POPIA & Data Protection

1. Applicable legislation

AEVO recognises the importance of protecting personal information and seeks to process personal information in accordance with applicable South African data-protection legislation.

POPIA establishes conditions for the lawful processing of personal information and provides rights and protections for data subjects. ([Government of South Africa](https://www.gov.za/documents/protection-personal-information-act?utm_source=chatgpt.com))

Where applicable, AEVO also considers the requirements of the Promotion of Access to Information Act 2 of 2000 ("PAIA").

2. AEVO's role

Depending on the circumstances, AEVO may process personal information as a responsible party or as an operator acting on behalf of a client.

Where AEVO determines the purpose and means of processing personal information, AEVO will generally act as the responsible party for that processing.

Where AEVO processes personal information on behalf of a client under a contract or mandate, AEVO may act as an operator and will process that information in accordance with the client's instructions and applicable legal requirements.

3. Principles for processing personal information

AEVO's approach to personal information is guided by the principles underlying POPIA, including:

4. Security safeguards

AEVO takes reasonable technical and organisational measures appropriate to the risks associated with the personal information it processes.

These measures may include:

• user authentication and access controls;
• role-based access to information and systems;
• confidentiality obligations;
• secure information storage;
• system and software security controls;
• appropriate backup and recovery measures;
• monitoring and review of security measures; and
• incident-management procedures.

Where AEVO uses operators or service providers to process personal information, AEVO takes reasonable steps to ensure that appropriate safeguards and confidentiality obligations apply.

5. Security compromises

AEVO maintains procedures for responding to suspected or confirmed security compromises involving personal information.

Where POPIA requires notification of a security compromise, AEVO will make the required notifications to the Information Regulator and affected data subjects in accordance with the applicable requirements.

6. Operators and service providers

AEVO may appoint third-party service providers to support its business operations, including technology, hosting, cloud, professional and administrative service providers.

Where such providers process personal information on AEVO's behalf, AEVO seeks to ensure that appropriate contractual, confidentiality and security requirements apply.

7. Cross-border processing

Certain technology or service providers used by AEVO may process or store information outside South Africa.

Where personal information is transferred across borders, AEVO will consider and apply the requirements of applicable data protection legislation, including the cross-border transfer requirements of POPIA where applicable.

8. Data subject rights

Subject to applicable legal requirements and limitations, data subjects may have rights including:

• requesting access to personal information held about them;
• requesting correction or updating of inaccurate information;
• requesting deletion where legally permissible;
• objecting to certain processing;
• withdrawing consent where consent is the applicable basis for processing; and
• lodging a complaint regarding the processing of personal information.

POPIA provides mechanisms through which data subjects may exercise their rights concerning personal information. ([National Treasury](https://www.treasury.gov.za/POPIA/?utm_source=chatgpt.com))

9. Requests relating to personal information

Requests relating to personal information held by AEVO should be submitted in writing using the contact details below.

Depending on the nature of the request, AEVO may require sufficient information to verify the identity of the requester and to establish the scope and legitimacy of the request.

10. Complaints

We encourage data subjects to contact AEVO first so that we can investigate and address any concern regarding the processing of personal information.

A data subject may also exercise any right to lodge a complaint with the Information Regulator in accordance with applicable law.

The Information Regulator is the independent South African regulator responsible for monitoring and enforcing compliance with POPIA and PAIA. ([Empowered Compliance](https://inforegulator.org.za/about/?utm_source=chatgpt.com))

Further information is available from the Information Regulator of South Africa .

11. Retention

AEVO retains personal information and business records only for as long as reasonably necessary for the applicable purpose, subject to contractual, professional, statutory and regulatory requirements.

Specific engagement records may be subject to longer retention periods where required by law, professional obligations or the applicable Engagement Terms.

12. Relationship with our Privacy Policy

This Notice should be read together with AEVO's Privacy Policy and, where applicable, the AEVO General Terms and Conditions of Business and any engagement-specific terms.

Where AEVO processes personal information on behalf of a client, the applicable Engagement Letter or Specific Service Agreement may contain additional provisions governing the processing of personal information.