POPIA Policy

ORMAN BRINK FUTTER CC: POLICY IN TERMS OF 
THE PROTECTION OF PERSONAL INFORMATION ACT 4 OF 2013 (“POPIA”)

Orman Brink Futter CC is committed to processing the personal information of our clients in compliance with POPIA.

We will obtain your written consent before processing your personal information, whenever this is required by POPIA.

1. GENERAL

  1. Orman Brink Futter CC treats all client information as strictly confidential. 
  2. Personal information is only requested from clients for business purposes and with the consent of the client concerned. 
  3. The reason/s for the collection, processing and storing of the personal information we request are explained to clients before such information is collected, processed or stored.
  4. You have the right to access your personal information that we hold, on condition that you provide sufficient proof of identity. 
  5. Proof of identity will also be requested where you wish to amend/update your record with us.
  6. A request for confirmation of whether we hold your personal information is done free of charge. However, where you request a record or description of your personal information we have, the prescribed fee (if any) will be charged and your request will be attended to within a reasonable time.

2. INFORMATION OFFICER

  1. The details of our Information Officer are as follows:
    Wilfred Marco Orman
    021 439 4254
    This email address is being protected from spambots. You need JavaScript enabled to view it.
  2. For any queries relating to our data processing practices, please contact our Information Officer.

3. INCIDENT MANAGEMENT 

  1. We do everything we reasonably can to protect your personal information. However, the risk of possible security breaches is still present. 
  2. Where we become aware of a data security breach / have reasonable grounds to believe that there has been a data security breach, this will be reported to the Information Regulator, as well as to the data subject concerned, as soon as reasonably possible after becoming aware of the breach / potential breach, and we will provide enough information to allow the data subject to take action against any potential consequences.

4. EMPLOYMENT APPLICATIONS

  1. All prospective employees are required to furnish certain personal information, necessary for the processing of their employment applications for the purposes of background and reference checks.
  2. Applicants confirm that the details of references provided to us are so furnished with the express consent of the namedreference.

5. EMPLOYEE COMPLIANCE WITH POPIA

  1. Employees of Orman Brink Futter are required to attend a POPIA training workshop on how to deal with the personal information of clients in line with the provisions of POPIA. 
  2. By virtue hereof, we ensure that every employee is aware of the requirements for lawful processing of personal information and is bound to treat all client information as confidential.
  3. Our Information Officer is responsible for updating and informing the employees of any relevant new regulations pertaining to POPIA and ensuring that they carry out their duties in line therewith.

6. DOCUMENTS CONTAINING PERSONAL INFORMATION

  1. Client and employee data is stored using accounting and payroll packages, as well as Office 365 (Sage One; Sage Payroll; Xero Accounting; Simple Pay; and Draftworx).
  2. The majority of the in-and-outflow of our client data is done via email. As stated in our POPIA Notice, we take reasonable measures to protect the data contained in this correspondence.  If it very sensitive information we can lock files such as Word and Excel requiring a password for them to be opened. We use our own email domain, which is set up and secured by our IT consultant (Dovetail Technologies).
  3. Only employees hold passwords for access to the firm’s computers and printers, which passwords are not shared with any other person.
  4. Upon termination of employment, all forms of access to computers / printers / servers, etc. by password or otherwise, are removed by our IT agent.
  5. Documents that are printed in hard copy are immediately removed from the printers and filed. 
  6. No physical or electronic files and/or documents containing client or employee personal information leaves our offices, situated at 30 Ocean View Drive, Fish Hoek, without the prior knowledge and approval of a managing member.
  7. Further, removal of files/documents from the office building may only take place where it is done for work purposes and it has been determined, by the managing member, that the files/documents will not fall into the hands of an unauthorised person.
  8. Where employees are required to work from home, remote access is granted to such employees, with the requisite security safeguards (passwords, etc.) in place.
  9. Before an employee may remove his/her computer, or any component of the machine, from the office building, the consent of a managing member is required.

7. OFFICE ACCESS RESTRICTIONS

  1. All physical and electronically created documents containing personal information are kept within the premises known as 39 Ocean View Drive, Green Point.
  2. All physical files are kept in filing cabinets, which are locked at the end of each day.  We have moved away from physical storage as much as possible, and only a small number of documents must be kept and stored, which makes security very manageable.  The bulk of client data or documents is kept electronically.
  3. After the expiry of the retention period, and where documents are not being further retained for record-keeping and/or auditing purposes, with the client’s consent or in terms of tax legislation, the Information Officer ensures that such documents/files (electronic or physical) are properly destroyed (i.e., removed from our server or shredded, whichever is applicable).

8. BUILDING ACCESS

  1. The doors and security gates to the office building are kept locked at all times. Only authorised employees have access to / a copy of the key.
  2. The office building is further protected by an alarm-system, the passcode to which only authorised employees have access. The last employee to leave the premises is responsible for activating the alarm.

9. RISK AWARENESS

  1. A risk analysis is conducted annually, where we do a thorough inspection of our existing security measures.
  2. Where necessary, the relevant aspects of our security is updated to ensure the strongest possible security measures, safeguarding both the physical and electronic documents/files containing personal information of clients and employees, are in place.

10. SUB-CONTRACTORS

  1. There are a number of instances where we, with the prior consent of the client, must make use of a sub-contractor, for example, when consulting on specialized or complicated tax matters. 
  2. These sub-contractors are obliged to treat our client and employee data with the same level of confidentiality as we do, in terms of a signed confidentiality agreement.
  3. Where a sub-contractor handles client information in a manner contrary to the provisions of our privacy and POPIA policies, or there are reasonable grounds to believe that a sub-contractor has handled client information in a manner contrary to the provisions of our privacy and POPIA policies, this will be reported to the data subject concerned, as well as to the Information Regulator, by our Information Officer.

11. BACK-UP SUPPORT

Electronic data is backed up on One Drive, cloud server which has redundancy and recover protocols of their own.  In addition to this we keep a backup of electronic data on a server in the Cape Town office which is locked in a cage.  On a regular basis off-site backups are made by our computer consultant and kept by them as part of a disaster plan. This is done at least quarterly.  Our second office, follows exactly the same procedure, independently from the first office in Green Point.  This means there are a number of redundancies.  

© 2019 Orman & Associates. All Rights Reserved.

Website by The { Web } Elite