Note: Please visit the Vodacom Privacy Policy on https://www.vodacom.co.za/vodacom/privacy-policy/terms?icmp=Home/Footer/PrivacyPolicy#ae486950-tabs-vertical--item-wrapper-763180282-763180282 for more detailed information on how Vodacom processes Personal Information of Data Subjects.

5.1 Purpose of Processing Personal Information of Data Subjects by Vodacom

Vodacom will process Personal Information of Data Subjects based on:

• The performance of contract with the Data Subject or to enter into the contract and to take action on their requests. For example, to make calls and texts, and browse the internet on their phone, Vodacom process things like the numbers dialled, how much data was used and how it is used so that it can provide connectivity. This also enables Vodacom to generate Data Subject’s bills, based on their usage. Vodacom also needs to conduct credit checks when the Data Subjects apply for a product or service.
• Vodacom's legitimate business interests, for example, fraud prevention, prevention of tax evasion and financial crime, maintaining the security of its network and services, direct marketing, and the improvement of services.
• Protecting Data Subject’s legitimate interests - for example, providing notifications regarding network availability and performance in their area, notification of emergency services, and fraud prevention.
• Compliance with a mandatory legal obligation, including for example, accounting and tax requirements, which are subject to strict internal policies, procedures, and Data Subject’s right to restrict usage of their Personal Information, which control the scope of legal assistance to be provided. Vodacom is also required to process Personal Information pursuant to legislation including but not limited to the Financial Intelligence Centre Act, 38 of 2001 (FICA), the Regulation of Interception of Communications and Provisions of Communication-related Information Act 70 of 2002 (RICA), the Electronic Communications and Transactions Act, 2002 (ECTA), the Electronic Communications Act, 2005 (ECA), the Consumer Protection Act, 2008 (CPA), the Promotion of Access to Information Act, 2000 (PAIA), and the Cybercrimes Act, 2020.
• Data Subject consent where Vodacom does not rely on another legal basis (referred to above). Consent may be withdrawn at any time. When Data Subject give their consent, they will be given details on how to change their mind.

The purpose for which Personal Information is processed by Vodacom will depend on the nature of the services or products being provided to the Data Subjects. Below are some purposes for Processing Personal Information:

• to provide Data Subjects with product and services;
• to bill Data Subjects for using Vodacom’s products and services, or to take the appropriate amount of credit;
• contact Data Subjects if the billing information they provided with is about to expire or Vodacom is not able to take payment;
• to respond to any questions or concerns about its network, products or services;
• to provide roaming services;
• for employment purposes;
• managing third party relationships;
• managing its networks and understanding network usage;
• marketing and tailoring service to Data Subjects;
• to contact Data Subjects with customer service messages to keep them updated with current information about products and services they have taken. For example, changes to our terms and conditions or service interruptions;
• to deliver advertising to Data Subjects;
• credit checks, fraud prevention and security;
• to manage visits by different stakeholders to any Vodacom premises;
• for research and analytics.

5.2 Categories of Data Subjects and their Personal Information

Vodacom holds information and records relating to the following Data Subjects. Please note that this list is non-exhaustive:

a) employees /personnel of Vodacom;

b) clients/customers of Vodacom;

c) any third party and/or supplier with whom Vodacom conducts its business;

d) contractors of Vodacom;

e) partners and agents;

f) service providers of Vodacom;

(g) Requesters in terms of PAIA and POPIA.

The categories of Personal Information that Vodacom processes of the Data Subjects defined below includes the following:

• Full names, address, phone and/or mobile number, date of birth, gender, information about their property or household, and email address.
• Credit or debit card information - information about bank account and other banking information. For example, when a Data Subject opens an account with Vodacom or process a payment whenever they make a purchase.
• Traffic data - this is data Vodacom see as part of providing Data Subjects with connectivity, like the numbers they call, the time and duration of the call or how data is used.
• Location data - this can be precise where it uses Global Positioning System (GPS) data or by identifying nearby mobile phone and Wi-Fi hotspots and the Data Subject enables location-based services or features. It can also be less precise where, for example, a location is derived from Data Subject’s IP address or data such as a post code or name of a town or city.
• Correspondence - such as a note or recording of a call Data Subjects make to one of its contact centres, a Live Chat, an email or letter sent, or other records of any contact with Vodacom.
• Account information - such as dates of payment owed or received, subscriptions, account numbers or other information related to an account or included in My Vodacom.
• Credential information – Vodacom collects passwords, hints and similar security information used for authentication and access to accounts and services.
• Preferences for particular products, services and lifestyle activities
• Data sessions - to enable connection to be made and for billing purposes, fraud investigations, network and store planning, campaign planning, marketing specific products such as URL bundles, identify visits to competitor websites, and personalisation of services.
• Photographs and images - when attending any of Vodacom’s events or functions or accessing premises with surveillance cameras.
• Information obtained from other sources, such as credit agencies, fraud-prevention agencies, and from other data providers. This includes demographic data and interest-based data.

5.3 The recipients or categories of recipients to whom the Personal Information may be supplied by Vodacom

Vodacom may supply information or records of information to the following categories of recipients:

a) its employees as part of executing its business functions;

b) statutory oversight bodies, regulators (such as the Information Regulator), law enforcement agencies or judicial commissions of enquiry making a request for information;

c) any court, administrative or judicial forum, arbitration, statutory commission, or ombudsman making a request for data or discovery in terms of the applicable rules;

d) South African Revenue Services, or another similar authority;

e) emergency Service Organisation (if the Data Subject make an emergency call), including their approximate location;

f) anyone making a successful application for access in terms of PAIA, to the extent that such access is permitted in terms of PAIA, as amended by POPIA.;

g) subject to the provisions of POPIA and the National Credit Act No. 34 of 2005, Vodacom may share information about a client’s creditworthiness with any credit bureau or credit providers;

h) debt collection agencies or other debt-recovery organisations;

i) any third party and/or supplier with whom Vodacom conducts its business;

j) contractors of Vodacom;

k) partners and agents;

l) service providers of Vodacom;

m) third-parties that we use to provide you with marketing and advertisements; and

n) companies in the Vodacom and Vodafone Group.

o) verification agencies for employment purposes

5.4 Planned trans-border flows of Personal Information 

Vodacom does transfer Personal Information of Data Subjects across the borders, including but not limited to countries in the European Union,  United States of America, United Kingdom, India, Australia and to the Vodafone and Vodacom group companies and/or authorised third parties beyond the borders of the countries to achieve a defined purpose. The defined purposes include the i) achievement of its business functions, ii) provision of products and services that the customer has requested,  iii) hosting or storage of some of its systems and infrastructure, iv) data warehousing activities and for the v) provision of centralised business activities within the Vodafone and Vodacom group of companies such as where we share technology and resources.

Vodacom will only engage in the cross-border transfer of information if one of the following conditions are met and the transfer has been assessed and approved by the Deputy Information Officer:

• The recipient is subject to existing legislation in his /her/it’s country, a binding corporate or binding agreement that provides an adequate level of protection for the personal information that is substantially similar to the data protection laws applicable to South Africa;
• The Data Subject has consented to such cross-border transfer;
• The transfer is necessary for the conclusion and/or performance of a contract between Vodacom and the Data Subject;
• The transfer is necessary for the conclusion or performance of a contract entered into, in the interest of the Data Subject, between Vodacom and the relevant Vodacom Group company or the Authorised Third Party;
• The transfer is to the benefit of the Data Subject and must take place in circumstances under which it is not reasonably possible to obtain the Data Subject’s consent and if it were reasonably possible to obtain such consent, the Data Subject would be likely to give it.

The processing of Personal Information in a foreign jurisdiction may be subject to the laws of the country in which it is held, and may be subject to disclosure to the Governments, Courts of law, Enforcement or Regulatory Agencies of such other country, pursuant to the laws of such country. As a measure, Vodacom conducts Transfer Impact Assessments to assess the legislative framework that governs disclosures of information in jurisdictions where information is transferred and implements security and contractual measures to limit the risk exposure. However, where such disclosures are required, Vodacom will ensure the adequate protection of your Personal Information.

5.5 General Description of Information Security Measures

• Vodacom is committed to continuously implement security safeguards to protect Personal Information. For this reason, Vodacom has specialised security teams that constantly review and improve its measures to secure the integrity and confidentiality of Personal Information by taking appropriate, reasonable technical and organisational measures to protect it from unauthorised or unlawful access, accidental loss, damage, disclosure or destruction.
• If Vodacom has an agreement with another organisation to provide services on its behalf, Vodacom will take reasonable steps to ensure that they have appropriate security measures in place that are substantially similar to the security measures implemented by Vodacom. These organisations will not be entitled to use Personal Information for their own purposes. If necessary, the security teams will conduct an audit on them to ensure they meet Vodacom’s security requirements.
• Vodacom has implemented various information security measures such as, but not limited to:
  • Firewall and network endpoint protection;
  • Antivirus and Multifactor Authentication;
  • A dedicated support network of cyber security professionals;
  • Encryption and/or similar cryptographic technologies and techniques;
  • Access control methodologies based on user roles and security clearance levels;
  • Confidentiality protocols that apply to all internal documents and correspondence; and/or
  • Disaster Recovery and Business Continuity Management Protocols and Procedures