Privacy Notice

01 Introduction

In this document, references to Carlz Scrap Metal (Pty) Ltd, "we", "us", or "the Company" are to Carlz Scrap Metal (Pty) Ltd and its subsidiary companies.

Carlz Scrap Metal (Pty) Ltd recognises its accountability in terms of the Protection of Personal Information Act (hereinafter referred to as POPIA), other privacy protection legislation, together with its regulations to all its clients, suppliers, service providers and other third parties. Carlz Scrap Metal (Pty) Ltd needs to collect personal information from its clients, suppliers, service providers and other third parties to carry out its business.

To maintain a trust relationship with our Stakeholders, we are committed to complying with both the spirit and the letter of POPIA, other privacy protection legislation, and to always act with due skill, care, and diligence when dealing with personal information.

02 What is Personal Information

Personal Information according to POPIA means information relating to an identifiable, living, natural person, and where it is applicable, an identifiable, existing juristic person, including, but not limited to:

• Information relating to race, gender, sex, pregnancy, marital status, national, ethnic or social origin, colour, sexual orientation, age, physical or mental health, well-being, disability, religion, conscience, belief, culture, language, and birth;
• Information relating to education, medical, financial, criminal, or employment history;
• Any identifying number, symbol, e-mail address, telephone number, location information, online identifier, or other particular assignment;
• Biometric information;
• Personal opinions, views, or preferences;
• Correspondence sent by the person that would reveal the contents of the original correspondence;
• The views or opinions of another individual about the person; and
• The name of the person if it appears with other personal information or if the disclosure of the name itself would reveal information about the person.

03 Where and When We Collect Personal Information

Information you provide to us:

Clients

• Directly from you
• Purchase orders
• Contracts

Suppliers

• Invoices
• Contacts

04 When We Will Process Your Personal Information

We will only process your personal information for lawful purposes relating to our business if the following circumstances apply:

• You have consented thereto;
• A person legally authorised by you, or a court, has consented thereto;
• It is necessary to conclude or perform under a contract we have with you;
• The law requires or permits it;
• It is required to protect or pursue your, our, or a third party's legitimate interest; and/or
• You are a child, and a competent person (such as a parent or guardian) has consented thereto on your behalf.

05 When We Will Process Your Special Personal Information

Special personal information refers to the following categories of information:

• Religious and philosophical beliefs
• Race and ethnic origin
• Trade union membership
• Political beliefs
• Health including physical or mental health, disability, and medical history
• Biometric information
• Criminal behaviour where it relates to the alleged commission of any offence

We will process special personal information only in these instances:

• You have consented to the processing;
• It is necessary to exercise or defend a right or obligation in law;
• It is necessary to comply with an international legal obligation of public interest;
• It is for certain historical, research, or statistical purposes that would not adversely affect your privacy; or
• You have deliberately made your personal information public.

06 What We Collect and How We Use Your Information

The following table sets out the main purposes and data elements collected. This list is not comprehensive.

Clients

Service Providers / Suppliers

07 How We Share Your Information

Third-Party Service Providers

• Regulatory bodies
• Law enforcement agents
• Government agencies

Legal Disclosures

We may need to share your information when we believe it is required by law, legal process, or to help protect the rights and safety of you, us, or others. We attempt to notify members about legal demands for their data when appropriate in our judgment unless prohibited by law or court order or when the request is an emergency.

08 Your Rights and Obligations

Data Retention

We keep most of your personal information while we still have a purpose, we need to provide you with services or where we are legally obligated to do so. We will also keep your information where you have agreed for us to do so. We keep some of your information even after our business relationship has terminated, if it is reasonably necessary to comply with our legal obligations, meet regulatory requirements, resolve disputes, maintain security, prevent fraud, or enforce our agreements.

Your rights include:

• Request access to your information: You may ask us what information we hold about you and request a copy. Submit your request to our Information Officer below. Certain exemptions may apply.
• Change or correct information: You have the right to ask us to rectify information you think is inaccurate or to complete information you think is incomplete.
• Delete information: You can ask us to delete or remove personal information under certain circumstances.
• Object to processing: You can object where we are relying on legitimate interest or where you have given consent and wish to retract it. Retracting consent does not invalidate processing that was lawful while consent existed.
• Request restriction of processing: You can ask us to suspend processing under certain circumstances, such as where you want us to establish its accuracy.

09 Changes to Our Privacy Notice

We may modify this privacy notice from time to time, as required by changes in legislation. When material changes are made, we will provide notice through our services, or by other means, to provide you the opportunity to review the changes before they become effective.

Your continued use of our services after we publish changes to this privacy notice means that the collection, use, and sharing of your personal information is subject to the updated privacy notice.

10 Other Important Information

Security

We have put in place appropriate security measures to prevent your data from being accidentally lost, used, or accessed in an unauthorised way, altered, or disclosed. We limit access to your personal information on a business need-to-know basis, subject to a duty of confidentiality.

Transborder Information Transfers

We do not share any of our clients', suppliers', service providers' or other third parties' information across borders.

11 Contact Information

Should you have a query regarding your personal information, please contact our Information Officer:

You also have the right to lodge a complaint with the South African Information Regulator: