Contents
1. INTRODUCTION
2. CONTACT DETAILS
3. TYPES OF PERSONAL DATA PROCESSED BY THE SADC SECRETARIAT
4. HOW THE SECRETARIAT COLLECTS YOUR PERSONAL DATA
5. WHAT THE SADC SECRETARIAT DOES WITH YOUR PERSONAL DATA
6. THE BASIS FOR PROCESSING YOUR PERSONAL DATA
7. DOES SADC SECRETARIAT PROCESS SENSITIVE DATA?
8. WHO DOES THE SADC SECRETARIAT SHARE YOUR PERSONAL DATA WITH?
9. DOES THE SADC SECRETARIAT TRANSFER YOUR PERSONAL DATA TO A THIRD-PARTY COUNTRY OR INTERNATIONAL ORGANISATION?
10. DOES THE SECRETARIAT EMPLOY THE USE OF AUTOMATED DECION MAKING PROCESSES
11. HOW THE SADC SECRETARIAT STORES YOUR PERSONAL DATA
12. FOR HOW LONG DOES SADC SECRETARIAT KEEP YOUR PERSONAL DATA?
13. WHAT RIGHTS DO YOU HAVE?
14. UPDATES OR CHANGES TO THIS PRIVACY NOTICE
1. INTRODUCTION
1.1. The Southern African Development Community (SADC) Secretariat hereinafter referred to as the “Secretariat” fundamentally values the importance of Personal Data. Further, that Personal Data is an asset which must be protected and processed lawfully. In that regard, individuals’ right to privacy in Personal Data should be upheld.
1.2. The Secretariat processes a lot of Personal Data of Data Subjects (“you”) when conducting its operations.
1.3. This Privacy Notice outlines the Secretariat’s data processing activities such as how it processes your Personal Data, the legal justification for processing such information, your rights and how to contact the Secretariat when you have queries or concerns regarding the processing of your Personal Data.
1.4. This Privacy Notice is freely accessible on the SADC Secretariat’s website, as a link in the footer of emails, in agreements, contracts, forms, printed media, adverts, financial promotions and digital products and services.
2. CONTACT DETAILS
2.1. Contact information for your communication with the Secretariat are as follows:
2.2. Southern African Development Community (SADC) Secretariat
a. Physical address Plot No. 54385
Central Business District Private Bag 0095 Gaborone, Botswana
b. Telephone Number +267 395 1863
c. Fax Number +267 397 2848 +267 318 1070
d. SADC Website https://www.sadc.int/
2.3. Attention:
Data Protection Officer
Name: Dr Phineas Matto
+267 364 1759 or +267 395 1863
Phone Number: ______________
Email: dataprotection@sadc.int
Deputy Data Protection Officer Name: Mr Mandla Ngcobo
Phone Number: _______________
2.4. How to submit complaints and concerns +267 395 1863
If you have any concerns or complaint regarding this Privacy Notice or how the Secretariat processes your Personal Data, you can submit your complaint or question to the SADC Secretariat’s Data Protection Officer.
You can contact the Data Protection Officer through email, telephone, fax, or post. The contact details of the Data Protection Officer are provided in 2.2 and 2.3 above.
3. TYPES OF PERSONAL DATA PROCESSED BY THE SADC SECRETARIAT
3.1. The Secretariat, during the implementation of its activities, collects and processes different types of Personal Data depending on your relationship with it. Examples of Data Subjects whose Personal Data the Secretariat processes include, inter alia, the following:
a. SADC Secretariat’s employees, their spouses and dependants;
b.Service providers, including consultants;
c. Contractors, including suppliers;
d. Donors or their beneficiaries;
e. SADC website users;
f. Job applicants;
g. Grants applicants;
h. Participants to SADC initiatives; and
i. Other Secretariat’s stakeholders.
3.2. The Secretariat may process, inter alia, the following types of Personal Data:
a. Names
b. Passport numbers
c. Identification numbers
d. Email addresses
e. Internet Protocol (IP) addresses
f. Postal or physical addresses
g. Phone numbers
h. Fax numbers
i. Employee information together with those of their spouses and dependants
j. Medical aid information
k. Dietary preferences likely linked to religious beliefs
l. Bank account numbers
m. Tax registration numbers
n. Biographical information
o. Gender information
4. HOW THE SECRETARIAT COLLECTS YOUR PERSONAL DATA
4.1. In most cases, the Secretariat processes Personal Data directly provided to it by you. The Secretariat collects your Personal Data, inter alia, when:
a. you apply for a job at the Secretariat;
b. you submit bid documents in response to a tender advertised or communicated by the
Secretariat;
c. Secretariat’s employee has listed you as his/her next of kin or emergency contact;
d. Secretariat’s employee has listed you as a spouse or beneficiary, for purposes of
facilitating his/her and/or your entitlements in terms of the SADC Policies;
e. you have made a complaint or an enquiry to the Secretariat;
f. you have requested certain information from the Secretariat;
g. you have provided your Personal Data for purposes of attending an event organised by the SADC Secretariat;
h. other sources have provided your Personal Data to the Secretariat, including in the following situations:
(i) The Secretariat has been given your details as an emergency contact or referee of its employee.
(ii) public authorities, regulators, or law enforcement bodies have provided your information to the Secretariat.
5. WHAT THE SADC SECRETARIAT DOES WITH YOUR PERSONAL DATA
5.1. The Secretariat processes your Personal Data for, inter alia, the following reasons:
a. for recruitment of new employees, contractors, including suppliers, or service providers, including consultants;
b. for procurement of services;
c. to comply with requirements of the law;
d. to establish, exercise or defend legal claims;
e. to process grants applications;
f. for auditing purposes;
g. to administer Secretariat’s websites;
h. to respond to any of your communications or queries; and
i. in responding to any regulatory requirements.
6. THE BASIS FOR PROCESSING YOUR PERSONAL DATA
6.1. Before processing your Personal Data, the Secretariat makes sure that it has a lawful justification to do so. The Secretariat may process your Personal Data under circumstances where:
a. you have provided the SADC Secretariat with your express consent to process your Personal Data for a specific purpose (s). For example, you may have given the SADC Secretariat consent to collect your Personal Data in respect of a certain program the Secretariat may be rolling out. Please take note that you can withdraw your consent at any time. However, this may lead to your Personal Data not to be processed for the intended purpose thus limiting your involvement in the program in question;
b. your Personal Data is availed for purposes of execution and/or performance of a contract between the Secretariat and yourself. For example, the Secretariat may process your Personal Data because you have a consultancy or employment contract with the SADC Secretariat;
c. the Secretariat is required by law to process your Personal Data. For example, the Secretariat may process your Personal Data to comply with tax laws or any other applicable regulatory requirements;
d. the Secretariat is to cooperate in investigation required in terms of national laws against crimes or breach of SADC Policies and Regulations, including on matters related to corruption and money laundering;
e. the Secretariat needs to protect your vital interests or vital interests of another person; and/or
f. the Secretariat needs to perform a public interest task or exercise an official authority vested on it. For example, to comply with public health regulations relating to Covid-19.
6.2. When the Secretariat processes your Personal Data, it will indicate to you if providing such information is mandatory and the possible consequences of failure to provide such information. For example, a law may require the Secretariat to collect certain Personal Data from you prior to the Secretariat providing you with assistance. If you do not provide the required Personal Data, there may be consequences of you not receiving a service, a benefit or assistance from the Secretariat.
7. DOES SADC SECRETARIAT PROCESS SENSITIVE DATA?
7.1. Sensitive Personal Data includes Personal Data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, genetic data, biometric data, health data and data concerning a person’s sex life or sexual orientation.
7.2. The Secretariat only processes Sensitive Personal Data in very limited circumstances, including the following:
a. where you have given the Secretariat your explicit consent to process your sensitive Personal Data for a specific purpose (s);
b. for Human Resources and Administration purposes, for example, about the Secretariat’s employees as far as necessary to fulfil duties as an employer;
c. where necessary to protect your vital interests or the vital interests of another natural person where you are not able to provide consent;
d. where necessary for the establishment, pursuing, or defence of legal claims;
e. where necessary for reasons of public interest in public health, such as protecting against serious cross border health threats or ensuring high standards quality and safety health care; or
f. processing Personal Data relating to criminal convictions and sentences if authorised by law.
8. WHO DOES THE SADC SECRETARIAT SHARE YOUR PERSONAL DATA WITH?
8.1. The Secretariat may share your Personal Data with third parties (“Data Processors”) for purposes of receiving a particular service. For example:
a. your Personal Data may be processed by a service provider when it hosts Secretariat’s email services and video conferencing recordings on its servers;
b. your bank account details may be shared with a payroll service provider for purposes of administering Secretariat’s payroll; and
c. your bank details as contractors, service providers, grant beneficiaries and employee’s beneficiaries may be shared with commercial banks for purposes of payments due from the Secretariat.
8.2. The SADC Secretariat may vet contractors and service providers and, in the process, share your Personal Data to check against fraud and ensure sound privacy and security practices and policies are complied with. In the process, the Secretariat makes sure that its service providers comply with the SADC Protection of Personal Data Policy of 2022.
8.3. The Secretariat makes sure that Data Processors do not further process your Personal Data without the former’s written authorisation.
8.4. Where the Secretariat intends to further process your Personal Data for a purpose other than that for which the Personal Data were collected, the Secretariat shall provide you with information regarding the purpose for further processing.
9. DOES THE SADC SECRETARIAT TRANSFER YOUR PERSONAL DATA TO A THIRD- PARTY COUNTRY OR INTERNATIONAL ORGANISATION?
9.1. The SADC Secretariat will only transfer your Personal Data to a third-party country or an international organisation under any one of the following conditions:
a. the Secretariat has explained to you of the possible risks of such transfer, and you have provided it with your explicit consent;
b. the transfer is necessary for the performance or conclusion of a contract between the Secretariat and yourself;
c. the transfer is necessary for public interest reasons;
d. the transfer is necessary for the establishment, pursuing or defence of legal claims; and
e. the transfer is necessary to protect your vital interests and it is not possible to get your
consent.
10. DOES THE SECRETARIAT EMPLOY THE USE OF AUTOMATED DECION MAKING PROCESSES?
The Secretariat does not employ the use of automated decision-making processes, including profiling when processing Personal Data.
11. HOW THE SADC SECRETARIAT STORES YOUR PERSONAL DATA
11.1. The Secretariat considers your Personal Data as a very important asset. It has put in place adequate organisational and technical measures to prevent any unauthorised access, disclosure, or misuse of your Personal Data. For example, the Secretariat has classified your Personal Data as confidential information and implement access control mechanisms.
11.2. While the Secretariat adopts all reasonable security measures to protect your Personal Data, it is acknowledged that it cannot guarantee absolute security of your Personal Data.
12. FOR HOW LONG DOES SADC SECRETARIAT KEEP YOUR PERSONAL DATA?
12.1. The Secretariat keeps your Personal Data for purposes of achieving the purpose of collection. Once the purpose has been achieved, the Secretariat deletes the Personal Data.
12.2. The Secretariat has put in place a detailed Data Retention Schedule which clearly sets out the time periods for retention of records of your Personal Data. Should you be interested in knowing the specific time frames applicable to you, please contact the Data Protection Officer (see section 2.3.).
13. WHAT RIGHTS DO YOU HAVE?
13.1. Right of access
a. You have the right to access information regarding the Personal Data about you that the Secretariat processes. You may request for access to a record of Personal Data by contacting the Data Protection Officer.
b. You may exercise this right by filling and submitting the Data Subject Access Request Form. A copy of the Form may be obtained from the Data Protection Officer.
13.2. Right to rectification of your Personal Data subject to SADC Policies and Regulations
a. you may ask the Secretariat to rectify information about you, which you think is inaccurate or incomplete.
b. if information about you is incomplete, you may also ask the SADC Secretariat to complete the information.
c. You may ask this by addressing the request at the email address indicated in section 2.3 to the attention of the Data Protection Officer.
13.3. Right to have your Personal Data erased
a. You have a right to have your Personal Data deleted once the purpose for processing it has been achieved.
b. In certain instances, you can exercise your right to ask the SADC Secretariat to delete your Personal Data. You may request the deletion of your Personal Data under the following circumstances:
i. the Personal Data are no longer necessary in relation to the purposes for which the Secretariat collected it;
ii. you have withdrawn your consent to the Personal Data being processed by the Secretariat;
iii. there are no other overriding legitimate grounds for the processing of your Personal Data by the Secretariat; or
iv. your Personal Data has been unlawfully processed.
c. You may submit this request at the email address indicated in section 2.3 to the attention
of the Data Protection Officer.
13.4. Right to have the processing of your Personal Data restricted
You have a right to request the Secretariat to restrict the way it processes your Personal Data, under any of the following instances:
a. where you are contesting the accuracy of the Personal Data;
b. the processing of the Personal Data is unlawful, but you do not want the information
deleted;
c. you want the Secretariat to keep the Personal Data for the establishment, pursuing, or
defence of legal claims; or
d. you have objected to the processing pending the verification whether Secretariat’s
legitimate grounds override your rights.
e. You may submit this request at the email address indicated in section 2.3 to the attention
of the Data Protection Officer.
13.5. Right to data portability
a. When you have supplied the Secretariat with Personal Data, you have the right to ask that the information you gave to the Secretariat be transferred to another organisation or Data Controller.
b. You have a right to receive your Personal Data in a format that is easy to read.
c. You may submit this request at the email address indicated in section 2.3 to the attention
of the Data Protection Officer.
13.6. Right to withdraw consent
a. You have a right to withdraw consent to the processing of your Personal Data. Once the Secretariat receives your notice of withdrawal, it shall immediately, as far as practicable, stop processing your Personal Data provided that the lawfulness of the processing of your Personal Data before such withdrawal will not be affected.
b. You may submit this request at the email address indicated in section 2.3 to the attention of the Data Protection Officer.
13.7. Right to lodge a complaint
You have a right to submit a complaint in writing to the attention of the SADC Executive Secretary at the email address indicated in section 2.3. when you are of the opinion that the Secretariat is processing your Personal Data not in compliance with the SADC Protection of Personal Data Policy of 2022.
13.8. Right to object to processing
You have the right to object to how the SADC Secretariat processes your Personal Data. You can object to the processing of your Personal Data at any time. The Secretariat may accept your objection also considering its legitimate interests and public interests versus your rights in terms of the SADC Protection of Personal Data Policy of 2022 and this Privacy Notice.
14. UPDATES OR CHANGES TO THIS PRIVACY NOTICE
14.1. This Privacy Notice is grounded on the SADC Protection of Personal Data Policy of 2022 currently in force together with its related amendments. As SADC is highly committed in safeguarding and protecting Personal Data, SADC is constantly reviewing and updating its policies to be compliant with the privacy regulations and to respect the highest standards in terms of processing and protecting Personal Data.
14.2. This Privacy Notice may vary and be updated. Modifications related to this Privacy Notice will be duly and widely announced on the SADC website and related information links. Restrictive measures to your rights as recognised in this Privacy Notice will never be applied without your prior explicit consent.
Mr. Elias M. Magosi
Executive Secretary
Date: 26/09/2022 SEPTEMBER 2022
Download SADC Policy Notice here.
