Privacy Policy

Privacy Notice

Last updated: 08/10/2026

This notice has two parts. Part A explains how we handle your personal information and applies to everyone we deal with, wherever you are. Part B contains a short annex for each region in which we operate (South Africa, the EU/EEA, the United Kingdom, New Zealand and Australia); the annex for your region sets out the local legal terms that apply to you, your specific rights, and the regulator you may contact. Where an annex differs from Part A, the annex applies to you.

Part A – Information that Applies to Everyone

1. Who We Are

Details of Entelect Software (Pty) Ltd
This is the Privacy Notice of Entelect Software (Pty) Ltd, registration number 2007/001837/07 (“Entelect”) and its subsidiaries (“Entelect Group”).

Registration and Contact Information
Registered Address:
Unit 13, 3 Melrose Boulevard, Melrose Arch, Johannesburg, South Africa

General Email:
enquiries@entelect.co.za

Data Queries:
privacyqueries@entelect.co.za

Telephone:
+27 11 994 3300

For all privacy queries, contact our privacy office at privacyqueries@entelect.co.za. The privacy contact, responsible officer and supervisory authority for your region are set out in the relevant regional annex (Part B).

2. Purpose of This Privacy Notice

Scope and Application
This policy details how we collect, store, protect and use personal information – that is information that can be used to identify an individual or a corporate entity – in connection with the services we may offer through our websites and through your dealings with us (referred to as the “Services”).

Who This Notice Applies To
This Privacy Notice aims to give you information on how we collect and process your personal information when you personally (or for a corporate entity):

1. Visit this website or any other website that is owned or operated by us;
2. Apply for employment with us or submit information via a career fair;
3. Use any of our services as a customer;
4. Engage with us on prospective contracts or other commercial arrangements with us or for other business purposes; and
5. Conclude a contract with us (for example, where you act as a customer, supplier, reseller, agent, etc).

Our Commitment to Compliance
Entelect is committed to complying with relevant data protection laws and protecting your personal information in accordance with them.

3. When We Are Responsible vs When We Act for Others

When We Are Responsible for Your Information
Where you are dealing with us directly, this Privacy Notice applies. We are responsible for making decisions about how your personal information is used. (Your regional annex sets out the legal term for this role — for example, "responsible party" or "controller".)

When We Act on Another Organisation’s Behalf
Where we have been contracted by another company, such as your employer or a company you are dealing with directly, please be aware that we are not the entity responsible for making decisions on your personal information, but instead are providing services to the company that you are dealing with directly. In these cases, we act on that organisation’s behalf and you should refer to the privacy policy of the company you are dealing with directly. (Your regional annex sets out the legal term for this role — for example, "operator" or "processor".)

When we act on another organisation’s behalf, the organisation that contracted us is accountable for the processing of your personal information. We process your information only on their instructions and in accordance with their privacy policy.

4. Personal Information We Collect

Categories of Personal Information
We may collect, use, store and transfer different kinds of personal information which we have grouped together as follows:

• Identity Information (dependent on the relationship): First name, maiden name, last name, username or similar identifier, marital status, title, date of birth, gender, company registration number, tax number, and may also include due diligence (know-your-client) information.
• Contact Information: Billing address, delivery address, email address and telephone numbers.
• Applicant Information: Work and education history, demographic information as required by law, compensation data, background checks, and professional development information.
• Financial Information: Bank account information.
• Transaction Information: Details about payments to and from you and other details of products and services you have purchased from us, and includes details about invoicing and other payment arrangements that may apply to our relationship with you.
• Profile Information: Your contact information together with purchases or orders made by you, your interests, preferences, feedback and survey responses.
• Marketing and Communications Preferences: Your preferences in receiving marketing from us and our third parties and your communication preferences.

Special Personal Information
Special personal information includes details about your race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, information about your health, and genetic and biometric information. We do not collect any special personal information (sensitive personal data) about you without your explicit consent or as required by law.

We do not collect any information about criminal convictions and offences unless you are applying for employment with us.

5. How We Collect Your Personal Information

Direct Collection From You
We may collect personal information directly from you through:

• Correspondence with you
• Meetings or other assessments
• Forms you complete
• Applications for employment
• Interactions with our group websites and services

Collection From Third Parties
We may collect personal information from third parties in the course of our business operations and where required to fulfil our contractual obligations to you.

Collection From Events
When we host events, we may collect information from you by means of your registration and any expression of interest or forms completed at the event.

Our events may include photography and videography for social media, in which case your image may be collected. Notice of such collection will be provided at the event, and you may decline photos at any time. You may request access to, deletion of, or restriction of processing of photos by contacting our privacy office.

Automated Collection

• Cookies and website tracking
• Online Meetings
• Transcriptions and Meeting Assistants

6. Why We Process Your Personal Information

Contractual Necessity
We will process your personal information when we are pursuing a contract with you, or when we must perform a contract; for as long as the contractual relationship is in place.

Legal Obligations
We may be obliged to process personal information to comply with our legal obligations, for example, where we are required to retain data for tax law or commercial purposes or where we must comply with regulatory requirements.

Legitimate Interests
We may process your data in terms of legitimate interest (ours, yours, or a third party’s), as long as the data being processed is strictly necessary, proportional, and does not infringe on your rights to privacy.

Consent-Based Processing
In very limited cases, we will process your data after obtaining your consent. You are free to withdraw your consent at any time.

Specific Purposes for Processing
We will only process your personal information when we have a legitimate basis to do so. Additional categories of information may be processed beyond those mentioned in this privacy notice to fulfil our obligations to you, in which case you will be informed of this at the time of collection.  

7. How We Use Software to Process Employment Applications

We use software as part of the employment application process. These tools are used to read your CV, categorise your experience, and provide our recruitment team the means to review your application personally.

In the first step of the application process, the software reads your CV and organises the information therein. After that, it categorises your experience and skills (using only your work experience, skills, and education) so we can see what roles and projects you might be suited to.

If an application does not show experience relevant to the role, it is flagged for a member of the team to review prior to rejection. Our software never decides on or rejects your application.

Our recruiters will always see your full CV along with any categorisation for validation, as well as alongside any flagging for experience that is not deemed to match the requirements. Every application is reviewed by a person, and every decision is made by a person.

Our tools do not make any assessment of your age, gender, sex, race, disability, nationality, name, or any other personal characteristic.

In certain regions, information may be used differently to others. Please see the Regional Annexes for any additional information used in your region.

8. Consent and Your Rights to Withdraw

When We Rely on Consent
We may process your information with your consent for the following purposes:

• Marketing communications, such as subscribing to our mailing list.
• Where we are required to process any sensitive or special personal information where consent is required as a matter of law.
• Cookies, in order to grant you a personalised experience when dealing with us. You may decline the installation of non-essential cookies; however, this may affect the functionality of our website or prevent you from using the Site entirely. If you opt out of using cookies, we may store a single cookie in order to remember this preference.
• For website analytics, storing details such as your IP address, bounce rate, page time, cost per click, most visited pages, and device information. These tracking cookies may be declined at any time.
• For promotional campaigns, in which case additional information may be volunteered by you in order to participate in the promotion or to receive a delivery.

How to Withdraw Consent
In cases where consent was given, you have the right to withdraw consent at any time by contacting our privacy office at privacyqueries@entelect.co.za or by clicking the unsubscribe links in marketing communications.

Consequences of Withdrawal
Withdrawal of consent will not affect the lawfulness of any processing carried out before you withdraw your consent. In certain cases, if you withdraw your consent, we may not be able to provide certain products or services to you. We will advise you if this is the case at the time you withdraw your consent.

Service-related messages do not rely on consent and you will continue to receive these as required in fulfilling our contract with you.

9. Cross-Border Information Transfers

Primary Data Storage Location
Our primary region for storing and processing data is South Africa.

International Transfers
In some cases, your information may be stored and processed outside of the country or region where it was originally collected. Entelect operates within different countries, including South Africa, the United Kingdom, the Netherlands, New Zealand and Australia, and may use services providers outside of these regions.

Safeguards for International Transfers
We ensure your personal information is protected by requiring all our group companies to follow the same rules when processing your personal information. When we transfer your personal information to service providers in other countries, we will protect that information as required by law, for example, by signing Standard Contractual Clauses (SCCs) or International Data Transfer Agreements (IDTAs), and by implementing robust data processing agreements.

10. Who We Share Your Information With

Third-Party Service Providers
We may share your information with third parties in relation to the performance of any contract or business with you, or to whom we subcontract to provide services like software developers, system administrators, data hosting services, and other IT vendors. We do not allow our third-party service providers to use your personal information for their own purposes and only permit them to process your personal information for specified purposes and in accordance with our instructions. We will not sell your information, and we ensure that contracts are in place with all third-party service providers.

Business Transfers and Mergers
We may share your information with third parties, to whom we may choose to sell, transfer or merge parts of our business or our assets. Alternatively, we may seek to acquire other businesses or merge with them. If a change happens to our business, then the new owners may use your personal information in the same way as set out in this privacy policy.

Legal and Professional Advisers
We may share your information with:

• Legal advisers and insurers where necessary to investigate, exercise or defend claims
• Other professional advisers such as our auditors, accountants, specialist consultants, and insurers

Law Enforcement and Regulators
We may share your information with:

• Law enforcement bodies, where necessary to facilitate the prevention or detection of crime or the apprehension or prosecution of offenders
• Public authorities, regulators and government bodies, where necessary for us to comply with our legal and regulatory obligations (for example, a data protection regulator), and in some cases contractual obligations
• Third parties where we have to take legal action to protect our, or third-party rights

Our Group Companies
We may share your information with other companies within the Entelect Group for legitimate business purposes.

11. Security Safeguards

Technical Security Measures
We implement appropriate technical measures to ensure a level of security appropriate to the risk.

Organisational Security Measures
We have appropriate security measures to prevent your personal information from being lost, damaged, destroyed in an unauthorised way or accessed in an unauthorised way.

Access Controls
We limit access to your personal information to those employees, agents, contractors and other third parties who have a business need to know. They will only process your personal information on our instructions and they are subject to a duty of confidentiality.

Employee Confidentiality Obligations
We will ensure that our employees are subject to confidentiality agreements and any statutory privacy obligations.

12. Data Breach Notification

Our Breach Response Procedures
We have procedures to deal with any suspected data breach (that is, where we have reasonable grounds to believe that a breach of security has led to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal information).

Data Breach Notification
If we experience a data breach that poses a risk of serious harm to you, we will notify you and the relevant data protection regulator, where required, as soon as reasonably possible after becoming aware of the breach. The regulator and any region-specific reporting obligations are identified in your regional annex.

13. Retention and Restriction of Records

Retention Periods
We will only retain your personal information for as long as reasonably necessary to fulfil the purposes we collected it for or subsequently processed, unless:

• The retention of the information is required or authorised by any legal or regulatory requirements;
• We reasonably require the information for lawful purposes relating to one of our functions or activities (for example in the event of a complaint or if we reasonably believe there is a prospect of litigation in respect to our relationship with you);
• The retention of the information is required by a contract entered into between us; or
• You consent to such retention of information.

Anonymisation
We may retain your personal information for a longer period for historical, statistical or research purposes only where we have implemented appropriate safeguards against your information being used for any other purpose (for example, by irrevocably anonymising the information so that it can no longer be associated with you).

Criteria for Determining Retention Periods
To determine the appropriate retention period for personal information, we consider:

• The amount, nature and sensitivity of the personal information
• The potential risk of harm from unauthorised use or disclosure of your personal information
• The purposes for which we process your personal information and whether we can achieve those purposes through other means
• The applicable legal, regulatory or other requirements

14. Your Rights

The rights described below may apply to you in full or in part, depending on your region. Your regional annex (Part B) sets out which of these rights apply to you and how to exercise them.

Right to Notification of Collection
When your personal information is collected, you have the right to be informed that your information is collected and where the information is not collected from you, you have the right to be informed of the source that it is collected from.

Right to Access Your Personal Information
You have the right to request access to your personal information.

Right to Correction or Deletion
You have the right to request correction or rectification of your personal information and, where the law of your region provides for it, its deletion or erasure. Where you have and exercise a right to deletion, we will permanently erase your information, except for information we are required to keep by law.

Right to Object to Processing
You may object to processing in accordance with relevant data protection regulation.

Right to Restrict Processing
You may restrict processing in accordance with relevant data protection regulation.

Right to Notification of Security Compromises
Where reasonable grounds exist for us to believe that your personal information has been accessed or acquired by an unauthorised person, you have the right to be notified.

How to Exercise Your Rights
You may exercise your rights at any time by lodging a request with our privacy office at privacyqueries@entelect.co.za. The responsible officer and supervisory authority for your region are identified in the relevant regional annex.

15. Direct Marketing

Your Right to Opt-Out
We strive to provide you with choices regarding certain personal information uses, particularly around marketing and advertising.

How to Opt-Out
You can ask us to stop sending you marketing messages at any time by following the opt-out links on any marketing message sent to you or by contacting us at any time.

Processing After Opt-Out
Where you opt out of receiving marketing messages, this will not apply to personal information provided to us that is necessary for the purposes of our contract, relationship, legal obligation or legitimate interest.

How We Use Your Information for Marketing
We may use your Identity, Contact, Technical, Usage and Profile Information to form a view on tailoring service offerings and engagements. This is how we decide which products, services and offers may be relevant for you.

16. Automated Decision-Making

Whether We Use Automated Decision-Making
Where we make use of services to determine creditworthiness as part of service delivery, we may use automated decision-making. Where we do, we will tell you. Your rights in relation to automated decision-making — including any right to request human intervention, to contest the decision, or to obtain an explanation of it — are set out in your regional annex (Part B).

17. Cookies and Tracking Technologies

Types of Cookies We Use
If you provide consent for the installation of cookies, your data may be processed by third parties. These cookies are subject to the third parties’ respective Privacy Policies.

Purpose of Cookies
Cookies are used in order to grant you a personalised experience when dealing with us.

How to Manage Cookie Preferences
You may decline the installation of cookies; however, this may affect the functionality of our website or prevent you from using the Site entirely. If you opt out of using cookies, we may store a single cookie in order to remember this preference.

Impact of Declining Cookies
Declining cookies may affect the functionality of our website or prevent you from using the Site entirely.

Analytics Cookies
For website analytics, we may store details such as your IP address, bounce rate, page time, cost per click, most visited pages, and device information. These tracking cookies may be declined at any time.

18. Third-Party Links and Services

Links to External Websites
Our Websites and Apps may contain links to other third-party sites. When you click on one of these links, you are visiting a website operated by someone other than us, and the operator of that website has a different privacy policy. We are not responsible for the privacy practices of those sites. We encourage you to read the privacy policies of these third-party operators.

Third-Party Privacy Policies
If you provide consent for the installation of cookies, your data may be processed by third parties. These cookies are subject to the third parties’ respective Privacy Policies. We encourage you to read the privacy policies of these third-party operators.

19. Children’s Privacy

In general, Entelect does not process information of individuals under 18 years of age. From time to time, we collaborate with partner organisations to host or support events such as hackathons, project days, or workshops. Where such events are open to persons under the age of 18, the registration process and collection of attendee personal information is managed by the relevant partner organisation. We do not directly collect or process the personal information of minors in connection with these events. Attendees and their parents or legal guardians should refer to the applicable partner organisation's privacy notice for information on how their personal information is processed.

20. Your Obligation to Provide Information

Where we need to collect personal information by law, or under the terms of a contract we have with you, and you fail to provide that information when requested, we may not be able to perform the contract we have or are trying to enter into with you (for example, to provide you with the Services).

In cases where we cannot proceed without certain information, we may not be able to proceed with a particular engagement we have or intend to have with you (this may include cancelling a service you have with us), but we will notify you if this is the case at the time.

21. Keeping Your Information Accurate

Your Responsibility to Update Information
Please remember that it is your duty to keep information updated so we can correctly provide you with the Services, and you undertake to verify the information you have provided to us from time to time to make sure that it is accurate.

How to Update Your Information
You may update your information in writing at any time by submitting a support request or sending an email to privacyqueries@entelect.co.za or contacting our privacy office.

22. Complaints and Queries

How to Contact Our Privacy Office
If you have any questions about this privacy policy, including any requests to exercise your legal rights, please contact our privacy office at privacyqueries@entelect.co.za. The responsible officer for your region is identified in the relevant regional annex.

Our Complaints Handling Process
We would appreciate the opportunity to deal with your concerns before you approach the relevant data protection regulator, so please contact us in the first instance.

23. Changes to This Privacy Notice

Right to Update This Notice
This policy may be updated from time to time.

How We Will Notify You of Changes
You may be required to accept the updated Privacy Policy in order to keep using our Services. Alternatively, we may post non-material changes to this Privacy Policy on our Site, with a notice advising of the effective date of the changes. 

24. Governing Law

This Privacy Notice is governed by the laws of South Africa, including the Protection of Personal Information Act, 2013 (POPIA), as the law of our primary place of establishment. This does not affect any mandatory rights you have under the data protection law of your own region, which are described in the relevant regional annex (Part B).

 

Part B – Regional Annexes

The annex for your region applies to you in addition to Part A. Where an annex differs from Part A, the annex prevails for you.

Annex A –  South Africa (POPIA) 

If you deal with our South African operations, or your personal information is processed in South Africa, the following applies to you in addition to Part A.

Local legal terms
Under the Protection of Personal Information Act, 2013 (POPIA), the organisation that decides how your information is used is the “responsible party” (referred to as “we” in Part A); an organisation that processes information on our behalf is an “operator”; and our designated privacy contact is our “Information Officer”.

Information About Juristic Persons
In South Africa, personal information includes information relating to juristic persons (corporate entities). We may collect company registration numbers, tax numbers, and other information relating to corporate entities.

Our Information Officer
Information Officer: Shashi Hansjee | Telephone: +27 11 994 3300 | Email: privacyqueries@entelect.co.za 

Deputy Information Officer: Ryan Naudé | Telephone: +27 11 994 3300 | Email: privacyqueries@entelect.co.za 

Reporting of Data Breaches
If we experience a data breach that poses a risk of serious harm to you, we will notify you and the Information Regulator as soon as reasonably possible after becoming aware of the breach. Where required by the Cybercrimes Act, we will also report qualifying incidents to South Africa’s Computer Security Incident Response Team (CSIRT).

Right to Submit Complaints to the Information Regulator
You have the right to make a complaint at any time to the Information Regulator, the South African regulatory authority for personal information protection issues. We would, however, appreciate the opportunity to deal with your concerns before you approach the Information Regulator, so please contact us in the first instance. Information Regulator website: https://inforegulator.org.za. 

Right to Institute Civil Proceedings
You have the right to institute civil proceedings regarding the alleged interference with the protection of your personal information.

Automated decision-making
Under POPIA, you have the right not to be subject to a decision based solely on automated processing of your information that results in legal consequences for you or affects you to a substantial degree, except in permitted circumstances. Where such automated decision-making is used, you may request human intervention, contest the decision, and obtain an explanation of how it was reached.

Employment equity information
As a South African employer, we have obligations in law that we need to meet. As part of this, we record the race information you provide in your application. This is taken from your application when we first process it and stored in our recruitment system. It is used for employment equity and B-BBEE reporting.

It is not passed to the software that categorises your experience, and it plays no part in how your skills or experience are assessed.

Governing law
This notice is governed by South African law, including POPIA, as set out in Part A (Governing Law).

Annex B — European Union / EEA (GDPR)

If you are in the European Union or the European Economic Area, the following applies to you in addition to Part A.

Local legal terms
Under the General Data Protection Regulation (GDPR), the organisation that decides how your information is used is the “controller” (referred to as “we” in Part A); an organisation that processes information on our behalf is a “processor”; and our designated privacy contact is our Data Protection Officer (DPO).

Your rights under the GDPR
In addition to the rights described in Part A, you have the right to:

1. access your personal data and obtain a copy of it;
2. have inaccurate personal data rectified;
3. have your personal data erased (the “right to be forgotten”), where applicable;
4. restrict the processing of your personal data, where applicable;
5. data portability — receive the personal data you provided to us in a structured, commonly used, machine-readable format and have it transmitted to another controller, where applicable;
6. object to processing carried out on the basis of legitimate interests, and to object at any time to processing for direct marketing;
7. not be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you; and
8. withdraw your consent at any time, without affecting the lawfulness of processing carried out before withdrawal.

Automated decision-making
Where a decision producing legal or similarly significant effects is based solely on automated processing (including profiling), you have the right to obtain human intervention, to express your point of view, to contest the decision, and to obtain an explanation of it, in accordance with Article 22 of the GDPR.

Complaints to a supervisory authority
You may lodge a complaint with a data protection supervisory authority, in particular in the EU/EEA Member State of your habitual residence, place of work, or the place of the alleged infringement. Our lead supervisory authority is the Dutch Data Protection Authority (Autoriteit Persoonsgegevens), Postbus 93374, 2509 AJ Den Haag, the Netherlands — autoriteitpersoonsgegevens.nl.

Our Data Protection Officer
Data Protection Officer: Adrian Maritz | Telephone: +31 20 225 4566 | Email: privacyqueries@entelect.co.za 

Deputy Information Officer: Ryan Naudé | Telephone: +27 11 994 3300 | Email: privacyqueries@entelect.co.za

Barbara Strozzilaan 101, 1083 HN Amsterdam

Personal data breaches
Where a personal data breach is likely to result in a risk to your rights and freedoms, we will notify the competent supervisory authority within 72 hours where required, and will inform you without undue delay where the breach is likely to result in a high risk to you.

Your mandatory rights
Nothing in this notice limits the mandatory rights you have under the GDPR. 

Annex C — United Kingdom (UK GDPR)

If you are in the United Kingdom, the following applies to you in addition to Part A.

Local legal terms
Under the UK GDPR and the Data Protection Act 2018, the organisation that decides how your information is used is the “controller” (referred to as “we” in Part A); an organisation that processes information on our behalf is a “processor”; and our designated privacy contact is our Data Protection Officer (DPO).

Your rights under the UK GDPR
In addition to the rights described in Part A, you have the right to:

1. access your personal data and obtain a copy of it;
2. have inaccurate personal data rectified;
3. have your personal data erased, where applicable;
4. restrict the processing of your personal data, where applicable;
5. data portability, where applicable;
6. object to processing carried out on the basis of legitimate interests, and to object at any time to processing for direct marketing;
7. not be subject to a decision based solely on automated processing, including profiling, which produces legal or similarly significant effects; and
8. withdraw your consent at any time, without affecting the lawfulness of prior processing.

Our Lawful Basis for Employment Applications
We process your employment application information on the basis of our legitimate interests in assessing candidates for roles we are recruiting for. Decisions about your application are not made solely by automated means. Software may categorise your experience and flag an application for review, but every decision is made by a person who sees your full application and the reason for any flag. You may ask us to explain how software was used in your application and to have any decision looked at again by a person.

Automated decision-making
Where a decision producing legal or similarly significant effects is based solely on automated processing (including profiling), you have the right to obtain human intervention, to express your point of view, to contest the decision, and to obtain an explanation of it, in accordance with Article 22 of the UK GDPR.

Complaints to the regulator
You may lodge a complaint with the Information Commissioner’s Office (ICO), Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, United Kingdom — ico.org.uk. We would appreciate the opportunity to address your concerns first.

Our Data Protection Officer / UK representative
Data Protection Officer: Doug Crawford | Telephone: +44 (0) 7867 846 991 | Email: privacyqueries@entelect.co.za 

Deputy Information Officer: Ryan Naudé | Telephone: +27 11 994 3300 | Email: privacyqueries@entelect.co.za

39 Kings Chase, East Molesey, KT8 9DG, London, United Kingdom

Personal data breaches
Where a personal data breach is likely to result in a risk to your rights and freedoms, we will notify the ICO within 72 hours where required, and will inform you without undue delay where the breach is likely to result in a high risk to you.

Your mandatory right
Nothing in this notice limits the mandatory rights you have under the UK GDPR and the Data Protection Act 2018.

Annex D — New Zealand (Privacy Act 2020)

If you are in New Zealand, the following applies to you in addition to Part A.

Local legal terms
Under the New Zealand Privacy Act 2020, we are an “agency”; our handling of your information is governed by the Information Privacy Principles (IPPs); and our designated privacy contact is our Privacy Officer.

Your rights under the Privacy Act 2020
In addition to the rights described in Part A, you have the right to:

1. access your personal information that we hold (IPP 6); and
2. request correction of that information (IPP 7).

Collection of Information for an Employment Application by Referral
We usually collect information about you directly from your application. Sometimes we receive it from someone else, for example where you have been referred to us by an employee or a recruitment agency. Where that happens, we will let you know that we hold your information, where it came from, and what we will use it for.

Complaints to the regulator
You may complain to the Office of the Privacy Commissioner — PO Box 10094, Wellington 6143, New Zealand; Email: enquiries@privacy.org.nz; privacy.org.nz. We would appreciate the opportunity to address your concerns first.

Our Privacy Officer
Privacy Officer: Yatish Parshotam | Telephone: +64 21 315 839 | Email: privacyqueries@entelect.co.za 

Deputy Information Officer: Ryan Naudé | Telephone: +27 11 994 3300 | Email: privacyqueries@entelect.co.za

Level 2, 275 Cuba Street, Te Aro, Wellington, New Zealand

Privacy breaches
Where a privacy breach is likely to cause serious harm to an affected individual, we will notify the Office of the Privacy Commissioner and the affected individuals as soon as practicable, in accordance with the Privacy Act 2020.

Cross-border transfers from New Zealand
Personal information transferred from New Zealand is protected in accordance with Information Privacy Principle 12 and our intra-group data transfer arrangements, which require the receiving entity to protect your information in a manner consistent with the Privacy Act 2020.

Your mandatory rights
Nothing in this notice limits the mandatory rights you have under the New Zealand Privacy Act 2020.

Annex E — Australia (Privacy Act 1988 / Australian Privacy Principles)

If you are in Australia, the following applies to you in addition to Part A.

Local legal terms
Under the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs), we are an “APP entity”. Australian privacy law does not draw a distinction between a “controller” and a “processor”; our designated privacy contact is our Privacy Officer.

Unsolicited Information in Applications
CVs sometimes contain information we have not asked for and do not need, such as health information, ethnicity, religion or details of family circumstances.

We do not ask for this information, and it is not extracted from your CV or used to assess your application. Your CV is kept as part of your application record, so any such information you have included remains within it.

We only use it for the purpose of considering your application, and we do not disclose it or use it for anything else. It is protected by the same security measures as the rest of your application, and it is deleted when your application record is deleted.

Automated Decision-making
We use software as part of the employment application process. These tools are used to read your CV, categorise your experience, and provide our recruitment team the means to review your application personally. For more information, please review the section “How We Use Software to Process Employment Applications”

Your rights under the Privacy Act 1988
In addition to the rights described in Part A, you have the right to:

1. access the personal information we hold about you (APP 12);
2. request correction of that information (APP 13); and
3. deal with us anonymously or by pseudonym where it is lawful and practicable to do so (APP 2).

Complaints to the regulator

You may complain to the Office of the Australian Information Commissioner (OAIC) — GPO Box 5288, Sydney NSW 2001; oaic.gov.au; telephone 1300 363 992. We would appreciate the opportunity to address your concerns first.

Our Privacy Officer
Privacy Officer: Yatish Parshotam | Telephone: +64 21 315 839 | Email: privacyqueries@entelect.co.za 

Deputy Information Officer: Ryan Naudé | Telephone: +27 11 994 3300 | Email: privacyqueries@entelect.co.za

Suite 706, Level 7, 171 Clarence Street, Sydney 2000, Australia

Notifiable data breaches
Where an eligible data breach is likely to result in serious harm to an affected individual, we will notify the OAIC and the affected individuals as soon as practicable, in accordance with the Notifiable Data Breaches scheme under Part IIIC of the Privacy Act 1988.

Cross-border disclosure
We may disclose your personal information to group entities and service providers located outside Australia, including in South Africa and (for software development and related services) India. Under Australian Privacy Principle 8 we remain accountable for personal information we disclose overseas and take reasonable steps to ensure that overseas recipients handle it in a manner consistent with the APPs, including through our intra-group data transfer arrangements.

Your mandatory rights
Nothing in this notice limits the rights you have under the Privacy Act 1988 (Cth).