ST GEORGE’S VILLAGE MANAGEMENT ASSOCIATION NPC

POPI POLICY

Contents

1. Purpose
2. Definitions
3. Personal information which St George’s Village Management Association NPC may collect
4. Manner in which personal information is collected by St George’s Village Management Association NPC
5. Manner in which and the reason St George·s Village Management Association NPC processes personal information
6. Persons St George’s Village Management Association NPC may share personal information with
7. Data security
8. Length of time that personal information will be retained
9. Rights of data subjects
10. Lines of communication
11. Changes to this privacy policy
12. Types of information we collect and why we use it. 

1. Purpose

2. Definitions

Some of the keytermsthat we use in this policy are defined below:

1. “Data subject” means the individual the personal data relates to.
2. “Information officer” means a figure responsible for:
   • Encouraging compliance within the organisation, to the lawful processing of personal information as set out in the POPIA.
   • Dealing with requests made in terms of the POPIA.
   • Working with the Information Regulator, with regards to any investigations the Information Regulator may conduct in terms of chapter 6 of the POPIA.
3. “Personal information” means information relating to an identifiable, living, natural person, and where it is applicable, an identifiable, existing juristic person, including, but not limited to:
   • Information relating to the gender, sex, pregnancy, marital status, national, ethnic, or social origin, colour, sexual orientation, age, physical or mental health, well-being, disability, religion, conscience, belief, culture, language, and birth of the person.
   • Information relating to the education or the medical, financial, criminal or employment history of the person.
   • Any identifying number, symbol, e-mail address, physical address, telephone number, location information, online identifier, or other particular assignment to the person.
   • The biometric information of the person.
   • The personal opinions, views, or preferences of the person.
   • Correspondence sent by the person that is implicitly or explicitly of a private or confidential nature or further correspondence that would reveal the contents of the original correspondence.
   • The views or opinions of another individual about the person; and
   • The name of the person if it appears with other personal information relating to theperson or if the disclosure of the name itself would revealinformation about the person.
4. “POPIA” means the Protection of Personal Information Act 4 of 2013, as amended from time to time.
5. “Processing” means any operation or activity or any set of operations, whether or not by automatic means, concerning personal information, including:
   • The collection, receipt, recording, organisation, collation, storage, updating or modification, retrieval, alteration, consultation, or use.
   • Dissemination by means of transmission, distribution or making available in any other form; or
   • Merging, linking, as well as restriction, degradation, erasure, or destruction of information.
6. “Village” means St George’s Retirement Village.
7. “We”‘, “us” or “our” means the St George’s Village Management Association NPC and all our affiliates, business partners and related parties.

3. Personal information which St George’s Village Management Association NPC may collect

1. We may collect and process the following personal information from data subjects:
   • Name and contact information, including email address, telephone number, physical address, postal address and other location information, erf number.
   • Date of birth, age, gender, nationality, title, and language preferences.
   • Identity number, passport number andphotograph.
   • Vehicle registration number, vehicle licence and driving licence.
   • Biometric information, including but not limited to, if applicable, that information obtained from fingerprints, hands, facial recognition and/or retinal scanning.
   • Verified banking details, documents, including but not limited to bank statements, list of assets and liabilities, investment statements, certificates of balance related to pension or investment funds.
   • Employment details.
   • Correspondence of a private or confidential nature.
   • The categories of personal information listed in our PAIA Manual or otherwise included in the definition of “personal information” as set out in POPI.
   • Reports from doctors; prescriptions from pharmacies, medical records and medical aid details.
   • Living will.
   • Such other personal information as is disclosed to us and/or reasonably required.

4. Manner in which personal information is collected by St George’s Village Management Association NPC

1. We may collect or obtain personal information from data subjects:
   • Directly.
   • During the course of our interactions.
   • When you visit the village.
   • Upon interaction with our website or any other social media platforms or IT services.
   • From publicly available sources; and
   • From a third party who is authorised to share that information.

5. Manner in which and the reason St George’s Village Management Association NPC processes personal information

1. POPIA requires that personal information “is collected for a specific, explicitly defined and lawful purpose.”
2. Further, POPIA provides that personal information may only be processed if:
   • The data subject or a competent person acting on behalf of a mentally incapacitated data subject or a data subject who is a minor, consents to the processing.
   • Processing is necessary to carry out actions for the conclusion or performance of a contract to which the data subject is party.
   • Processing complies with an obligation imposed by law on the responsible party.
   • Processing protects alegitimate interest of the data subject.
   • Processing is necessary for the proper performance of a public law duty by a public body; or
   • Processing is necessary for pursuing the legitimate interests of the responsible party or of a third party to whom the information is supplied.
3. We may collect other personal information from time to time, as necessary for our operational requirements, or in order to comply with applicable laws.

6. Persons St George’s Village Management Association NPC may share personal information with

• Depending on the circumstances, we may disclose personal information to the following categories of persons:
  • Auditors, legal and other professional advisers, and consultants of the Village or other third parties who help us deliver our services, including St George’s Village Management Association NPC and all sub-committees of the Company, including the boards of St. George’s Management Village Management Association NPC, and Grace Village Management (Pty) Ltd.
  • Information Technology and other service providers who help us run the Village or otherwise manage or store the personal information.
  • Government and law enforcement authorities.
  • Other third parties where disclosure is required by law or otherwise required for us to perform our obligations and provide our services; and
  • Any other person with consent to the disclosure.
• We take reasonable steps to protect the confidentiality and security of personal information when it is disclosed to a third party, and seek to ensure the third party deals with your information in accordance with our instructions, applicable privacy laws, and only for the purpose for which it is disclosed.

7.  Data security

1. We may hold personal information in electronic or in hard copy form. We may keep this information at our own premises, or at sites managed by our services providers.
2. We are committed to keeping your personal information safe.
3. We use a range of physical, electronic, and procedural safeguards to do this. We update these safeguards from time to time in order to address new and emerging security threats. We also train our people on privacy matters as appropriate, and seek to limit access to personal information to those of our people who need to know that information.
4. We implement appropriate IT security measures to protect your personal information that is in our possession against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, unauthorised access, in accordance with applicable law. Please find attached a report marked ‘A’ on these security measures from our service provider.
5. Where there are reasonable grounds to believe that your personal information that is in our possession has been accessed or acquired by any unauthorised person, we will notify the relevant regulator and the data subject, unless a public body responsible for detection, prevention or investigation of offences or the relevant regulator informs us that notifying you will impede a criminal investigation.

8. Length of time that personal information will be retained

1. We retain personal information for as long as we have an ongoinglegitimate operational need to do so (for example, to provide you with a service) or to comply with applicable legal, tax or accounting requirements.
2. We shall only retain and store your personal information for the period for which the information is required to serve the purpose for its collection, or a legitimate interest or the period required to comply with applicable legal requirements, whichever is longer.

9. Rights of data subjects

1. Data subjects have the right to:
   • ask what personal information we hold.
   • request access to the personal information.
   • ask us to update, correct or delete any out-of-date or incorrect personal information.
   • unsubscribe from any direct marketing communications; or
   • object to the processing of personal information.
2. May exercise any of these rights or has any queries regarding the personal information held, the data subject can contact us as per the details provided below.
3. To protect the integrity and security of the information we hold, we may ask that a data subject follows a defined access procedure, which may include steps to verify their identity.
4. If a request is made to delete all personal information, we may need to terminate the agreements with such data subject. We may refuse to delete such information if we are required by law to retain it or if we need it to protect our rights.

10. Lines of communication

1. If a data subject wishes to raise a question, concern, or complaint regarding the way in which we handle personal information or believes that we have failed to comply with this policy or breached any applicable laws in relation to the management of that information, a complaint may be lodged.
2. Any question, concern or complaint should be made in writing to our Information Officer – Heather Murrell- accounts@st-georges.co.za
3. If you wish to make a request to access your personal information in terms of section 23 of POPIA, you must liase directly with the Information Officer.

11. Changes to this privacy policy

1. This policy was published on 26 September 2024.
2. We may change this privacy notice from time to time. The latest edition will be available from the Information Officer.

12. Types of information we collect and why we use it

The below sets out a list of the types of information we collect and why we use it.

Information Type   Identification information: such as name, photograph, passport, national identification, biometric information, gender, date of birth. vehicle registration number, vehicle license and driving license, information regarding employer.	Reasonswhy we may use this information   To verify identity to, inter alia, confirm the financial criteria, to enable entrance tothe Village, toprovide seNices. undertake adequate security and monitoring measures, comply with our legal and contractual obligations, and otherwise for our legitimate interests or those of a third party.
Contact information: such as, email address; telephone number; physical address; erf number and next of kin details.	To keep data subjects informed about our activities and updates, to respond to any queries and requests, to manage and resolve any commercial or legal complaints or issues, to carry out planning and forecasting activities, to comply with our legal and contractual obligations, and otherwise for our legitimate interests or those of a third party, includingcontacting next of kin.

Contact and payment information and other information of suppliers/ contractors I service providers.	To enable us to procure products and services from them, to keep them informed about our activities and updates. to respond to any queries and requests, to carryout market analysis and research, to carry out planning and forecasting activities, for other internal business processes, to comply with our legal and contractual obligations, and otherwise for our legitimate interests or those of a third party.
Contact and other information of our directors and  Toenable them to carry out their roleI duties, to carry staff (past / present) I prospective employees:  out our contract with them, monitor their contact details, employment history, references, performance and compliance with our policies / vetting information, financial information including standards/ procedures, provide them with training banking details, IT information and other information  and benefits and provide remuneration, to comply relating to employment (e.g. leave; appraisals etc.)   with our legal and contractual obligations, and otherwise for our legitimate interests or those of a third party.
Information obtained for purposes of entry, exit and To allow residents, prospective residents and their whilst inside the Village: such as CCTV images: relatives/friends and service providers access to the photographs; contact details; incident reports; Village in line with our security policies and witness statements; car registration information; procedures and to manage and resolve any legal or access records and registration details.              commercial  complaints  or  issues,  including security practices. To identify criminal activity pursuant to the prevention and prosecution of crime committed against property and persons in the village or ourselves.
Financial records including bank statements.         To confirm that you meet the financial admission statement of assets and liabilities, validation of    criteria. income, pension fund and investment fund certificates of balance.
Doctor’s      information,      medical      reports      and To allow the Village to provide the best possible prescription history.                                           care, to liase with medical aids if necessary, to alert the Village to any health issues.
Living will.                                                                      To alert the Village Management as to a data subjects’ wishes upon their death, as well as to convey a copy of the living will to authorities requesting this document.