About this notice
This notice is published in terms of the Protection of Personal Information Act 4 of 2013 (“POPIA”). It accompanies, and should be read with, ourprivacy policy and theStudio Collezioni privacy policy. Where the privacy policy explains in plain terms what we do with your information, this notice sets out the statutory detail: our lawful bases, the conditions for lawful processing we apply, the prescribed forms, and the remedies open to you.
It also serves as the notification contemplated in section 18 of POPIA, which requires us to tell you what we collect, why, from where, whether supplying it is voluntary, and what rights you hold.
Responsible party and Information Officer
Made in Africa Investments (Pty) Ltd is the responsible party for the personal information described in this notice — that is, the party that determines why and how it is processed.
Made in Africa Investments (Pty) Ltd
Registration number: 2016/387423/07
Unit S3 Executive City
cnr Cross Street & Charmaine Avenue
President Ridge, Randburg, 2194
Republic of South Africa
info@miagroup.africa
076 12 97 140
The address above is both our registered office and our postal address.
Our Information Officer, who is responsible for POPIA and PAIA compliance and is registered with the Information Regulator as section 55 of POPIA requires, is:
Valentina Cortini
Director, Made in Africa Investments (Pty) Ltd
info@miagroup.africa
Address every request, objection or complaint under this notice to the Information Officer. We may ask you to verify your identity before we act on it, so that we do not disclose someone else’s information to the wrong person.
The eight conditions we apply
Section 4 of POPIA sets eight conditions for the lawful processing of personal information. We apply them as follows:
- Accountability (s 8). Our Information Officer is answerable for the measures described in this notice and for keeping them current.
- Processing limitation (ss 9–12). We process only what is adequate, relevant and not excessive for the purpose, on one of the lawful bases listed below, and we collect it directly from you wherever practicable.
- Purpose specification (ss 13–14). We collect for the specific, explicitly defined purposes set out below, and we do not keep records longer than those purposes require.
- Further processing limitation (s 15). We use your information again only for a purpose compatible with the one it was collected for.
- Information quality (s 16). We take reasonably practicable steps to keep your information complete, accurate and up to date, and we would rather you correct us than that we act on something stale.
- Openness (ss 17–18). We document our processing, we maintain a PAIA manual, and we publish this notice and our privacy policy.
- Security safeguards (ss 19–22). We secure our records, bind our operators in writing, and report security compromises as described below.
- Data subject participation (ss 23–25). You may ask what we hold, and have it corrected or deleted, by the routes set out below.
What we process, why, and on what basis
Section 11 of POPIA permits processing only where it is justified. The table below sets out each category of personal information we hold through this website, the purpose, the justification we rely on, and how long we keep it.
| Information | Purpose | Lawful basis (s 11) | Retention |
|---|---|---|---|
| Name, email address, telephone number and the contents of your enquiry | To answer you and to carry out any work that follows | Your consent in submitting the form, and our legitimate interest in responding to enquiries (s 11(1)(a) and (f)) | For the duration of our dealings with you, then as long as a contractual or statutory record is required |
| Project details and requirements you choose to share | To scope, quote for and deliver our services | Performance of, or steps towards, a contract with you (s 11(1)(b)) | For the life of the engagement, then as prescribed by law |
| Server data recorded by our hosting provider, including IP address, browser type and pages requested | To serve the site, diagnose faults and keep it secure | Our legitimate interest in operating and securing the site (s 11(1)(f)) | For the short period our provider retains its logs |
| IP address and browser or device signals passed to the anti-spam check on our enquiry form | To tell a person apart from automated software, so that the form is not abused | Our legitimate interest in preventing automated abuse (s 11(1)(f)) | Momentary — the verification token expires shortly after it is issued |
| Your cookie preference, where a consent banner is shown | So that we need not ask again on each visit | Your consent (s 11(1)(a)) | Until you change it, or the stored preference expires |
Supplying your information is voluntary. You are under no legal obligation to complete our enquiry form — but if you leave out your name, email address or your message, we cannot answer you. You are equally welcome to email or telephone us instead.
We do not ask for identity numbers, banking details or payment card data through this website.
Special personal information and children
We do not seek special personal information as section 26 of POPIA defines it — religious or philosophical beliefs, race or ethnic origin, trade union membership, political persuasion, health or sex life, biometric information, or criminal behaviour. Please do not include any of it in an enquiry; where it reaches us unsolicited we delete it unless the law requires otherwise.
Our services are directed at adults. We do not knowingly process the personal information of a child as contemplated in section 34, and we have no prior authorisation from the Regulator to do so. If you believe a child has sent us information, tell our Information Officer and we will delete it.
Direct marketing
Section 69 of POPIA restricts unsolicited electronic marketing. We send marketing messages only to people who are our customers, or who have asked us to — and in either case every message carries a means of opting out, which we act on without charge or justification.
If you are not a customer and we have not approached you before, the Act allows us to ask for your consent once, using the prescribed Form 4 under the POPIA Regulations. You may refuse, and we will not ask a second time. You may withdraw consent at any time by writing to our Information Officer.
Operators and cross-border transfers
An operator processes personal information on our behalf and under our instruction. Sections 20 and 21 of POPIA require that each is bound by a written agreement to maintain confidentiality and appropriate security, and to notify us of any compromise. Ours fall into these categories:
- Our website hosting and form-delivery provider, which receives enquiry submissions
- Our email provider, which delivers and stores our correspondence
- The provider of the anti-spam verification on our enquiry form
- Content delivery networks that serve fonts, icons and images to your browser
- Professional advisors, and public authorities where disclosure is legally required
Several of these operate outside the Republic, so your information may be transferred across borders. Section 72 permits this where the recipient is subject to a law, binding corporate rules or a binding agreement that upholds principles substantially similar to POPIA’s conditions, where the transfer is necessary to perform a contract with you or in your interest, or where you consent. We satisfy ourselves on one of those grounds before a transfer takes place, and we do not sell, rent or trade your information to anyone.
Security safeguards and security compromises
Section 19 requires appropriate, reasonable technical and organisational measures. We serve this site over an encrypted connection, restrict access to enquiry records to the people who need them, keep our software current, and review these measures as our processing changes. No transmission over the internet is completely secure, so we cannot promise absolute security.
Where there are reasonable grounds to believe your personal information has been accessed or acquired by an unauthorised person, section 22 obliges us to notify the Information Regulator and you as soon as reasonably possible after discovering it. Our notification will describe the possible consequences, the measures we intend to take or have taken, what you can do to mitigate the harm, and — if we know — the identity of the unauthorised person.
Automated decision-making
Section 71 protects you from decisions with legal consequences for you based solely on automated processing intended to profile you. We make no such decisions. The automated check on our enquiry form decides only whether a submission appears to come from a person or from a machine; if it stops a genuine message, simply email or telephone us instead and a person will deal with you.
Your rights as a data subject
Section 5 of POPIA gives you the right to:
- Be notified that we are collecting your information, or that it has been accessed by an unauthorised person (ss 18 and 22)
- Ask whether we hold information about you, and to request a record or a description of it, together with the identity of any third party who has had access (s 23)
- Request correction, deletion or destruction of information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or obtained unlawfully (s 24)
- Object to processing, on reasonable grounds relating to your particular situation, where we rely on legitimate interests (s 11(3)(a))
- Withdraw consent at any time, where our processing rests on it — which does not affect processing already carried out (s 11(2)(b))
- Object to direct marketing by unsolicited electronic communication (s 69)
- Not be subject to a decision based solely on automated processing (s 71)
- Complain to the Information Regulator, and to institute civil proceedings (ss 74 and 99)
Exercising these rights costs you nothing, except that a prescribed fee may apply to an access request under PAIA, as explained below.
How to exercise them
Write to our Information Officer atinfo@miagroup.africa. A plain email is enough to start, and we will tell you if a prescribed form is needed. The forms below are published by the Information Regulator atinforegulator.org.za.
| If you want to… | Use | Send it to |
|---|---|---|
| See what we hold about you | Form 2 of the PAIA Regulations — request for access to a record of a private body | Our Information Officer |
| Object to our processing | Form 1 of the POPIA Regulations — objection to the processing of personal information | Our Information Officer |
| Have information corrected or deleted | Form 2 of the POPIA Regulations — request for correction or deletion | Our Information Officer |
| Complain about how we handled your information | Form 5 of the POPIA Regulations — complaint in terms of section 74 | The Information Regulator |
| Ask the Regulator to assess our compliance | Form 11 — request for an assessment in terms of section 89 | The Information Regulator |
How we respond. We acknowledge requests promptly and deal with access requests within the thirty days PAIA allows, which may be extended by a further thirty days where the request is complex or voluminous — we will tell you if that happens, and why. Where we refuse a request, we will give you reasons and tell you how to take it further. Where we correct or delete information that we have already passed to a third party, we will notify that party where it is reasonably practicable to do so.
Access to records and our PAIA manual
The Promotion of Access to Information Act 2 of 2000 (“PAIA”) governs requests for access to records held by a private body. Our manual in terms of section 51 of PAIA describes the records we hold and how to request them, and is available free of charge from our Information Officer on request.
A prescribed request fee and access fee may apply to a PAIA request, except where you are asking for your own personal information — a request for the record of your own personal information carries no request fee. We will tell you in advance what, if anything, is payable.
Complaints
Please raise your concern with our Information Officer first. We would rather put something right ourselves, and the Regulator in any event expects a private body to have had the opportunity to respond before it investigates.
If you remain dissatisfied, you may complain to the Information Regulator. Your complaint must be in writing, on Form 5, and may be lodged through the Regulator’s online complaint facility.
Information Regulator (South Africa)
Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191
Telephone: 010 023 5200 · Toll-free: 0800 017 160
POPIA complaints:POPIAComplaints@inforegulator.org.za
PAIA complaints:PAIAComplaints@inforegulator.org.za
General enquiries:enquiries@inforegulator.org.za
inforegulator.org.za
Nothing in this notice limits your right to institute civil proceedings under section 99 of POPIA, whether or not you first complain to the Regulator.
Changes to this notice
We will update this notice as our processing or the law changes. The date at the top always reflects the current version, and material changes will be signposted on the site.