1.1 The Western Cape Gambling and Racing Board, (herein after referred to as “we”, ”us”,or the“WCGRB”) in our capacity as a Responsible Party, in order to do business will have to process Personal Information, and in doing so, will have to comply with a law known as the Protection of Personal Information Act, 4 of 2013 (hereinafter referred to as “POPIA”), which regulates and controls the processing of a legal entity’s and/or an individual’s Personal Information in South Africa, (hereinafter referred to as a “Data Subject”), which processing includes the collection, use, and transfer of a Data Subject’s Personal Information.
1.2 In order to comply with POPIA, a person processing another’s Personal Information must:
1.2.1 provide the owner of the Personal Information with a number of details pertaining to the processing of his/her/its Personal Information, before such information is processed; and
1.2.2 get permission or consent from the owner of such Personal Information, to process his/her/its Personal Information, unless such processing:
is necessary to carry out actions for the conclusion or performance of a contract to which the owner of the Personal Information is a party;
is required in order to comply with an obligation imposed by law;
is for a legitimate purpose or is necessary to protect the legitimate interest(s) and/or for pursuing the legitimate interests of i) the owner of the Personal Information; ii) the person processing the Personal Information; or iii) that of a third-party to whom the Personal Information is supplied; or
is necessary for the proper performance of a public law duty by a public body or on behalf of a public body.
1.3 Where any person uses our Websites, electronic applications, e-mail or electronic services, or social media sites and/or services, and messaging services such what’s app, we will have to process such person’s Personal Information.
1.4 In accordance with POPIA, and because your privacy is important to us, please take note of this Privacy Notice, as it describes how we process your Personal Information, including the receipt, collection, use, disclosure, sharing, retention and importantly the protection of your Personal Information.
1.5 This Privacy Notice also asks that you provide us with your consent to process your Personal Information, where this is required, which consent will be deemed to have been given by yourself, when you provide us with your Personal Information for processing.
2. APPLICATION OF THE PRIVACY NOTICE
This Privacy Notice applies to the the WCGRB Websites, email facilities, electronic applications or electronic services, any WCGRB social media sites and/or services, and messaging services such as WhatsApp and/or to the WCGRB eServices offered by WCGRB and to all users of the WCGRB Websites, email facilities, electronic applications or electronic services, the WCGRB social media sites and/or services, and messaging services and/or to the WCGRB eServices, (hereinafter referred to as our / the “Websites”).
3. WHAT PERSONAL INFORMATION DO WE COLLECT AND PROCESS?
When you use our Websites, we will collect, without detracting from the generality thereof, the following Personal Information, which belongs to you:
General contact and account details, including your name, including business name where applicable; contact details including address, e-mail address and telephone or cellular phone number; identity number or business registration number; name of employer, insurer or medical aid provider and related contact details; membership numbers; account log on details, including password or identifiers and security questions, which may have been allocated to you;
device and browser information, including device identification number and type; network and connection information (including Internet Service Provider (ISP) and Internet Protocol (IP) addresses), device and browser identifiers and information (including device, application, or browser type, version, plug-in type and version, operating system, user agent, language and time zone settings, and other technical information), advertising identifiers, cookie identifiers and information, and similar data;
usage information and browsing history, such as usage metrics (including usage rates, occurrences of technical errors, diagnostic reports, settings preferences, backup information, API calls, and other logs), content interactions (including searches, views, downloads, prints, shares, streams, and display or playback details), and user journey history (including clickstreams and page navigation, URLs, timestamps, content viewed or searched for, page response times, page interaction information (such as scrolling, clicks, and mouse-overs), and download errors), advertising interactions (including when and how you interact with marketing and advertising materials, click rates, purchases or next steps you may make after seeing an advertisement, and marketing preferences), and similar data;
location data, such as the location of your device, your household, and similar location data;
demographic information, such as country, preferred language, age and date of birth, marriage status, gender, physical characteristics, personal or household / familial financial status and metrics,
vehicle details where access to our facilities is required;
serial number of assets and/or devices where access to our facilities or Websites is required;
opinions and preferences;
your image, such as still pictures, video, voice, and other similar data;
social media and online content, such as information placed or posted in social media and online profiles, online posts, and similar data.
4. HOW WE COLLECT INFORMATION
4.1 We collect the Personal Information detailed above about you and any other party whose details you provide to us, when you use and access the Websites, including any access to such Websites for the following purposes:
to make enquiries about the WCGRB or the WCGRB services, its affiliates, service providers or business partners, via our Websites;
to use the WCGRB services, especially any eServices, which are available or accessible via our Websites and to allow us to send you details regards any request or requirement which you have asked us for, including any confirmation of request or order;
to complete online forms, including call back requests;
to take part in surveys, to post content on our message boards, or to post any blogs;
to register to attend one of our events;
to look for, locate, read and/or download information or publications about us or our licensees, and trading partners;
to request or sign up for, or to view WCGRB specific material;
for the performance of contractual terms, or for the enforcement of contractual rights;
to obtain details of our terms, conditions, policies and procedures and to enforce and apply same;
to participate in any interactive areas that appear on our Websites;
to interact with us, our affiliates, our licensees, service providers, business partners or others;
to provide us with your contact details or updates to such details;
to send us an e-mail.
4.2 We will also collect your Personal Information where you only partially complete and/or abandon any information inputted into our Websites including online forms and may use this information to contact you to remind you to complete any outstanding information.
4.3 We also collect your Personal Information from your own devices including mobile devices and or the devices which you use in order to access our Websites, which is collected using cookies or similar technologies, as described and set out under clause 5.2.
4.4 We may enhance Personal Information we collect from you with information we obtain from third-parties that are entitled to share that information; for example, information from regulators, credit agencies, search information providers or public sources but in each case as permitted by applicable laws.
5. DETAILS DESCRIBING THE PURPOSE FOR THE COLLECTION AND USE OF YOUR INFORMATION, AND HOW WE USE IT
5.1 The Personal Information detailed under clause 4 above, which you provide to us is used for the following purposes:
to provide any information to you that you have requested – legitimate purpose;
to provide you with any WCGRB information or services that you have enquired about and/or requested – legitimate and contractual purpose;
for the performance of contractual terms, or for the enforcement of contractual rights – legitimate and contractual purpose;
to provide you with details of our terms, conditions, policies and procedures and to enforce and apply same – legitimate and contractual purpose;
to provide, maintain, protect and improve our Websites and WCGRB services – legitimate purpose;
to manage and administer the WCGRB services – legitimate and contractual purpose;
to manage our relationship with you – legitimate and contractual purpose;
to provide you with any information that we are required to send to you in order to comply with our contractual, service, regulatory or legal obligations – legitimate, lawful and contractual purpose;
to provide you with location-based services (for example personalised content), where we collect geo-location data – legitimate and contractual purpose;
to detect, prevent, investigate or remediate, crime, illegal or prohibited activities or to otherwise protect our legal rights (including liaison with regulators and law enforcement agencies for these purposes) – legitimate and lawful purpose;
to contact you to see if you would like to take part in our customer research (for example, feedback on your use of our Websites, products and services) – legitimate purpose;
to monitor, measure, improve and protect our content, Websites, services and provide an enhanced, personal, user experience for you – legitimate purpose;
to compare information for accuracy and to verify it with third-parties – legitimate purpose;
manage and administer your use of our Websites, products and services – legitimate, lawful and contractual purpose;
to undertake internal testing of our Websites and services, to test and improve their security, provision and performance – legitimate, lawful and contractual purpose;
to monitor, carry out statistical analysis and benchmarking, provided that in such circumstances it is on an aggregated basis which will not be linked back to you or any living individual – legitimate, lawful and contractual purpose;
for data analytics and benchmarking, in order to carry out research and development to improve our WCGRB services and Websites; and
to develop and provide new and existing functionality and services (including statistical analysis, benchmarking and forecasting services) – legitimate, lawful and contractual purpose.
5.2 Our Websites may contain technology (including Cookies) that enable us to:
check specific information from your device or systems directly relevant to your use of the Websites against our records, to make sure the Websites are being used in accordance with our end-user agreements and to troubleshoot any problems – legitimate, lawful and contractual purpose;
obtain information relating to any technical errors or other issues with our Websites legitimate purpose;
collect information about how you and users use the functions of the features of our Websites – legitimate, lawful and contractual purpose; and
gather statistical information about the operating system and environment from which you access our Websites, applications or services legitimate, lawful and contractual purpose.
5.3 Where you are not happy with the types of processing, detailed under section 5.2 above, then you can opt out of this type of processing by managing your cookies and privacy settings within your browser or on our Websites (where applicable).
5.4 We may monitor and record any communications which we hold with you when using the Websites, for quality assurance purposes, for evidential purposes and in order to meet our legal and regulatory obligations generally.
6. SHARING YOUR INFORMATION
6.1 We may share your information with:
any WCGRB employee or business partner or service providers, for the purposes set out in this Privacy Notice, (e.g. global information and relationship management; software and service compatibility and improvements; or to provide you with any information, applications or services that you have requested);
our service providers and agents (including their sub-contractors) or third-parties which process information on our behalf (e.g., affiliates, internet service and platform providers, and those service providers or organisations who we engage to help us provide you with the WCGRB services or to send communications to you);
WCGRB partners, including system implementers, independent software vendors and developers that may help us to provide you with the Websites, products, services and information you have requested or which we believe is of interest to you;
third-parties where you have a relationship with that third-party and you have consented to us sending information to such party;
various verification agencies, including credit reference and fraud prevention agencies;
Regulators, in order to meet legal and regulatory obligations;
law enforcement agencies so that they may detect or prevent crime or prosecute offenders;
any third-party in the context of actual or threatened legal proceedings, provided we can do so lawfully (for example in response to a court order);
any third-party in order to meet our legal and regulatory obligations, including statutory or regulatory reporting or the detection or prevention of unlawful acts;
our own professional advisors, including attorneys and auditors for the purpose of seeking professional advice or to meet our audit or legal responsibilities; and
Government departments where reporting is mandatory under applicable law.
6.2 We may share non-personally identifiable information about the use of our Websites, or services publicly or with third-parties but this will not include information that can be used to identify you.
6.3 Where we share or disclose your Personal Information as described above, such sharing and or disclosure will always be subject to an agreement which will be concluded as between ourselves and the party to whom we are disclosing your Personal Information to, which contractually obliges the recipient of your Personal Information to comply with strict confidentiality and data security conditions.
6.4 Where your Personal Information is transferred to a recipient in a country which is situated outside South Africa, your Personal Information will only be transferred to those recipients who are stated in countries which have similar data privacy laws in place or, in the absence of similar data privacy laws, where the recipient of the Personal Information concludes an agreement which contractually obliges the recipient to comply with strict confidentiality and data security conditions and which in particular will be to a no lesser set of standards than those imposed by POPIA.
6.5 By using our Websites, or by interacting with us in the ways described in this Privacy Notice, you consent to the transfer of your Personal Information to other parties in the circumstances set out in this Privacy Notice. If you do not want your information to be shared and/or transferred in such manner you should not use our Website.
7. SOCIAL MEDIA, AND OTHER THIRD-PARTY PLATFORMS
7.1 When you link onto social media forums like Facebook, Twitter, Yammer, Pinterest, Instagram, LinkedIn, YouTube, etc., which may house a reference to us, please note that these are not our platforms and that the use of these platforms will be subject to the relevant platform owners’ own privacy notices, and that we take no responsibility for your use of these platforms.
7.2 Where our Websites may contain links to third-party Websites; if you follow these links, you will exit our Websites and the use of these Websites will be subject to the relevant platform owners’ own privacy notices. Where you respond to communications, we post on third-party platforms such as Facebook, Google and Twitter, such Personal Information may be shared with those third-party platforms for the purposes of providing you with targeted advertising via the relevant third-party platform based on your provided profile / interests. While these third-party Websites are selected with care, WCGRB cannot accept liability for the use of your Personal Information by these organisations. You can however control what advertisements you receive using the privacy settings housed on the relevant third-party’s platform.
8. PROCESSING OF CHILDREN’S PERSONAL DATA
Any person who accesses our Websites who is under the age of 18 may only do so with the consent of his or her parent or legal guardian. If we determine upon collection that any person accessing the Websites is under the age of 18, and has not provided a parent/guardian’s consent, we will not use or maintain his/her Personal Information
9. LAWFUL REASONS FOR PROCESSING AND THE REQUIREMENT FOR CONSENT WHERE NO LAWFUL REASON CAN BE SHOWN
9.1 In terms of POPIA, consent to process your Personal Information is not required where there is a lawful reason for such processing, including where:
it is necessary to carry out actions for the conclusion or performance of a contract to which the owner is a party;
it is required in order to comply with an obligation imposed by law; or
it is for a legitimate purpose or is necessary to protect the legitimate interest(s) and/or for pursuing the legitimate interests of i) the owner of the Personal Information; ii) the person processing the Personal Information; or iii) that of a third-party to whom the Personal Information is supplied; or
it is necessary for the proper performance of a public law duty by a public body or on behalf of a public body.
9.2 Where a lawful reason cannot be met or shown for any specific processing detailed under this Privacy Notice, then your consent to such processing is required. Following this, where your consent is required for the processing of your Personal Information, the provision of the required Personal Information in such instances by you, to us, will be taken as you indication that we may process your Personal Information, which consent, you may at any time withdraw, in the prescribed manner and form, but which withdrawal may affect your ongoing ability to optimally use the Websites and related WCGRB Services.
10. SECURITY AND STORAGE OF INFORMATION
10.1 We will use our best endeavours to keep your Personal Information secure by taking appropriate technical and organisational measures against any unauthorised or unlawful processing and against any accidental loss, destruction or damage.
10.2 Whilst we will use our best endeavours as indicated above to protect your Personal Information, please note that no method of transmission over the Internet or method of electronic storage is 100% secure and that in light of this we cannot guarantee the security of your Personal Information which is transmitted via Websites, or to other Websites, applications and services via an internet or similar connection. Therefore, while we strive to use commercially acceptable measures designed to protect Personal Information, we cannot guarantee its absolute security.
10.3 Where we have given you, or you have chosen a password to access certain areas of our Websites, please keep this password safe and do not share this password with anyone.
10.4 Once your Personal Information is no longer required due to the fact that the purpose for which the Personal Information is held has come to an end, such Personal Information will be retained in accordance with our WCGRB Records Retention Schedule, which varies depending on the type of processing, the purpose for such processing, the business function, record classes, and record types. We calculate retention periods based upon and reserve the right to retain Personal Information for the periods that the Personal Information is needed to: (a) fulfil the purposes described in this Privacy Notice, (b) meet the timelines determined or recommended by regulators, professional bodies, or associations, (c) comply with applicable laws, legal holds, and other legal obligations (including contractual obligations), and (d) comply with your requests.
11. OTHER SITES AND SOCIAL MEDIA
11.1 If you follow a link from our Websites to another site or service, this Privacy Notice will no longer apply. We are not responsible for the information handling practices of third-party sites or services and we encourage you to read the privacy notices appearing on those sites or services.
11.2 Our Websites may enable you to share information with social media sites, or use social media sites to create your account or to connect your social media account. Those social media sites may automatically provide us with access to certain Personal Information retained by them about you (for example any content you have viewed). You should be able to manage your privacy settings from within your own third-party social media account(s) to manage what Personal Information you enable us to access from that account.
12. WHEN YOU PROVIDE US WITH INFORMATION ABOUT OTHERS?
If you provide us with Personal Information about someone else, you warrant that you have consent to provide us with such third-party information, and indemnify and hold us harmless against any losses or damages in the event that such consent is not in place.
13. YOUR RIGHTS
13.1 You as a Data Subject have certain rights, which are detailed below:
The right of access – You may ask the WCGRB (free of charge) to confirm that we hold your Personal Information, or ask us to provide you with details, (at a fee) on how we have processed your Personal Information, which request must be done by following the process set out under the WCGRB PAIA Manual.
The right to rectification – You have the right to ask us to update or rectify any inaccurate Personal Information which we hold of yours, which can be done by accessing the update / rectification request.
The right to object to and restrict further processing – Where we do not need your consent to process your Personal Information, but you are not in agreement with such processing, you may lodge an objection to such processing by accessing the objection request.
The right to withdraw consent – Where you have provided us with consent to process your Personal Information, you have to right to subsequently withdraw your consent, which can be done by accessing the withdrawal of consent request.
14.1 As WCGRB changes over time, this Processing Notice is expected to change as well.
14.2 WCGRB reserves the right to amend the Processing Notice at any time, for any reason, and without notice to you other than the posting of the updated Processing Notice on the WCGRB Website.
14.3 We therefore request that you to visit our Website frequently in order to keep abreast with any changes.
15. CHANGES TO THIS PRIVACY STATEMENT
15.1 If you process another’s Personal Information on the WCGRB’s behalf, or which we provide to you in order to perform your contractual or legal obligations or to protect any legitimate interest, you will:
if you are processing such Personal Information as our Operator as defined under POPIA, process all and any such Personal Information in compliance with the obligations set out under our standard “Operator Agreement” housed on our Website; or
where not acting as an Operator, nonetheless keep such information confidential and secure as per POPIA and you will not, unless authorized to do so, process, publish, make accessible, or use in any other way such Personal Information unless in the course and scope of your duties, and only for the purpose for which the information has been received and granted to you, and related to the duties assigned to you.
16.2 Should you wish to discuss a complaint, please feel free to contact us using the details provided above. All complaints will be treated in a confidential manner.
16.3 Our offices are open 08:00 am – 04.30 pm GMT, Monday to Friday.
16.4 Should you feel unsatisfied with our handling of your Personal Information, or about any complaint that you have made to us, you are entitled to escalate your complaint to the South African, Information Regulator who can be contacted at https://www.justice.gov.za/inforeg/.
17. ACCEPTANCE AND BINDING NATURE OF THIS DOCUMENT
17.1 By visiting our Websites and where applicable, by providing us with your Personal Information,
you acknowledge that you understand why your Personal Information needs to be processed;
you accept the terms which will apply to such processing, including the terms applicable to the transfer of such Personal Information cross border;
where consent is required for any processing as reflected in this Processing notice, you agree that we may process this particular Personal Information.
17.2 Where you provide us with another person’s Personal Information for processing, you confirm that that you have obtained the required permission from such person(s) to provide us with their Personal Information for processing.
17.3 The rights and obligations of the parties under this Processing Notice will be binding on, and will be of benefit to, each of the parties’ successors in title and/or assigns where applicable.
17.4 Should any of the Personal Information concern or pertain to a legal entity whom you represent, you confirm that you have the necessary authority to act on behalf of such legal entity and that you have the right to provide the Personal Information and/or the required permissions in respect of the processing of that Organization or entities’ Personal Information.