Protection of Personal Information Policy

TECH REVIVAL, because of the role it fulfils as collator and custodian of sensitive personal information which includes information relating to identity, race, gender, age, identifying number, e-mail address, telephone number etc. has a legal and moral responsibility to its clients to ensure that all the staff of TECH REVIVAL:

• obtain and process personal information fairly;
• keep it only for a specified and explicit lawful purpose;
• process it only in ways compatible with the purposes for which it was given initially;
• keep personal data safe, confidential and secure;
• keep data accurate, complete and up-to-date;
• retain it for a period no longer than is necessary for the specified purpose;
• provide a copy of a client's personal information to that client, on request.

The introduction of the Protection of Personal Information Act ("POPIA") further strengthens the need to ensure confidentiality of personal information. POPIA is data protection legislation intended to protect the personal information of individuals held by third parties, centered on a set of "information protection principles" requiring that personal information be processed lawfully and in a reasonable manner that does not infringe on the privacy of the data subject.

"Data subject" means the person to whom personal information relates; the principal duty-bearer is the "responsible party" — the body which determines the purpose and means of processing personal information.

"Personal information" means information about a person's race, gender, sex, pregnancy, marital status, nationality, ethnic or social origin, sexual orientation, age, physical or mental health, disability, religion, conscience, belief, culture, language, education, medical information, financial information, criminal or employment history, an identifying number, e-mail address, physical address, telephone number, blood type, biometric information, personal opinions, views or preferences; private correspondence; and the person's name if it appears with other personal information relating to them.

"Process" means collection, receipt, recording, organization, collation, storage, updating or modification, retrieval, alteration, consultation, use, dissemination, distribution, merging, linking, blocking, degradation, erasure or destruction of information.

• Personal information may not be stored without the data subject's direct consent.
• A data subject may request to review or correct any personal information held about them at any time, and this may not be withheld.
• No personal information may be disclosed to any person without the data subject's direct authorisation — a breach is a serious, punishable offence.
• No alterations may be made to a data subject's information without their authorisation.
• No data may be released in a way that distinctively identifies a data subject for research, statistics, or similar purposes.

• Access to the TECH REVIVAL office, data centre, and server rooms is restricted to authorised staff.
• Access no longer required is removed.
• Passwords must be strong (numbers, symbols, upper and lowercase, 8–14 characters, no dictionary words or biographical information) and changed regularly with an audit trail.
• Requests for access to personal information from third parties are evaluated through a formal procedure.
• Staff who leave the company are removed immediately from access lists.
• Contractors and external service providers are bound by formal confidentiality agreements.
• Every employee receives and signs this Policy.
• A Risk Audit covering storage, handling, and protection of personal information is completed at least every six months.
• Paper and electronic client files are disposed of securely — paper is shredded, storage media is securely wiped at end-of-life.
• New staff are trained before being given access to personal information.
• Visitors and unauthorised persons may not view personal information on paper or on screen.
• PCs are locked when unattended; files are saved only to the allocated network drive, not local disks.
• A "clean desk policy" applies overnight.

• Personal information held electronically is stored centrally and not copied to laptops or portable storage devices.
• Remote access is via a secure encrypted link with strong passwords or token authentication, and cannot be copied from the central location to the remote device.
• Only company-approved machines with up-to-date anti-virus and full encryption may access personal information remotely, authorised by the Information Protection Officer.
• Wireless networks used for remote access must use the strongest available encryption.

• All portable devices are password-protected, with strong passwords meeting the standard above.
• Personal information should not be stored on portable devices; where unavoidable, the device must be encrypted (full-disk encryption for laptops).
• Care is taken to avoid disclosure in public places.
• Only authorised, licensed software may be installed.
• Anti-virus and firewall software is kept up to date.
• Each device is authorised for use by a specific named individual, who is responsible for its physical safeguarding.
• Laptops are physically secured overnight and never left in an unattended vehicle.
• Portable storage media is used only where there is a genuine business need.
• Personally owned devices (media players, cameras, USB sticks) cannot connect to TECH REVIVAL computers.
• A clear procedure exists for immediate reporting of a lost device so it can be disconnected from the company's systems.

Transfers happen only where necessary, via the most secure channel available, encrypted with strong passwords sent separately from the data. Standard email is never used to transmit personal information.

Any transfer to a third party requires a prior written agreement covering:

• what information is shared, why
• named contacts
• frequency
• transfer/encryption method
• acknowledgement procedure
• retention period
• an equivalent security commitment from the third party
• how breaches will be reported

All transfers must be legal, justifiable, and necessary.

Under Section 22 of POPIA, a data subject may request confirmation that TECH REVIVAL holds personal information about them, a description of it, and details of who has accessed it — such requests go to the Information Protection Officer.

Under Section 23, a data subject may request correction of information that is inaccurate, incomplete, misleading, out of date, or unlawfully obtained — also handled by the Information Protection Officer.

• TECH REVIVAL maintains up-to-date firewall technology and restricts access to personal information to staff with a genuine business need.
• Audit trails capture instances of inappropriate access, addition, deletion, or editing of data, and access is monitored on an ongoing basis by the Information Protection Officer.