POPIA AND POPI
POPIA (The Protection of Personal Information Act, Act No. 4 of 2013) and POPI (the Protection of personal
Information)
Who are we?
The Brand Surgeon is a South African based research company who do qualitative and quantitative market research
online research panel where consumers give our clients’ feedback in exchange for a reward. We deliver high-quality
market research data to clients who are in various business industries, including other market research agencies.
We maintain online and face to face consumer panels and research surveys, providing real-time digital consumer insights to our clients via our market research surveys and analytics platforms.
The Brand Surgeon is a company with whom you register as a member, and we are responsible for your personal data.
What is POPI?
The Protection of Personal Information (POPI) Act (No. 4 of 2013) is a governmental regulation designed to protect the personal information of South African citizens, similar to the General Data Protection Regulation (GDPR) in Europe. If we are collecting personal information of SA citizens (for instance, through interviews or focus groups, or surveys that collect identifiers such as names, contact information, etc.), The Protection of Personal Information Act (POPI) regulates how we handle your personal information while we do our work as a market research consultancy.
POPI stands for Protection of Personal Information. Regardless of whether there is a law or not, The Brand Surgeon
needs to ensure that the Personal Information we capture, manage and store, is secure. It makes common, logical sense that this information is sensitive, and shouldn’t be exposed. One of the principles that we all should consider is “privacy by design”.
This means that we consider privacy implications in all our processes and systems and build security and privacy
concepts into the day-to-day operation within the Brand Surgeon. POPI is all about Privacy, and this means security. In order to secure information, we have systems and structures in place to understand what information is gathered and how it is kept.
The core focus of POPI in a research context is ensuring that if personal identifiers must be collected, they need to be stored in a secure, access-controlled location to prevent the data being harvested and used by third parties. POPI does not prevent open data sharing – in fact, open data sharing, by virtue of the need to remove personal identifiers from shared datasets, complies entirely with POPI. In research, POPI impacts more on research process, such as being strategic in storing only de-identified datasets on cloud storage, and ensuring that on-site storage (personal hard drives, external hard drives, the UCT G Drive) is strictly access-controlled to named and designated individuals to ensure data protection.
POPI is intended to balance 2 competing interests, these are:
1. Your constitutional right to privacy (which requires your personal information to be protected): and
2. The needs of our company to have access to and to use your personal information for legitimate research
purposes, for example, to enable us to do our work for you.
POPI obliges us to inform you of our process.
What is POPIA?
POPIA stands for the Protection of Personal Information Act, Act No. 4 of 2013 or POPI Act. This is the new law and is something that most (if not all organisations, including The Brand Surgeon) will need to follow.
The difference between POPI and POPIA is that POPI is the act of protecting Personal Information. This implies that all the policies, procedures, processes and practices in the Brand Surgeon relating to personal information, are in fact doing POPI. In order to comply with POPIA, we needed to implement a POPI programme. In order to implement it, there were a number of steps which need to be followed and a number of documents and instruments which were developed.
What is our Privacy obligation to you?
We value your privacy and are dedicated to protecting your personal information. This privacy notice describes how we collect, use, share and secure your personal data on www.thebrandsurgeon.co.za. It also describes your privacy rights and how laws that are applicable to you may protect you and is intended to add to other notices and privacy policies.
Personal data we collect?
Personal data means any information about an individual from which that person can be identified. It does not include data where the identity has been removed.
We may collect, use, store and transfer different kinds of personal data about you which we have grouped together
follows:
1. Contact data: email address and telephone number.
2. Identity data: name, date of birth, marital status, gender, panellist id and username.
3. Demographic: interests, preferences; age, marital status, gender, birthday, household size, income, education
and employment status.
4. Special categories of personal data: ethnic/racial origin, health, genetics.
5. Pseudonymised data: are identifiable data as unique identifiers (e.g. panellist ID’s).
Public forums and blogs
Our website and platform securely hold your information and not publicly accessible except a respondents own personal profile (accessed via a login name and password). You should be informed that any information you offer can be read, collected, and used by third parties and other research clients.
We strongly discourage you from disclosing any of your personal data in any public forum or community area that you may find on the site and in particular, we would never ask you to provide your Contact details or Identity data on a public community area, even if it was part of a survey.
Who do we share your personal data with?
Feedback we gather from you via our surveys, online panels and face to face research is delivered to our clients either in anonymised and aggregated form or in pseudonymised form. If we give the results in anonymised and aggregated form, the results involve data about groups of individuals and not on an individual level. If we supply the results in pseudonymised form, the results will be on an individual basis, using unique identifiers, such as your assigned panellist ID, but will not include your Identity data or Contact data.
What other ways can you become a member of our panel?
We may make accessible a service either directly or through third parties by which you can receive messages on your wireless device via short message service.
Your provider’s standard data and messaging rates apply to all SMS correspondence. All charges are billed by and payable to your mobile service provider. You represent that you are the owner or authorised user of the wireless device on which messages will be received and that you are authorised to accept the applicable charges.
What cookies do we use on our site?
We employ cookies on our site to distinguish you from other account holder of our site and estimate visits and click
throughs for specific campaigns. This helps us to offer you a good experience when you navigate our site and also allows us to improve our site. These cookies expire when your browsing session ends. By continuing to browse the site, you are agreeing to our use of cookies.
A cookie is a small file of letters and numbers that we store on your browser or the hard drive of your computer if you agree. Cookies contain information that is transferred to your computer’s hard drive.
What are other Tracking Technologies?
Surveys – client cookie tracking, including for Ad effectiveness campaigns.
Each respondent is given a unique ID by ourselves, who may write, set or read cookies or use other Technical data about you from multiple locations, including our own servers or systems. If you participate, your ID will be stored or associated with those technical data to allow us and/or our clients to conduct online survey campaigns, track your visits to websites, use your demographic/ profile data to create look-a-like segments and/or gain other online insights about you. If you have interacted with the online ad or promotion, our client will send you ID and the specific survey to us and we may provide you with the opportunity to complete the survey.
Technologies
Automated technologies or interactions.
As you interact with the site, we will automatically collect technical data about your equipment, browsing actions and
patterns. We collect this technical data by using cookies, server logs, digital finger printing technologies and other similar technologies. We may also receive technical data about you if you visit other websites employing our cookies.
Fingerprinting technologies:
In general, digital Fingerprinting technologies assign a unique identifier or “Machine-ID” to a user’s computer to identify and track your device. The Technology will analyse publicly available information and data obtained from your computer’s web browser and from other publicly available data points, including the technical settings of your computer, the characteristics of your computer, and its IP Address, to create a unique identifier, which will be assigned to your device.
We use the Technology for quality control, validation, and fraud detection and prevention purposes, including assisting us in ensuring the integrity of survey results. Appropriate technical and operational processes and procedures will be put in place to ensure that the technology is safe, secure and does not cause undue privacy or data security risks and the technology will be used and distributed in a professional and ethical manner.
What is our reward cashing in policy and prize winner’s policy and privacy guarantee?
Members and others who take our surveys are usually issued reward points and when they reach 1000 points, they can cash these in via our cash out system. In the event of a randomly selected prize being offered to one or more winners, to win prizes for participation in surveys, content, and other promotions, all winners are notified by email or via our site of their winnings. The Brand Surgeon shall post the usernames of winners on our site and on our own blogs and newsletters.
For more information, please visit our Terms and Conditions page. Cash and other prizes awarded to non-members will be awarded directly.
What security measures do we undertake to protect your personal data?
We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal data to those
employees, agents, contractors and other third parties who have a business need to know. They will only process your personal data on our instructions, and they are subject to a duty of confidentiality.
Although we do everything, we can keep your data safe, unfortunately no systems can guarantee they are 100% secure. If you have questions about the security of your personal data, or if you have reason to believe that the personal data that we hold about you is no longer secure, please contact us immediately as described in this Privacy Notice.
We have put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator or supervisory authority of a breach where we are legally required to do so.
Should you have any issues with the way in which we are processing your personal information, you are entitled to lodge a complaint with the Information Regulator, whose contact details are:
33 Hoofd Street
Forum III, 3rd Floor Braampark
P.O Box 31533
Braamfontein, Johannesburg, 2017
Complaints email: complaints.IR@justice.gov.za
General enquiries email: inforeg@justice.gov.za.
What are our data retention and destruction policies?
How long will you use my personal data for?
We will only retain your personal data for as long as necessary to fulfil the purposes we gathered it for, including for the purposes of satisfying any legal, accounting, or reporting requirements.
To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the
applicable legal requirements.
How do you access your information?
When requested, The Brand Surgeon will supply you with details about whether we hold any of your personal data on our platform. You may access your information at any time via your unique login and password (which you have created), rectify, or request deletion of your personal data, or cancel your membership by logging into your Member Account. By following the appropriate directions, your details should be automatically updated or deleted in our database.
Data Retention
If you cancel your membership, we will no longer use your personal data to contact you, but in conformity with our backup procedures, we will retain your personal data until your personal data are eventually destroyed in accordance with our data retention and destruction policies and we will continue to use the security procedures and technologies to keep your personal data safe.
You have the right of access to your personal information on the Brand Surgeon research platform and the right to
correct any errors relating to the information that we have on record. In addition, you have the right to object to us
continuing to process your personal information and request us to remove your personal information. In this regard,
please note that if you do exercise this right, we you will not be able to do any further paid market research projects for us, and we will remove you from the platform and cease to contact you. You will also forfeit any rewards under 1000 points. Any above 1000 points you may cash out prior to unsubscribing, but not after you have unsubscribed. When you unsubscribe, you remove the right to cash any rewards out as your information and project history will be removed and unattainable.
Will I get spam as a result of joining The Brand Surgeon?
No. Our respondent platform has been created solely for marketing research purposes and your personal information will not be shared nor sold to third parties. Your contact details will only be used by The Brand Surgeon for research. For more information, read our Privacy Policy.
Changes to the privacy notice
The Brand Surgeon has the right to change this privacy statement at any moment, you have the sole responsibility to review it constantly. If we do decide to change our privacy notice, we will post those changes to this privacy statement on the homepage, or other places we deem appropriate so that you are aware of what information we collect, how we use it, and under what circumstances, if any, we disclose it. If we make material changes to this policy, we will notify you here, by email, or by means of a notice on our home page prior to the change becoming effective. It is important that the personal data we hold about you is accurate and updated. Please keep your Account details updated if your personal data changes during your relationship with us.
Privacy contact details
We trust that our processing of your personal information will be handled in a way that complies with all the relevant laws and that your rights to privacy will be protected as required by law and within the South African Market Research protocols.
We are dedicated to attending to your queries and if you are a The Brand Surgeon member and have questions about this, please email us at survey@thebrandsurgeon.co.za
