1. INTRODUCTION
Boabab Management Services (hereafter “BMS”) respects your privacy and your personal information. This Privacy Policy together with BMS PAIA Manual (available on request) aims to let you know how BMS will treat any personal information that it may have about you and how you can access such personal information held. BMS will take all reasonable measures, in accordance with this Policy, to protect your personal information and to keep it confidential.
2. DEFINITION OF PERSONAL INFORMATION
Personal information is “personal information” as defined in terms of section 1 of the Protection of Personal Information Act 4 of 2013 (“POPIA”).   This is information relating to an identifiable, living natural person or existing juristic person.  Please refer to POPIA for a detailed definition and various types or categories of personal information.
3. CATEGORIES OF DATA SUBJECTS AND PERSONAL INFORMATION COLLECTED
BMS only collects general personal information (some of which may be publicly available) and aims to only collect that personal information which is necessary for it to carry out its Services and other facilities provided to you or your members. BMS collects the following categories of personal information:
a.    Member – such as name, identity number, contact details, email, physical and postal addresses, company details, designations, professional experience, registration and qualifications. Member profiles provide for other information to be provided but this is voluntary information that can be provided at the discretion of the member.
b.    Alumni (Training and Event Delegates and past Corporate Clients) – such as name, contact details, email, physical and postal addresses, company details and documents (where necessary), dietary requirements, and allergies. With regards to Corporate Services company documents required for services and specifically in director’s personal opinions on the performance of the board are collected and stored for the purposes of reporting. 
c.    Further information may be requested by BMS depending on the Service being provided or for statistical or healthy and safety reasons. 
d.    NEC Designations – same information as per Members above including records of results and decisions.
e.    Suppliers/Procurement – such as company name, address and contact details, banking details, VAT number and BEE certificate/level information.
f.    Website: – website user (ie. non-member and public) name and contact details for access to specific SAOPA content/services not freely available to the general public, but on request by the user through website enquiry.
g.    Employees – all applicable employee information required to be kept from a labour law perspective and running of the organisation. Such information relates to internal employees and not external clients. Furthermore, external parties (unless with applicable court orders or legal reasons) shall not have access to such Employee Information. 

4. HOW PERSONAL INFORMATION IS COLLECTED
Your personal information is obtained directly from you either via online forms on our website, email communications, requests for proposals, hard copy forms submitted to BMS (such as training facilitator accreditation forms); and on occasion telephonically (only under specific circumstances and at your request). In instances where clients require services, the client representative may provide individual information to BMS. It is the responsibility of the client to ensure it has consent from such individuals to share their general personal contact information.
5. PURPOSE FOR COLLECTING PERSONAL INFORMATION
BMS collects personal information for the following purposes:
a.    To provide you with services offered and requested.
b.    To understand your specific needs and requirements, and in order to improve BMS service and value offering.
c.    To provide you with communications in relation to the services being rendered, and keeping you informed of governance related updates. 
d.    To provide you with related marketing material due to your past interaction and use of BMS services. 
e.    To ensure payment to suppliers for services procured.
f.    For health and safety purposes.
g.    For statistical, historical and/or reporting purposes. 
BMS will always ask for your permission before it uses your personal information for any purpose not disclosed above or unrelated to the operations/services of BMS and its use in the ordinary course of business.
6. RECIPIENTS OF PERSONAL INFORMATION
The Personal information collected is used only by BMS and its employees in the rendering of its organisational purpose and services. Only in instances where the sharing of personal information to recipients outside of BMS is necessary in order to fulfil an obligation or service will such information be provided. 
7. PERSONAL INFORMATION SHARED TO THIRD PARTIES
BMS may be required to provide third party service providers with minimal personal information (such as for example: name, membership number, contact details) in order to provide such the agreed service. Personal information provided to third party service providers for such purposes, will be limited to only that information which is absolutely necessary to fulfil the service or agreement. No further information will be provided and third party service providers are prohibited from using personal details for any other purpose other than providing the agreed service or for statistical and historical purposes. 
Your privacy is important to us. BMS will therefore not sell, rent nor provide your personal information to unauthorised entities or to third parties for their independent use without your consent. BMS will release your personal information to a party if it believes that its is required by law or by a court or statutory body to do so. BMS will also disclose your personal information if BMS believes that it is necessary to prevent or lessen any unlawful or harmful actions and to protect and defend legitimate business interests, rights or property of BMS. 
8. PROTECTION OF PERSONAL INFORMATION
BMS values the information that you choose to provide to us and will therefore take reasonable steps to protect your personal information from loss, misuse or unauthorised alteration. BMS conducts regular security testing of its servers and ensures that its employees are trained around protection of personal information to ensure that your personal information is used correctly and protected.
When you use the services or facilities provided by BMS, you may be given an access number, username, password and/or personal identification number (“PIN”). You must always keep your username, password and/or PIN a secret and ensure that you do not disclose it to anyone. BMS shall not be held responsible for personal information accessed as a result of you providing someone your profile username and password.
Upon your request BMS will provide you with its records of the personal information you provided to us. For security reasons, this information will only be sent to the e-mail address on file for the subscriber username and password associated with it.
If you wish to object to BMS processing your personal information, kindly complete Form 1 (Annexure A) in terms of POPIA and send same to the Information Officer at BMS or to office@baobabmanagment.co.za. Objecting to the processing of your personal information, may result in services being stopped, access or implementation issues and/or other service inefficiencies and communications. 
9. STORAGE OF PERSONAL INFORMATION AND RETENTION THEREOF
Personal information is stored on BMS’s servers located onsite and in the cloud (which in this case may be hosted outside of South Africa, see Clause 10 below) which is accessed by BMS internal employees only. Personal information will only be retained for so long as necessary to carry out the function, Services required and/or for historical and statistical use by BMS. 
Personal Information no longer required for the purposes of rendering services to you or after completion of services, will be destroyed. BMS undertakes to ensure that personal information shall not be stored for longer than 5 years, unless required to do so by law or other regulatory obligations and/or for historical record purposes. BMS however may maintain de-identified information for statistical purposes.
Note: Membership records, Service Agreements, training attendance records, reports or deliverables provided to Corporate Clients in terms of specific scope of work and personal information related thereto shall be kept for BMS indefinitely. The purpose of which is to ensure a continuous and accurate record of your membership, training history and reports/advice provided by BMS. 

10. TRANS-BORDER FLOW OF PERSONAL INFORMATION
Your personal information may be stored on servers located outside of South Africa due to BMS’s Member Management System. BMS however undertakes to ensure that service providers used for such cloud servers and/or services are obliged to comply with the highest standards of data protection to ensure the security of your personal information. 
11. LINKS ON BMS WEBSITE OR EMAIL COMMUNICATIONS
BMS is not responsible for the content or the privacy policies of websites of other institutions to which it may link you to – mainly for information purposes and access to documents provided by such institutions. The use of other third party websites and content is at your sole discretion. This Policy applies solely to information collected by BMS. 
BMS is not responsible for any representations or information or warranties or content on any website of any third party (including websites linked to BMS website). BMS does not exercise control over third parties’ privacy policies and you should refer to the privacy policy of any third party to see how such party protects your privacy.
12. PERSONAL INFORMATION HELD BY OR DISCLOSED BY YOU TO THIRD PARTIES 
If you disclose any personal information to a third party, such as one of our business partners or anyone other than BMS, you must be aware that BMS does not regulate or control how that third party uses your personal information. You should always ensure that you read the privacy policy of any third party. 
I13. CORRECTION OF PERSONAL INFORMATION
t is your responsibility to ensure that the personal information provided to BMS is true, correct and accurate at all times. You may update and correct your personal information at any time either yourself via your online profile, via email communications to BMS (kindly contact office@baobabmanagement.co.za), telephonically by calling either BMS information or BMS Chief Operating Officer or through completing and sending Form 2 (Annexure A) in terms of POPIA to the Information Officer at BMS or to office@baobabmanagement.co.za. BMS does not vet or check the information provided to it, and thus will not be held responsible for any incorrect or outdated information it may and which may be used to provide you with relevant and important communications.
If you would like your Personal Information deleted by BMS, kindly also use Form 2 (Annexure B) and send same to the Information Officer at BMS or to office@baobabmanagement.co.za . Deleting your Personal Information may impact the services being used, offered or access there to.
14. ACCESS TO PERSONAL INFORMATION HELD BY BMS
See BMS PAIA Manual for detailed information around your rights to access information held by BMS and applicable steps to follow.

15. CHANGES TO THIS POLICY
BMS may change this Policy at any time. The most current version of this Policy will be displayed on BMS website. If you use this website or any of the services or facilities offered by BMS after BMS has displayed a change to this Policy, you will be deemed to have read and agreed to the change.
16. APPLICABLE LAWS
This Policy will be governed by the laws of the Republic of South Africa. Specifically, BMS undertakes to comply with the provisions of POPIA and the Promotion of Access to Information Act No.2 of 2000 (“PAIA”).
17. JURISDICTION
The jurisdiction of the South African courts for any dispute which may arise out of this privacy policy applies.