The Unlimited Group (Pty) Ltd & THE UNLIMITED International (Pty) ltd PRIVACY NOTICE FOR JOB APPLICANTS, EMPLOYEES AND CONSULTANTS (“PERSONNEL”)
Index
- Introduction
- Application
- What personal information we collect and why
- How we collect personal data?
- Legal basis.
- Storage
- Automated decisions about you
- Disclosure to other Responsible Parties
- Processors
- International transfers
- Security and Monitoring
- Your data protection rights
- Customer Information
- Confidential Information
- General
Appendix 1: Definitions
Appendix 2: Scope of the personal information processing covered by this Notice
Appendix 3: List of Processors
1. Introduction
This is our privacy notice when it comes to protecting the privacy of personnel. We respect your privacy and take it very seriously. This notice explains how we handle personal information within The Unlimited Group (Pty) Ltd and The Unlimited International (Pty) Ltd (“The Unlimited”, “we”, “us” or “our”), including how we collect, use, disclose, store, and secure it to manage our recruitment, talent and people at a local and international level as part of our business.
1. Application
Where it applies. This policy applies to you if:
- you are someone who works for us in exchange for compensation under a contract. For example, if you are a permanent, temporary or seconded employee, a consultant, or a director, or
- you are a job applicant or a prospective job applicant.
(collectively, our “Personnel”, “you” or “your”)
3. What personal information we collect and why
The types of personal information we collect and process about you, and the purposes for doing so are described in Appendix 3 attached to this Notice.
4. How we collect personal data
We collect information about you from the following sources:
|
|
- provident fund administrators,
|
- employment / recruitment agencies,
|
|
- your employer if you’re a secondee,
|
|
- references you provide us,
|
- Registered Professional Bodies, and
|
- security / background clearance providers,
|
|
- Social media verification providers,
|
- occupational health and other health providers
|
|
|
|
5. Legal basis
Depending on the processing activity, we rely on the following legal justifications to process your personal information:
- where it is necessary to carry out actions for the conclusion or performance of a contract with you;
- so we can comply with our statutory and other legal obligations as an employer;
- to protect your legitimate interests or those of another person;
- to pursue our legitimate interests in a proportionate manner;
- where you provide us with your consent, provided that consent may always be withdrawn later by emailing our Information Officer or Head of Talent & People (see Enquiries).
6. Storage6.1. Accuracy. We do our best to keep your personal information that we collect as accurate, complete, and up to date as is necessary for the purposes defined in this policy.
6.2. Participation. We may ask you to update your personal information with your human resources business partner from time to time or give you a way to review it, such as through the employee portal or by emailing or phoning the relevant person. We will take steps to verify your identity to prevent unauthorised access.
6.3. Retention. We only keep your personal information for as long as needed to comply with our legal obligations or to fulfil the relevant purposes for their collection. For example, we may generally keep:
- Employee file records during your employment and for up to 5 years from the end of your employment. Only then are they destroyed.
- Other day to day records which do not form part of employee files for up to 3 years from the date of their creation and are then destroyed.
- your CV and/or limited job application information for 12-months or for as long as we need it to comply with employment equity laws.
7. Automated decisions about you
We do not use your personal information to make any automated decisions about you without the involvement of a human being in the decision-making process.
8. Disclosure to other Responsible PartiesSharing with other Responsible Parties. We may share or disclose your personal information with the following third parties who act as Responsible Parties alone or jointly with us, including with:
- government departments and regulators where it is mandatory under applicable laws (with Tax Authorities for tax deduction purposes),
- our agents and owners in Distribution,
- other Personnel that strictly need it to do their jobs,
- Insurers and provident or pension fund administrators where we are required to do so under our employment contract with you and strictly for the purposes of registering you with such providers for the benefit of you or your dependents (including your children) and making payment of any employer’s contributions to them, and
- third parties as required by applicable law.
Analytical purposes. We may disclose anonymised and aggregated statistical information that we have derived from our Personnel for analytical purposes.
For the protection of The Unlimited and others. We may access, keep, and disclose the data we collect and maintain about you if required to do so by law or, in good faith, believe that such access, retention or disclosure is reasonably necessary to:
- comply with legal process (e.g., a subpoena or court order);
- enforce our employment agreements, disciplinary codes, workplace policies or insurance policies, including investigating any potential violations to such terms and policies;
- respond to claims that your conduct violates the rights of third parties; or
- to mitigate any reasonable risks, or to protect the rights, property or personal safety of The Unlimited, our service providers, our customers, or the public.
With your consent, we may also disclose your information in other ways you direct us to.
9. Processors
We use external data operators (“Processors”) for certain processing activities and to assist in the performance of our legal and contractual obligations as an employer.
We reserve the right to change our Processors at any time without further notice to you, but we will ensure our Processors are bound by similar terms providing the same or higher levels of protection.
Such external processing activities include, but are not limited to:
- our contracted vendors and contractors who help administer the employment relationship with you;
- external auditors & advisors. This includes disclosing personal information such as your name, gender, age, job position, disabilities, and race with our employment equity advisors or, where applicable, with accreditation agencies or auditors to help us comply with our legal obligations;
- IT systems, support, backups, security, and infrastructure;
- Platforms and providers that assist us with managing human resources and recruitment, leave management, and payroll;
- credit reference and background verification agencies;
- recruitment and employment equity verification agencies.
When entering a business relationship with these Processors, we follow due diligence checks with them. A non-exhaustive list of our Processors is available in Appendix 3.
This list of Processors may change from time to time depending on our business needs.
10. International transfers
Generally, the personal information we collect about you will generally be processed by us in South Africa. However, in limited instances and for a select group of Personnel we may need to transfer or store your personal information in other territories to facilitate your access to technology platforms hosted in these foreign territories (e.g. dialler systems) or to otherwise fulfil our legal obligations. This typically includes, among others, any of the following territories:
- European Economic Area,
- United Kingdom, and
- United States of America.
As a result, limited personal information may be transferred to or accessible from these territories.
Some of these territories may not necessarily have data protection laws as comprehensive as South Africa. However, we’ll ensure your personal information has an appropriate level of protection and that the transfer is in line with applicable legal requirements.
11. Security and Monitoring
11.1. Information security. We take the protection of personal information very seriously and do our best to comply with applicable information security laws. Our employee portal is hosted in a secure server environment that uses a firewall and other advanced security measures to prevent interference or access from outside intruders. We authorise access to personal information only for those employees who require it to fulfil their job responsibilities. We implement disaster recovery procedures where appropriate.
11.2. General monitoring. Our monitoring practices are conducted by authorised personnel only and are generally reactive and incident based. This means we do not engage in any form of active spying on Personnel, and we only monitor activity when it is unusual, suspicious, or necessary to react to or investigate potential incidents or threats to the Company, our Personnel, customers, suppliers or other stakeholders. We may monitor you when you are using our IT equipment or infrastructure. Therefore, you should have limited expectations of privacy concerning your use of our IT equipment or infrastructure.
11.3. Computer, Microsoft Teams and email monitoring. We may monitor your computer, Microsoft Teams and email use subject to the relevant policies. We will not intrusively monitor or access your computer, your Microsoft Teams account or your email unless we have a legal or business reason to do so.
11.4. Work output. Your work output belongs to us. We reserve the right to monitor your work output and use our IT equipment or infrastructure to create that work output.
11.5. Reasons for monitoring
We monitor Personnel and may intercept electronic communications for any lawful purpose strictly in accordance with applicable laws, including to prevent, detect, report and investigate any reasonably suspected:
- non-compliance with our workplace policies and procedures,
- unacceptable usage of IT Systems or company-issued devices,
- criminal or otherwise unlawful activity,
- abuse or compromise of our IT systems, equipment, infrastructure, networks or company-issued devices,
- breaches of workplace, or health and safety regulations,
- harassment or bullying in the workplace,
- information security threats, or
- misconduct
We do not monitor your use of IT systems, infrastructure or devices to assess or manage your performance.
11.6. CCTV or company-issued device tracking surveillance. We may monitor your activities on our premises or with our property as an employee. For example, some of our premises may have surveillance cameras to protect against intruders, theft, or vandalism. We routinely destroy anything recorded by surveillance cameras on a schedule, but we may turn those records over to the appropriate authorities if we suspect any wrongdoing. Specific laws may require us to preserve the recordings for a more extended period for investigative or evidentiary purposes.
12. Your data protection rights
The Protection of Personal Information Act 4 of 2013 (“POPIA”) grants you with, among others, the following rights:
- Request access to your personal information – You may ask us free of charge to confirm that we hold your personal information, or ask us to provide you with details, at a fee, how we have processed your personal information.
- Request the correction of your personal information – to ensure any incomplete or inaccurate personal information is corrected;
- Request erasure of your personal information – where there is no lawful basis for the retention or continued processing of your personal information.
- Object to the processing of your personal information for a legitimate interest (or those of a third party) – under certain conditions where you feel it disproportionately impacts your fundamental rights and freedoms.
- Request restriction of processing of your personal information – to restrict or suspend the processing of your information to limited circumstances;
- Lodge a complaint – to our Information Officer. If you believe our attempts to resolve the issue have been inadequate, you can file a complaint with the Information Regulator. Complaint Forms and procedures are available on the Information Regulator’s website.
- bring civil legal proceedings – regarding the alleged interference with the protection of your personal information.
- Withdraw consent given for the processing of your personal information at any time – where we rely on your consent to process certain personal information for a specific purpose, you can withdraw your consent. This will not affect the continued processing of your personal information in instances where your consent is not required.
To withdraw your consent – email our Information Officer. In the body of your email, please refer to the specific activity and type of personal information which you no longer consent to The Unlimited collecting or using.
All requests and objections must be submitted to our Information Officer via email at dataprivacy2@theunlimited.co.za.
On receipt of a request/objection, we will respond within 30 calendar days. If consent is withdrawn, we will acknowledge this action as soon as reasonably practicable.
13. Customer Information
Customer information is essential to us; you must protect this information, regardless of the data’s format.
14. Confidential Information
You may be entrusted with confidential information. You must protect this information regardless of the format in which this information was shared with you.
15. General
15.1. Changes to this policy. We may amend this Privacy Notice from time-to-time, and we will take reasonably practicable steps to inform you when changes are made. Without limiting the way we may inform you, we may notify you by email, or when you access our IT network.
15.2. Updating. You may update your personal information by contacting the Talent & People Department.
15.3. Limitation. We are not responsible for anyone else’s privacy policies or practices. Your use of other sites or portals outside our control is not subject to our policy.
Enquiries. Please contact
Dataprivacy2@theunlimited.co.za if you have any questions about this privacy notice or how we handle your personal information.
Revision History
|
Version
|
Date
|
Revision Author
|
Summary of Changes
|
|
1.00
|
August 2021
|
Tamina
|
-
|
|
2.00
|
August 2024
|
M Brooks
|
Included reference to The Unlimited International. Appendices added. More detail added to types of personal data and processing. Clarified legal basis.
|
Appendix 1: Definitions
|
“Automated decisions”
|
refer to decisions made by electronic means without human intervention, based on personal information processed solely by automated means. These decisions involve the evaluation of certain aspects relating to a person, such as their performance at work, creditworthiness, reliability, conduct, or other similar characteristics
|
|
“Data Subject”
|
A Data Subject is an individual whose personal information is being collected, processed, or stored. In this Privacy Notice, Data Subjects are those persons described in paragraph 2 (Application) of this Privacy Notice.
|
|
“Responsible Party”
|
A Responsible Party is the entity responsible for determining the purposes and means of processing your personal information. This is generally us.
|
|
“POPIA”
|
Protection of Personal Information Act 4 of 2013, as amended from time to time.
|
|
“personal information”
|
any information that relates to an identifiable individual, often referred to as a Data Subject. Personal information includes but is not limited to those types described in Appendix 2 of this Notice, and any other information specific to an individual.
|
|
“Processor”
|
an entity or organization that processes personal information on behalf of the Responsible Party. Also referred to as ‘operators’ in POPIA. Processors are typically engaged by the Responsible Party to perform specific data processing activities, and they are required to adhere to data protection obligations and security measures.
|
|
“Regulator”
|
the Information Regulator of South Africa
|
Website: Inforegulator.org.za
Contact: POPIACompliance@inforegulator.org.za
|
|
“The Unlimited”, “we”, “us”, or “our”
|
The Unlimited Group (Pty) Ltd and/or The Unlimited International (Pty) Ltd.
|
Appendix 2: Scope of the personal information processing covered by this Notice
We collect your personal information for the following purposes. We also describe the consequences of failing to provide us with this information.
|
Your employment
|
- name, address, telephone numbers (landline and mobile) and personal email address.
- date of birth, gender (or voluntarily disclosed non-binary status), ethnicity, Identity Number or passport number.
- applicant photographs and videos.
- additional information you have made public on your social media profiles.
- a copy of your Identity Document and driver’s license.
- emergency contacts.
- employment and education history (qualifications, CV, employment references), country of residence, visa’s (if applicable
|
- credit check (including details of your credit history);
- details of any criminal convictions, including those obtained through mandatory criminal checks (e.g., MIE verification checks).
- interview notes;
- Location of employment and willingness to relocate;
- details of any secondary employment declared.
- offers and acceptances of employment.
- policy acknowledgements or sign-off documents.
|
|
Purpose(s)
|
- Contractual Obligations: To fulfil our contractual obligations to you, including ensuring that you have access to the necessary systems and services required for your role.
- Human Resource Management: To manage all aspects of your employment, including recruitment, placement, performance management, and career development.
- Regulatory Compliance: To comply with legal and regulatory requirements, such as those related to employment equity, transformation laws, and workplace health and safety.
- Creditworthiness: To assess your suitability for positions that require trust and honesty and involve handling cash or financial responsibilities, in compliance with the National Credit Act Regulations. Credit checks will only be conducted for relevant roles.
- Inclusion and Support: To ensure that we provide a supportive and inclusive work environment. Information on non-binary status or other gender identities, if voluntarily disclosed, will be used strictly to ensure appropriate recognition and support within the workplace, including respecting preferred pronouns, facilitating access to gender-appropriate facilities, and ensuring that workplace policies are inclusive and non-discriminatory.
- Risk Management: To ensure a secure and reliable work environment by verifying your qualifications, employment history, and legal standing through background checks.
|
|
If you don’t provide this information
|
- Impact on Employment: This information is mandatory. If you fail to provide it, we may be unable to hire you or continue with your employment.
- Contractual and Legal Compliance: Failure to provide this information may prevent us from fulfilling our contractual obligations to you or complying with our statutory duties as an employer.
- Inclusion and Equity Considerations: While disclosure of non-binary status or other gender identities is voluntary, not providing this information may limit our ability to offer tailored support to you or ensure your full inclusivity in the workplace.
- Risk of Disqualification: In some cases, particularly for roles involving financial responsibilities, not providing information such as credit checks or criminal background checks could disqualify you from consideration for the role.
- Potential Disciplinary Action: If you are already employed and fail to provide updated information as required, this could lead to disciplinary action in accordance with company policies.
|
|
Your salary, leave administration. payroll and garnishee orders.
|
- job role and employment contract, including start and leave dates, salary, any changes to your employment contract, working patterns (e.g., any requests for flexible working).
- Working hours and any overtime, expenses and other payments claimed, including details of any loans, entertainment or travel expenses.
|
- bank account details, payroll records and SARS tax numbers and status information, to process any salary deductions and court orders regarding payments of debts
- details of any leave including sick leave, annual leave, family responsibility leave, and special leave, etc.
- details relating to maternity, paternity, shared parental and adoptive parental leave and pay. Including forms applying for the relevant leave, copies of forms/matching certificates and any other relevant documentation relating to the nature of the leave you will be taking.
|
|
Purpose(s)
|
- Salary Processing: To ensure accurate and timely payment of your salary and other employment-related benefits, including processing deductions as required by law (e.g., tax, garnishee orders).
- Leave Management: To administer and manage your statutory and contractual leave entitlements, such as sick leave, annual leave, maternity/paternity leave, and other special leaves.
- Contractual Obligations: To fulfil our contractual obligations to you as outlined in your employment contract, including managing any changes to your contract or working conditions.
- Compliance with Legal Requirements: To comply with statutory obligations, including tax regulations, workplace health and safety laws, and court orders, such as garnishee orders for debt payments.
- Financial and Expense Management: To process and reimburse any expenses you claim in the course of your employment, including loans, entertainment, and travel expenses, ensuring proper financial management and compliance with company policies.
|
|
If you don’t provide this information
|
- Impact on Salary and Benefits: This information is mandatory. If you fail to provide it, we may be unable to process your salary payments, reimburse expenses, or provide you with the employment benefits you are entitled to.
- Leave Entitlement Issues: Failure to provide the necessary information may result in an inability to approve or manage your leave, which could impact your employment benefits and entitlements.
- Legal and Compliance Risks: Not providing this information could result in non-compliance with statutory obligations, such as tax payments or court orders, which could lead to legal consequences for both you and the company.
- Risk of Employment Termination: In certain cases, such as failure to comply with legal obligations (e.g., providing accurate tax information), it could lead to disciplinary action or termination of employment, as per company policy.
|
|
Your performance & training
|
- Information relating to your performance at work, including personality profile, psychometric or cognitive assessments, and reviews for assessing probations and promotions).
- grievances, harassment, safety and dignity at work related matters and investigations to which you may be a party or witness.
|
- disciplinary records and evidence related to any investigations, hearings, warnings, and sanctions.
- information related to your training history and development needs.
|
|
Purpose(s)
|
To assess your performance, to conduct pay and grading reviews and to deal with any employer / employee related disputes. We also use it to meet the training and development needs for your role.
|
|
If you don’t provide this information
|
- Incomplete Performance Evaluations: Without this information, we may be unable to fully assess your job performance, which could affect your eligibility for promotions, raises, or other career advancement opportunities.
- Limited Training Opportunities: Failure to provide accurate training history and development needs may result in missed opportunities for skill enhancement, which could impact your ability to perform effectively in your role.
- Impaired Dispute Resolution: If you do not provide information related to grievances or disciplinary matters, it may hinder our ability to investigate and resolve issues, potentially leading to unfair outcomes or unresolved conflicts.
- Risk of Negative Inferences: If critical information is missing, we may need to draw inferences based on the available data, which could negatively impact your performance reviews or disciplinary outcomes, as permitted by law.
|
|
Monitoring and Access Control
|
- about your access and use of our IT systems, equipment and networks.
- Monitoring (e.g., official work mailboxes, Microsoft Teams file sharing and chat history, correspondence, passwords, and record-keeping systems).
|
- CCTV footage and images.
- Facial images or fingerprints used for access control to secure areas
|
|
Purpose(s)
|
- IT Usage Compliance: To ensure that all employees comply with our IT acceptable use policies, including proper and secure use of company systems, equipment, and networks.
- Security and Access Control: To manage and secure access to company premises and assets, ensuring that only authorized personnel have access to certain areas and information.
- Investigation and Detection: To detect and investigate any abuse or misuse of company assets, including IT systems and physical property.
- Protection of Company Assets: To protect against damage or loss to stock, property, or persons on the premises, and to ensure a safe and secure working environment for all employees.
|
|
If you don’t provide this information or object to it being collected
|
We may need to restrict or limit your ability to access certain areas of the premises or your use of certain assets. We may offer alternatives to you, but this will be subject to our operational requirements and risk tolerance.
|
|
Your health and well-being
|
- Health and wellbeing information voluntarily declared by you that may affect your work including, allergies, dietary requirements, occupational health reports, sick leave forms, or health management questionnaires (e.g., Fitness for Work from your GP or hospital).
- Accident or incident records if you have an accident or incident at work.
|
- Details of any desk audits, access needs or reasonable adjustments.
- Information you have voluntarily provided about mental health, disability status, and gender identification and may be extended to include other protected characteristics.
- Where required by legislation, any notifiable medical conditions which may pose a significant threat to public health and the safety of other employees.
|
|
Purposes
|
- Compliance with Health and Safety Regulations: To fulfil our legal obligations under workplace health and safety regulations. This ensures that we maintain a safe working environment and that any necessary accommodations are made to protect your health and well-being.
- Supporting Employee Well-being: To support your health and well-being at work by making reasonable adjustments or accommodations, such as providing ergonomic equipment or adjusting workspaces based on your health needs.
- Incident and Risk Management: To document and manage any workplace accidents or incidents, ensuring that appropriate measures are taken to prevent future occurrences and to comply with legal reporting requirements.
- Equity, Diversity, and Inclusion Compliance: To process information related to gender, disability status, and other protected characteristics in order to comply with legal requirements and regulations aimed at promoting equity, diversity, and inclusion in the workplace.
- Public Health and Safety: To comply with legal obligations related to notifiable medical conditions that may affect public health, ensuring that appropriate precautions are taken to protect all employees.
|
|
If you don’t provide this information
|
- Impact on Health and Safety: If you fail to provide us with mandatory health-related information, we may be unable to make necessary accommodations or adjustments, potentially compromising your health and safety, as well as that of your colleagues.
- Legal Non-compliance: Failure to provide required health information may result in our inability to comply with statutory obligations, such as ensuring a safe workplace or managing public health risks, which could lead to legal consequences for both you and the company.
- Potential Disciplinary Action: If critical health information is not disclosed, it could impact our ability to fulfil our contractual obligations to you, such as approving leave or ensuring workplace safety. This could result in disciplinary action, especially if non-disclosure leads to health or safety incidents.
- Limited Support and Adjustments: Without this information, we may be unable to offer the necessary support or make reasonable adjustments to your work environment, which could affect your ability to perform your job effectively and comfortably.
|
Appendix 3: List of Processors
Processors are third parties who supply certain parts of our recruitment, human resources, employment equity, leave management and payroll services for us. We have contracts in place with them to adequately protect your personal information.
Our current Processors are listed below. This list is non-exhaustive, and we may appoint other external Processors not listed as and when needed, and where it is allowed in terms of POPIA.
|
Processor
|
Purpose for processing
|
Data accessed / stored
|
Location of Data Transfer (if any)
|
|
Metrofile
|
Waste paper provider and archiving of Employee Files
|
Employee Files
|
South Africa
|
|
Microsoft Corporation
|
Email host; digital file storage and server infrastructure (incl. online services such as email, file storage, Office Apps, etc).
|
Personnel activity, Employee Files
|
South Africa.
|
|
MIE Verification (Smart Screen)
|
Background verification services
|
Full names, ID Numbers, fingerprints, background verification and criminal information, and credit checks
|
South Africa. May check data against international databases
|
|
Momentum Life and Momentum Provident Fund
|
Insurer and administrator of Life cover benefits and Provident Fund Administration (where it applies to you)
|
Information requested by Momentum.
|
South Africa
|
|
JazzHR
|
Job Applicant tracking system
|
Full names, role applied for, date of application, status
|
South Africa
|
|
Silent Guardian
|
Cybersecurity and IT Support
|
Employee activity data, Masterfile data
|
South Africa
|
|
Simplify.hr, a division of Media24 Proprietary Limited
|
To advertise job vacancies, collect applications for advertised vacancies, to enhance and enrich job applicant data, and to extract key words and information from CV files based on set criteria.
|
Full names, ID Numbers, Gender, Phone Number, Email Address, Physical Address, ethnicity, CVs, additional media you have made public on your social media profiles
|
South Africa
|
|
Amax BEE Verification
|
B-BBEE Accreditation and consulting; and Employment Equity & SETA
|
Full names, ID Numbers/passport numbers, race and ethnicity, gender
|
South Africa
|
|
Deel Software Solutions (Pty) Ltd t/a PaySpace
|
Payroll software and infrastructure, and hosting
|
Full names, ID Numbers, Bank Account details, Salary amounts, payslips
|
South Africa
|
