Privacy & Personal Information

Who the policy applies to

“CEG Group” is a descriptive collective term used for the affiliated companies identified in the Consolidated Privacy Policy. It is not a separate registered company or juristic person.

Each CEG Group entity remains a separate legal entity and is individually responsible, as the responsible party under the Protection of Personal Information Act 4 of 2013 (“POPIA”), for personal information collected or processed by that entity.

The full list of entities and their respective Information Officers is contained in the downloadable Privacy Policy.

Personal information we process

Depending on the relevant CEG Group entity and the service being provided, personal information may include identification and contact information, financial and tax information, employment information, corporate and beneficial-ownership information, FICA and verification records, correspondence and other information required to provide professional services or comply with applicable law.

Where relevant and lawfully permitted, certain CEG Group entities may also process special personal information.

Personal information may be collected directly from a data subject, through correspondence or forms, in the course of providing services, or from other lawful sources where permitted.

Why we process personal information

Personal information is processed only where there is a lawful basis to do so and for purposes connected with the activities of the relevant CEG Group entity.

These purposes may include providing professional services, performing contractual obligations, complying with legal and regulatory requirements, conducting client and counterparty verification, maintaining client and business records, administering complaints, audit and compliance functions, and communicating with clients and other stakeholders.

Marketing or direct marketing is undertaken only where permitted by POPIA and other applicable requirements, including applicable consent and objection rights.

Sharing and service providers

Personal information may be shared where necessary with other CEG Group entities, financial institutions, product or professional-service providers, auditors, compliance providers, information-technology providers, regulators, government authorities, law-enforcement bodies and other parties where the disclosure is lawful and relevant to the purpose for which the information is processed.

Where third parties process personal information on behalf of a CEG Group entity, appropriate contractual and security arrangements are applied where required by POPIA.

Cross-border transfers

Some services or business activities may require personal information to be processed or transferred outside South Africa.

Any cross-border transfer is undertaken in accordance with section 72 of POPIA, including where the recipient is subject to appropriate legal or contractual protection, the data subject has consented where applicable, or another statutory basis for the transfer applies.

Information security

CEG Group entities implement appropriate technical and organisational measures designed to protect personal information against loss, unauthorised access, interference, modification, disclosure or destruction.

Where there are reasonable grounds to believe that personal information has been accessed or acquired by an unauthorised person, the relevant responsible party will make the notifications required by POPIA, including notification to the Information Regulator and affected data subjects where applicable.

Retention and disposal

Personal information is retained only for as long as required for the purpose for which it was collected, or for longer where required by legislation, regulation, contractual obligations, dispute requirements or legitimate legal interests.

When information may lawfully be disposed of, it is deleted, destroyed or de-identified using appropriate measures.

Website analytics, advertising and cookies

This website may use cookies and similar technologies for its operation and, where enabled, for analytics and advertising measurement.

CEG intends to use Google Analytics and Google Ads to understand website usage and measure advertising performance. Where these services are enabled, their use will be controlled through the website’s cookie preferences where required.

Information processed through these services may include website usage information, device and browser information, approximate location, referral or campaign information and other technical information associated with visits to the website.

Further information is available in our Cookie Policy.

Your rights

Subject to POPIA and other applicable law, data subjects may:

• request confirmation of whether a CEG Group entity holds personal information about them;
• request access to that information;
• request correction, destruction or deletion where the statutory requirements are met;
• object to processing on the grounds provided by POPIA;
• object to direct marketing;
• withdraw consent where processing is based on consent;
• exercise applicable rights relating to automated decision-making; and
• lodge a complaint regarding the processing of their personal information.

Requests to object to processing or to correct or delete personal information may be made free of charge in accordance with the current POPIA Regulations.

Information Officer

Requests relating to personal information should be directed to the Information Officer of the CEG Group entity responsible for the information concerned.

The Consolidated Privacy Policy contains the Information Officer details for each group entity.

Information Regulator

A data subject who believes that their rights under POPIA have been infringed may lodge a complaint with the Information Regulator of South Africa.

POPIA complaints

POPIAComplaints@inforegulator.org.za

General enquiries

enquiries@inforegulator.org.za

Telephone

010 023 5200

Website

inforegulator.org.za ↗