Grrrabit Pty Ltd is registered as Grrrabit Limited.
Grrrabit takes data protection, and our responsibility to correctly and lawfully treat personal data as a data controller seriously. We are committed to complying with legal obligations and practice industry standards when collecting, processing and storing personal data.
This policy is intended to provide information about how our company will use (or "process") personal data about individuals including its staff; its current, past and prospective clients; and other business associates, including partners and suppliers.
This information is provided because Data Protection Law (in South Africa, the Protection of Personal Information Act [called the POPI Act or POPIA]) gives individuals rights to understand how their data is used. Our staff and clients (existing and prospective) are all encouraged to read this Privacy Notice and understand our company’s obligations to its entire community.
This Privacy Notice applies alongside any other information our company may provide about a particular use of personal data, for example when collecting data via an online or paper form.
This Privacy Notice also applies in addition to the company’s other relevant terms and conditions and policies, including:
Anyone who works for, or acts on behalf of, the company (including staff, volunteers, interns, contractors and service providers) should also be aware of and comply with this Privacy Notice, which also provides further information about how personal data about those individuals will be used.
The Company has appointed a Data and Compliance Officer who will deal with all your requests and enquiries concerning the company’s uses of your personal data (see section on Your Rights below) and endeavour to ensure that all personal data is processed in compliance with this policy and Data Protection Law.
To carry out its ordinary duties to staff and clients, the company needs to process a wide range of personal data about individuals (including current, past and prospective clients, contractors and staff members) as part of its daily operation.
Some of this activity the company will need to carry out to fulfill its legal rights, duties or obligations – including those under a contract with its staff, clients and contractors.
Other uses of personal data will be made in accordance with the company’s legitimate interests, or the legitimate interests of another, provided that these are not outweighed by the impact on individuals and provided it does not involve special or sensitive types of data.
This will include by way of example:
Generally, the company receives personal data from the individual directly; this may be via a form, or in the ordinary course of interaction or communication (such as email or written assessments).
However, in some cases, personal data will be supplied by third parties (for example another company, or other professionals or authorities working with that individual).
Occasionally, the company will need to share personal information relating to its community with third parties, such as:
For the most part, personal data collected by the company will remain within the company and will be processed by appropriate individuals only in accordance with access protocols (i.e. on a ‘need to know’ basis). Particularly strict rules of access apply in the context of:
Finally, in accordance with Data Protection Law, some of the company’s processing activity is carried out on its behalf by third parties, such as IT systems, web developers or cloud storage providers. This is always subject to contractual assurances that personal data will be kept securely and only in accordance with the company’s specific directions.
The company will retain personal data securely and only in line with how long it is necessary to keep for a legitimate and lawful reason. Typically, the legal recommendation for how long to keep ordinary staff and personnel files is up to 7 years following departure from the company. However, incident reports and safeguarding files will need to be kept much longer, in accordance with specific legal requirements.
A limited and reasonable amount of information will be kept for archiving purposes, for example; and even where you have requested we no longer keep in touch with you, we will need to keep a record of the fact to fulfill your wishes (called a "suppression record").
The company will use the contact details of staff, clients and other members of the company community to keep them updated about the activities of the company, or events of interest, including by sending updates and newsletters, by email and by post. Unless the relevant individual objects, the company may also:
Individuals have various rights under Data Protection Law to access and understand personal data about them held by the company, and in some cases ask for it to be erased or amended or have it transferred to others, or for the company to stop processing it – subject to specific exemptions and limitations.
Any individual wishing to access or amend their personal data or wishing it to be transferred to another person or organisation, or who has some other objection to how their personal data is used, should put their request in writing to the Data and Compliance Officer.
The company will endeavour to respond to any such written requests as soon as is reasonably practicable and in any event within statutory time- imits (which is one month in the case of requests for access to information).
The company will be better able to respond quickly to smaller, targeted requests for information. If the request for information is manifestly excessive or similar to previous requests, the company may ask you to reconsider or require a proportionate fee (but only where Data Protection Law allows it).
Where the company is relying on consent as a means to process personal data, any person may withdraw this consent at any time (subject to similar age considerations as above). Examples, where we do rely on consent, are certain types of uses of images and certain types of fundraising activity. Please be aware however that the company may not be relying on consent but has another lawful reason to process the personal data in question even without your consent. That reason will usually have been asserted under this Privacy Notice or may otherwise exist under some form of contract or agreement with the individual (e.g. an employment contract, or because a purchase of goods, services or membership of an organisations).
The rights under Data Protection Law belong to the individual to whom the data relates.
The company will endeavour to ensure that all personal data held about an individual is as up to date and accurate as possible. Individuals must please notify the Data and Compliance Officer of any significant changes to relevant information, such as contact details, held about them.
An individual has the right to request that any out-of-date, irrelevant or inaccurate or information about them is erased or corrected (subject to certain exemptions and limitations under Data Protection Law): please see above for details of why the company may need to process your data, of who you may contact if you disagree.
The company will take appropriate technical and organisational steps to ensure the security of personal data about individuals, including policies around use of technology and devices, and access to company systems. All staff and governors will be made aware of this policy and their duties under Data Protection Law and receive relevant training.
The company will update this Privacy Notice from time to time. Any substantial changes that affect your rights will be provided to you directly as far as is reasonably practicable.
Any comments or queries on this policy should be directed to the Data and Compliance Officer, Mari Bassoli at firstname.lastname@example.org.
If an individual believes that the company has not complied with this policy or acted otherwise than in accordance with Data Protection Law, they should utilise the company Complaints Procedure by getting in touch with us and lodging a complaint.