Privacy Supplement

Vodacom South Africa is the Responsible Party in terms of the Protection of Personal Information Act 4 of 2013 (“POPIA”) as it relates to the provision and facilitation of using biometric information for purposes of identity verification, security and fraud prevention purposes.

Your opinion matters to us – if you have any questions about this privacy supplement, you can email VSA at: [email protected] or you can write to our privacy team at:

Vodacom (Pty) Ltd

Vodacom Corporate Park

082 Vodacom Boulevard

Midrand

1685

VSA will collect a limited set of Personal Information to ensure that we verify and confirm your identity prior to providing any products to you, more specifically, the following information is collected by VSA :

• Cell phone number: to receive the SMS with the link to capture your selfie image if you are not in store or cannot capture your image using the in-store camera.
• Email Address: to receive the link to capture your selfie image if you are not in store or cannot capture your image using the in-store camera.
• ID number: to verify your ID number and selfie image against the Home Affairs National Identification System (“HANIS”) database.
• A copy of your identity document (where required)
• The outcome of the biometric verification (whether you have been verified based on your biometric information
• Your uploaded image/photo: is used to facially match your selfie image to the image in the Department of Home Affairs image (or other trusted databases) and confirm your identity.
• Fingerprints: are used to match your fingerprints image to the Department of Home Affairs image to confirm your identity.

VSA processes your personal information for specific and limited purposes. These include:

• to verify your identity
• To identify potential fraud
• supporting fraud investigations and risk assessments
• to assess and handle any customer queries in relation to the biometric processing and
• complying with regulatory and legal obligations

Your biometric information might be shared with verification service provider to validate it against the HANIS database. 

Please note that third-party service providers may also have independent access to other forms of your personal information if you provided them with a separate consent. 

We use reasonable measures to store, transmit, and protect personal information from unlawful disclosures. 

We may not retain your personal information any longer than is necessary for achieving the purpose for which your personal information was collected or subsequently processed. We will only retain your information if:

• The retention of your personal information is required or authorised by law.
• We reasonably require your personal information for lawful purpose related to our function or activities.
• The retention of your personal information is required by a contract that we enter into with you.
• Vodacom does not retain raw biometric data but may receive verification outcomes and associated metadata. All data is retained only as long as necessary for the purposes outlined above and in accordance with POPIA.

VSA may also retain your personal information for the following reasons:

• Your personal information may also be retained so that we can continue to improve your experience with us and to ensure that you potentially receive alternative and /or related products or services if you have taken up a product/service with us.
• We will actively review the personal information we hold and delete it securely, or in some cases anonymise it when there is no longer a legal, business or consumer need for it to be retained.

At VSA, we are committed to processing personal information honestly, ethically, with integrity, and always consistent with applicable laws and our values. Below we set out details on how you can exercise your rights. Please note, under certain circumstances these rights may be limited if we still have lawful grounds to process your personal information. If you have a question or cannot find the answer, please contact the privacy team via the contact details provided above and /or in the respective privacy policy / notice mentioned above.

An automated decision is a decision that is made solely by automatic means, where no humans are involved in the decision-making process related to your personal information. Where any automated processing is applied, we will ensure same is conducted only to ensure that we provide our products and services in a responsible manner. Please also note that if your biometric information cannot be automatically verified against the defined database, Vodacom will provide an alternative verification methods to verify your identity as may be applicable.

You have the right to request a record or description of personal information that we hold about you. This includes the right to request VSA to confirm, free of charge, whether or not it holds any personal information about you; as well as information about the categories of third parties who have, or have had, access to your personal information. To make this request please contact the VSA privacy team at [email protected]

You have the right, in certain circumstances, to object to VSA processing your personal information.  To provide you with products and services, we are required to verify your identity and process your personal information which is necessary for the conclusion or performance of a contract and to give effect to you signing up to our products/services and as such the provision of your personal information is mandatory.

VSA strives to only process and retain your personal information for as long as we need to. In certain circumstances, for example, where you indicate that your personal information is inaccurate, irrelevant, excessive, out of date, incomplete, misleading, or obtained unlawfully, you have the right to request that we erase your personal information that we hold. If you feel that we are retaining your personal information longer than we need, it is worth first checking that your products/services with us have been terminated, which you can do with Customer Services. If your contract with us has been terminated or we require the information for any other lawful business purposes, we may still have lawful grounds to process your personal information.

If you feel that the personal information, we hold on you is inaccurate, or you believe we shouldn’t be processing your personal information, please contact our Customer Services team at 082 135 or  [email protected]. In certain circumstances, for example where you contest the accuracy of your information, or where VSA no longer requires your information for achieving its purpose but must maintain it for purposes of proof, you have the right to ask us to restrict processing.

If you want to contact us about any of your rights or should you believe that we have used your personal information contrary to applicable law, you undertake to first attempt to resolve any concerns with our Privacy Office at [email protected]  If you are not satisfied with such process, you have the right to lodge a complaint with the Information Regulator at: The Information Regulator (South Africa)

Woodmead North Office Park
54 Maxwell Drive
Woodmead
Johannesburg
2191
Email: [email protected]

• We will update this privacy supplement when necessary to reflect customer feedback and changes in our products and services or processes.
• If the changes are significant, we will provide a more prominent  notice (including, for certain services, email notification of privacy supplement changes). We will also keep prior versions of this privacy supplement in an archive for your review.
• We will not reduce your rights under this privacy supplement.