Privacy Policy

file_1663848207440

NMI DURBAN SOUTH MOTORS (PTY) LTD PRIVACY AND COOKIE POLICY

Date of Publication: 9 September 2022

Revision: 1.0


  1. INTRODUCTION


    1. NMI Durban South Motors (Pty) Ltd, Registration Number 1999/005078/07, including its various dealerships and wholly owned subsidiaries, (“We”, “Us”, “Our”) take privacy, and the security of personal information, very seriously, and We are committed to ensuring that We safeguard the privacy and personal information of all our stakeholders("You”, “Your”). We communicate either personally with You, or by conducting business with You as part of our normal business activities, or through Our Website, applications and other electronic media whether by email or other electronic means, at all times and in the most practical way possible.

    2. This privacy policy contains important information for You. It explains:

      1. who We are;

      2. Our Website;

      3. what personal information We collect about You;

      4. how, when and why We collect, store, use and share Your personal information;

      5. how We keep Your personal information secure;

      6. for how long We keep Your personal information;

      7. Your rights in relation to Your personal information;

      8. issues relating to marketing; and

      9. how to contact Us or the relevant supervisory authorities should You have a complaint.

    3. NMI Durban South Motors (Pty) Ltd, Registration Number 1999/005078/07, is a private company registered in the Republic of South Africa and Our registered office is at 12th Floor, Menlyn Central, 125 Dallas Avenue, Waterkloof Glen, South Africa. Our contact telephone number is: +27 (0)11 052 0100. Our Information Officer for data protection purposes may be contacted on privacy@nmi.co.za.

    4. When We collect, use and process personal information, We are subject to the provisions of the Protection of Personal Information Act No. 4 of 2013 (“POPI Act”) and We are what is described as a “Responsible Party” of that personal information for the purposes of those laws. In other words, We are primarily responsible for that personal information and are the “natural or juristic person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal information”.

    5. If You have any questions about the use to which We put Your personal information, please contact Our Information Officer, whose contact details are set out in paragraph 1.3 above.

    6. This policy relates to You conducting business with Us including, but not limited to, Your use of Our Website, telephonic or other electronic or physical communications from either party. Please note that Our Website may link

      to other third-party websites and systems that may also gather information about You which could include your personal information. We make no representations or warranties about the data privacy practices of any third party and cannot accept responsibility for the data privacy practices of, or content displayed on third party websites and systems. Third-party websites and systems will operate in accordance with their own separate data privacy policies, and We have no control over any personal information that they may acquire, store and use. For data privacy information relating to these other third-party websites, You should consult their privacy policies as appropriate.

    7. We are committed to preserving the privacy of Your personal information so that We can:

      1. deliver service of a high quality to clients;

      2. at all times comply with the law and the various regulations that We are subject to;

      3. meet the expectations of clients, employees and third parties; and

      4. protect Our reputation.

    8. In this policy, please note the use of the following terms:

      1. personal information has the meaning given to it by the POPI Act and means any information relating to an identified or identifiable data subject;

      2. processing means any operation or actions performed on personal information; for example, collection, recording, organisation, structuring, storing, altering, deleting or otherwise using personal information.

      3. We, Us and Our refers to NMI Durban South Motors (Pty) Ltd including its various dealerships and its wholly owned subsidiaries; and

      4. You and Your refers to any person who is purchasing Our goods and / or services, from whom We purchase goods and / or services or is accessing Our Website and whose personal information is processed and can include clients, suppliers, contractors, business partners, prospective employees, third parties and visitors.


  2. YOUR PERSONAL INFORMATION


      1. Personal information is collected about You whenever You conduct business with Us, including when You contract with Us for the purchase of Our goods or the rendering of Our services, access Our Website, contact Us, send Us feedback, post material to Our Website, complete forms manually or on Our Website, take part in client surveys, participate in competitions, submit reviews to or via Our Website.


      2. Personal information is collected either directly (for example when You contact Us, complete transactions, complete forms or submit reviews manually or via Our Website) or indirectly (for example where You are browsing Our Website through the use of ‘Cookies’).


      3. The personal information We receive and process is dependent on what information You give to Us when contracting to purchase Our goods and/ or services and/or how You access Our Website, what You do while You are accessing it, and what You perceive the end result of accessing Our goods, services or Our Website will be.


      4. In general, the sorts of personal information that We can acquire, depending on the circumstances, may include but is not limited to:


        1. Your name, address, email, telephone number;


        2. Your identity, birth certificate or passport number;

        3. If You are a corporate entity then Your name, registration number, VAT number, Tax information, telephone number, address, corporate documentation registered at the Companies and Intellectual Property Commission, contact person and their contact details;


        4. Your bank account or other financial details;


        5. details of any feedback You give Us, and this may be by phone, email, post or via social media;


        6. information about the goods and services We provide to You;


        7. Your account / profile details, such as username, login details;


        8. Your IP address, the browser You use, Your operating system;


        9. the pages of Our Website, or other resources on that Website, that You have accessed and when You accessed them; and


        10. the details of any documents or other resources that You have downloaded from Our Website.


      5. In general terms, We may use this personal information to do the following, which list is not limited, to:


        1. create and manage Your account / profile with Us;


        2. verify Your identity;


        3. comply with legislation which may be applicable to the goods and services We render or Our business;


        4. provide goods and services to You;


        5. assist you with financing applications;


        6. customise Our goods and / services and Website and its content to Your particular preferences;


        7. notify You of any changes to Our Website or to Our goods and services that may affect You;


        8. improve Our goods and services;


        9. receive Your reviews and respond to them.


      6. Please note that it is important that the personal information We hold about You is accurate and current. Please keep Us informed if Your personal details change during Your relationship with Us.


      7. Please note that Our Website is not intended for use by children under the age of 18 years of age, and We do not knowingly collect or use personal information relating to children.


      8. You should not disclose the personal information of third parties to Us unless:


        1. there is a lawful reason why We need to have that information;


        2. You are permitted by the third party to disclose their personal information to Us; and

        3. You have brought this privacy policy to the attention of the third party. When you give Us the personal information of a third party, please provide a copy of this Privacy Policy to that person so that they can also be made aware of the conditions under which their personal information is handled by Us. We have no way of checking that You have complied with the requirements relating to the disclosure of third party's personal information and therefore We will assume that You have done so and You shall be liable to the data subject if You breach this clause


  3. THE PURPOSES FOR WHICH YOUR INFORMATION IS USED


      1. Data protection law requires that We only use Your personal information for the purposes for which it was acquired, or where We have a proper reason for using it. Those reasons may include the following:

        1. Where You have given consent to the use of Your personal information for one or more specific purposes;


        2. Where the use is necessary for the performance of a contract to which You are party, or in order to take steps at Your request prior to entering into a contract;


        3. Where the use is necessary for compliance with a legal obligation that We are subject to;


        4. Where the use is necessary in order to protect Your legitimate interests or those of another person;


        5. Where the use is necessary for the performance of a task carried out in the public interest, or in the exercise of official authority vested in Us; and


        6. Where the use is necessary for the purposes of Our legitimate interests or those of a third party, except where those interests are overridden by Your interests or fundamental rights and freedoms which require protection of personal information.


      2. The reasons set out above represent the general position as to the purposes for which personal information may be used. The specific position in relation to Your personal information, however, is that We may use it for the following purposes including, but not limited to, and as more fully detailed in Schedule A.

        1. In order to supply goods and/or services to You, which may also be through or via Our Website. This processing relies on the performance of a contract between Us and the steps needed to deliver those contractual goods and services.


        2. To verify or authenticate your personal information or that of any other person to whom we sell and / or purchase goods or render or receive services. This will help to prevent any loss or damage either to You, a third party, or to Us. This processing relies on factors related to Our legitimate interests in processing the personal information.


        3. To preserve the confidentiality of commercially sensitive information, and for Our legitimate interests or those of a third party in relation to the protection of Our, or another’s, intellectual property and other commercially valuable information. This processing relies on Your consent where this has been given, or on factors related to Our legitimate interests in processing the personal information.


        4. In connection with credit control and credit reference checks in relation to the services We perform or the goods We supply. This processing relies on Your consent where this has been given, on factors related to Our legitimate interests in processing the personal information (in that We are seeking to provide goods

          and services as part of Our business, or the performance of a contract between Us, and the steps needed to deliver those contractual goods and services).


        5. To analyse the use made of Our Websites. Here We may make use of Your IP address, where You are based, the type and version of the browser You use, details of Your operating system, how You came to Our Website (for example whether You were referred from another Website or from a search engine), how long You remained on Our Website, the number of pages on Our Website that You viewed, how You moved around Our Website, the links that You followed, and whether any of those links were used to leave Our Website. This processing relies on Your consent where this has been given, or on factors related to Our legitimate interests in processing the personal information (in that We are seeking to monitor and improve Our Website and/or the goods and services We provide).


        6. To provide those goods and services which You have requested Us to provide. This may include taking such security measures as are appropriate, backing up the personal information We hold, and contacting You. This processing relies on Your consent where this has been given, or on factors related to Our legitimate interests in processing the personal information (in that We are seeking to provide goods and services as part of Our business, or the performance of a contract between Us, and the steps needed to deliver those contractual goods and services).


        7. In relation to information which You wish to include in our documentation, where You participate in telephonic reviews, or post on Our Website (for example by submitting a review of Our goods and services, supplying a blog post or the publishing of other information). This processing relies on Your consent where this has been given, or on factors related to Our legitimate interests in processing the personal information (in that We are seeking to provide goods and services as part of Our business, or the performance of a contract between Us, and the steps needed to deliver those contractual goods and services).


        8. For dealing with an enquiry submitted by You to Us in connection with Our goods and/or services, or in relation to the supply of newsletters, email notifications, product data or general updates. This processing relies on Your consent where this has been given, or on factors related to Our legitimate interests in processing the personal information (in that We are seeking to provide goods and services as part of Our business, or the performance of a contract between Us, and the steps needed to deliver those contractual goods and services).


        9. Where it is necessary for Us to do so in order to establish, exercise or defend a legal claim, whether in court proceedings or in an administrative or out-of-court procedure. This processing relies on factors related to Our legitimate interests in processing the personal information.


        10. In connection with the compliance by Us with a legal obligation that We are subject to, or in order to protect Your, or Our, legitimate interests, or the legitimate interests of another natural person.


      3. The purposes set out above may apply to what is termed ‘special personal information’. This includes personal information revealing racial or ethnic origin, political opinions, religious beliefs, philosophical beliefs, trade union membership, genetic and biometric data, and data concerning health, sex life or sexual orientation. We will only ever process information of that nature with Your explicit consent.

  4. CONTACTING YOU


      1. In addition to the general matters dealt with in paragraph 3.2 above, We may also need to send You updates concerning Our goods and services, and about relevant developments in relation to You, Our goods and services, or other related matters which might concern You, or be of interest to You. This may be by telephone, email or text, and may include information about the goods and services We offer and information relating to changes in those goods and services.

      2. We regard ourselves as having a legitimate interest in processing Your personal information for the purposes as set out in clause 3.2, and We take the view that We do not require Your consent in order to do so. Where We believe that consent is required, We will contact You specifically for this, and will do so in a clear and transparent manner.

      3. Where You have agreed to Us doing so, We may also send You information about third party goods and services in which You have expressed an interest, or which are relevant to any goods and services that We have supplied.

      4. Be assured that We treat Your personal information with the utmost respect and will never share it with others for marketing or promotional purposes. You have, at all times, the right to request that We do not contact You for any purpose other than providing Our goods and services. We may, however, require that You confirm Your marketing preferences from time to time so that We can be sure that Your views remain the same, especially in relation to issues such as legal and regulatory updates and where the Original Equipment Manufacturer (“OEM’s”) require us to do so for product recalls and related matters.


  5. SHARING YOUR PERSONAL INFORMATION WITH OTHERS


      1. Notwithstanding the fact that We will not share Your personal information for marketing purposes, it may be necessary for Us to share Your personal information with others in order to supply Our goods and render services to You, to comply with Our contractual obligations to You, to comply with Our legal or regulatory obligations to You, to comply with Our obligations to the OEM’s, or to comply with any contractual, legal or regulatory obligations that We are subject to. These may include:


        1. When sharing Your personal information, We will ensure at all times that those with whom it is shared process it in an appropriate manner and take all necessary measures in order to protect it. In doing so We impose contractual obligations on all providers of goods and services to ensure that Your personal information is kept secure. We will only ever allow others to handle Your personal information if We are satisfied that the measures which they take to protect that personal information are satisfactory.


        2. Please be aware that, from time to time, We may be required to disclose Your personal information to, and exchange information about You or relating to You with, government, law enforcement and regulatory bodies and agencies in order to comply with Our own legal and regulatory obligations.


        3. We may be required to share Your personal information to third party contractors whose goods and services are affiliated with / necessary to our goods and services. This includes but is not limited to banks/financiers, insurers, insurance brokers, OEM’s, sub-contractors and / or suppliers.


        4. We may also need to share some personal information with other parties, such as potential buyers of some or all of Our business or during a re-structuring. Usually, information will be anonymised, but this may not always be possible. The recipient of the information will be bound by confidentiality obligations.


        5. From time to time it may be necessary for Us to share data for statistical purposes. We will always take steps to try to ensure that information shared is anonymised but, where this is not possible, We will require that the recipient of the information keeps it confidential at all times.

      2. Other than as set out above, and save where in our sole discretion it is necessary to protect Our legitimate interests, Your legitimate interests or the legitimate interests of another person or as permissible in terms of POPI Act, We will not share Your personal information with any other third party without Your consent.


  6. HOW YOUR PERSONAL INFORMATION IS KEPT


      1. Your personal information will be kept secure at all times.


      2. Some of Your personal information may be held in an electronic database on our server infrastructure and is secured using various methods, including application and physical firewalls. Where this takes place outside the Republic of South Africa then the provisions set out in Paragraph 7 below will apply.


      3. We implement various security measures in order to prevent loss of, or unauthorised access to, Your personal information. In order to ensure this, We restrict access to Your personal information to those with a genuine business need to access it, and We have procedures in place to deal with any suspected data security breach. We will notify You and any applicable regulator of a suspected data security breach where We are legally required to do so.


      4. Personal information that is processed by Us will not be retained for any longer than is necessary for that processing, or for purposes relating to or arising from that processing.


      5. Where Your personal information is retained after We have finished providing Our goods and services to You, or where the contract with You has ended in any other way, this will generally be for one of the following reasons:


        1. so that We can respond to any questions, complaints or claims made by You or on Your behalf;


        2. so that We are able to demonstrate that Your matter was dealt with adequately and that You were treated fairly; or


        3. in order to comply with legal and regulatory requirements.


      6. In general, We will retain Your personal information for only so long as is necessary for the various objectives and purposes contained in this policy. Please note, however, that different periods for keeping Your personal information will apply depending on the type of personal information being retained, the various legislation applicable to it and the purpose of its retention.


      7. We will also retain Your personal information as follows:


        1. so that We can inform You of updates concerning Our goods and services, and about relevant developments in relation to You, Our goods and services or other related matters which might concern You, or be of interest to You;


        2. for such time as is necessary for compliance with a legal obligation that We are subject to, or in order to protect Your legitimate interests or the legitimate interests of another person; and


        3. in order to provide value-added goods and services related to the goods and services purchased including, but not limited to, warranty extensions, value-added products, OEM product recalls, finance and insurance products, for example;


      8. We will delete and/or anonymise any personal information which it is no longer necessary for Us to retain.

  7. TRANSFERRING YOUR PERSONAL INFORMATION OUTSIDE SOUTH AFRICA


      1. From time to time, it may be necessary for Us to transfer Your personal information outside South Africa where, for example, Your interaction/communication is with one of Our dealerships located outside of South Africa, or those with whom We need to make contact on Your behalf have offices outside South Africa, where electronic goods and services and resources are based outside South Africa, where there is an international element to Your interaction/communication, where personal information is stored outside South Africa, where OEM’s may have external data repositories or transactional facilities or where payments are done. Where this is the case, special rules apply to the protection of Your personal information.


      2. We will always take steps to ensure that, wherever possible, the transfer complies with data protection laws, and endeavour to ensure that our host providers are subject to laws, or policies, which uphold principles for the reasonable processing of information substantially similar to the data protection laws in South Africa to ensure adequate protection of any such data. In most, if not all instances all collection and processing outside of South Africa will be with countries who contract to adhere to the POPI Act or are subject to the European Union’s General Data Protection Regulations (“GDPR”).


      3. You expressly agree to such transfers of Your personal information for the purposes above.


      4. Notice to European Users: We are a registered company in South Africa and Our dealerships are located in South Africa and Botswana and any third parties to which We provide access to Your personal information are therefore located internationally. The personal information You provide to Us, may therefore be transferred outside of the European Economic Area, including to countries which may not offer an equivalent level of protection to that in the European Union. Article 49 of the GDPR allows for transfer of personal data from the European Union to a third country if the individual has explicitly consented to the transfer of personal information, regardless of the third country's level of protection. By providing Us with personal information, You consent to the transfer of all such information to South Africa and other countries which may not offer an equivalent level of protection to that in the European Union and to the handling of that information in terms of this Privacy Policy.


      5. For further information please contact Our Information Officer at privacy@nmi.co.za.


  8. YOUR RIGHTS IN RELATION TO YOUR PERSONAL INFORMATION


      1. Data protection legislation gives You, the data subject, various rights in relation to Your personal information that We hold and process. Those rights are set out the POPI Act, and are summarised as follows:


        1. Right of access—the right to obtain from Us confirmation as to whether or not personal information concerning You is being processed, and, where that is the case, access to that personal information and various other information, including the purpose for the processing, with whom the personal information is shared, how long the personal information will be retained, and the existence of various other rights (see below).


        2. Right to rectification—the right to obtain from Us, without unreasonable delay, the correcting of inaccurate personal information concerning You.


        3. Right to erasure—sometimes referred to as the ‘right to be forgotten’, this is the right for You to request

          that, in certain circumstances, We delete personal information relating to You.


        4. Right to restrict processing—the right to request that, in certain circumstances, We restrict the processing of Your personal information.

        5. Right to personal information portability—the right, in certain circumstances, to receive that personal information which You have provided to Us in a structured, commonly used and machine-readable format, and the right to have that personal information transmitted to another responsible party.


        6. Right to object—the right, in certain circumstances, to object to personal information being processed by Us and provided there is no legal obligation or entitlement on Us to process Your personal Information as provided in various legislation.


        7. Right not to be subject to automated decision making—the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning You or similarly significantly affects You.


      2. Full details of these rights can be found in the POPI Act or by reference to guidance produced by the Information Regulator.


      3. In the event that You wish to exercise any of these rights You may do so by:


        1. contacting Our Information Officer at privacy@nmi.co.za or at any of the contact details We have provided in clause 1.3;


        2. completing a form which We will supply to You for this purpose; or


        3. through a third-party who You have authorised in writing for this purpose.


  9. ABOUT COOKIES


      1. We use cookies in connection with the operation of Our Website. A cookie is a small file that is sent by a web server (where We host Our Website) to a web browser (from where You view Our Website) and which is then stored by the browser. The cookie contains an identifier which is stored in Your browser and then sent back to Our server each time Your browser accesses Our Website. These cookies may either be ‘persistent cookies’ (in which case they will continue to be held by Your browser until they are deleted, or until a specified event/date) or they will be ‘session cookies’ which expire when You close Your browser.


      2. Usually, cookies do not hold any data by which You can be identified, although if We do hold personal information about You (for example, because You have subscribed to a service that We offer) the cookie may be linked to that personal information.


      3. We also use cookies for the following purposes:


        1. authentication purposes;


        2. to identify users who are using a membership service;


        3. personalising the web browsing experience;


        4. security.


      4. In addition to cookies used by Us, Our service providers may also use cookies, and those cookies may also be stored in Your browser when You visit Our Website.


      5. We use Google Analytics. This uses cookies to gather data about how users use Our Website. This data is used to create reports about that use. Further information about Google’s use of data may be obtained from Google’s Website.

      6. In order to operate Our Website, We use session cookies to identify You to the website. In doing so, We allow You to transact on Our Website to the extent possible.


      7. If You wish to do so then, usually, You can prevent cookies from being downloaded to Your browser and can delete those that have already been downloaded. How this may be achieved varies between different browsers. Consult the website of Your browser provider for more details.


      8. However, You should be aware that if You block or delete cookies this may have a detrimental impact on Your ability to access Our Website, and the goods and services that We provide. It may mean that not all of the facilities on Our Website will be accessible by You. We regret that We may not be able to, for technical reasons, supply goods and services, to the extent applicable, unless Your browser is set to accept cookies.


      9. For further information about the cookies We use please contact our Information Officer at privacy@nmi.co.za;


  10. KEEPING YOUR PERSONAL INFORMATION SECURE


      1. In order to ensure that Your personal information is kept secure, and to prevent there being any breach of confidentiality, We have put in place security measures which are intended to prevent Your personal information from being accidentally lost, used, or accessed unlawfully. Access to Your personal information is restricted to those with a need to access it, and regard will be had to the need for confidentiality when that personal information is processed.


      2. In the event that there is a suspected data security breach You will be notified. Where relevant We will also inform the appropriate regulator (including the Information Regulator’s Office) of a suspected data security breach where We are legally required to do so.


  11. MAKING A COMPLAINT


      1. If You have any queries as to the acquisition, use, storage or disposal of any personal information relating to You please contact Our Information Officer, at privacy@nmi.co.za;


      2. Despite Our best efforts, inevitably sometimes things do go wrong. If You are unhappy with any aspect of the use and/or protection of Your personal information, You have the right to make a complaint to the Information Regulator’s Office, who may be contacted in writing at complaints.IR@justice.gov.za or telephone number: +27

    (012) 406 4818.


  12. CHANGES TO THIS PRIVACY POLICY


12.1 We may change or update this Privacy Policy from time to time. Any updated versions of this Privacy Policy will be posted on Our Website and will be effective from the date of posting. Where practical, and at Our discretion, we will endeavour to display a notice of the change on the Website.

Schedule A


Note: this document may be updated and amended from time to time as the information changes


CATEGORY OF PERSONAL INFORMATION

PURPOSE OF PROCESSING

LAWFUL BASIS FOR PROCESSING

VOLUNTARY / MANDATORY

Personal details such as full name, identity number or passport number

Authentication and verification of data subject

Compliance with legal obligation

Mandatory

Nationality

If not a South African Resident and conducting business with NMI


Authentication and verification of data subject

Compliance with legal obligation

Mandatory

Residential Address

To enable correspondence with the data subject

Authentication and verification of data subject

Compliance with legal obligation

Mandatory

Email Address

To enable correspondence with the data subject

For invoicing and receipt purposes and other communications related to goods sold and services rendered

Mandatory

Corporate Entity name, registration number, VAT number, Tax details, BEE Certificates, corporate documents registered at CIPC, contact person and contact details and related information

To enable goods and services to be bought and sold


correspondence for and on behalf of a data subject


Selling goods and rendering services to the Corporate Entity


Receiving goods and services from the Corporate Entity


Authentication and verification of data subject

Compliance with legal obligation


For invoicing and receipt purposes and other communications related to goods sold and services rendered / received

Mandatory

Bank account or other financial details

To enable goods and services to be paid for


To pay service providers / suppliers

Legitimate interest to receive payment


To pay for goods and services received

To make refunds, if applicable


Proof of Payment

To verify payment received from clients/data subjects or other parties who may make payment to Us

Legitimate interest to receive and verify actual payment

Mandatory

Car Registration

To conduct business with NMI

Legitimate interest in providing lawful client service

Mandatory

VIN Number

To conduct business with NMI

Legitimate interest in providing lawful client service

Mandatory

Information collected through cookies and similar technologies

To conduct and store Website usage analytics, authentication purposes, statistical, identifying users for membership services, personalising the web browsing experience, security


To generate client profiles to facilitate marketing initiatives

Consent

Voluntary

Contact history

To provide client service and support


To train Our staff

To provide client service and support

Voluntary

Browser, device and Website usage information

To improve the Website


To protect the Website against fraud


To set default options for You, such as language

Performance of contracts


Legitimate interest in maintaining Our Website

Mandatory

Information from linked websites or accounts

To enable You to log into the Website simply without having to create a specific account

Legitimate interest in providing high quality client service

Voluntary

Responses to surveys, competitions and promotions

To run the survey, competition or promotion

Performance of contract


Legitimate interest in administering and/or improving Our products and goods and services generally


Client comments and product reviews

To improve Our goods and services


Where relevant, to establish, exercise or defend legal claims

Performance of contract


Legitimate interest in dealing with complaints or claims and improving Our products and/or goods and services generally

Voluntary

Sponsorships

To provide sponsorship or trade exchanges in respect of goods and / or services

Performance of contract Consent

Mandatory