POPIA Compliance

1. About POPIA

The Protection of Personal Information Act 4 of 2013 ("POPIA") is South Africa's data protection legislation. It regulates how organisations collect, process, store and share the personal information of individuals. Inco Link Construction is committed to full compliance with POPIA and respects the privacy rights of all data subjects.

2. Responsible Party

In terms of POPIA, Inco Link Construction is the "Responsible Party" for the processing of your personal information. This means we determine the purpose and means of processing your data.

3. Purpose of Processing

We collect and process personal information for the following specific purposes:

• Responding to project enquiries and requests for quotation
• Entering into and fulfilling construction contracts
• Managing client relationships and project communication
• Complying with statutory, regulatory and tax obligations
• Managing subcontractor and supplier relationships
• Health and safety record-keeping in accordance with safety and quality requirements
• Improving our website and services

4. Conditions for Lawful Processing

Inco Link Construction processes personal information in accordance with the eight conditions for lawful processing as set out in POPIA:

1. Accountability: We take responsibility for complying with POPIA and have appointed an Information Officer.
2. Processing limitation: We collect personal information only for specific, defined purposes and with the knowledge or consent of the data subject.
3. Purpose specification: We collect information for a specific, explicitly defined and lawful purpose and do not retain it longer than necessary.
4. Further processing limitation: We do not process personal information for purposes incompatible with the original purpose of collection.
5. Information quality: We take reasonable steps to ensure personal information is complete, accurate and up to date.
6. Openness: We are transparent about how and why we process personal information, as set out in this notice and our Privacy Policy.
7. Security safeguards: We implement appropriate technical and organisational measures to protect personal information.
8. Data subject participation: We respect your right to access, correct and request deletion of your personal information.

5. Categories of Personal Information

We may process the following categories of personal information:

• Identity information (name, surname, ID number where required by contract)
• Contact information (email, phone, physical address)
• Business information (company name, position, VAT number)
• Financial information (banking details for payment purposes, as required by contract)
• Technical information (IP address, browser data, website usage)
• safety and quality-related information (safety records, incident reports, where applicable)

6. Your Rights as a Data Subject

Under POPIA, you have the following rights:

• Right to be notified: You have the right to be informed that your personal information is being collected and the purpose thereof.
• Right of access: You may request confirmation of whether we hold your personal information and request access to it.
• Right to correction: You may request that we correct or delete inaccurate, irrelevant, excessive, out-of-date, incomplete, or misleading information.
• Right to deletion: You may request that we destroy or delete your personal information, subject to legal retention requirements.
• Right to object: You may object to the processing of your personal information on reasonable grounds.
• Right not to be subject to automated decision-making: You have the right not to be subject to a decision based solely on automated processing.
• Right to submit a complaint: You may submit a complaint to the Information Regulator if you believe your rights have been infringed.

7. How to Exercise Your Rights

To exercise any of your rights under POPIA, please submit a written request to our Information Officer:

We will respond to your request within 30 days. We may request verification of your identity before processing the request.

8. Cross-Border Transfers

Inco Link Construction does not routinely transfer personal information outside of South Africa. Should a cross-border transfer be required, we will ensure that the recipient country has adequate data protection legislation or that appropriate safeguards are in place, in accordance with Section 72 of POPIA.

9. Data Breach Notification

In the event of a data breach that compromises the confidentiality or integrity of your personal information, Inco Link Construction will:

• Notify the Information Regulator as soon as reasonably possible
• Notify affected data subjects where the breach poses a risk to their rights
• Take immediate steps to contain and remediate the breach
• Document the breach and measures taken in response

10. Information Regulator

If you are not satisfied with how we have handled your personal information or responded to your request, you may lodge a complaint with the Information Regulator of South Africa:

11. Updates

This POPIA Compliance Notice may be updated from time to time. The most current version will always be available on this page.