Privacy Policy

1. INTRODUCTION

Pick n Pay (“PnP”) acknowledges and supports consumer rights and the right to privacy. Accordingly, our customers’ privacy and trust are extremely important to us! We will ensure that personal information (“information”) is collected and handled in a transparent and lawful manner in alignment with the Protection of Personal Information Act, 2013 (“POPIA”).

We respect privacy we promise:

• To implement reasonable computer (logical), physical and procedural (process) safeguards to protect the security and confidentiality of the information we collect.
• To limit the information collected to the minimum required to provide a better service and/or product or meet our other goals.
• To permit only properly trained, authorised employees to access information.
• Not to disclose your information to external parties unless consent has been provided or we are required or permitted by law to do so, and authorised by our Information Officer.

1.1. Purpose

PnP offer a wide range of products and services, including but not limited to in-store services, digital offerings, a loyalty programme, and value-added services. This Statement explains how we use the information we collect from you when you use our products and/or services and by using our products and/or services and/or by providing information to us you agree to the information being processed as set out in this Statement. This Statement also:

• sets out the types of information that we collect;
• explains how and why we collect and use your information;
• explains whom we share your information with;
• explains the rights and choices you have when it comes to your information; and
• explains how to contact us or the relevant authorities.

Some parts of our business may need to collect and use personal information to provide you with their products and services. In most cases they will refer to this Statement, but you must also read their specific terms and conditions. PnP websites or mobile apps may contain links to websites operated by other organisations that have their own privacy policies. Please make sure you read their terms and conditions and privacy policies carefully before providing any personal information on other websites as we do not accept any responsibility or liability for other organisations. We provide these links merely for your convenience. We have no control over, do not review, and are not responsible for third party sites, their content, or any goods or services available through these sites.

1.2. Scope

In this Statement, “PnP”, “us”, “our” or “we” refers to one or more of the companies in the Pick n Pay Group that operate in South Africa. Whilst our franchisees as well as Boxer generally use our systems and we have written agreements in place with them to comply with law, this Statement does not necessarily reflect the individual practices of our franchisees or Boxer as they are their own legal entities. Please refer to Boxer’s Privacy Statement for further details.

1.3. Legislation and Regulations

This Statement is subject to the laws of the Republic of South Africa in particular POPIA and the Consumer Protection Act, 2008 (“CPA”) as well as other relevant data protection legislation. Any dispute arising will, to the extent permitted by law, first attempted to be settled internally and if this is not possible be referred to arbitration in Cape Town at a venue to be determined by us applying the Uniform Rules of the High Court of South Africa.

In the interests of compliance with the Promotion of Access to Information Act, 2000, PnP offers you the opportunity to view our PAIA manual on our website: https://www.pnp.co.za/paia-manual.

1.4. Roles and Responsibilities

Based on POPIA, the following role players are relevant to this Statement:

3. PURPOSE AND USE OF INFORMATION

PnP uses your information for the purposes for which it was collected or agreed with you to facilitate the provision of our products and services to you, and for purposes which are within reasonable expectations and where permitted by law.

Examples of information collected from you or other sources and processed by PnP are detailed below (which is not an exhaustive list) and linked to the purpose thereof.

• ID number / passport number (which you consent we may collect from credit bureaus and/or other aggregators) – to identify you as a unique person on our database as for us to validate who you are when you want to change your profile details or resolve queries related to your Smart Shopper card, transactions or points. We also use this to inform segmentation analytics to provide benefits including targeted birthday, pensioner or other life stage-relevant offers. We are also required to process this information where required by law or to facilitate the registration of an external service or product you have signed up for.
• Biometric information – to facilitate the self-RICA process
• Unique Identifiers – we may collect other unique identifiers such as Smart Shopper, account or other numbers, for the purpose of sharing them with other entities in our group and business partners to do data matching if we are legally permitted to do so. We may also collect unique identifiers such as user IDs and passwords.
• Contact information – to communicate with you as well as better customise our offering to you including:
  • In support of facilitating required activities for services and programs you have chosen to participate in i.e.: OTPs, invoices, statements, deliveries, etc;
  • Send information regarding services and programs via direct marketing i.e. new benefits, clubs or partners as well as inform you of promotions or deals;
  • Process the delivery or return of products from or to our stores
  • Send information regarding services and programs via direct marketing i.e. new benefits, clubs or partners as well as inform you of promotions or deals;
  • Send or serve you targeted advertising across social media, other digital media platforms and physical post;
  • Contact you where you may have won a competition / draw that you have entered;
  • Request your feedback and opinion in the form of surveys, opinion polls or focus groups, should you wish to participate;
  • PnP may send out surveys directly or on behalf of business partners opted-in customers. Should customers take part by submitting their personal; and
  • Contact you in relation to Customer Careline relating to feedback provided and custom complaints or feedback you wish to give us where you agree to us contacting you.
  • Employment applications and related correspondence.
• Any additional information relating to you that you provide to us directly through the website, mobile apps or indirectly through use of thereof, offline or online, through our representatives or otherwise.
• About your computer – collect statistical data such as IP address, operating system and browser type including browser actions and patterns to present content in the most effective manner.
• Inform segmentation or analysis based on your transaction history for use by our internal commercial team as well as vendors / suppliers and business partners to serve relevant content or offers. We may do this for use and disclosure of the de-identified information to determine preferences and shopping patterns.
• We may also disclose detailed information with our business partners to assist them in marketing products and services as governed by this Statement and the related service’s specific terms and conditions as well as the business partner’s Privacy Policy, Notice or Statements.
• Share information with 3^rd (third) parties as an outsourced function, with the purpose of communicating to you.

We may also use your information for the following reasons:

• complying with statutory and regulatory requirements in respect of the storage and maintenance of documents and information;
• providing customer service and assessing customer complaints;
• detecting and preventing fraud and money laundering and/or in the interest of security and crime prevention;
• assisting in law enforcement, fraud investigations, anti-money laundering and counter-terrorist financing initiatives;
• providing you with the services, products or offerings you have requested, and notifying you about important changes to these services, products or offerings;
• managing your account or relationship and complying with your instructions or requests;
• operational, marketing, auditing, legal and record keeping requirements;
• recording and/or monitoring your telephone calls and electronic communications to/with PnP in order to accurately carry out your instructions and requests, to use as evidence and in the interests of crime prevention;
• conducting market research and providing you with information about PnP’s products or services from time to time via email, telephone or other means (for example, events);
• where you have unsubscribed from certain direct marketing communications, ensuring that we do not sent such direct marketing to you again;
• disclosing your personal information to third parties for reasons set out in this Statement or where it is not unlawful to do so;
• monitoring, keeping record of and having access to all forms of correspondence or communications received by or sent from PnP or any of its employees, agents or contractors, including monitoring, recording and using as evidence all telephone communications between you and PnP;
• improving or evaluating the effectiveness of PnPs business or products, services or offerings;
• conducting internal investigations; and
• prevention and control of any disease.

5. RETENTION AND DESTRUCTION OF INFORMATION

Information that PnP collects is kept in a form which permits your identification for no longer than is necessary for the purposes for which it was collected and processed in each specific case, and in any case not longer than as specified by the relevant applicable laws unless we have your consent to process it indefinitely.

PnP will retain your information after you have closed your account where reasonably necessary to comply with our legal obligations (including law enforcement requests), meet regulatory requirements, resolve disputes, maintain security, prevent fraud and abuse, enforce our agreement, or fulfill your request to “unsubscribe” from further messages from us.

We may retain de-identified or anonymised information after your account has been closed using techniques that do not permit your re-identification. If none of the afore-mentioned scenarios are required, PnP will permanently delete (electronic) and shred (paper) after the purpose of collection the information has expired.

7. INFORMATION DISCLOSURE

Notwithstanding anything to the contrary in this Statement, PnP reserve the right to disclose any information about you if we are required to do so by law, and if we believe that such action is necessary to: (a) fulfil a government request; (b) conform with the requirements of the law or legal process; (c) protect or defend our legal rights or property, our website, or other users; or (d) in an emergency to protect the health and safety of our website’s users or the general public.

Authorised PnP employees or agents will have access to some or all your information. We may also disclose your information within our group of companies. Such data sharing is governed by our CIAP information security principles and associated practices.

We do use service providers to provide our services and maintain our systems, including but not limited to maintenance, security, analysis, audit, payments, customer service, marketing and system development. These parties will have access to your information as reasonably necessary to perform these tasks on our behalf (namely role-based access). Where we contract with service providers, and wherever possible, we impose contractual obligations on them to ensure that your information is handled and secured in accordance with law and industry good practise.

Some of our service providers may be located in other countries that may not have the same levels of protection of information as South Africa. Wherever possible, we try to only use service providers that are located in countries with similar or more stringent levels of protection of information as South Africa. Alternatively, we require that service providers in less stringently regulated countries undertake to protect the information of our customers to the same level that we do.

Unless you have explicitly consented to this, we will never sell your personal information.

9. INFORMATION BREACH NOTIFICATION

A security compromise or information breach can be described as a threat to the Confidentiality, Integrity, Availability or Privacy of IT systems and/or information. Such incidents are governed by the PnP Security Incident Response process which allows us to deal with the compromise/breach and/or loss in an efficient and effective manner. One of the key pillars of this process is keeping all impacted stakeholders informed and updated.

When there are reasonable grounds to believe that your information has been accessed, altered, deleted or acquired by any unauthorised person, we will notify the Information Regulator and yourself in cases where your identity can be established. This notification will be done in accordance with the provisions of POPIA and as soon as reasonably possible after the discovery of the compromise, considering the legitimate needs of law enforcement or any measures reasonably necessary to determine the scope of the compromise and to restore the integrity of our systems.

11. CONTACT US

11.1. PnP Information Officer

If you have questions about this Privacy Statement or wish to exercise your rights in terms of access to, correction, or deletion of your information, please contact us via our Customer Care Line (0860 30 30 30) who will attempt to resolve your query.

If unable to, and depending on your situation, our Customer Care Line will explain the process to follow and potentially refer your query to internal subject matter experts.

Our Information Officer contact details are:
Information Officer / Deputy Information Officer
Address: Pick n Pay Office Park, 101 Rosmead Avenue, Kenilworth, Cape Town
Tel: +27 (21) 658 1000
Email: InformationOfficer@pnp.co.za

11.2. Information Regulator (South Africa)

Should you believe that PnP has utilised information contrary to applicable law, you undertake to first attempt to resolve any concerns with PnP. If you are not satisfied with such process, you have the right to lodge a complaint with the Information Regulator of South Africa.

The Information Regulator’s contact details are:
JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001
P.O Box 31533, Braamfontein, Johannesburg, 2017
Email: inforeg@justice.gov.za
Website: https://www.justice.gov.za/inforeg/

[NOTE: no specific conventions for this vertical split box are noted in the asset dimensions]