Privacy notice and POPIA section 18 informed consent notice

Introduction

1.1 The company herein, being KMK Digital Studio (Pty) Ltd and its trading partners, being a private company established and duly registered in accordance with the company laws of the Republic of South Africa (hereinafter referred to collectively as the "organisation").

1.2 In terms of a law known as the Protection of Personal Information Act 4 of 2013 (POPIA), everyone has the right to privacy, including the right to the lawful collection, retention, dissemination and use of one's personal information.

1.3 In order to give effect to this right, the organisation is under a duty to provide any person whose personal information is processed by it, known as a data subject, with a number of details pertaining to the use of and subsequent processing of the data subject's personal information, before such information is used or processed.

1.4 In accordance with this requirement, the organisation sets out below:

• 1.4.1 The reasons why it will be required to process a data subject's personal information;
• 1.4.2 The conditions under which it will receive and use a data subject's personal information;
• 1.4.3 How the organisation will use and handle this personal information; and
• 1.4.4 The conditions under which it will provide its own personal information.

Accountability

3.1 The organisation takes the privacy and protection of a data subject's personal information very seriously and will only process a data subject's personal information in accordance with POPIA and the terms of this privacy statement.

3.2 In turn, where the organisation provides any of its personal information to a responsible party or operator, then such person will be required, as a condition of receiving such information, to process such personal information in accordance with POPIA and the terms of this privacy statement.

3.3 Accordingly, the relevant data privacy principles relating to the processing of personal information, whether belonging to the organisation or to a data subject (including, but not limited to, the collection, handling, transfer, sharing, correction, storage, archiving and deletion), will apply without exception, save where POPIA provides for such an exception, to all and any personal information provided by the organisation to another or received by the organisation as a result of the use of the organisation's email and/or social media and electronic platforms.

Receipt, use and sharing of personal information by the organisation

5.1 The organisation will receive personal information pertaining to a data subject when the data subject submits a query or request via the organisation's website or by way of email, telephone or via social media.

5.2 On receipt of the request or query, the organisation will thereafter use and process the data subject's personal information for a variety of purposes, depending on the query or request, which without detracting from the generality thereof may include:

• 5.2.1 For the purposes of identifying and/or verifying the data subject's details;
• 5.2.2 For the purposes of providing information, products and/or services that the data subject may have requested;
• 5.2.3 For employment application purposes;
• 5.2.4 For the purposes of managing any information pertaining to the data subject;
• 5.2.5 For general administration purposes;
• 5.2.6 For legal or contractual purposes;
• 5.2.7 To help the organisation improve the quality of the organisation's products and services;
• 5.2.8 To help the organisation detect and prevent fraud and money laundering;
• 5.2.9 For the purposes of recovering unpaid fees and/or any other amount due to the organisation;
• 5.2.10 For the purpose of debt collection;
• 5.2.11 For the purposes of research, analytical and statistical purposes;
• 5.2.12 For the purpose of carrying out analysis of customer profiling;
• 5.2.13 For the purposes of identifying other products and services which might be of interest to the data subjects;
• 5.2.14 For the purposes of informing a data subject about the organisation's products and services.

5.3 In order to correctly handle any request or query and to perform the purposes described above, the organisation may from time to time share a data subject's personal information with the following parties:

• 5.3.1 The organisation's employees, which will only be on a need-to-know basis;
• 5.3.2 The organisation's carefully selected business partners who provide products and services which may be of benefit to a data subject, which will only be on a need-to-know basis; and
• 5.3.3 The organisation's operators such as service providers and agents who perform services on our behalf, which will only be on a need-to-know basis and in terms of an operator agreement.

5.3.4 The organisation does not share a data subject's personal information with any third parties who have not been described above, unless:

• The organisation is legally obliged to provide such information to another for legal or regulatory purposes;
• The organisation is required to do so for purposes of existing or future legal proceedings;
• The onward transmission or sharing of personal information is necessary for the pursuance or protection of the organisation's legitimate interests or that of the data subject or a third party;
• The organisation is involved in the prevention of fraud, loss, bribery or corruption and is using another agent or service provider under a mandate to provide such service;
• Under all of the above-mentioned circumstances, the organisation will take reasonable measures to ensure that such personal information is only provided to the recipient if such recipient undertakes to keep the information confidential and secure;
• Where the organisation has to transfer the data subject's personal information across South African borders, it will ensure that before it does so, the recipient thereof agrees to be bound by POPIA under and in terms of a set of binding corporate rules or binding agreements that provide an adequate level of protection and uphold the principles for the reasonable and lawful processing of such personal information.

Information quality, openness and data subject participation

7.1 Whilst the organisation will make every effort to ensure the integrity and accuracy of a data subject's personal information, this may not be possible at all times. Following this, the data subject accepts the responsibility for keeping its, her or his information up to date and undertakes to inform the organisation of any changes to its, his or her personal information. This can be done by accessing the prescribed change of details form on the organisation's website and submitting it to the organisation's information officer.

7.2 A data subject has a right of access to any personal information which the organisation may have, and where applicable may ask the organisation to correct any inaccuracies in or to any such personal information. This request must be made by way of a formal PAIA process, which is accessible on the organisation's website. Should you have any questions, complaints or objections regarding the processing of your personal information, you may contact the organisation's information officer at info@kmkdigitalstudio.co.za.

Third party information and information belonging to minors

9.1 If a data subject provides the organisation with personal information on behalf of another, the organisation will not be able to process the query or request unless such query or request is accompanied by the required permission and consent from the third party to process the third party's personal information.

9.2 If a data subject is under the age of 18, such person's personal information will only be processed if the minor's parent or legal guardian gives the required consent or permission to the processing.

Revision of policies

11.1 We reserve the right to and may from time to time update this privacy notice. Any such revision will be published as an amended version on our website. Any change to this policy will be posted as an updated version, and readers are advised to visit and re-read this policy on a regular basis.