Partners in Performance Privacy Policy

Privacy policy

Last updated: 1 September 2021

This Policy describes how the Partners in Performance Group being Partners in Performance International Pty Ltd and its related bodies corporate globally (Partners in Performance/ Us/ We), including the data controller entities specified in the schedule collects, uses, holds and discloses the personal information it holds about its clients, employees, potential clients or employees, business associates, and their employees, as well as visitors to Partners In Performances’ website or users of any products or applications it makes available (You).

This Policy also explains your data protection rights including the rights You have to access your personal information, correct inaccurate information and to object to the use of personal information for the purposes described in the Policy. This Policy also describes our acts and practices in relation to the way we process personal information about our suppliers, contractors, and employees.

This Policy contains the following sections:

1. Applicable laws.
2. What types of personal information do we collect?
3. How we get your personal information
4. How do we use personal information?
5. With whom do we share personal information?
6. Sending information overseas.
7. Storage and protection of personal information.
8. Your data protection rights.
9. Updates to this Policy.
10. How to contact us.

1. Applicable laws

Applicable laws

“Personal information” is information or an opinion relating to an individual which can be used to directly or indirectly identify that individual especially by an identifier such as a name or identification number, location data or an online identifier in some instances, it can relate to existing juristic persons (such as companies).

Laws and rules regarding the use of personal information may vary by jurisdiction. Partners in Performance Group members comply with laws and rules which apply to their jurisdiction, or which govern the personal information that they collect and use.

Certain privacy laws may apply based on your or our location, or the location in which the processing of personal information takes place.

For example,

• where we offer services to individuals in the European Union, the EU General Data Protection Regulation (EU GDPR) will apply;
• where we process data in the UK, or where we offer services to individuals in the UK, the UK GDPR and the Data Protection Act 2018 will apply;
• In respect of personal information that is processed in South Africa the Protection of Personal Information Act, 2013 (POPIA) will apply.
• In respect of data processed in Australia, the Privacy Act (Cth) 1988 and applicable state and territory privacy laws will apply.

2. What types of personal information do we collect?

We currently collect and process the following information:

• Basic personal details such as your name or job title;
• Contact data such as your telephone number and postal or email address;
• Financial data such as payment‑related information, bank account details, or tax information;
• Demographic data such as your address;
• Website usage and other technical data such as details of your visits to our websites or information collected through cookies and other tracking technologies. For more information on our use of cookies and other tracking technologies, please see the Cookies and Other Tracking Technologies Notice.
• Information about your subscription applications, interests and marketing preferences for example when you submit online forms;
• If you are a supplier, contractor or employee of ours, then we may collect feedback and other performance records, leave, payroll, employment history, educational qualifications and history, details of professional memberships, names and contact details of referees and other similar information;
• Identification and other background verification data such as a copy of your passport or driver licence;
• Data that you may provide to us in course of attending meetings with us such as dietary requirements;
• Health data, for example details of your vaccination status or the results of any medical tests, after obtaining your consent or where otherwise it is lawful for us to collect sensitive information under applicable data protection laws.
• Details of any professional or trade association/trade union to ensure we are able to comply with our occupational health and safety, insurance and other obligations to you, after obtaining your consent or where otherwise it is lawful for us to collect sensitive information under applicable data protection laws.

You are not required to provide us with your personal information. However if you do not provide it to us, then we may not be able to provide services to You, or otherwise engage or do business with, You or employ you (as the case may be).

3. How we get your personal information

Most of the personal information we process is provided to us directly by for example by corresponding with us by phone email, or via other direct interactions with us such as completing a form online.

We also receive personal information indirectly, from the following sources in the following scenarios:

• where we monitor use of, or interactions with, our websites, any marketing we may send to you, or other email communications sent from us;
• third party sources, for example, if you are a client where we collect information about you to assist with our client acceptance procedures or if you are an employee where we receive information about you from recruitment agencies. Health data may also be received from health services providers if we obtain your consent or we otherwise have a lawful basis to collect it;
• publicly available sources ‑ we may, for example, use such sources to help us keep the contact details we already hold for you accurate and up to date or for professional networking purposes, for example from LinkedIn.

4. How do we use personal information?

In general, we use and disclose your personal information for the following purposes. To:

• Understand and meet our clients’ needs;
• Conduct our business or do business with You;
• Perform our contractual obligations;
• Recruit, manage and develop our employees and contractors;
• Provide and market our services, including products or applications;
• Communicate and manage our relationship with you;
• To facilitate use of our websites and to ensure content is relevant;
• In the event that we are to undergo a re‑organisation, to reorganise or make changes to our business;
• Meet our legal obligations and to ensure that you meet yours.

We will only use your personal information where we are permitted to do so by applicable law.

In Australia, we may use or disclose your personal information for the primary purpose for which it is collected, for reasonably expected secondary purposes which are related to the primary purpose and in certain other circumstances provided for in the Privacy Act 1988 (Cth) Privacy Act 1988 (Cth) or applicable state and territory privacy laws.

If the EU GDPR or UK GDPR applies (for example because You are located in the European Economic Area or You are in the UK) we process personal information where we have a lawful basis for doing so. This means we collect and use your information only where:

• Contract performance: your information is necessary to enter into or perform our contract with you.
• Legitimate interest: we have a legitimate interest (which is not overridden by your data protection interests), such as to provide services to clients, to market and promote our services and protect our legal rights and interests;
• Consent: You give your consent to do so;
• Legal obligation: we need to process your personal information to comply with a legal obligation, for example to comply with information security or workplace health and safety laws.

Where information is collected or processed in South Africa, we collect and use your information where:

• It is necessary to carry out actions for the conclusion or performance of a contract with you;
• It is necessary for pursuing our legitimate interests or those of a third party to whom the information is supplied;
• You give your consent to do so;
• The processing complies with an obligation imposed on us by law; or
• For special personal information, you give your consent, deliberately make the information public (such as information found on LinkedIn or a company website), it is necessary to comply with our legal obligations or enforce our rights, or where there are other recognised grounds in POPIA.

5. With whom do we share personal information?

We may disclose your personal information to:

• Other members within Partners in Performance including prospective members of Partners in Performance and their advisors;
• Other companies or individuals, in, or outside, your country, who assist us in providing services or who perform functions on their behalf. This may include, for example, information technology service providers, our professional advisers such as lawyers or accountants, payroll providers, our insurers, and third party service providers;
• Anyone else to whom you authorise us to disclose it or you would reasonably expect us to disclose it to;
• Regulators in the course of regulatory dialogue with them;
• Government agencies and other third‑parties where required by law, and in certain circumstances to enforce agreements, policies and terms of service, to protect us or the public from harm or illegal activities; or to respond to an emergency;
• Other types of entity where permitted by law to do so.

6. Sending information overseas

Partners in Performance is a global organisation, with offices in various jurisdictions. As a global organisation, we cannot limit our processing of an individual’s personal information to the country in which that individual is based. In the course of providing our services, we will likely need to transfer personal information to locations outside the jurisdiction in which you provide it or where you are viewing our website. By using our website, you expressly agree to such transfers.

In some circumstances, we may be required to disclose your personal information to other members of Partners in Performance located in, or outside, your country, which may not have equivalent data privacy laws to where you reside. In appropriate circumstances, we may disclose your personal information to other members of Partners in Performance located in, or outside, your country, which may not have equivalent data privacy laws to where you reside. We will treat personal information collected and sent to us, in accordance with the requirements of any applicable binding corporate rules or local laws relating to privacy. Accordingly, your personal information may be transferred outside of your country and it may be accessed and processed by authorised individuals from any location. By using our website, you expressly agree to such transfers.

For example, wherever your information is processed outside of your country of origin, we will ensure that appropriate mechanisms and/or contractual arrangements are in place to protect your information. We secure any transfers from the EEA or from the UK ensuring that appropriate safeguards are in place (if adequacy decisions are not in place), such as by using European Commission‑approved model clauses (alongside other supplementary technical or contractual measures where necessary).

A current list of countries in which Partners in Performance members are located or operating can be obtained from the Privacy Officer upon request. Contact details are set out in section 9 below.

We also disclose personal information to service providers located outside your country or the country from which the data was provided (collectively the “jurisdiction of origin”). While such third parties will often be subject to privacy and confidentiality obligations, where lawful, such obligations may differ from and be less stringent than the requirements of the privacy laws of the jurisdiction of origin. For transfers from the EEA, we rely on European Commission‑approved model clauses.

7. Storage and protection of personal information

Personal information that we collect is stored on on‑site secure physical servers or by on‑line cloud‑based third party data storage providers. All access to data is password protected, and we employ the use of Rights Management Services (RMS) in some circumstances.

Generally, we will only retain your personal information for so long as is necessary to achieve the purpose for which it was collected. In some cases, we may retain your information for a longer period, in which case, it will be retained for as long as we require it for a lawful business purpose or to comply with our legal obligations, for historical or statistical purposes, or otherwise for so long as you have consented to us retaining your information.

8. Your data protection rights

Under data protection laws, you have rights including:

• Your right of access ‑ You have the right to ask us for copies of your personal information.
• Your right to rectification ‑ You have the right to ask us to rectify personal information you think is inaccurate. You also have the right to ask us to complete information you think is incomplete.
• Your right to erasure ‑ You have the right to ask us to erase your personal information in certain circumstances.
• Your right to restriction of processing ‑ You have the right to ask us to restrict the processing of your personal information in certain circumstances.
• Your right to object to processing ‑ You have the the right to object to the processing of your personal information in certain circumstances. Your right to data portability ‑ You have the right to ask that we transfer the personal information you gave us to another organisation, or to you, in certain circumstances.

As we are required to take reasonable steps to ensure that your personal data remains accurate, please let us know of any changes to the personal data that you have provided to us by contacting us at privacy@pip.global.

You may exercise your data protection rights by contacting the Privacy Officer at privacy@pip.global (subject to exceptions set out in the applicable laws). Your rights may be limited in some cases, such as where we have a compelling reason or are subject to a legal requirement to deny the request. Where personal information is used on the basis of consent, you may withdraw your consent at any time, but this will not affect processing that has already taken place and we may be entitled to continue processing your information where we have another lawful ground upon which to do so.

lf you exercise your rights, we will require you to verify your identity and to specify what information you require. You are not required to pay any charge for exercising your rights.

9. Updates to this policy

This Policy will be reviewed from time to time to take account of new laws and technology, changes to our operations and practices and the changing business environment.

10. How you can contact us

If you have any questions about privacy‑related issues, please contact the Privacy Officer by email to privacy@pip.global. Any complaint about our handling of personal information should be made in writing to the Privacy Officer who will respond within 30 days. If the complaint remains unresolved, you can refer it to any data protection authority where you live, where you work or where you feel your rights have been infringed.

EU Representative: Partners in Performance UK Limited

Schedule 1 – Data Controllers for the purposes of EU GDPR, UK GDPR and POPIA

• PIP Global IP Limited
• Partners in Performance Global IP UK Limited
• Partners in Performance UK Limited
• Partners in Performance International Pty Ltd
• Partners in Performance South Africa (Pty) Ltd (responsible party for the purposes of POPIA), located at Bridgeport House, Hampton Office Park, 20 Georgian Crescent, Bryanston, 2191, South Arica.