1.   INTRODUCTION

The Institute of Directors in South Africa NPC (hereafter “IoDSA") respects your privacy and your Personal Information. This Privacy Policy together with the IoDSA PAIA Manual aims to let you know how the IoDSA will treat any Personal Information that it may have about you and how you can access such Personal Information held. The IoDSA will take all reasonable measures, in accordance with this Policy, to protect your Personal Information and to keep it confidential.

The IoDSA is the responsible party or controller accountable for any processing of Personal Information on the IoDSA website.

3.   CATEGORIES OF DATA SUBJECTS AND PERSONAL INFORMATION COLLECTED

The IoDSA only collects general Personal Information (some of which may be publicly available) and aims to only collect that Personal Information which is necessary for it to carry out its Services and other facilities provided to you. The IoDSA collects the following categories of Personal Information:

1. Member – such as name, contact details, email, physical and postal addresses, company details, designations, professional experience, work experience (CVs) and qualifications. Member profiles provide for other information to be provided but this is voluntary information that can be provided at the discretion of the member.
2. Alumni (Training and Event Delegates and past Corporate Clients) – such as name, contact details, email, physical and postal addresses, company details and documents (where necessary), dietary requirements, and allergies. With regards to Corporate Services company documents required for services and specifically in respect to Board Appraisal Services, director’s personal opinions on the performance of the board are collected and stored for the purposes of reporting. 
   Further information may be requested by the IoDSA depending on the Service being provided or for statistical or healthy and safety reasons.
3. Director Designations – same information as per Members above including records of results and decisions, certification records such as date awarded, and such information as may be required from the South African Qualifications Authority from time to time.
4. Suppliers/Procurement – such as company name, address and contact details, banking details, VAT number and BEE certificate/level information.
5. Website -  such as general website page analytics and usage information through the use of cookies (all such information is un-identifiable information for the purposes of POPIA, see IoDSA Cookie Policy for further detail); as well as in some instances website user (i.e. non-member and alumni) name and contact details for access to specific IoDSA content/services not freely available to the general public.
6. Employees – all applicable employee information required to be kept from a labour law perspective and running of the organisation. Such information relates to internal employees and not external clients. As such the rest of this Policy will not cover Employee Information as this is dealt with in IoDSA internal HR Policies. Furthermore, external parties (unless with applicable court orders or legal reasons) shall not have access to such Employee Information. The Personal Information relating to children may be collected in so far as it relates to the children of the IoDSA employees and where so required by law, this may include the name, surname and date of birth or identity number of the child.

The IoDSA may collect “Special personal information” this includes information relating to race, ethnical origin, health, biometric information and criminal behaviour of a data subject. Any such collection will be subject to the protocols prescribed under the applicable law.

4.   HOW PERSONAL INFORMATION IS COLLECTED

Your Personal Information is obtained directly from you either via online forms on the IoDSA website, email communications, requests for proposals, hard copy forms submitted to the IoDSA (such as training facilitator review forms); and on occasion telephonically (only under specific circumstances and at your request). In instances where Corporate Clients require services, the Corporate Client representative may provide individual director information to the IoDSA. It is the responsibility of the Corporate Client to ensure it has consent from such individuals to share their general personal contact information.

5.   PURPOSE FOR COLLECTING PERSONAL INFORMATION

The IoDSA collects Personal Information for the following purposes:

1. To provide you with services offered and requested.
2. To understand your specific needs and requirements, and in order to improve the IoDSA member benefit, service and value offering.
3. To provide you with IoDSA communications in relation to the services being rendered, and keeping you informed of governance related updates.
4. To provide you with IoDSA related marketing material due to your past interaction and use of the IoDSA services.
5. To ensure payment to suppliers for services procured.
6. For health and safety purposes.For statistical, historical and/or reporting purposes. 

The IoDSA will always ask for your permission before it uses your Personal Information for any purpose not disclosed above or unrelated to the operations/services of the IoDSA and its use in the ordinary course of business.

6.   YOUR RIGHTS IN RELATION TO PERSONAL INFORMATION

Under certain circumstances, you have rights under information protection laws in relation to your Personal Information. These include the:

• Right to be Informed: You have the right to know how your Personal Information is collected and used. 
• Right to Access: You can request access to the Personal Information the IoDSA hold about you (refer to IoDSA PAIA Manual). 
• Right to Rectification: If your Personal Information is inaccurate or incomplete, you can request that the IoDSA correct it (refer to Annexure A).
• Right to be Deleted: You can ask the IoDSA to delete or dispose of your Personal Information (refer to Annexure B). 
• Right to Restrict Processing: You can request that the IoDSA limit the processing of your Personal Information.
• Right to Object: You can object to the use of your Personal Information for specific purposes.
• Right to Withdraw Consent: Where the IoDSA rely on your consent to use your Personal Information, you can withdraw it at any time.
• Right Against Direct Marketing: Your Personal Information will not be used for direct marketing via electronic communication without your consent.
  
   

7.   RECIPIENTS OF PERSONAL INFORMATION

The Personal Information collected is used only by the IoDSA and its employees in the rendering of its organisational purpose and services. Only in instances where the sharing of Personal Information to recipients outside of the IoDSA is necessary in order to fulfil an IoDSA obligation or service will such information be provided. 

8.   PERSONAL INFORMATION SHARED TO THIRD PARTIES

As part of the Member Benefits provided to IoDSA Members, the IoDSA may be required to provide third party service providers with minimal Member Personal Information (such as for example: name, membership number, contact details) in order to provide such Member Benefits. Personal Information provided to third party service providers for such purposes, will be limited to only that information which is absolutely necessary in order for the member to enjoy such benefit which he/she is entitled to. No further information will be provided and third party service providers are prohibited from using Member details for any other purpose other than providing the Member Benefit or for statistical and historical purposes. 

Your privacy is important to the IoDSA. The IoDSA will therefore not sell, rent nor provide your Personal Information to unauthorised entities or to third parties for their independent use without your consent. The IoDSA will release your Personal Information to a party if it believes that IoDSA is required by law or by a court or statutory body to do so. The IoDSA will also disclose your Personal Information if the IoDSA believes that it is necessary to prevent or lessen any unlawful or harmful actions and to protect and defend legitimate business interests, rights or property of the IoDSA. 

IoDSA policies mandate that all third parties engaged by the IoDSA must respect the security of your personal data and handle it in compliance with the law. Additionally, third-party service providers engaged by the IoDSA are prohibited from using your personal data for their own purposes and may only process your data for specified purposes, strictly in accordance with the IoDSA’s instructions.