1. Who we are 

This Privacy Policy explains how [ETS Group (Pty) Ltd], and its subsidiaries and affiliated companies (together, “ETS Group”, “we”, “us” or “our”) collect, use, share and protect personal information. 

It applies when you visit https://ets.group (the “Website”), use our services, communicate with us, attend our events, apply for a job, or deal with us as a client, supplier or business partner. 

ETS Group is the responsible party (or controller) for the personal information described in this policy. Where we process personal information on behalf of a client under a service agreement, we act as an operator (or processor), and that client’s privacy notice governs the processing. 

2. Laws that apply 

We process personal information in line with the Protection of Personal Information Act 4 of 2013 (“POPIA”), the Promotion of Access to Information Act 2 of 2000 (“PAIA”), and the Electronic Communications and Transactions Act 25 of 2002 (“ECTA”). 

Where we process personal information of people in the European Economic Area or the United Kingdom, we also comply with the EU General Data Protection Regulation (“GDPR”) and the UK GDPR, together with the Data Protection Act 2018. Where other local laws apply to our group companies, we comply with those laws too. 

In this policy, “personal information” includes “personal data” as defined in the GDPR. Under POPIA, personal information can relate to an identifiable, existing juristic person (such as a company) as well as a natural person. 

3. Personal information we collect 

We collect only what we reasonably need for the purposes set out in section 5. 

Special personal information. We do not intentionally collect special personal information (such as health, religious beliefs, race or ethnic origin, biometric information or criminal behaviour) through the Website. We may process limited special personal information in recruitment or employment, for example for employment equity reporting or criminal record checks, only where the law allows it or you have given explicit consent. 

Children. Our Website and services are aimed at businesses and adults. We do not knowingly collect personal information of children under 18 without the consent of a competent person. If you believe we have done so, contact us and we will delete it. 

4. How we collect personal information 

• Directly from you, when you complete forms, request a quote or demo, sign a contract, subscribe to updates, attend an event, apply for a role, or contact us. 

• Automatically, when you use the Website, through server logs, cookies and similar technologies. 

• From third parties, such as your employer (when it is our client or supplier), recruitment agencies, credit bureaux, background screening providers, public registers (such as CIPC), professional networking platforms, event organisers and business partners who have a lawful basis to share it with us. 

Where we collect information from a third party, we take reasonable steps to make sure you are aware of the collection, unless an exception under POPIA applies. 

5. Why we use personal information and our lawful basis 

We process personal information only where we have a lawful basis under section 11 of POPIA and, where applicable, Article 6 of the GDPR. 

Where we rely on legitimate interests, we have balanced our interests against your rights and freedoms. You may ask us for details of that assessment. 

We will not use personal information for a purpose that is incompatible with the purpose for which it was collected, unless you consent or the law permits it. 

6. Direct marketing 

We send electronic direct marketing only with your consent, or where you are an existing client and the marketing relates to similar products or services. Every marketing message includes our details and a simple way to opt out at no cost. 

You can withdraw consent or opt out at any time by using the unsubscribe link, updating your preferences, or emailing [privacy@ets.group]. Opting out of marketing does not affect service communications we must send you, such as invoices or security notices. 

7. Automated decision-making 

We do not make decisions that have legal or similarly significant effects on you based solely on automated processing, including profiling. If this changes, we will tell you, explain the logic involved, and give you the chance to make representations and request human review. 

8. Who we share personal information with 

We do not sell personal information. We share it only where necessary and lawful, with: 

• ETS Group companies, for the purposes in this policy, under intra-group data sharing arrangements. 

• Operators and service providers who process information on our behalf, such as cloud hosting, IT support, CRM, email delivery, payment processing, analytics, recruitment platforms, professional advisers, auditors and insurers. They are bound by written agreements requiring confidentiality and appropriate security measures, as required by sections 20 and 21 of POPIA. 

• Business partners and subcontractors involved in delivering services you have requested. 

• Regulators, courts, law enforcement and government bodies, where required by law or to protect our rights. 

• Prospective buyers or investors, in connection with a corporate transaction, subject to confidentiality obligations. 

• Anyone else, with your consent. 

9. Cross-border transfers 

Some of our service providers store or process personal information outside South Africa, including in [the European Union, the United Kingdom and the United States]. 

We transfer personal information across borders only where section 72 of POPIA allows it, for example where the recipient is subject to a law, binding corporate rules or a binding agreement that provides an adequate level of protection, where you consent, or where the transfer is necessary to perform a contract with you. 

For transfers out of the EEA or UK, we rely on adequacy decisions, the European Commission’s Standard Contractual Clauses, the UK International Data Transfer Agreement or Addendum, or another valid transfer mechanism. You may request a copy of the relevant safeguards. 

10. How we protect personal information 

We maintain appropriate, reasonable technical and organisational measures to protect personal information against loss, damage, unauthorised destruction, and unlawful access or processing. These include: 

• encryption of data in transit (TLS) and, where appropriate, at rest 

• role-based access controls, multi-factor authentication and the principle of least privilege 

• network security controls, endpoint protection, logging and monitoring 

• regular vulnerability assessments, patching and backups 

• confidentiality obligations and privacy and security training for staff 

• supplier security assessments and contractual safeguards 

• an incident response procedure 

No system is completely secure. If a security compromise affects your personal information, we will notify the Information Regulator and affected persons as required by section 22 of POPIA, and the relevant supervisory authority within 72 hours where the GDPR applies. 

11. How long we keep personal information 

We keep personal information only for as long as needed to achieve the purpose for which it was collected, unless a longer period is required or authorised by law, required by contract, or reasonably needed for legal claims. 

When the retention period ends, we securely delete, destroy or de-identify the information. 

12. Your rights 

Subject to applicable law, you have the right to: 

• be told that your personal information is being collected, and that it has been accessed or acquired by an unauthorised person 

• request confirmation of whether we hold your personal information, and access a copy of it 

• request correction, destruction or deletion of personal information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or unlawfully obtained 

• object to processing on reasonable grounds, including processing based on legitimate interests 

• object to direct marketing at any time 

• withdraw consent at any time, without affecting the lawfulness of processing before withdrawal 

• not be subject to decisions based solely on automated processing 

• lodge a complaint with the Information Regulator 

If the GDPR or UK GDPR applies, you also have the right to restrict processing and to data portability. 

How to exercise your rights. Email [privacy@ets.group] or write to our Information Officer at the address above. Access requests are handled under PAIA, and the prescribed forms and any fees are set out in our PAIA Manual. Correction or deletion requests may be made on Form 2 of the POPIA Regulations. 

We will verify your identity before acting on a request and respond within a reasonable time, and within 30 days where PAIA or the GDPR applies (extendable where the law allows). We may decline a request where the law permits, and we will give you reasons. 

13. Complaints 

Please contact our Information Officer first so that we can try to resolve your concern. You may also complain to the Information Regulator (South Africa): 

• Website: https://inforegulator.org.za 

• Complaints: POPIAComplaints@inforegulator.org.za 

• General enquiries: enquiries@inforegulator.org.za 

If you are in the EEA or UK, you may also complain to your local data protection authority, such as the Information Commissioner’s Office in the UK. 

14. EU and UK representative 

[If required under Article 27 of the GDPR or UK GDPR, insert the name and contact details of ETS Group’s EU and UK representative. Delete this section if not applicable.] 

15. Third-party websites 

The Website may link to third-party websites, platforms and social media. We are not responsible for their privacy practices. Please read their privacy policies before sharing information with them. 

16. Changes to this policy 

We may update this policy from time to time to reflect changes in law, technology or our operations. The updated version will be published on the Website with a new “last updated” date. Where changes are material, we will notify you by email or a prominent notice on the Website.