1.Introduction

Core Vision EMEA (Pty) Ltd (“CORE VISION”) is licensed to grant access to and use the myBuildings facilities management system on a Software as a Service (SaaS) basis. CORE VISION is committed to sound business practices in compliance with relevant legislation, which, for purposes of this Privacy Policy, includes the Protection of Personal Information Act 2 of 2000 (PAIA) read with the Constitution of the Republic of South Africa.

2.Purpose, Scope and Objectives

2.1    This policy will set out the way personal information of internal and external parties is collected, managed, stored, used and protected by CORE VISION. This policy applies to all employees of CORE VISION.

2.2    The objectives are to:

• process personal information lawfully in terms of legislation;
• provide a guideline as to the way CORE VISION processes and protects personal information;
• adopt good practices in terms of processing of personal information;
• protect CORE VISION from the consequences of breaching its responsibilities; and
• display the commitment of CORE VISION to uphold and respect information privacy.

 

3.Definitions

3.1    “personal information” means information relating to an identifiable, living, natural person, and where it is applicable, an identifiable, existing juristic person, including, but not limited to-

• information relating to the race, gender, sex, pregnancy, marital status, national, ethnic or social origin, colour, sexual orientation, age, physical or mental health, well-being, disability, religion, conscience, belief, culture, language and birth of the person;
• information relating to the education or the medical, financial, criminal or employment history of the person;
• any identifying number, symbol, e-mail address, physical address, telephone number, location information, online identifier or other assignment to the person;
• the biometric information of the person;
• the personal opinions, views or preferences of the person;
• correspondence sent by the person that is implicitly or explicitly of a private or confidential nature or further correspondence that would reveal the contents of the original correspondence;
• the views or opinions of another individual about the person; and
• the name of the person if it appears with other personal information relating to the person or if the disclosure of the name itself would reveal information about the person.

3.2    “processing” means any operation or activity or any set of operations, whether by automatic means, concerning personal information, including-

• the collection, receipt, recording, organisation, collation, storage, updating or modification, retrieval, alteration, consultation or use;
• dissemination by means of transmission, distribution or making available in any other form; or
• merging, linking, as well as restriction, degradation, erasure or destruction of information.

3.3    This Privacy Policy will refer to:

• The myBuildings service as “myBuildings”, “we”, “our” or “us”;
• myBuildings SaaS websites and myBuildings Check-In Application as “Sites” or “myBuildings App”; and
• Our Clients as “our customers” or “our clients”.

 

4.Type of Information Processed

4.1    We collect different types of personal information based on the relationship we have with you. Examples of this type of information include:

• Contact Information such as your name, country, phone number, company name, your role in the company, and work email;
• Account Setup such as your first name, last name, email address, phone number and password;
• System Data such as your computer or device, device type, operation systems and IP address;
• Metadata and Personal Identifiable Information may be collected using our Sites for the purpose of keeping accurate records between third parties. An example would be a maintenance contractor responding to a work order relating to a property on behalf of an end user;
• We may collect the following information while using our Sites:
• In App Use such as Incident & Safety records, Work Requests Records, Quoting Records, Contractor Records, and Invoicing Records;
• User Generated Data such as text, photos and videos which is associated with the accounts or emails used to create an account with our Sites;
• Information that is collected while using our Website and Application;
• We collect information about how you use our website and application which helps us improve the delivery of our web pages and measuring traffic on the Sites.
• Technical Data that we collect about your computer or device includes (not limited to) your device type, operation system and IP address.

 

5.Lawful Processing

CORE VISION undertakes to comply with the 8 conditions for the lawful processing of personal information:

• Accountability

CORE VISION takes responsibility and remains accountable for personal information in our possession and processed by us. CORE VISION will ensure that the conditions for lawful processing are given effect to and complied with.

• Processing Limitation

 

5.2.1          CORE VISION undertakes to process personal information,

• lawfully;
• In a reasonable manner that does not infringe the privacy of the data subject; and
• in a manner that is adequate, relevant and not excessive.

5.2.2          Personal information will only be processed if,

• the data subject or a competent person, where the data subject is a child, consents thereto;

• processing is necessary to carry out actions for the conclusion or performance of a contract to which the data subject is party;
• processing complies with an obligation imposed by law;
• processing protects a legitimate interest of the data subject;
• processing is necessary for the proper performance of a public law duty by a public body; or
• processing is necessary for pursuing the legitimate interests of the responsible party or of a third party to whom the information is supplied.

5.2.3          Personal information will be collected directly from the data subject, unless:

• the information is contained in or derived from a public record or has deliberately been made public by the data subject;
• the data subject or a competent person, where the data subject is a child, has consented to the collection of the information from another source;
• collection of the information from another source would not prejudice a legitimate interest of the data subject;
• collection of the information from another source is necessary;
• to avoid prejudice to the maintenance of the law by any public body;
• to comply with an obligation imposed by law or to enforce legislation;
• for the conduct of proceedings, in any court or tribunal, that have commenced or are reasonably contemplated;
• in the interests of national security;
• to maintain the legitimate interests of the responsible party or of a third party to whom the information is supplied;
• compliance would prejudice a lawful purpose of the collection; or
• compliance is not reasonably practicable in the circumstances of the case.

 

• We may also collect your information through the following channels:
• Directly from you;
• Our Website Forms; and
• myBuildings Sites

 

• Purpose Specification

 

• CORE VISION will collect personal information for the following and related purposes:

• Managing our ongoing relationship with you;
• Performing activities related to management, development, and improvement of our Sites;
• Authorisation to login and use for a user account;
• Authentication purposes;
• Sharing information about our offerings and periodic newsletters;
• Internal record keeping;
• The creation or the development of business intelligence or data analytics;
• Maintaining accurate records in multi-party transactions;
• Managing or resolving any legal matters, complaints, or issues; and
• Complying with our legal obligations.

 

5.3.2          Once personal information, processed and stored by CORE VISION, has reached its expiry date or becomes in any way redundant, CORE VISION will destroy or delete the record of personal information in a manner that prevents its reconstruction in an intelligible form.

• Further Processing Limitation

 

CORE VISION undertakes to carry out any further processing of personal information in accordance or compatible with the purpose for which it was collected originally.

 

• Information Quality

 

CORE VISION will take reasonably practicable steps to ensure that the personal information is complete, accurate, not misleading and updated where necessary.

 

• Openness

 

• CORE VISION will maintain the documentation of all processing operations under its responsibility.
• If personal information is collected, CORE VISION will take reasonably practicable steps to ensure that the data subject is aware of:

• the information being collected or the source from which it is collected;
• the name and address of the responsible party;
• the purpose for which the information is being collected;
• whether or not the supply of the information by that data subject is voluntary or mandatory;
• the consequences of failure to provide the information;
• any law authorising or requiring the collection of the information;
• the fact that, where applicable, the responsible party intends to transfer the information to a third country or international organisation and the level of protection afforded to the information by that third country or international organisation; and
• any further relevant information.

 

• Security Safeguards

 

• CORE VISION undertakes to secure the integrity and confidentiality of personal information in its possession or under its control. This is done by taking appropriate, reasonable technical and organisational measures to prevent loss of, damage to, or unauthorised destruction of personal information, and unlawful access to or processing of personal information.
• Where there are reasonable grounds to believe that the personal information of a data subject has been accessed or acquired by any unauthorised person, CORE VISION will notify, as soon as reasonably possible after the discovery of the compromise,

• the Regulator; and
• the data subject unless the identity of such data subject cannot be established.

5.7.3       CORE VISION has put in place the following adequate safeguards to secure the integrity and confidentiality of personal information:

• Physical access security to the building;
• Password protection on Loan Management systems;
• Password protection on all computer logins;
• Anti-virus on all computers;
• Employee training on Privacy and Security;
• System security such as access controls, firewalls, intrusion detection and virus scanning software; and
• Policies and procedures on information handling, security, and privacy.

 

• Data Subject Participation

 

If you have any questions or concerns regarding this policy, your personal information held by CORE VISION, the correction or deletion of personal information or updating your personal information held by CORE VISION, you should contact CORE VISION by sending an email to the information officer:

 

Riaan van der Merwe

Riaan@corevision.africa

 

• Disclosure of Information

Where applicable, we may disclose your personal information to our service providers and partners who are involved in the delivery of products or services to you. We will ensure that they have taken reasonably practicable steps to comply with and process personal information in accordance with PAIA.

• Lodging a Privacy Complaint

 

• If you have a complaint regarding how we have handled your personal information, which remains unresolved after having referred the complaint to our information officer, you may direct your complaint to:

 

The Information Regulator (South Africa)

JD House, 27 Stiemens Street, Braamfontein, Johannesburg

P.O Box 31533, Braamfontein, Johannesburg, 2017

Tel: 010 023 5200

e-mail: enquiries@inforegulator.org.za