1. Policy Statement

The development of a standard operating procedure to ensure adequate protection of personal client information which becomes available to EMPOWER FINANCIAL SERVICES (PTY) LTD and its personnel is of utmost importance for the effective operations and risk management of the company.

Internal control mechanisms to constantly review and measure adherence to procedure are important risk management tools and assist the company in treating our clients fairly. The absence of policy and procedure will expose the company to unnecessary risk and create a burden in respect of financial and other regulatory requirements.

EMPOWER FINANCIAL SERVICES (PTY) LTD subscribes to the principles espoused in the Protection of Personal Information Act and the Constitution of South Africa in respect of:

• The lawful processing of client data by EMPOWER FINANCIAL SERVICES (PTY) LTD, acting as a responsible corporate citizen.
• The identification and allocation of accountability where personal data is processed contrary to the prescripts of the Act.

2. Meaning / Definitions

Act means the Protection of Personal Information Act, 4 of 2013.

Data subject means the person to whom personal information relates.

Policy means this policy on the lawful processing and protection of client information.

Procedure means a statement or number of statements, contained in a separate yet linked document.

3. Scope and Application

3.1 Lawful Processing

• The purpose of data use must be lawful.
• Processing must not infringe on client privacy.
• Data must be relevant and limited to purpose.
• Consent must be obtained where required.
• Data should be collected directly from the data subject unless required otherwise.
• Third-party processing requires agreements.
• Data subjects may object to processing.

3.2 Collection & Retention

• Data must be collected for a defined purpose.
• Data subjects must be informed.
• Data must be accurate and high quality.
• Retention must be limited to required duration.
• Data must be securely destroyed when no longer needed.

3.3 Transparency

• Users must know what data is collected.
• Users must know why it is collected.
• Users must know their rights.

3.4 Protection of Data

• Data must be secure and confidential.
• Security controls must align with best practices.
• Third parties must comply with policy.
• Breaches must be reported.
• Cross-border transfers require consent and safeguards.

3.5 Access to Information

• Users may request access to their data.
• Users may request corrections.
• Sensitive data processing is restricted unless authorised.
• Children’s data requires guardian consent.

3.6 Information Officer

• An Information Officer ensures compliance.
• Deputies may be appointed.

4. Standards and Application

• Compliance with SA regulatory standards.
• Departments must review and align processes.

5. Review

• Annual review of policy.
• Compliance reporting to management.

6. Authority

• Information Officer has authority.
• Executive Committee may amend policy.