Investmech Privacy Statement

Investmech (Pty) Ltd is an engineering consulting company providing specialist services and products. 

This Privacy Statement describes how Investmech obtain, use, and disclose personal information, in accordance with the requirements of the Protection of Personal Information Act (“POPIA”).

1. Our commitment with your privacy

Investmech is committed to protecting your privacy and ensure that personal information is collected and used properly, lawfully, and transparently.

At Investmech, we are aware that all people who collaborate with us (including job candidates, employees, former employees, clients, and contractors) have the right to privacy and the protection of their personal information.  Therefore, we are concerned to establish and maintain in force controls, measures and procedures that allow us to protect the personal information of all identifiable, living natural persons and identifiable existing juristic persons who interact with us in compliance with the provisions of the Protection of Personal Information Act 4 of 2013 (“POPIA”), its regulations and any other applicable regulations concerning data protection.

This Privacy Statement is intended to inform our clients, contractors, job candidates, employees, and former employees (collectively, “Data Subjects” or “you”) of the privacy policies and practices that govern the Investmech and the rights that you enjoy.

2. Data subjects

This Privacy Statement provides information relevant to:

  1. any person who sends us their curriculum vitae or who in any other manner is involved in a recruitment and selection process with us (the “Candidates”);
  2. persons who are employed by Investmech under an employment contract (the “Employees”);
  3. external contractors, either by providing professional services on their own or employed by any company providing services to Investmech, including independent contractors, sub-contractors, agents and expatriates (the “External Contractors”); and
  4. external clients to whom we provide products and services in terms of a contractual relationship. These services may be provided either directly by us or indirectly through third party sub- contractors appointed by us to provide services to our clients (“Clients”).

Unless specifically stated otherwise, the term “you” in this notice refers to any of the groups of persons referred to herein, unless a reference to a particular group is made in this Privacy Statement.  Although, the purposes for processing the personal information of each of the groups referred to above may be different, in general, we are concerned to protect such information in the same manner, in compliance with POPIA.  Therefore, unless specifically stated otherwise in this Notice the terms (“you” and/or “Data Subjects”) include Candidates, Employees, Contractors and Clients.  For purposes of clarity with our Candidates and our Contractors, it is noted that this Privacy Statement does not constitute a job offer or an employment contract.

3. Definition of personal information

According to the Act “personal information” means information relating to an identifiable, living, natural person, and where it is applicable, an identifiable, existing juristic person.

4. The information we collect

The personal information we collect from you depends on the relationship you have with us, whether as a Candidate, an Employee, Contractor or Client. The personal information we can request from you are listed in the subsections below.

4.1. Identification Information

 In respect of natural persons, this information relates to any information that allows you to be differentiated from other natural persons.  This information includes, amongst others: your name, gender, race, marital status, nationality, ethnic or social origin, date of birth, age, biometric information, photographs, passport number, driver’s licence, location information, your religious and philosophical beliefs and personal identification number.  In respect of juristic persons, this information includes, amongst others: the company name, the company registration number, the company tax number, the company VAT registration number, the company’s corporate structure, its directors, shareholders and members, the company’s composition, BEE status and business operations.  Depending on the purpose for which we require the identification information, we may request copies of any associated credentials.

4.2. Contact Information

In respect of natural persons, this information relates to information that allows us to keep in touch with you.  This information could include your home address, work address, e-mail, private phone number or other phone number contact, such as mobile number.  In respect of juristic persons, this information relates to information that allows us to keep in touch with you.  This information could include the company’s physical addresses, the company’s telephone numbers, telefax numbers, email addresses and website address.

4.3. Employment Information

In respect of natural persons, this information relates to information concerning your previous employment or current employment, your title and position, whether in our company or the company in which you work; working experience, professional experience, information relating to your spouse or partner and to your children, information related to training that you have taken, evaluations, professional profile, disciplinary actions, the reasons for the termination of your employment contract and your criminal behaviour to the extent that such information relates to the commission of an alleged offence or to any proceedings in respect of which you are alleged to have committed an offence, among others.

4.4. Academic Information

In respect of natural persons, this information relates to information that allows us to know your professional orientation, including your school degree, educational background, specialization, level of specialization, degrees, certificates, and recognition, among others.

4.5. Financial Information

In respect of natural persons, this information relates to information related to the assets or rights of individuals or their financial situation, including information obtained through socio-economic studies, bank account numbers, income (relating to payroll or considerations), insurance information, pension fund information, credit bureau information, among other information.  In respect of juristic persons, this information relates to the company’s banking account details and associated identifiers, credit ratings, payment history and financial standing, including statements of account, among others.

4.6. Health information

Generally, we will obtain a psychological assessment of our Candidates and Contractors through psychometric tests or tests of confidence.  We may also require to be furnished with a person’s pregnancy status for the purposes of determining maternity leave if that person is an Employee and in some cases we may require to be furnished with your blood type should this be required in the case of an emergency.  We will also collect information pertaining to your physical or mental health or disability if you are an Employee

4.7. Biometric data

In some cases, the fingerprints and photographs of the Employees and some Contractors are obtained in order to allow them access to certain facilities.

4.8. Electronic Records

This information includes certain information that is obtained when you access our website or access our facilities and include:

  1. data that is obtained through cookies on our websites, such as IP address with which you access the website, user preferences, type of browser, activity on the site, and previously visited page;
  2. records of images and/or voice obtained through video surveillance systems, which are obtained when you visit our facilities; and
  3. in the case of employees, electronic records that are obtained when the Employee uses our computer systems (including equipment and telecommunication networks and IT systems). The latter information may include access to electronic, network or communications equipment, the use of such systems and tools (including Investmech e-mail and the Internet) and its geolocation.  Employee activity on their devices may be monitored for the purpose of maintaining your safety, as well as the Investmech’s safety, the safety of its employees and assets; and to monitor compliance with our policies or the law and for internal or external investigations when it is suspected that an Employee may have committed an action contrary to our policies or applicable laws.

4.9. Information on trade union affiliation

Information that allows us to identify a person’s membership to a specific union and the position he/she holds.

4.10. Events Information

If we are hosting an event, we may request you to furnish us with information pertaining to any special dietary requirements/allergies, any special assistance needs (hearing, sight or physical impairment), travel arrangements, the name and age of your child/children (collected through parents or guardians attending events) and if applicable, your speaker biography.

4.11. Service Information

This information relates to your views, use and experience of our products and services.  We use this information as part of our quality management system and to initiate service improvements and changes to our services.

 

4.12. Special Personal Information

Some of the personal information described in Paragraph 4.1, Paragraph 4.3, Paragraph 4.6, Paragraph 4.7 and Paragraph 4.8 above is considered to be “special personal information” in terms of POPIA.  

The special or sensitive Personal Information, that we collect is limited to:

  1. information pertaining to race or ethnic origin which is required by us for compliance with the Employment Equity Act 55 of 1998 and the Broad-based Black Economic Empowerment Act 53 of 2003;
  2. information pertaining to physical or mental health or disability and which is required by us for compliance with the Occupational Health and Safety Act 85 of 1993, the Employment Equity Act 55 of 1998, the Health Act 63 of 1997 and the Consolidated Directions on Occupational Health Safety Measures in Certain Workplaces, 2020 (“COVID Regulations“) published in terms of the Disaster Management Act 57 of 2002;
  3. biometric information;
  4. trade union membership;
  5. your religion; and
  6. information relating to criminal behaviour to the extent that such information relates to the alleged commission of an offence or to proceedings in respect of the alleged commission of an offence.

Investmech does not intend to collect any special or sensitive Personal Information that is prohibited by local law and without your prior consent, where required.

5. Authorization to contact third parties (personal or professional references)

Investmech may contact third parties related to you in the following cases:

  1. Employees: Employees will be requested to provide contact and identification information of their family members or of a third party for emergency contact purposes.
  2. Candidates: We may request to be furnished with the contact and identification information of your previous employers.

Where we request such information, we request you to ensure that the third-party data you provide is accurate, complete, and correct, and is up to date.

6. Collection of personal information

Investmech may obtain a Candidate’s personal information through different means:

  • Personally, from the Candidate during the recruitment process.
  • Indirectly from the Candidate, for example, where Investmech or the Candidate makes use of the services of a third-party recruiter.

Investmech may obtain an Employees’ personal information through different means:

  • Personally, from the Employee during the recruitment process and during the employment relationship.
  • Directly, through different means including our intranet, phone, monitoring or video surveillance systems and the Company’s IT platforms and applications of Investmech.
  • Indirectly from the Employee, for example, by receiving reports or information, which is provided to us by companies that we hire, to perform different tests and examinations regarding our Employees, or information stored in public access sources.

Investmech may obtain an External Contractor’s personal information through different means:

  • Personally, from the External Contractor during the contracting process and during the contract relationship.
  • Indirectly from the External Contractor, for example where the External Contractor is appointed as a sub-contractor by a third party who contracts directly with Investmech for the provision of services to Investmech.

Investmech may obtain a Client’s personal information through different means:

  • Personally, from the Client during the contracting process and during the contract relationship.
  • Directly from the Client’s employees and/or representatives during the contracting process and during the contract relationship.
  • Indirectly from publicly available records and information pertaining to the Client.

7. Purposes for processing your personal data

Although the purposes may vary according to the legal relationship that you have with Investmech, in general, your personal data is used for the following purposes:

  1. In the case of Candidates, the personal information is requested to evaluate the competencies of the Candidate and the suitability of the Candidate for the vacant position. In general, the information is used to manage the recruitment and selection process.  Where Investmech obtains special personal information from Candidates, we will ask you to give your consent.
  2. In the case of the Employees:
    1. for the proper administration of the employment relationship, including to confirm and maintain the Employee’s employment record and to pay the Employee’s salaries and benefits;
    2. for the administration of life insurance and medical expenses plans;
    3. for the identification of the Employee’s skills, aptitudes and competencies and for the evaluation of his/her professional performance;
    4. to support the Employee in case of accidents and generate the corresponding internal reports;
    5. to evaluate the Employees’ use of the facilities, information and communications infrastructure of Investmech and the equipment that Investmech makes available to the Employee as work tools or the Employee’s devices that Investmech allows the Employee to connect to Investmech’s network, also as a working tool; the monitoring is carried out in order to protect our computer systems, assets, assets, intellectual property assets and the security of Investmech, and its employees (including also the integrity, working conditions and assets of our employees);
    6. to verify and audit our Employees’ compliance with our internal policies, including ensuring that Employees have appropriate health conditions that enable them to perform their work;
    7. to carry out investigations or internal audits for purposes of compliance, quality or investigation of inappropriate or illegal conduct, among others;
    8. to manage the relationship with the trade union to which the Employee belongs and to provide the trade union with the information required of the Employee, when applicable;
    9. to manage the activities that are necessary to comply with labour and social security obligations; and
    10. occasionally the Employee’s information may be used for Investmech’s publicity or internal communications (e.g. company accolades and event related).
  3. In the case of External Contractors:
    1. expatriates and independent contractors, for the management of the expatriate’s or independent contractor’s assignment in Investmech as well as for compliance with applicable legislation and internal policies;
    2. in the case of third party sub-contractors, the personal information is processed in order to verify that the sub-contractor complies with their employment and social security obligations and also for the purposes of compliance with internal policies (access to facilities, compliance with security and quality policies, etc.). In certain specific cases (for example, the hiring of drivers, technicians or security personnel), the agencies that support us may conduct more specific certification tests.
  4. In the case of Clients for information, contractual and relationship management purposes, and business purposes, including data analysis, audits, developing and improving products and services, identifying usage trends, and determining the effectiveness of promotional campaigns, and enhancing, improving or modifying our service. Personal information is also obtained from Clients for risk management, compliance with our legal and regulatory obligations and for fraud detection, prevention and investigation, conflict and other necessary onboarding and ongoing Client checks, due diligence and verification requirements, credit checks, credit risk analysis, compliance with sanctions procedures or rules, and tax reporting.  We also process the personal information of our Clients to provide, and perform our obligations with respect to, the services or otherwise in connection with fulfilling instructions and to send administrative information to clients, such as changes to our terms, conditions and policies.
  5. We also process the personal information of Candidates, Employees, External Contractors and Clients to comply with laws and regulations (including any legal or regulatory guidance, codes or opinions), and to comply with other legal process and law enforcement requirements (including any internal policy based on or reflecting legal or regulatory guidance, codes or opinions).
  6. In addition, the personal information of Candidates, Employees, External Contractors and Clients is processed for event management and execution to ensure that all participants have a safe and enjoyable experience, to provide notifications concerning the event, provide analysis to improve our events and develop new events, determine their overall effectiveness, enhance products and services, and to operate and expand our business activities.

8. Transfer of personal information

Investmech may communicate or transfer your personal data to different entities for the purposes established in this document.  These transfers are made to the extent that they are necessary for the maintenance or fulfilment of the contractual relationship between Investmech and you.  Any of the transfers referred to below may be national or international.

Investmech may refer all or part of your personal information to service providers to support us in a particular process.  These suppliers include, for example:

  • companies that provide us with a recruitment and selection service;
  • accounting or computer companies that support us to pay the payroll;
  • companies, or laboratories that perform psychometric, psychological, medical, clinical studies, among others; (
  • offices that support us in accounting, legal and immigration matters;
  • insurance agents, insurance companies, medical aid companies and pension scheme administrators; and
  • companies that provide us with information technology outsourcing and management services as well as cloud hosting services.

Before transferring information to these suppliers, we make sure to sign contracts that oblige these companies to commit themselves to protect your personal information.

9. Information security

Investmech is legally obliged to provide adequate protection for the personal information we hold and to stop unauthorised access and use of personal information.  We will continually review our security controls and related processes to ensure that all personal information remains secure.

Our security includes:

  1. Physical security of servers and data storage devices.
  2. Computer and network security.
  3. Authorised access.
  4. Secure connections.

10. Privacy rights

All our Employees, Candidates External Contractors and Clients may always, have a right to request from Investmech access to their personal information or the correction of such personal information.  Likewise, you may request us to delete or erase your personal information.  You may also object to Investmech processing your personal information for specific purposes and you may revoke any consent previously granted to the processing of your personal information.  Your Data Subject Rights may be subject to limitations detailed in applicable laws.  To exercise your Data Subject Rights, you must send Investmech a request addressed to the following email address: info@investmech.com to our Information Officer.  Employees may also send queries or complains in connection with their privacy rights to this email.

In case you decided to exercise your Data Subject Rights, our CEO may inform you of:

  • the information that you will need to provide for identification purposes as well as the documents you may need to enclose with your request;
  • the expected timeframe for receiving a response from us regarding your request;
  • how to submit your request, including the forms that you will be required to use, if available; and
  • the form in which we will deliver your information to you (which usually may be copies of documents or digital files).

In terms of POPIA, you are entitled to approach the South African courts and you can lodge a complaint with South Africa’s Information Regulator in respect of any alleged interference with the protection of your personal information.

The contact details of South Africa’s information regulator are as follows:

Physical address:          JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001

Postal address:             P.O. Box 31533, Braamfontein, Johannesburg, 2017

Email address:              complaints.IR@justice.gov.za

11. Limiting the use of personal information

As a Candidate, Contractor or Employee, you may at some point wish to explore whether there are ways to limit the way we use or disclose your personal information.  For example:

  • an Employee could request his/her photograph not be published on the Investmech webiste or in a catalogue of Investmech;
  • a Candidate may request that we do not send him/her emails informing him/her of vacancies; or
  • an ex-employee could request that we not mention him, etc.

In these cases or any other where you wish to explore what forms exist for us not to process your personal information for any particular purpose, please contact us at info@investmech.com . Our CEO or his delegate will let you know what options you have.

12. Changes to Privacy Statement

Investmech reserves the right to modify or update this Privacy Statement at any time.  The modified notice will be posted on our website or will be sent via email or any other means of communication.  You can verify that the notice has mbeen modified with reference to the date of the last update or revision number.  If you do not agree with the modifications, please contact us.