Henley Business School, Africa Privacy Notification to Data Subject when Collecting Personal Information

 

Who we are?

  1. Henley Business School Africa is an international, triple accredited business school which offers a holistic learning system by blending theory with practice. Our holistic learning system means students can look forward to business education that provides them with insightful business acumen, the ability to both master themselves and lead and manage others, and exceptionally relevant and practical theory that is tried and trusted in practice in their own workplace.
  2. Henley Business School Africa is committed to protecting the information we hold about you.  This notice applies to all of the businesses making up Henley Business School Africa.  In this notice, we refer to ourselves collectively as “Henley Business School Africa”, “we”, “us” and “our”. 
  3. This notice provides you with information about how, when, and why we use your personal information and how we keep it secure. It also sets out your rights under law, our responsibilities to you and how you can contact us. 
  4. This notice concerns any information that we collect in the following ways:
    • Information we receive through our website https://www.henleysa.ac.za, where applicable. Additional details of the information we receive through the Henley Business School Africa Website can be found in our cookie policy; and
    • Information we receive as a result of the products and services that we offer, including through our related support, mobile or cloud-based services.  Should you have any questions about who we are, or what we do with your personal information, please contact us using the information provided in Part B.

 

2. Part A: General Information

Personal Information we hold about you.

(A description of the types of personal information about you that we collect, use, process and share.)

  1. As with most businesses, we collect personal information about you. Most of this information is necessary for us to comply with our legal obligations, to enter into a contract with you, or for legitimate business purpose. 
  2. When you apply to become an employee, a client or a student, and during the course of our dealings with you, we will collect some personal information about you. This includes what you tell us about yourself and what we learn by having you as an employee, customer or student.  Whether this collection is mandatory, or voluntary, will depend on the reason why we are collecting your personal information. For example, if you want to become a student of ours, we require certain mandatory information from you to be able to add you to the relevant system and course programme you register to.  If you refuse or fail to supply this information, we will not be able to enter into a business relationship with you. However, if you voluntarily contact us about our services and you are not a client or a student, you are in control of what information you volunteer, and which is subsequently collected by us. We have set out below a description of the types of personal information about you which we will collect and process in different situations when you interact with us.
  3. Personal information that we generally process regardless of how you contact us, or for whatever reason, includes:
    • your title, full name, your contact details, including for instance your email address, home and mobile telephone numbers; and/or
    • your home address, correspondence address (where different from your home address) and address history.
  4. If you submit an application to become a student or are already one, in addition to the above personal information, we may collect the following from you:
    • your date of birth and/or age; financial information (current salary), including your bank account information, sex, race, ID number, Nationality, current employment details, your work experience, higher education, professional qualifications and disability status;
    • personal information and contact information which you provide in correspondence with us, whether by email, written letter, or telephone call or through our online enquiry system (this will be information volunteered by you); and/or
    • information relating to your use of our service.
  5. When you interact with the Henley Business School Africa Website or any online system, in addition to the above personal information, we may collect the following from you:
    • your login information, including your username and password;
    • where you submit an application for employment, such information may include education and qualification details, training and professional memberships and accreditations, date of birth and/or age, current and previous employers, details of criminal convictions, health related information and disability status; and/or
    • technical information about the products and services that you use, and how you use them. For more information see “Henley Business School Africa Website and other websites” section.
  6. In addition to the above, we may collect the following information from you when required:
    • to comply with our legal and regulatory requirements, your tax residency and/or nationality;
    • for anti-money laundering purposes, personal information which we obtain from identity verification agencies;
    • to secure your online valuation facility, the answers to security verification questions, and/or your username.

 

Where we get our information about you 

{Details of information which you give to us, which we gather ourselves and which we seek from third parties.}

  1. Information that you provide to us. We typically collect the personal information directly from you as part of our client process when you complete an application form and provide proof of your identity.  Additionally, we collect personal information from you when you correspond with us (whether by telephone, e-mail, or through the Investec Website) or complete a request for a product or service. The nature of our relationship with you will determine the kind of personal information we might ask for.
  2. Information that we collect or generate about you. We will continue to collect additional personal information that we learn about you during the course of providing our products and services, such as:
    • the way you use our online services;
    • information which you provide in correspondence to us (whether by telephone, e-mail, or through the Henley Business School Africa Website), including contact history; and/or
    • information collected through the use of cookies or similar technologies.
  3. Information that we obtain from other sources. Sometimes we collect additional information about you from third parties. Specifically, we will obtain information about you from:
    • agencies that provide us with background checking services (if you apply for a job); and/or
    • a third party who you have tendered as a reference {if you apply for a job}.

 

How we use information about you and why

{A description of what we use your personal information for, why we use it and why we are allowed to use it.}

  1. General
    • We mainly use the personal information we hold about you where it is necessary for us to perform our contract with you and/or to enable us to comply with legal obligations.  Your personal information will also be used when it is in our legitimate interest. A legitimate interest is when we (and sometimes third parties) have an academic, business or commercial reason to use your information. But even then, our legitimate interest must not unreasonably go against what is right and best for you.
    • Each of these categories is a ‘legal basis’ that allows us to process your information under data protection law (GDPR and POPI). We have provided further information below about what this actually means, in terms of how we process, or the purposes for processing your personal information relevant to each legal basis.
  2. Necessary use of your personal information so that we can fulfil our obligations to you and provide you with the agreed products and services, including:
    • to communicate with you about your service, to verify that your instructions are genuine and to process them accordingly;
    • to enable us to process your student registration, switch, conversion or redemption instruction;
    • to recover any money amount owed to us;
    • to investigate and deal with complaints or disputes;
    • to contact you when we have updated this Privacy Notice and consider that it is necessary to advise you about any changes to the way we are processing your personal information;
    • to transfer your personal information to any third party who replaces Henley Business School, Africa as a provider of services to you; and/or
    • to share your personal information with third parties (such as our service provider who assists us administer or process transactions on our behalf) if required for the management of your product or service.
    • We need to use some personal information to provide you with our service and to fulfil our contract with you.
  3. Use of your information is necessary for us to comply with our legal obligations.
    • to verify your identity and to carry out regulatory checks (such as identity verification checks);
    • to comply with audit requests from our auditor;
    • to comply with requests made by you when exercising your legal rights (such as those contained within this Privacy Notice); 
    • recording incoming and outgoing calls for regulatory purposes;  
    • We need to use some personal information to comply with legal obligations. 
  4. Use of your information which is necessary to pursue our “legitimate interests”.
    • We are allowed to use your personal information to pursue our own interests as long as your fundamental interests do not override these. 
    • This will include processing which, on balance, we consider is in our legitimate interests and which do not cause you undue prejudice. Our legitimate interests which are applicable to our processing of your personal information include:
      • recording incoming and outgoing calls for training, monitoring, and security purposes, as well as to keep an accurate record of any instructions received from you;
      • administering and managing your account(s) and services relating to that, updating your records, tracing your whereabouts to contact you about your studies and account;
      • to adhere to guidance and best practice under the regimes of governmental and regulatory bodies such as tax authorities, ombudsmen and regulators; 
      • for management and audit of our business operations including accounting;
      • reviewing and improving the information provided on the Henley Business School Africa Website to ensure is it user friendly and to prevent any potential disruptions or cyber-attacks;
      • conducting analysis required to detect malicious data and understand how this may affect your IT system;
      • for statistical monitoring and analysis of current attacks on devices and systems and for the on-going adaptation of the solutions provided to secure devices and systems against current attacks;
      • to carry out searches at identity verification agencies pre-application, at the application stage, and periodically after that;
      • to determine the target market for our existing and future products;
      • to contact you when we have updated this Privacy Notice and consider that it is necessary to advise you about any changes to the way we are processing your personal information;
      • when, to achieve the above purposes, we share your personal information with the following categories of individuals or organisations:
        • members of our school;
        • our legal and other professional advisers, auditors;
        • governmental and regulatory bodies such as tax authorities, ombudsmen and regulators (depending on the circumstances of the sharing); 
        • other organisations and businesses who provide services to us under contract such as agents that recover money owed to us, back up and server hosting providers, IT software and maintenance providers, document storage providers and suppliers of other back-office functions;
        • market research organisations who help us to develop and improve our products and services.
        • (Should you have any questions about the above listed categories of people and/or organisations, please contact us using the contact information provided in this Privacy Notice.)
  5. Use of your personal information with your consent.
    • Where we are relying on your consent to process your personal information, you are entitled to withdraw your consent at any time.
    • However, as noted above, we are usually processing your personal information based on another reason, in which case withdrawing your consent will not change how we process your personal information. 
    • Unlike the uses described above, sometimes we rely on your consent to use your personal information. We will rely on your consent:
      • when you request that we share your personal information with someone else and consent to that (for example if you apply for a job and request that we provide information about your study record to that potential employer);
      • where you have submitted an application for employment on the Henley Business School, Africa Website, to process your application;
      • where you have opted-in to receiving marketing communications (and have not subsequently opted-out or requested to be removed from any marketing list); and/or
      • where you have opted-in (and have not subsequently opted-out) for the processing of your personal information for analysing purposes by means of cookies and other technologies, e.g. to provide you with a better user experience; and/or
      • when you volunteer information to us in correspondence, which information we need in order to respond to your enquiry, and only where lawful to do so.
    • You have the right to withdraw your consent at any time – the contact information is given in Part B.  Please note, if you do withdraw your consent, this will mean that we will stop similar future processing. However, the withdrawal of your consent will not invalidate any processing which we previously undertook before you withdrew your consent.
    • Please note that, where we rely on another lawful reason to process your personal information which does not require your consent, withdrawing your consent will not affect that processing.  This is the case where the processing is necessary for our performing our contact with you, or where we must process your personal information to comply with law, as described above. We will continue to process your personal information for those lawful purposes notwithstanding the fact that you have withdrawn your consent for one of the above listed purposes that requires your consent.

 

Whether you have to provide personal information

(An explanation of whether you have to provide personal information to us and what happens if you do not.)

  1. If you want to use our services, there is some information which you will be required to provide to us either because of legal requirements, or because we need that information to provide our services to you. 
  2. We are required to collect some personal information by law and regulation. 
  3. In other cases, we need the information in order to provide our service to you.  
  4. We will tell you when the personal information requested is mandatory, or if it is voluntary.  If you do not provide that personal information that is mandatory, we will be unable to properly provide you with the services and/or perform all obligations under our agreement with you.
  5. Where you choose not to provide us voluntary personal information this may reduce the quality of service, we are able to provide (for example, if you only provide us your postal address and do not provide us with your e-mail address, we will only be able to contact you by postal mail).

 

When we share your information with others

(Information about third parties that we share your information with. If you provide us with personal information about other people – such as a reference or your dependents – you must show this privacy notice to them, and you must ensure that you have their consent to provide their personal information to us.)

  1. Your personal information will be shared with other businesses, regulators and authorities.
  2. Yes, there are times when we are either mandated by law to disclose your personal information to third parties (such as Tax authorities). In addition, where we contract third parties to help us run our business, we will also disclose your personal information to those third parties, but always subject to appropriate contracts and safeguards.
  3. We will never sell, rent or trade your personal information.
  4. We will share your information with others who have a duty to keep it secure and confidential, and where we have a lawful reason for doing so, as explained above.
  5. The categories of organisations that we will share your information with are:
    • our service providers, agents and sub-contractors who administer or process information on our behalf (such as an auditor);
    • professional advisors, such as lawyers, accountants; and/or
    • anyone we transfer our rights and duties to – e.g. if we restructure or sell our business.
    • Government departments such as Department of Higher Education and the Council for Higher Education and or the South African Qualifications Authority for regulatory purposes, keeping good governance and to remain an accredited educational institution.
  6. If you have further questions about the third parties, we share your personal information with, please contact us using the details in Part B.
  7. We cannot control all use of your information by third parties (especially where they are not our service providers and under contract with us, for example personal information shared with regulators). As such, where your personal information has been shared with another responsible party entity, you will have rights over how that third party handles your personal information and you can and should contact those parties directly if you want to exercise your rights in relation to those third party’s uses of your personal information.  

 

Where we transfer your data

(A notification that your information is transmitted and processed outside the Republic of South Africa.)

Where we transfer your personal information outside of the Republic of South Africa, the safeguards that we will use to protect your personal information include contractual obligations imposed on the recipients of your personal information. Those obligations require the recipient to protect your personal information to the standard required in the Republic of South Africa. Safeguards also include requiring the recipient to subscribe to ‘international frameworks’ intended to enable secure data sharing and where the framework is the means of protection for the personal information.

 

How long we will keep your information.

(A summary of the circumstances in which we can keep your information)

  1. We will keep your personal information as long as you are a student, client or employee of Henley Business School Africa.
  2. Your information may be held for a considerable period after our relationship ends (or indefinitely if anonymised). 
  3. After you cease to be a client, student or employee of ours we may keep your data for up to an additional 10 years for one of the below reasons:
    • To respond to any questions or complaints.
    • To show that we treated you fairly.
    • To maintain records in accordance with the rules that apply to us.
  4. We may keep your data for longer than 10 years if we cannot delete it for legal, or regulatory reasons. We may also keep it for research or statistical purposes. If we do, we will make sure that your privacy is protected and only use the data for those purposes and, to the extent possible anonymised.
  5. If you have further questions about our data retention practices, please contact us using the details in Part B. 
  6. If we anonymise your personal information so that it can no longer be associated with you, it will no longer be considered personal information, and we can use it without further notice to you.

 

Your rights (‘data subject’ rights)

(A summary of your general rights over personal information.  Please note that these do not always apply as there are exceptions in the POPI Act.)

  1. Under the POPI Act you have a number of rights (set out below). Please note that these rights are not without limitation, and in some instances may not be available.
  2. You have a number of rights over your personal information including a right to object to the processing of your information.  You will not be able to use these rights in all circumstances. You are also entitled to make a complaint to the regulator. 
  3. Where applicable, you have the right to:
    • be informed about our processing of your personal information;
    • have inaccurate/incomplete personal information corrected/completed;
    • object to the processing of your personal information;
    • restrict the processing of your personal information;
    • have your personal information erased;
    • request access to your personal information and to obtain information about how we process it;
    • move, copy or transfer your personal information digitally; and
    • object to automated decision making, such as profiling.
  4. To exercise your rights as set out above, please write to us using the details in Part B. There is no fee for making these requests.  However, if your request is excessive or unfounded, we can charge a reasonable fee or refuse to comply with it.
  5. You also have the right to lodge a complaint with the information regulator if you think that we have infringed any of your rights. Information about the information regulator is set out in Part B.

 

Henley Business School Africa Website and other websites

(Information about the Henley Business School Africa Website and the information we collect.)

  1. If you use the Henley Business School Africa Website, we may collect technical information through the use of cookies. For example, what pages of the Henley Business School Africa Website were visited by each user, any documents downloaded and security incidents. For more information on the cookies used by Henley Business School Africa, please see our Cookie Policy here: https://www.henleysa.ac.za/ 
  2. If you use the Henley Business School Africa Website and follow a link from it to another website different privacy policies may apply. Prior to submitting any personal information to a website, you should read the privacy notice applicable to that website.
  3. The content of this notice is likely to change over time.  We will tell you if it changes.
  4. We will always have the latest version available on the Henley Business School Africa Website.

 

Future changes to this privacy notice

(A notification that the privacy notice can change and that we will update you about changes.)

  1. We reserve the right to update this privacy notice at any time, and we will notify you when we make any substantial updates. 
  2. We will also notify you in other ways from time to time about the processing of your personal information.

 

Part B – Contact Information

How you can contact us with questions

Henley Business School Africa 

You can contact Henley Business School Africa if you have any questions about this privacy notice or information, we hold about you.

Our Contact Particulars.

Organisation Name:

Henley Business School, Africa

Write to us:

P.O. Box 2890, Sunninghill, 2157

Email us:

info@henleysa.ac.za

Call us:

+27 11 808 0860

 

Our Information Officer:

Information Officer:

Jacques le Roux

Deputy Information Officer:

Frempong Acheampong

E-Mail Address:

jacqueslr@henleysa.ac.za

Contact Number:

+27 11 808 0860

Address Postal:

P.O. Box 2890, Sunninghill, 2157

 

Information Regulator

You can contact the Information Regulator if you have any complaints about this privacy notice or information, we hold about you.

Information Regulator

Address:

33 Hoofd Street; Forum III, 3rd Floor Braampark

Tel No:

+27 (0) 10 023 5200

Email:

complaints.IR@justice.gov.za

Web Address:

https://www.justice.gov.za/inforeg/contact.html