Access to Information Manual

Access to Information Manual

(in accordance with section 51 of the Promotion of Access to Information Act No. 2 of 2000)

main_icn_Chevron_down
1. Introduction

Section 51 of the Act requires Private Bodies to compile a Manual setting out the procedure and requirements to be adhered to in seeking to obtain access to information held by that Private Body. The section also stipulates the minimum requirements a Manual has to comply with. To this end section 51 of PAIA requires the Manual to contain, amongst others, the following:

  • The postal and street address, phone and fax number and, if available, electronic mail address of the head of the body;
  •  Contact details of the Head of the Private Body;
  • Categories of information available without formal request, if any;
  • A description of the records available in accordance with other legislation;
  • Sufficient detail to facilitate a request for access to a record of the Private Body;
  • A description of the categories of subjects and of the information or categories of information;
  • A description of the subjects on which the body holds records and the categories of records held on each subject,
  •  Such other information as may be prescribed

POPIA requirements pertaining to the processing of information

  • Purpose of processing

the Protection of Personal Information Act (PoPIA), Personal Information must be processed for a specified purpose. The purpose for which Personal Information is processed by Vodacom will depend on the nature of the Personal Information and the particular Data Subject. This purpose is ordinarily disclosed, explicitly or implicitly, at the time when Personal Information is collected.

  • Access to Personal Information

POPIA provides that a Data Subject may, upon proof of identity, request the Responsible Party to confirm, free of charge, all the information it holds about the Data Subject and may request access to such information, including information about the identity of third parties who have or have had access to such information. Further, POPIA provides that where the Data Subject is required to pay a fee for services provided to him/her, the Responsible Party must provide the Data Subject with a written estimate of the payable amount before providing the service and may require that the Data Subject pay a deposit for all or part of the fee.

 

  •  Categories of Data Subjects

> Vodacom holds information and records on the following categories of Data Subjects: a) employees / personnel of Vodacom; b) clients of Vodacom; c) any third parties and/or suppliers with whom Vodacom conducts its business services; d) contractors of Vodacom; e) partners and agents f) service providers of Vodacom.

(This list of categories of Data Subjects is non-exhaustive)

  • The categories of recipients to whom the information is supplied

Depending on the nature of the Personal Information, Vodacom may supply information or records to the following categories of recipients: a) statutory oversight bodies, regulators, law enforcement agencies or judicial commissions of enquiry making a request for information; b) any court, administrative or judicial forum, arbitration, statutory commission, or ombudsman making a request for personal information or discovery in terms of the applicable rules (e.g the Information Regulator ); c) South African Revenue Services, or another similar authority; d) Emergency Service Organisations (if you make an emergency call), including your approximate location; e) anyone making a successful application for access in terms of PAIA; f) subject to the provisions of POPIA and the National Credit Act No. 34 of 2005, Vodacom may share information about a client’s creditworthiness with any credit bureau or credit provider.

  • Planned transborder flows of information

If you are visiting our websites from a country other than South Africa the various communications will necessarily result in the transfer of information across international boundaries.

Vodacom may also need to transfer your information to other Vodacom or Vodafone group of companies or service providers in countries outside South Africa, in which case we will fully comply with applicable data protection legislation. This may happen if our servers or suppliers and service providers are based outside South Africa, or if our services are hosted in systems or servers in Vodafone Operating Companies outside South Africa including Europe or India and/or if you use our services and products while visiting countries outside this areas. Other countries outside South Africa may not have data protection laws which are similar to those of South Africa, however, Vodacom will ensure that your Personal Information is protected and enter into appropriate agreements to achieve this.

 

  • Security measures implemented to ensure the confidentiality and privacy of the information which is to be processed

Vodacom is committed to implementing leading data security safeguards. For this reason, Vodacom has specialised security teams who constantly review and improve its measures to protect your Personal Information from unauthorised access, accidental loss, disclosure or destruction.

If Vodacom has an agreement with another organisation to provide it with services or a service on its behalf to process your Personal Information, then Vodacom will make sure they have appropriate security measures and only process your Personal Information in the way we have authorised them to. These organisations will not be entitled to use your Personal Information for their own purposes. If necessary, our security teams will conduct a due diligence them to make sure they meet the security requirements we have set.

Communications over the internet (such as emails) are not secure unless they have been encrypted. Further, your communications may go through a number of countries before being delivered, as this is the nature of the internet. Consequently, we cannot accept responsibility for any unauthorised access or loss of Personal Information that is beyond our control.


2. Definitions

The following words  shall bear the same meaning as under PoPIA:

“Act/PAIA” means the Promotion of Access to Information Act No. 2 of 2000

 

“Consent” means a voluntary, specific and informed expression of will in terms of which a Data Subject agrees to the processing of Personal Information relating to him or her

 

“Data Subject”  means the person to whom Personal Information relates

“Information Officer” means the head of Vodacom as contemplated in section 1 of PoPIA

“Minister” means the Minister of Justice and Correctional Services

“Personal information”  means information relating to an identifiable, living, natural person, and where it is applicable, an identifiable, existing juristic person including:

  •  information relating to the race, gender, sex, pregnancy, marital status, national, ethnic or social origin, colour, sexual orientation, age, physical or mental health, well-being, disability, religion, conscience, belief, culture, language and birth of the person;
  • information relating to the education or the medical, financial, criminal or employment history of the person;
  • any identifying number, symbol, e-mail address, physical address, telephone number or other particular assignment to the person;
  • the blood type or any other biometric information of the person;
  • the personal opinions, views or preferences of the person;
  • correspondence sent by the person that is implicitly or explicitly of a private or confidential nature or  further correspondence that would reveal the contents of the original correspondence;
  • the views or opinions of another individual about the person; and
  • the name of the person if it appears with other personal information relating to the person or if the  disclosure of the name itself would reveal information about the person

 

“PoPIA” means Protection of Personal Information Act, Act No 4 of 2013

 “Private body” means a natural person who carries or has carried on any trade, business or profession in that capacity, a partnership or juristic person

“Processing” means any operation or activity or any set of operations, whether or not by automatic means, concerning personal information, including:

(a) the collection, receipt, recording, organisation, collation, storage, updating or modification, retrieval, alteration, consultation or use;

(b) dissemination by means of transmission, distribution or making available in    any other form; or

(c) merging, linking, as well as blocking, degradation, erasure or destruction of information;

 “Public body” means any department of state or administration in the national, provincial or local sphere of government or functionary exercising pubic power or exercising public function in terms of any legislation;

“Responsible party”  means a public or private body or any other person which, alone or in conjunction with others, determines the purpose of and means for processing Personal Information;

“Requester” in relation to –

(a) a public body, means any person making a request for access to a record of that public body (or authorised representative);

(b)  a private body, means  any person, including, but not limited to, a public body or an official thereof, making a request for access to a record of that private body  (or authorised representative).


3. Vodacom structure and functions

Vodacom is a leading African communications company providing a wide range of communication services, including mobile voice, messaging, data, financial and converged services to over 103 million (including Safaricom) customers. With its roots in South Africa, Vodacom has grown its mobile network business to include operations in Tanzania, the DRC, Mozambique, Lesotho and Kenya. Vodacom’s mobile networks cover a population of over 284 million people. Through Vodacom Business Africa (VBA), we offer business managed services to enterprises in 32 countries. Vodacom is listed on the JSE Limited.

Vodacom is majority owned by Vodafone Group Plc, one of the world’s largest mobile communications companies by revenue. As such Vodacom is bound by and adheres to Vodafone Group Privacy Commitments.


4. Particulars Required in terms of the Section 51(1)(a) of PAIA

To confirm whose particulars to be included, in particular, telephone, email and fax

Company Registration:

Vodacom Group Limited

Vodacom (Pty) Ltd  

1993/005461/06

1993/003367/07

Chief Executive Officer & Managing DirectorShameel Joosub
Privacy & Information OfficerMpumi Simelane
Chief Officer: Legal and Regulatory AffairsNkateko Nyoka
Street Address

082 Vodacom Boulevard

Vodacom Valley

Midrand

1685

Postal Address

Private Bag X9904

Sandton

2146

Telephone011 653
Website

www.vodacom.co.za

www.vodacom.com

E mail[email protected]

5. List of Records and Information

The information held by Vodacom has been divided into different categories grouped into twelve subjects, each of which describes a single business unit, for example, "Human Resources". For ease of understanding and navigation, an additional level has been added between the "subject" and "category" levels. This additional level describes more accurately the sub-set of categories that falls under it. For example, under the additional level, the subject "Performance and Remuneration" is made up of information categories describing payroll, bonus and incentives, and employee performance information.

The categories of information are not exhaustive but are merely meant to give a broad indication of the information subject and categories held by Vodacom, without specification. A category may therefore contain sub-categories and sub-sets of information, which are not specifically listed. (For purposes of the list of records and information held by Vodacom see Appendix A: Categories and Types of Information).

Purpose of processing

In terms of POPIA, personal information must be processed for a specified purpose. The purpose for which personal information is processed by Vodacom will depend on the nature of the personal information and the particular data subject. This purpose is ordinarily disclosed, explicitly or implicitly, at the time the personal information is collected.

Access to personal information

POPIA provides that a data subject may, upon proof of identity, request the responsible party to confirm, free of charge, all the information it holds about the data subject and may request access to such information, including information about the identity of third parties who have or have had access to such information.

 

POPIA also provides that where the data subject is required to pay a fee for services provided to him/her, the responsible party must provide the data subject with a written estimate of the payable amount before providing the service and may require that the Requestor pay a deposit for all or part of the fee.

 

Categories of data subjects

Vodacom holds information and records on the following categories of data subjects:

  • employees / personnel of Vodacom;
  • any third party with whom Vodacom conducts its business services;
  • contractors of Vodacom;
  • suppliers of Vodacom; and
  • service providers of Vodacom.

(This list of categories of data subjects is non-exhaustive.)

The categories of recipients to whom the information is supplied

Depending on the nature of the Personal Information, Vodacom may supply information or records to the following categories of recipients:

  • statutory oversight bodies, regulators or judicial commissions of enquiry making a request for data;
  • any court, administrative or judicial forum, arbitration, statutory commission, or ombudsman making a request for data or discovery in terms of the applicable rules (i.e. the Competition Commission in terms of the Competition Act No. 89 of 1998);
  •  South African Revenue Services, or another similar authority;
  •  anyone making a successful application for access in terms of PAIA; and
  •  subject to the provisions of POPIA and the National Credit Act No. 34 of 2005, Vodacom may share information about a client’s creditworthiness with any credit bureau or credit providers industry association or other association for an industry in which Vodacom operates.

Planned transborder flows of  information –

If you are visiting our websites from a country other than the country in which our servers are located, the various communications will necessarily result in the transfer of information across international boundaries.

We may need to transfer your information to other Vodacom or Vodafone group companies or service providers in countries outside South Africa, in which case we will fully comply with applicable data protection legislation. This may happen if our servers or suppliers and service providers are based outside South Africa, or if our services are hosted in systems or servers in Vodafone Operating Companies outside South Africa including Europe or India and/or if you use our services and products while visiting countries outside this area. These countries may not have data-protection laws which are similar to those of South Africa.

 

Security measures implemented to ensure the confidentiality and privacy of the information which is to be processed –

We are committed to implementing leading data security safeguards.

We have specialised security teams who constantly review and improve our measures to protect your personal information from unauthorised access, accidental loss, disclosure or destruction.

If we have a contract with another organisation to provide us with services or a service on our behalf to process your personal information, we will make sure they have appropriate security measures and only process your information in the way we have authorised them to. These organisations won’t be entitled to use your personal information for their own purposes. If necessary, our security teams will check them to make sure they meet the security requirements we have set.

Communications over the internet (such as emails) are not secure unless they’ve been encrypted. Your communications may go through a number of countries before being delivered – as this is the nature of the internet. We cannot accept responsibility for any unauthorised access or loss of personal information that is beyond our control.


6. Entry Point for Requests for Information

In order to ensure that Vodacom complies with the Act, management has designated Vodacom Customer Care as the only entry point through which any request in terms of the Act must be channeled.

All requests in terms of the Act must be addressed to:

VODACOM CUSTOMER CARE

Physical Address

Vodacom Customer Care

082 Vodacom Boulevard, Vodacom Valley, Midrand, 1685                                                                  

Postal Address

Vodacom Customer Care

Private Bag X9904, Sandton, 2146

Other

Telephone: (082) 135

Electronic mail: [email protected] / [email protected]


7. Who May Request Information or Records

a. The purpose for which Information is required

The Act provides that a person may only request information in terms thereof if that information is required for the exercise or protection of a right.

Further, PoPIA provides that a Data Subject may, upon proof of identity, request the Responsible Party to confirm, free of charge, all the information it holds about the Data Subject and may request access to such information, including information about the identity of third parties who have or have had access to such information, and may, where necessary, request the correction, destruction or deletion of his or her personal information.  PoPIA further provides that where the Data Subject is required to pay a fee for services provided to him/her/it the Responsible Party:

  • Must provide the Data Subject with a written estimate of the payable amount before providing the service; and
  • May require that the requestor pay a deposit for all or part of the fee  

b. Categories of Requestors

The capacity under which a Requester requests documentation/ information will determine the category he or she falls in. Please note that the Requester category has a bearing on the conditions of access to the information.

Requesters have been classified into four categories:

  • A Personal Requester: requests information about himself/herself/itself.
  • A Representative Requester: requests information relating to and on behalf of someone else.
  • A Third Party Requester: requests information about another person.
  • A Public Body: requests information in the public interest. 

c. Third party notifications

Where the records requested relates to third parties the Information Officer will take all reasonable steps to inform a third party to whom or which the record relates of the request. The third party will be informed as soon as reasonably possible, but within 21 days after that request is received and by the fastest means reasonably possible. When informing the third party about the information request the Information Officer will:

  • inform the third party that he or she is considering a request for access to its records and describe the content of the record;
  • furnish the name of the requester;
  • describe the type of information in question;
  • if the disclosure is in the public interest, describe circumstances under which the disclosure is made
  • inform the third party that it may, within 21 days after the third party is informed:

(a) make written or oral representations to the head why the request for access should be refused; or

(b) give written consent for the disclosure of the record to the requester.


8. Request Procedure

a. Completion of Form C

Any request for information in terms of the Act must be submitted in terms of Form C (a copy of the form is enclosed as Annexure B hereto). These forms are available on request from Vodacom Customer Care and upon payment of a prescribed fee. The forms can also be downloaded from www.vodacom.co.za / www.vodacom.com.

Form C must be completed in full and returned to Vodacom Customer Care at the address referred to in paragraph 6 above as soon as reasonably possible together with any other information that may be required in order to consider and decide on the request. A request which does not comply with the formalities contained in this Manual will be referred back to the Requester with advice on the necessary steps for compliance. This includes Forms that are not completed in full.

The Affidavit contained in Form C must also be completed in full and signed by a Commissioner of Oaths,

b. Proof of identity

Proof of identity is required to authenticate the request and the Requester. In view hereof, a Requester will, in addition to Form C, be required to submit acceptable proof of identity such as a certified copy of their Identity Document or other legal form of identification.

c. Vodacom Products

In instances where information or records pertaining to any of Vodacom's products (other than marketing information) is requested, the Requester will have to prove ownership of the MSISDN (Mobile Station International Subscriber Directory Number) to which the requested information or records relate. The Requestor may also be required to provide further particulars to prove ownership or to provide an explanation why access to the identified records is required.

 

Note: Information will not be furnished unless a person clearly provides sufficient particulars to enable the company to identify the right the Requester is seeking to protect as well as an explanation of why the requested information is required for the exercise or protection of that right.

d. Checklist for submission of information requests  

Form C

 

  • Number B – particulars of person requesting access to the records
  • Number C – only if the request is a third party request
  • Number D1 – the time period as well as type of information required
  • Number D2 – the cell number or ref. number that was provided by Vodacom (if available)
  • Number E – exemption from paying the fees, if so the client will need to supply his/her salary advice and if the client is married, a copy of the spouse’s salary advice will need to be supplied as well
  • Number F1 – copy in a computer readable form (memory stick or compact disc)
  • Number G1 – indicate which right is to be exercised or protected
  • Number G2 –  the reason for which this information is required (we will not accept ‘personal reasons’ as a reason)
  • Number H – preferred method of communication
  • Documentation signed and every page must be initialed.

 

Affidavit

  • Number 3 – choose a, b or c
  • Number 6 – choose a, b or c
  • Number 7 – only in the case of a Third Party request
  • The affidavit must be commissioned by a Commissioner of Oath (eg SAPS or Notary).
  • NB the following information must also be attached:
  • A certified copy of your identity document. Please also initial the identity document.
  • For pre-paid clients. A Vodacom prepaid certificate, if available. This must also be initialed.
  • Contract clients must supply a copy of their latest Vodacom statement. This must also be initialed.
  • If it is a company owned contract, a letter from the company providing permission for the release of this information must be provided.

9. Request Fees

In terms of POPIA, a data subject has the right to request Vodacom to confirm, free of charge, whether or not it holds personal information about the data subject. However, both in terms of PAIA and PoPIA, Vodacom is entitled to levy a prescribed fee (as set out below) for the provision of records of personal information about the data subject or third parties in its possession.

The fees that may be charged have been published by the Minister of Justice and Correctional Services and are displayed below.

  1.  ACCESS FEES FOR REPRODUCTION

  1.1

For every photocopy of an A4-size page or part thereofR1.10
1.2For every photocopy of an A4-size page or part thereof held on a computer or in electronic or machine-readable formR0.75
1.3For a copy in a computer-readable form on memory stickR7.50
1.4For a copy in a computer-readable form on compact discR70.00
1.5For a transcription of visual images for an A4-size page or part thereofR40.00
1.6For a copy of visual imagesR60.00
1.7For a transcription of an audio record for an A4-size page or part thereofR20.00
1.8For a copy of an audio recordR30.00
2. ACCESS FEE FOR TIME SPENT
2.1The time reasonably required to search for the record for disclosure and preparationR30.00/hr or part thereof
3. REQUEST FEE
3.1For a request for access to a record by a person other than a personal RequestorR50.00
4. DEPOSIT
4.1One third of the access fee is payable as a deposit by the Requester 
5. POSTAL FEE
5.1When a copy of a record must be posted to the RequestorR9.75
6. APPEAL FEES
6.1For lodging an internal appeal against the refusal of a request for access to a recordR50.00
7. VAT
7.1Vodacom, as a private body registered under the Value Added Tax Act, 1991 will add VAT to all the above-mentioned fees 

10. Granting or Refusal of Requests

All requests complying with the requirements set out above will be processed and considered expeditiously.

If the request for access is granted then Vodacom will advise the Requestor on the following:

  • the prescribed fee for accessing the information or documentation
  • payable deposit fee and balance outstanding
  • the form in which access will be given
  • the right to lodge an internal appeal against the access fee to be paid or the form of access to be granted.

If the request for access is refused then Vodacom will advise the Requestor about the reasons for refusal of access and may advice the Requestor to lodge an application with the Information Regulator  against the refusal of the request after the Requestor has exhausted all Vodacom’s  internal appeal process. 

Chapter 4 of the PAIA Act stipulates the following grounds for refusing requests for information:

  • protection of the privacy of a third party who is a natural person 
  • protection of commercial information of a third party 
  • protection of certain confidential information of a third party 
  • protection of safety of individuals and protection of property
  • protection of records privileged from production in legal proceedings 
  • commercial information of the Private Body
  • protection of research information of a third party and of the Private Body.

These grounds of refusal are also endorsed under PoPIA.

Vodacom will give the Requester a written notice of the decision within 30 days after the decision is made. In case of a request being refused, the notification will include the reasons for the refusal. Vodacom may extend the 30 day notice period for a further period not exceeding 30 days due to the nature of the request and the amount of time required to gather the requested information. The Requester will however be given notice of the extension prior to the expiry of the 30 day period and provided with reasons for the extention.


11. Appeal/ Lodgment of Complaints

The Act makes provision for the lodgment of complaint against:

  • Access fee charged or the form of access granted
  • Refusal of the request to grant access
  • Decision to extend the 30 days’ period for granting the requested access
  • Form in which access is granted

A complaint or an internal appeal must:

  • be lodged within 30 days after the decision is communicated to the Requestor;
  • be delivered or sent to the address, fax or electronic mail address contained in paragraph 6 above;
  • identify the subject of the complaint or internal appeal and state the reasons for the complaint or internal appeal;  
  • be accompanied by the prescribed appeal fee as prescribed in paragraph 10 above;
  • specify a postal address, fax number or electronic mail for the return of the decision. 

(see Annexure D for the copy of the form to be used in lodging the internal appeal)

Where, in addition to a written reply, the complainant/appellant wishes to be informed of the decision in any other manner he/she/it must state that manner and provide the necessary particulars to be so informed. 

The complainant/appellant who is not happy with the decision of the internal process may lodge an application with the Information Regulator  against the decision made within 30 days after the decision was communicated to him/her/it. 

Where the complaint or internal appeal is lodged after the expiry of the 30 days period the Information Officer may, on good cause shown, allow the late lodgment of the complaint or internal appeal.


12. Other information as may be prescribed

Section 51(1)(f) of the Act grants the Minister powers to publish a notice prescribing any other information that companies will have to disclose.


13. Availability of the Manual

As provided for in terms of section 51(2) of PAIA this Manual will be updated as and when the need arises and as soon as any amendments have been finalized the latest version of the Manual will be made public through:

The Vodacom website: www.vodacom.co.za / www.vodacom.com

Alternatively, on request from:

The Information Officer

Vodacom Group Ltd

082 Vodacom Boulevard

Vodavalley Midrand

1685

Email: [email protected] ;

This Manual is available for inspection during office hours and at no charge. Should you wish to obtain a copy of this Manual or part thereto such copy can be obtained from either:

the address set out above subject to payment of applicable fees (refer to clause 9 above); or

downloaded from our website free of charge.


14. Annexure A: Categories and types of Information that can be requested

 

1.1 Categories and type of records automatically available without having to request access to these records (Section 52(2) of  PAIA  read with regulation 9A to the PAIA ): Web and Magazine Content

The PAIA makes provision for the automatic disclosure of certain records. These records need not be formally requested from Vodacom since they are automatically available from our website www.vodacom.co.za / www.vodacom.com

The following are categories of records automatically available:

Description  of category of records automatically available in terms of section 52(1)(a) of the PAIA ActManner of access to records (Section 52(1)(b)
For inspection in terms of section 52(1)(a)(i) 
Product InformationSoft copy/website
Public Customer InformationSoftcopy
RegistersSoftcopy
For copying in terms of section 52(1)(a)(ii) 
Annual ReportsSoft copy/website
Financial StatementsSoft copy/website
Available free of charge in terms of section 52(1)(a)(iii)
Media ReleasesWebsite/Soft copy

1.2 Categories and types of records that can be requested (section 51(1)(e) of the PAIA): 

Vodacom maintains the types and categories of records as listed below. Each request for information will be dealt with on a case by case basis and the mere fact that a record is listed below does not mean that access to that record will be granted.

The following are categories of records that can be requested from Vodacom:

Business partners

Information Category

Business partners

Information Category

Information CategoryInformation Category Description
Commercial agreement with business partnersThis is the document, which records the agreement with the business partner, and is the output of contractual negotiations undertaken previously. It is co-owned by the business unit(s) involved and Legal Affairs Department.
Contractual issues with Business PartnersAll information related to reaching an agreement with a business partner, for example correspondence and minutes of meetings prior to the actual agreement, including details related to the agreement itself.

Corporate Social Investment

Information Category

Information CategoryInformation Category Description
Corporate Social Investment - Application for FundingThis details all Corporate Social Investment applications received for funding by Vodacom Foundation.
Corporate Social Investment – ProjectsDetails of the projects that have been approved and are underway.
Corporate Social Investment - Vodacom responseThe information relating to process of approval or rejection of the applications received for Corporate Social Investment.

External Communication

Information CategoryInformation Category Description
External PublicationAll publications for external bodies, includes all press clippings
Press Release/CommuniquéIssuing of media statements, press releases, official speeches etc.
Web and Magazine ContentContent available on Vodacom internet sites (for e.g. vodacom.net) and magazines (for e.g. Vodaworld Magazine) as well as at POS (Point of Sale) Kiosks (e.g. at Vodaworld).

Government Protocol

Information CategoryInformation Category Description
South African Government structureDetails of the structure and holders of the South African government
South African Parliament structureDetails of the structure and holders of the South African parliament
Visiting Foreign Governments structureDetails of the positions held by foreign government visitors to South Africa

Legal

Information CategoryInformation Category Description
Finalised litigationLitigation that has been concluded by court process or mutual consent

Management

Information CategoryInformation Category Description
Board reports & meeting minutesReports prepared for the board meetings, and the subsequent minutes recording these meetings.
Project Activity and ScheduleDetails of projects (tasks, resources, dependencies, durations, etc.)
Project Lifecycle and Macro Plan InformationThis records the status and overarching objectives of the project.  Project planning is undertaken according to the "Manage by Project" standard and all projects are registered in a project register.

Regulatory

Information CategoryInformation Category Description
Compliance certificationCompliance to international standards such as ISO9000 and COBIT
Compliance to licenseThe criteria related to the Electronic Communication Services and Electronic Communications Network Service License conditions, as well as the performance against those conditions.  Some metrics are number of subscribers, network rollout, performance and coverage, community, customer care and emergency services, documented in the Compliance Reports submitted to the Independent Communications Authority of South Africa (“ICASA”).
Policies and proceduresThe documented policies and procedures of Vodacom's business processes and practices, for example relating to customer complaints

Regulatory Submissions

Information CategoryInformation Category Description
Draft Legislations, Draft Regulations, Policy DirectivesInformation regarding Vodacom’s position on  draft legislation, regulations and policy directives

VIP events

Information CategoryInformation Category Description
VIP event management Vodacom Events with business partners and other third parties and including staff functions of a high profile.

Customer Information

Information CategoryInformation Category Description
Customer Contract DetailsContract customer details received during application process
Customer Credit CheckingCriteria and results of the credit checking process for customers requiring a contract
Customer DetailAll other customer details recorded during customer creation process, which are not covered by information categories Customer Contract Details and Customer Credit Checking, and including customer preferences.
Customer passwords & identificationPasswords, for e.g. PIN and PUK, and identification required for release
Customer ProfileInformation relating to the customer profile, for e.g. which services are activated
Customer TypeInformation relating to the customer type, for e.g. type of tariff plan.
Loyalty AwardInformation relating to awards given to loyal customers.
Number and growth of subscribersThe count of active subscribers and prepaid customers as measured at a certain period, and the growth this reflects.
Payment HistoryInformation relating to payments made.
Subscriber demographicsThe subset of customer information which describes the demographic information of that subscriber.

Customer Management

Information CategoryInformation Category Description
Call Centre Call DataThe details of calls handled by the call centre (call centre agent, time, duration, query, etc.)
Customer ComplaintDetails of specific customer complaints which are (or have been) communicated to the Advertising Standards Authority, ICASA and the National Consumer Commission.
Customer Frequently Asked Questions (FAQ) databaseInformation on the most frequently asked questions
Customer InquiryDetails of general customer inquiries
Customer Service RequestThe recording of an issue raised by a customer which requires attention.
Outbound ResponseInformation relating to responses communicated to customers
VIP customer complaintsThe complaints of customers categorised as VIP customers

Distribution Channel Management

Information CategoryInformation Category Description
Dealer Competitive InformationInformation relating to the market conditions and environment for dealers
Dealer PromotionInformation relating to dealer promotions (type of handset, price, conditions etc.)
Field Marketing Executive (FME) VisitInformation relating to the visit of a FME (to a dealer)

Distribution Channel Structure

Information Category
Information Category Description
Community Services' dealer commissionThe commission paid to Community Services' dealers
Community Services Phone Shop / ContainerInformation on Community Services phone shops (type, location, number of, size of, etc.)
DealerDealer information
Franchise vettingThe criteria and results of the credit checking process for franchisees
ranchiseeFranchisee information
Independent Service ProviderInformation about Service Providers who are independent of Vodacom Group (dual SPs)
OutletInformation about the outlet (location, size, type, etc.)
RetailerRetailer information
Sales ClusterThe geographic area within South Africa in which a sale took place

Accounting

Information CategoryInformation Category Description
BudgetBudget information (amount, code, responsibility)
Cash / Bank TransactionInformation generated by a financial transaction as a result of the flow of information to or from Vodacom
CreditorCreditor information (name, amount, status, etc.)
DebtorDebtor information (name, amount, status, etc.)
Electricity bill paymentSpecific information generated with respect to the electricity consumed by Vodacom GSM network element devices installed on sites not owned by Vodacom, as well as electricity consumed in Vodacom's administrative buildings.
Financial transactionsInformation generated by a financial transaction
General Ledger AccountGeneral Ledger Account information (code, name, responsibility)
General Ledger AccountGeneral Ledger Account information (code, name, responsibility)
Payment termsThe details of payment terms with creditors and debtors
Property rental valueThe rental paid / due from Vodacom sites
Vodacom InvoiceInvoices from Vodacom to debtors

Asset

Information CategoryInformation Category Description
AssetAll assets, including the financial aspect of IT or GSM equipment

Financial Performance

Information CategoryInformation Category Description
Financial Management StatisticsThe description, definition and measurement of financial metrics which measures the financial performance of the organisation and which are reported in the monthly management report
Financial TargetThe planned goal of a financial metric (for example "Earnings before Income Tax, Depreciation and Amortisation")

Wholesale Bill

Information CategoryInformation Category Description
3rd Party Contract Wholesale BillWholesale Billing information prepared related to contract customers' revenue, forwarded as invoices to Service Providers
3rd Party Interconnect BillBilling information prepared for third party network operators related to calls which originated and/or terminated on their networks, also presented as invoices
3rd Party Prepaid Wholesale BillWholesale Billing information related to prepaid customers' revenue forwarded as invoices to Service Providers (for connection bonus purposes).

 

GSM Device Site

Information CategoryInformation Category Description
Environmental Impact Assessment resultsInformation relating to Environmental Impact Assessments
Environmental standardsThe environmental standards within which Vodacom needs to construct sites (for example cellular masts).
Site DetailDetails of the site of a Vodacom GSM network element
Site MaintenanceInformation relating to site maintenance
Site Rollout Planned and ActualThis information is available regionally and nationally as part of the regional Project Management Work Order documentation. Available in hard copy format or software format.

GSM Network and IT Configuration

Information CategoryInformation Category Description
Actual and Planned CoverageThe areas of South Africa where coverage on the Vodacom network is received
GSM & Information Technology (IT) Network DeviceThis is any device on either the GSM or IT network.  Examples are MSC / BSC / cell for GSM and server / PC / software for IT network.
GSM Network Equipment ConfigurationThe (initial) configuration and setup of GSM network equipment
Handset DetailDetails on handset (Make, model, settings etc.)
Information Technology (IT) Equipment Change HistoryDetails of changes performed on Information Technology equipment
Information Technology (IT) Equipment ConfigurationThe (initial) configuration and setup of Information Technology equipment
Information Technology (IT) Performance DataMeasurements related to the performance of Information Technology equipment
Internal e-mail - content and partiesIncludes internet email originating from or terminating with Vodacom
Voice Mail ConfigurationThe (initial) configuration and setup of voicemail equipment

GSM Network and IT Statistics

Information CategoryInformation Category Description
GSM Network Capacity and Throughput DataInformation related to the capacity of the network (maximum planned) as well as the actuals being processed
GSM Network Performance DataMeasurements related to the performance of GSM network equipment
GSM Network Quality IndicatorDefinitions and measurements of the quality of the network (for example number of dropped calls %)
GSM Network Test ResultResults of GSM network tests
Information Technology (IT) Capacity and Throughput DataThe measurement of IT equipment's performance.
Raw GSM Network StatisticsThe unprocessed data relating to measurement of the GSM network
Transmission PerformanceMeasurements related to the performance of Transmission equipment

Technical Alarm / Event

Information CategoryInformation Category Description
GSM Network Alarm and EventThe information relating to an alarm, which is generated, alerting support personnel to a failure (or possible failure) of an element or elements in the GSM network.
GSM Network Equipment Fault HistoryThe history of faults and resolutions relating to items of IT equipment
Information Technology (IT) Alarm and EventThe information relating to an alarm, which is generated, alerting support personnel to a failure (or possible failure) of an element or elements in the IT network.
Information Technology (IT) Equipment Fault HistoryThe history of faults and resolutions relating to items of IT equipment

Internal Communication

Information CategoryInformation Category Description
Internal CommuniquéThe information contained within any internal communication, via email or physical (paper) distribution. Examples are e-mail, Yeboflash and Vodacom Express.
Policy and Procedure Tracking and DocumentationThe dissemination and implementation of policy and procedure information
Reference MaterialReference material used in internal communications
Research MaterialResearch material used in internal communications

Organisation Structure and Position

Information CategoryInformation Category Description
Archive of Senior Management PhotographsPhotographs of senior management
Job ProfilingThe categorisation of responsibilities associated with an employment position
Organisational StructureThe structure of the organisation into business units, commonly depicted in an organogram.  This usually includes the top "n" levels of an organisation, for example the executive directors, name of departments reporting into their business units and position.
PositionThe title and responsibilities of employment positions, including information related to the role and current incumbents.  This includes information on contractors and other non-permanent staff members.

Performance and Remuneration

Information CategoryInformation Category Description
Employee Performance RecordThe records relating to the employee performance, for example performance awards
Employee Timesheet InformationThe records relating to the working hours' availability of an employee
PayrollAll information related to payment of an employee, for example payment method, bank account details, payment amount, payment date
Salary/Incentive/BonusInformation related to the "package" of an individual, for example gross salary, PAYE amount etc.

Personnel Detail

Information CategoryInformation Category Description
Curriculum Vitae (CV) and Application DetailDetails of applicants for employment, including CV details
Disciplinary RecordRecords of disciplinaries, for example, person, reason, status
Employee Lifecycle InformationThe information about an employee "life" at Vodacom, i.e. when joined, promoted, positions held etc.
Employee Personal DetailPersonal details kept on employees, for example, next of kin

Personnel Development

Information CategoryInformation Category Description
Employee Promotion criteriaThe criteria for promotion
Skill LevelThe skills required for positions
Training Event / CourseDetails of training courses available and held

Facility

Information CategoryInformation Category Description
Bookings & appointmentsDetails of bookings for infrastructure elements, for example parking for visitors or video conference facilities
Facility/Security Access RecordRecords of access to buildings by individuals
Loan ItemItems loaned to employees, for example training material
Office Layout and MaintenanceDetails on office layout and maintenance performed, for example air-conditioning maintenance

Audit Information

Information CategoryInformation Category Description
Service Level AgreementThe details of service levels agreed between two parties
Service Level RatingThe measurement of a service level's performance.
Supplier and Partner Contract/AgreementThe contract between a supplier and/or a business partner.

Contract/SLA Management

Information CategoryInformation Category Description
Service Level AgreementThe details of service levels agreed between two parties.
Service Level RatingThe measurement of a service level's performance.
Supplier and Partner Contract/AgreementThe contract between a supplier and/or a business partner.

Inventory Control

Information CategoryInformation Category Description
StockThe physical items required to be distributed throughout Vodacom, for example, SIM cards and Handsets distributed to the distribution channel outlets or the stock of equipment to upgrade the radio network stored in a warehouse distributed to the Network Operations' units.

Procurement

Information CategoryInformation Category Description
Information Service ProviderThe information about an information service provider
ManufacturerDetails related to a manufacturer who produces goods for Vodacom, for example Name, Address, Goods produced
Procurement decisionsInformation related to procurement decisions
Request for Information (RFI)Details contained within a request for information document, for example services and deliverables required
Statement of WorkThe details related to a Statement of Work, including the deliverable specifications, due date, price, risks etc
SupplierDetails relating to Supplier for example, registered name, banking details, status
Supplier demographicsDemographics of suppliers, with specific attention to the Historically Disadvantaged Individual (HDI) indicators
Supplier InvoiceDetails related to an invoice received from suppliers
Vodacom Purchase OrderDetails related to the purchase order process which controls the operational and capital expenditure of Vodacom

Production

Information CategoryInformation Category Description
Operator ScheduleDetails of Production and operators' schedules.
Production Capacity and ThroughputDetails of maximum production capability and current measurement of production.
Production ScheduleDetails of scheduled production.

Product/Service Management

Information CategoryInformation Category Description
Bearer ServiceA bearer service is a basic service that provides the capabilities for the transmission of information between user-network interfaces.
Brand promotionInformation about promotions on Vodacom brands, including venue, date, format, leaflets, competition entry forms.
Brand tracking & researchResearch and measurement of Vodacom's brands, done formally quarterly.
Price List (wholesale and retail)Details of the available tariff plans, including prices, bundled minutes, services available etc
Product ConfigurationCovered in the TAPCM, tariff and product configuration management, which covers product planning, designing, packaging, technical development and supply for a product, for example "Starter Pack Vodago".
Product LaunchInformation related to the launch of a new or revamped product
Product Life CycleThe product life cycle is a sequence of stages (status) a product moves through from inception to decommissioning
Product Package & MediaInformation related to the packaging of hardcopy or software (CDs) or tariffs or VAS or handsets or at point of sale.  Includes media strategy and planning information.
Product Performance InformationThe metrics and performance of products
Product SpecificationThe specifications of a product
SponsorshipsInformation about the sponsorships Vodacom is involved with which leverage the brand.  These include Sport, cultural, CSR and broadcast.
Value Added ServiceThe information about value added services, for example voicemail.

Retail Sale

Information CategoryInformation Category Description
Customer DeliveryInformation generated during a delivery of an item to a customer, for example delivery address of an upgrade handset
Customer OrderInformation on a customer order
Point of Sale (POS) Merchandising materialAll consumer educational literature, including leaflets, posters, in-kiosk branding, material from sponsorship properties such as Idols, Super 15 etc.

Sales Management

Information CategoryInformation Category Description
Advertisements and PromotionsInformation related to advertising schedules, standards & content, as well as management of advertising agencies
CommissionInformation on the commission a distribution channel receives for customer transactions, which may be a new subscription or usage.
Incentive and TargetInformation on the incentives and targets a distribution channel receives for customer transactions, which may be a new subscription or usage.
Sales Figure and TargetInformation on the actual sales as well as the target sales figures for the distribution channels

Wholesale Sales & Distribution

Information CategoryInformation Category Description
DispatchThe information generated during the dispatch of goods to the distribution channel.
Wholesale Order (SIM card/Voucher)Information on the orders received from distribution channel for SIM cards and vouchers.

Fault

Information CategoryInformation Category Description
Diagnostic Support InformationThe information generated by the diagnostic tests done on a faulty network element.
Trouble TicketInformation on the faults logged (manually or automatically) for example date and time logged, element involved, type of problem. Also known as a service request.
Trouble Ticket ResolutionInformation on the resolution of a trouble ticket, for example, time resolved.
Works OrderThe information on planned engineering activity to network elements in order to install, maintain or upgrade it.

Service Event

Information CategoryInformation Category Description
Credit Card Recharge TransactionThe information generated during a credit card recharge transaction, for example date, amount.
Provisioning Command (recharge event)The information created during a recharge event, which is disseminated throughout the GSM network.
Recharge TransactionThe information generated during a non-credit card recharge transaction, for example date, and amount.
Service Event InformationThe information related to events when services requested by a subscriber, for example, a request for the data service
Subscription Item ActivityInformation on activities (or events), which are related to the subscription, for example, SIM swap.

Service Profile

Information CategoryInformation Category Description
Procedures & policies with regard to stolen phonesThe information on the specific procedures and policies relating to the recording or handling of stolen phones.
Suspected Fraud AlertThe information on alerts, which are triggered when fraud is suspected.

Usage Event

Information CategoryInformation Category Description
Call Data (Rated)The information on call data which has been rated, i.e. billed according to the defined rules for the tariff which includes factors such as duration, time of day, called party, etc.
GPRS Event RecordThe information generated during a GPRS event.
Short Message Service (SMS) Event RecordThe information generated during an SMS event, for example, date and time, number SMS'ed etc.
Traffic infoThe information generated by aggregated traffic
Voice Mail Event RecordThe information generated during a voicemail event, for example voicemail box, date, time, message etc.

Risk Management

Information CategoryInformation Category Description
Biometric InformationInformation that personally identifies the customer/employee/third party/business partner based on physical or behavioral characterization including blood type, fingerprint, DNA Analysis, retinal scanning and voice recognition 

1.3 Access to records held by Vodacom

The following procedure must be followed when requesting information and/or documents:

  1. i) The request must be sent in the prescribed form. (The form can be downloaded from Vodacom’s website at www.vodacom.co.za / www.vodacom.com).  
  2. ii) The Request must be submitted to the Information Officer and sent to the address, fax number or electronic mail address as set out in paragraph 6 of the Manual.
  3. iii) The Requestor must provide proof of identity of the person requesting the record
  4. iv) If the request is made on behalf of another person, the Requestor must provide proof of the capacity in which he/she/it is making the request.

 

1.4 The following procedure will be followed by Vodacom after receipt of the request for access:

  1. a) Once a request is made, the Requestor will receive notice from Vodacom to pay the prescribed deposit fee
  2. b) The prescribed deposit fee must be paid before the request is processed
  3. c) Payment of this fee should be made as directed by the Information Officer
  4. d) After receiving payment of a deposit fee Vodacom will then make a decision in respect of the request and will notify the Requestor of the decision
  5. e) Should the request be refused, the Requestor may lodge an application or appeal in accordance with paragraph 11 of the Manual  against the refusal of the request or payment of the requested fee and this will be advised in the notice to be sent to the Requestor (in terms of section 54(3) of the PAIA Act).
  6. f) If the request is granted then the Requestor might be required to pay a further access fee for the search, reproduction and preparation of the record as well as for the time that has exceeded the prescribed hours to search and to prepare the record for disclosure to the Requestor (in terms of section 54(6) of the PAIA Act).
  7. g) The fee schedule can be downloaded from the Department of Justice and Constitutional Development’s website at www.justice.gov.za

15. Annexure B: Prescribed Form C
16. Annexure C: Some of the key pieces of legislation in terms of which Vodacom is obliged to retain information / records

Vodacom keeps information and/or documents in accordance with the following legislation (This is not an exhaustive list):

LegislationType of information to be retained
a) Basic Conditions of Employment Act No. 75 of 1997The Act requires employers to keep records of information containing the personal details of all its employees, working times and remuneration package.
b) Broad Based Black Economic Empowerment Act No. 53 of 2003 (“BBBEE”)The BBBEE Act has as one of its objectives the promotion of economic transformation in order to enable meaningful participation of black people in the mainstream economy. It is expected that companies should keep records of activities undertaken in order to promote economic transformation and meaningful participation of black people in the mainstream economy.
Companies Act No. 71 of 2008The Act requires all company documents and records to be kept in a written format. Companies are also expected to maintain memorandum of incorporation and a record of their directors.  
Compensation for Occupational Injuries and Health Diseases Act No. 130 of 1993Employers are expected to keep a register, employee record or reproduction of same relating of wages, time worked, payment for piece work and overtime
Consumer Protection Act No. 68 of 2008The Act applies to all transactions in South Africa and is aimed at promoting and protecting the economic interests of consumers. The Act however does not deal with consumer personal information nor impose obligations on businesses in respect of treatment and/or protection of such information. 
Criminal Procedure act No. 51 of 1977The Act makes provision for the admissibility of documents as evidence where such documents were compiled in the course of trade or business by persons who have personal knowledge of matters contained in the document.
Electronic Communications Act No. 36 of 2005There are no specific requirements on the type of information to be retained. However it is expected that companies protect confidentiality of customer and to use it only for purpose authorized by the customer or in terms of the law
Electronic Communications and Transactions Act No. 25 of 2002The Act requires that information emanating from electronic transactions only be collected, collated, processed and disclosed with customer’s consent. Further, the purpose for which information is collected must be disclosed to the customer and must only be used for that purpose unless customer consents otherwise
Employment Equity Act No. 55 of 1998Employers are required to maintain records relating to the workforce, employment equity plans and other relevant records
Financial Advisory and Intermediary Services Act No. 37 of 2003

An authorized financial service provider is required to maintain records relating to:

premature cancellation of transactions or financial products complaints received and an indication whether such complaints were resolved

cases of non-compliance with the Act and reasons for such non-compliance

Financial Intelligence and Centre Act No. 38 of 2001

The Act requires that prior to establishing a relationship with a client Intelligence Centre’s should collect information relating to

Client’s Identity Document ID of a person on whose behalf the client is acting and proof of authority

Nature of business relationship/transaction

Amounts involved

Details of employee who captured info on behalf of company

Labour Relations Act No. 66 of 1995The Act requires employers to keep records of disciplinary transgressions against employees, actions taken and reasons for the action
National Credit Act No. 34 of 2005A credit provider is expected to maintain records of all applications for credit, credit agreements and credit accounts in the prescribed manner and form and for the prescribed time.
Occupational Health and Safety Act No. 85 of 1993Employers are required to keep records relating to the health and safety of persons in the workplace
Pension Funds Act 24 of 1956Every fund is expected to maintain books of account and other records as may be necessary for the purpose of the fund. All the money and assets belonging to the fund may be kept in the name of the pension fund by other institutions subject to conditions determined by the Minister
Prevention and Combating of Corrupt Activities Act No. 12 of 2004The Act provides for the strengthening of measures to prevent and combat corruption and corrupt activities. To this end companies are expected to keep records relating to any offer of improper gratification relating to the procurement or execution of contracts or employment relationship
Prevention of Organized Crime Act No. 121 of 1998The Act requires that any person who is aware of criminal activities is obliged to report them to the authorities. The duty of confidentiality or other restrictions on the disclosure of information, whether imposed by law, the common law or by agreement does not affect the obligation to report or disclose information or to permit access to any registers, records or other documents unless that obligation of confidentiality relates to attorney-client privilege.
Public Prosecution Authority Act No. 32 of 1998The Act regulates the establishment of a single National Prosecuting Authority. To this end the Director-General: Justice is required to cause the necessary accounting and other related records to be kept by the National Prosecuting Authority.
Regulation of Interception of Communications and Provision of Communication Related Information Act No. 70 of 2002 (“RICA”)

The Act requires the following information to be stored in respect of all customers:

Name, surname, ID number, MSISDN and one address

For businesses: name, registration number, business address, name and surname of business representative, his or her ID number as well as the address

The above information should be stored in a separate RICA database which complies with specific security requirements prescribed under the Act and is used only for RICA purposes

Short Term Insurance Act No. 53 of 1998Under the Act the policyholder, and the person who entered into the short-term policy, are entitled, against payment of a prescribed fee to be provided, upon request, with a copy of the policy agreement.
Skills Development Act no. 97 of 1998The Act requires, amongst other things, that employers who commence with learnership programmes to enter into learnership agreements with the learner concerned specifying the learnership to be provided, the duration of the learnership and an undertaking to provide the learner with the specified practical experience. To comply with this requirement Employers are expected to keep records of all learnership agreements.
Skills Development Levies Act No. 9 of 1999Every employer is expected to make payments towards the skills development levy at a rate of 1% of the leviable amount. Records detailing payments made by the Employer are expected to be kept.
Unemployment Insurance Act No. 30 of 1996An Employer is expected to keep records relating to payment of contributions to the Unemployment Insurance Fund relating to: illness, maternity and for dependents. The Act does however, subject to the provisions of the Promotion of Access to Information Act, No. 2 of 2000, prohibits the disclosure of information obtained in the performance of functions under the Act. 

17. Annexure D: Notice of Internal Appeal
18. Annexure E: Objection to the Processing of Personal Information
19. Annexure F: Request for correction or deletion of Personal Information or Destroying or deletion of record of Personal Information