information (at no charge).
Provide you with a copy of any records containing your Personal Information or a description of the Personal Information that the Organisation hold about you (subject to payment of a prescribed fee);
and/or
Confirm the identity or categories of third parties who have had, or currently have, access to your
Personal Information (also subject to payment of a prescribed fee to cover our costs).

When you request your Personal Information, we will take reasonable steps to confirm your identity.

There may be times when we cannot grant access to your Personal Information, including where granting
you access would:

I. interfere with the privacy of others, or
II. result in a breach of confidentiality.

We will always provide you with reasons if this is the case.

If you are of the view that any Personal Information that we hold about you is incorrect in any way,
including that it is inaccurate, irrelevant, outdated, incomplete or misleading, you can request a correction.
If you believe that any Personal Information that we hold about you is excessive or has been unlawfully
obtained, you can request that we destroy or delete it. You may do the same if you think that we have
retained it for longer than necessary, given the purpose. We will do so unless there are good grounds not to
(such as CITRA Development 1 is required to hold it for a period prescribed by any applicable legislation).
It is important, however, to understand that if you withdraw your consent for us to use some of your
Personal Information, it may affect the quality and level of service that we can provide to you.

Promotion of Access to Information Act 2 of 2000 (“PAIA”)

PAIA gives you the right to access information that is required to exercise or protect your rights. In terms of
PAIA, before access to the information requested by persons is granted, specific requirements have to be
met.

PAIA also requires private bodies such as the Organisation to compile a manual designed to assist persons
who want to exercise their right to access information. You or third parties may also request access to your
Personal Information held by the Organisation.

PAIA regulates and sets out the procedure for such a request and under what circumstances such access
may be refused.

Please contact us should you require our PAIA manual, the prescribed request form and/or information on
applicable fees payable for access to this information.