Privacy Policy & POPIA Notice

1 Introduction

1.1 This is the Privacy Policy of Dragynn (referred to in this policy as “Dragynn”, “us”, “we” or “our”, as the context requires). It sets out our policies regarding the collection, use, disclosure and protection of personal information when you use our service, and the choices and rights you have in relation to that information.

1.2 Dragynn operates an online candidate database and job-matching platform. Job seekers (“Dragynns”) create profiles that employers, recruiters and recruitment agencies search in order to identify and approach suitable candidates. Employers also advertise vacancies on the platform.

1.3 This Privacy Policy is drafted to comply with the Protection of Personal Information Act, 4 of 2013 (“POPIA”) and, where applicable, the Electronic Communications and Transactions Act, 25 of 2002 (“ECTA”) and the Promotion of Access to Information Act, 2 of 2000 (“PAIA”).

1.4 The provisions of this Privacy Policy operate together with the provisions of our Terms and Conditions. Where there is a conflict between the two in relation to the processing of personal information, this Privacy Policy prevails.

1.5 We use your information to provide, secure and improve the service. By using the service, you agree to the collection and use of information in accordance with this Privacy Policy.

2 Who we are — responsible party & Information Officer

2.1 For the purposes of POPIA, Dragynn is the responsible party in respect of the personal information described in this policy.

2.2 Our Information Officer is registered with the Information Regulator (South Africa) and is responsible for encouraging and ensuring our compliance with POPIA, dealing with requests made to us under POPIA and PAIA, and working with the Regulator in relation to investigations.

2.3 Where employers, recruiters or recruitment agencies obtain your personal information through Dragynn and thereafter process it for their own purposes, they act as separate responsible parties in their own right and are independently accountable under POPIA for that processing. See section 11.

3 Definitions

3.1 The following words, expressions and abbreviations bear the meanings assigned to them below. Where a term is defined in POPIA, the POPIA meaning applies.

3.1.1 “service” means the services and products made available on our website, and as advertised by email, on the website or through other marketing campaigns operated under the same domain by the proprietor of this website;

3.1.2 “personal information” means information relating to an identifiable, living natural person and, where applicable, to an identifiable, existing juristic person — including your name, contact details, identity or passport number, employment history, qualifications, location information, online identifiers, and information about your browsing habits on our website;

3.1.3 “special personal information” means personal information concerning your religious or philosophical beliefs, race or ethnic origin, trade union membership, political persuasion, health or sex life, biometric information, or criminal behaviour, as contemplated in section 26 of POPIA;

3.1.4 “data or content” means data collected automatically, generated by your use of the service, or produced by the service infrastructure itself, and which includes personal information;

3.1.5 “processing” means any operation concerning personal information, including collection, receipt, recording, organisation, storage, updating, retrieval, use, dissemination, distribution, merging, linking, restriction, degradation, erasure or destruction;

3.1.6 “cookies” means small pieces of data stored on your device;

3.1.7 “responsible party” (referred to elsewhere as a data controller) means the public or private body or any other person which, alone or in conjunction with others, determines the purpose of and means for processing personal information. For the purposes of this Privacy Policy, we are the responsible party in respect of your personal information;

3.1.8 “operator” (referred to elsewhere as a data processor or service provider) means a person who processes personal information for a responsible party in terms of a contract or mandate, without coming under the direct authority of that party. We use operators in order to process your information more effectively;

3.1.9 “data subject or user” means the person to whom personal information relates, including candidates, employers, recruiters and website visitors;

3.1.10 “Regulator” means the Information Regulator established in terms of section 39 of POPIA;

3.1.11 “employer or recruiter” means any registered business user of the platform, including direct employers, in-house talent teams, recruitment agencies, labour brokers and headhunters.

4 Our commitment to the POPIA conditions

4.1 We process personal information in accordance with the eight conditions for lawful processing set out in POPIA:

• Accountability — we take responsibility for ensuring the conditions are complied with.
• Processing limitation — we process lawfully, in a reasonable manner that does not infringe your privacy, and only to the extent adequate, relevant and not excessive for the purpose.
• Purpose specification — we collect for the specific, explicitly defined and lawful purposes set out in section 10.
• Further processing limitation — any further processing is compatible with the purpose of collection.
• Information quality — we take reasonably practicable steps to keep information complete, accurate, not misleading and updated. You can edit your profile at any time.
• Openness — we maintain documentation of our processing and give you notice of what we collect and why, through this policy.
• Security safeguards — we secure the integrity and confidentiality of personal information through appropriate technical and organisational measures.
• Data subject participation — you may request access to, and correction or deletion of, your personal information.

4.2 We rely on one or more of the following lawful bases for processing under section 11 of POPIA: your consent; the conclusion or performance of a contract to which you are a party; compliance with a legal obligation; the protection of your legitimate interests; or the pursuit of our legitimate interests or those of a third party to whom the information is supplied.

5 Your consent

5.1 How Dragynn obtains your consent

5.1.1 We obtain your consent when you voluntarily provide us with personal information — when you register an account, create or update a candidate profile, upload a CV, apply for a position, register a company, subscribe to alerts, complete a form, or otherwise engage with us through the website or any other platform we use to provide our services.

5.1.2 Consent under POPIA must be voluntary, specific and informed. By ticking the consent box presented to you at registration and by submitting your profile, you confirm that you have read this policy, that you understand how your information will be used and displayed, and that you agree to that use and display.

5.1.3 Where we wish to process your personal information for a secondary purpose that is not compatible with the original purpose (for example, a new marketing initiative), we will either ask you for express consent or give you a clear opportunity to decline.

5.1.4 If you provide us with the personal information of another person (for example, a referee, an emergency contact or a colleague), you warrant that you have that person's consent to do so and that you have informed them of the contents of this policy.

5.2 Withdrawing your consent

5.2.1 You may withdraw your consent at any time, subject to legal or contractual restrictions and reasonable notice. See section 19 for how to do this and what the effect will be.

5.2.2 Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

6 Public display of your profile and contact details

6.1 What you consent to. By registering as a candidate on Dragynn and submitting your profile, you expressly and voluntarily consent to:

• the display of your profile and your contact information on the website, where it may be viewed by employers, recruiters, recruitment agencies and other users of the platform, and where it may be indexed by search engines;
• being contacted directly by employers and recruiters in connection with employment, contract, freelance or other work opportunities — by telephone, SMS, WhatsApp, email or any other contact method you have published on your profile;
• your profile being included in search results, candidate shortlists, talent-pool exports and similar features made available to registered employers and recruiters.

6.2 Information that will be publicly displayed. The information you submit for display purposes may include, without limitation: your name and surname, your mobile or telephone number, your email address, your city, town, province and country, your job title and industry, your skills, trade or profession, your qualifications and certifications, your employment and work history, your availability and notice period, your salary or rate expectations, your profile photograph, and any CV, portfolio or supporting document you choose to upload.

6.3 You control what you publish. You choose the information you place on your profile. Please do not publish any information you are not comfortable making public. In particular, we ask that you do not include your identity or passport number, your residential street address, your banking details, your tax number, or any other sensitive identifier in your public profile. We do not require these to display your profile, and we will remove them where we identify them.

6.4 You can change your mind at any time. You may edit, hide or delete individual fields, set your profile to private (where that feature is available on your account type), or delete your profile entirely from your dashboard, or by emailing [email protected]. Once you do so, your profile will no longer be displayed or returned in searches on Dragynn.

6.5 Search engine indexing. Publicly displayed profiles may be crawled and cached by third-party search engines. We cannot control or remove third-party caches, although we will de-index a removed profile from our own systems and will honour standard removal protocols where technically possible.

6.6 Employer and recruiter contact details. If you register as an employer or recruiter, the contact information you submit for your company listing and job advertisements will likewise be displayed publicly so that candidates can respond to your vacancies. The same principles in this section apply to you.

6.7 Misuse of published contact details. Employers and recruiters are permitted to use contact details obtained from Dragynn only for genuine recruitment purposes. Using them for unsolicited direct marketing, resale, bulk harvesting, scraping or any unlawful purpose is a breach of our Terms and Conditions and, potentially, of POPIA. If you receive unwanted contact through a Dragynn profile, please report it to [email protected] so that we can investigate and, where appropriate, suspend the offending account.

7 Age of consent and children

7.1 By using this website you represent that you are at least 18 years of age and have the legal capacity to enter into binding agreements.

7.2 In terms of section 34 of POPIA, we do not knowingly process the personal information of a child (a natural person under the age of 18). Given that Dragynn publicly displays candidate contact details, registration is restricted to persons aged 18 and over. If you are under 18, please do not create a profile or submit personal information through the service.

7.3 If we become aware that a child has registered or that we hold a child's personal information without the required authorisation, we will delete that information from our records as soon as reasonably possible.

7.4 If a parent, guardian or other competent person becomes aware that a child in their care has provided us with personal information, they should contact us at [email protected] and we will remove it.

7.5 We encourage parents and legal guardians to monitor their children's internet usage and to assist us in enforcing this policy.

8 Information we collect

8.1 Information you give us

We collect the personal information you provide when you register, build a profile, upload documents, apply for roles, advertise vacancies, contact our support team, or otherwise interact with the service. This may include:

8.2 You may be asked, or required, to provide limited personal information in order for us to provide certain services to you. We may store this information manually or electronically, and we will use it only for the purposes for which it was provided and to which you have consented. It will be kept only for as long as is necessary to fulfil that purpose or as required by law.

8.3 Information we collect automatically

We may also collect technical information about the device you use, including your IP address, operating system, browser type, device identifiers and referring domain, for system administration, security and aggregate reporting purposes. In isolation this information is statistical and does not identify you personally; it helps us ensure that content is presented in the most effective manner for you and your device.

8.4 Log data

When you interact with the site or use our services, our servers automatically receive and store certain information (“log data”). Log data is collected passively and may include your IP address, browser type or the domain from which you are visiting, the pages you visit, the search terms you use, and any advertisements you click. For most users accessing the internet from an internet service provider, the IP address will differ each time you log on. We use log data to provide the services, to monitor use of the services and for technical administration. We do not associate your IP address with other personal information to identify you personally, except where we are required to comply with a subpoena or other legal demand, or where we suspect a violation of our policies, our Terms and Conditions or applicable law.

8.5 Information from third parties

Where you choose to register or sign in using a third-party service (such as a social or professional network), or where an employer refers you to the platform, we may receive limited personal information from that source. We will process it in accordance with this policy.

9 Special personal information

9.1 We do not require special personal information in order to create a profile, and we ask that you do not volunteer it unnecessarily.

9.2 In the South African employment context, however, certain special personal information may become relevant. Where it does, we process it only on the bases permitted by sections 26 to 33 of POPIA — in particular with your express consent, or where processing is necessary to comply with an obligation of law:

• Race, ethnic origin and gender — some employers request this information in order to meet their obligations under the Employment Equity Act, 55 of 1998, and the Broad-Based Black Economic Empowerment Act, 53 of 2003. Providing it is optional. If you provide it, you consent to it being made available to employers and recruiters for equity-reporting and shortlisting purposes.
• Health or disability information — you may choose to disclose a disability so that reasonable accommodation can be made. Providing it is optional and it will only be shared for that purpose.
• Criminal behaviour — some roles are subject to a statutory or industry vetting requirement. Where a verification or background check is carried out, it will be with your separate express consent and by an accredited third-party provider.

9.3 You may withdraw consent to the processing of special personal information at any time by removing it from your profile or by contacting [email protected].

10 Why we process your information

10.1 We consider your information to be a vital part of our relationship with you. We use the information we collect for the following purposes, which are not exhaustive:

10.1.1 to deliver the services you have asked for — in other words, to provide, operate and maintain the service, including creating and hosting your profile and account;

10.1.2 to operate a listing platform. It is understood and agreed that the contact information you submit is provided in order to be displayed on the website for the purpose of your being contacted by prospective employers, recruiters and clients, either directly or through website features. This information may include, but is not limited to, your name, surname, cell number and email address. Contact information submitted for that purpose will be publicly displayed;

10.1.3 to match candidates to vacancies, generate search results, shortlists and recommendations, and to enable employers and recruiters to contact you;

10.1.4 to verify your identity, qualifications or work history where you have consented to verification;

10.1.5 to notify you about changes to the service, and to respond to your enquiries and provide customer support;

10.1.6 to allow you to participate in interactive features of the service when you choose to do so;

10.1.7 to send you job alerts, newsletters, announcements and information about goods, services and events similar to those you have used or enquired about, unless you have opted out;

10.1.8 to gather analysis and insight so that we can improve the service, and to monitor usage of the service;

10.1.9 to detect, prevent and address technical issues, fraud, abuse, scraping and security incidents;

10.1.10 to compile demographic and statistical information about user behaviour in order to analyse the popularity and effectiveness of the website. Any disclosure of this information will be in aggregate form and will not identify individual users;

10.1.11 to administer subscriptions and payments, and to keep accounting records;

10.1.12 for research purposes, including labour-market research, where the information is de-identified or aggregated wherever practicable;

10.1.13 to comply with our legal, regulatory and tax obligations, and to establish, exercise or defend legal claims.

10.2 If you subscribe to alerts, news or announcements to be emailed to you from this website, we will hold your details on our database until you unsubscribe. You may do this at any time using the unsubscribe link in any communication or the alerts section of the site.

10.3 We do not sell your personal information. We do not sell personal information to third parties, and we do not provide it to direct marketing companies or similar organisations without your consent. We may disclose personal information where we are under a legal duty to do so — see section 13.

11 Employers, recruiters and what they may do with your information

11.1 Employers and recruiters who register on Dragynn agree, as a condition of access, to:

• use candidate information solely for genuine recruitment and talent-sourcing purposes;
• comply with POPIA and all other applicable laws in their own processing of that information;
• not use candidate contact details for unsolicited direct marketing;
• not resell, redistribute, bulk-export, scrape or harvest candidate information;
• retain candidate information only for as long as necessary and to honour candidate requests for access, correction and deletion.

11.2 Once an employer or recruiter has obtained your information from Dragynn, they process it as an independent responsible party under POPIA. Dragynn does not control and is not responsible for how they subsequently use it. Their own privacy notices apply to that processing.

11.3 We will take reasonable steps to enforce clause 11.1, including suspending or terminating accounts that breach it and reporting serious breaches to the Regulator where appropriate. Please report any misuse to [email protected].

12 Direct marketing

12.1 In accordance with section 69 of POPIA and section 45 of ECTA, we will only send you electronic direct marketing where you are an existing customer whose contact details we obtained in the context of providing the service and the marketing relates to similar products or services, or where you have given your consent.

12.2 Every marketing communication we send will identify us as the sender and will contain a clear, free and easy means of opting out.

12.3 Opt-out. If at any stage you no longer wish to receive marketing information, click the unsubscribe link in any email, change your preferences in your dashboard, or email us confirming that you wish to OPT OUT at [email protected]. We will action the request without charge and without undue delay.

12.4 Opting out of marketing does not stop transactional and service messages (such as password resets, security notices, billing notices, or messages from employers responding to your profile), which are necessary for the operation of your account.

12.5 Contact from employers is not direct marketing. Approaches from employers and recruiters about work opportunities are the core function of the platform and are covered by the consent described in section 6, not by this section. If you no longer wish to receive them, hide or delete your profile as described in section 19.

13 Sharing your information with operators and third parties

13.1 There are limited circumstances in which we share personal information:

• Employers and recruiters — as described in sections 6 and 11.
• Operators — we engage trusted third parties to perform functions and provide services to us, including hosting and maintenance, cloud storage, customer relationship management, database storage and management, email delivery, analytics, payment processing and marketing campaign delivery. We share personal information with them only to the extent necessary to perform those functions, under written contracts that require them to establish and maintain appropriate security safeguards and to process the information only on our instructions, as required by sections 20 and 21 of POPIA.
• Partners — in connection with the operation, promotion, advertising or marketing of the service, we may provide certain partners with limited information related to you. Where we do so, we only provide information that is already publicly available or publicly viewable on the platform.
• Professional advisors — auditors, attorneys, insurers and accountants, under duties of confidentiality.
• Research institutions — for research purposes, in de-identified or aggregated form wherever practicable.
• Business transactions — we may transfer or share some or all of our assets, including personal information, in connection with a merger, acquisition, reorganisation, sale of assets or winding-up. We will notify you of any such transfer and of any change to the responsible party.

13.2 Legal disclosure. Legal requirements may oblige us to disclose your information. Any such disclosure is made in good faith and in the belief that the action is necessary to: comply with a legal obligation; protect and defend our rights or property; prevent or investigate possible wrongdoing in connection with the service; protect the personal safety of users of the service or of the public; or protect against legal liability.

14 Transfers outside South Africa

14.1 Your information may be transferred to, and maintained on, computers located outside your province or country, where data protection laws may differ from those in your jurisdiction. Our hosting and service providers may operate servers outside the Republic of South Africa.

14.2 In accordance with section 72 of POPIA, we will only transfer personal information outside South Africa where at least one of the following applies: the recipient is subject to a law, binding corporate rules or a binding agreement that provides an adequate level of protection substantially similar to POPIA; you have consented to the transfer; the transfer is necessary for the performance of a contract between you and us, or for the implementation of pre-contractual measures taken in response to your request; or the transfer is for your benefit and it is not reasonably practicable to obtain your consent.

14.3 Your consent to this Privacy Policy, followed by your submission of information, represents your agreement to that transfer.

14.4 We will take reasonable steps to ensure that your information is treated securely and in accordance with this Privacy Policy, and no transfer will take place to an organisation or a country unless adequate controls are in place, including controls over the security of your information.

14.5 Please note that because your profile is publicly displayed, it may be viewed by employers and recruiters located anywhere in the world.

15 Retention of personal information

15.1 In accordance with section 14 of POPIA, we retain personal information only for as long as is necessary to achieve the purposes set out in this policy, unless a longer retention period is required or permitted by law, you have consented to longer retention, or the information is required for the establishment, exercise or defence of a legal claim.

15.2 When personal information is no longer required, we will destroy or delete it in a manner that prevents its reconstruction in an intelligible form, or de-identify it so that it can no longer be linked to you.

15.3 We may retain de-identified, aggregated statistical information indefinitely.

16 Security of your information

16.1 In accordance with section 19 of POPIA, we secure the integrity and confidentiality of personal information in our possession or under our control by taking appropriate, reasonable technical and organisational measures to prevent loss of, damage to, or unauthorised destruction of personal information, and unlawful access to or processing of personal information.

16.2 The measures we take include:

• encryption of data in transit using TLS/HTTPS across the website;
• encryption of data at rest in our production databases;
• storage of passwords using strong, salted one-way cryptographic hashing — we never store passwords in plain text and cannot retrieve them;
• role-based access control, so that staff and operators access only the information they need to perform their duties;
• maintaining technology products designed to prevent unauthorised computer access and to identify and remediate security vulnerabilities;
• regular backups, patching and monitoring of our infrastructure;
• written operator agreements with all third-party service providers, imposing equivalent security obligations;
• confidentiality undertakings and privacy training for personnel with access to personal information;
• rate limiting and anti-scraping controls to protect publicly displayed profiles from bulk harvesting;
• secure destruction of personal information when it is no longer needed for our record-retention purposes.

16.3 We regularly verify that these safeguards are effectively implemented and update them in response to new risks and deficiencies.

16.4 Your responsibilities. You are responsible for keeping your password confidential, for using a strong and unique password, and for notifying us immediately at [email protected] if you suspect unauthorised access to your account. You are also responsible for the information you choose to publish on your public profile.

16.5 No system is perfect. While we take the protection of your personal information seriously, no method of transmission over the internet and no method of electronic storage is completely secure. We cannot guarantee absolute security, and any transmission of personal information is at your own risk. Nothing in this policy excludes or limits any liability we may have under POPIA or any other law that cannot lawfully be excluded or limited.

17 Security compromises and breach notification

17.1 In accordance with section 22 of POPIA, where there are reasonable grounds to believe that your personal information has been accessed or acquired by an unauthorised person, we will notify the Information Regulator and you as soon as reasonably possible after discovering the compromise.

17.2 Notification to you will be in writing and communicated by email to your registered address, by post, by prominent notice on the website, or by publication in the news media, as appropriate. It will provide sufficient information to allow you to take protective measures, including a description of the possible consequences, the measures we intend to take or have taken, our recommendations on what you should do to mitigate the possible adverse effects, and the identity of the unauthorised person if known.

17.3 Notification may be delayed only where a public body responsible for the prevention, detection or investigation of offences, or the Regulator, determines that notification will impede a criminal investigation.

18 Your rights under POPIA

18.1 As a data subject you have the following rights in terms of section 5 of POPIA:

• To be notified that your personal information is being collected, and that it has been accessed or acquired by an unauthorised person.
• To access your personal information — to request confirmation, free of charge, of whether we hold information about you, and to request a record or description of that information (section 23). A prescribed fee may apply to the provision of the record itself.
• To correct or delete personal information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or obtained unlawfully, and to request the destruction or deletion of a record we are no longer authorised to retain (section 24).
• To object, on reasonable grounds, to the processing of your personal information in terms of section 11(3), and to object at any time to processing for direct marketing purposes.
• Not to have your personal information processed for direct marketing by means of unsolicited electronic communications, except as permitted by section 69.
• Not to be subject to a decision based solely on the automated processing of your information intended to profile you, where that decision has legal consequences for you (section 71). Our matching and ranking features are decision-support tools only; hiring decisions are made by employers, not by Dragynn.
• To submit a complaint to the Information Regulator regarding an alleged interference with the protection of your personal information (section 74).
• To institute civil proceedings regarding an alleged interference with the protection of your personal information (section 99).

18.2 How to exercise your rights. Access, correction and deletion requests must be made on the prescribed form and sent to our Information Officer at [email protected]. The forms are available in our PAIA manual (section 22) and from the Information Regulator's website. We may require proof of identity before actioning a request.

18.3 We will respond to a request within a reasonable time, and in any event within the periods prescribed by POPIA and PAIA. If we do not agree to a correction or deletion, we will attach an indication to the record that a correction was requested but not made, where you ask us to do so.

18.4 Many of these actions can be completed instantly and free of charge from your Dragynn dashboard — you can edit any profile field, change your visibility settings, download a copy of your profile data, or delete your account.

19 Withdrawing consent and deleting your profile

19.1 You may at any time:

• Edit or remove individual details from your public profile through your dashboard.
• Hide your profile from search results, where that setting is available on your account type, so that it is no longer displayed to employers and recruiters.
• Unsubscribe from marketing using the link in any email or your communication preferences.
• Delete your account permanently through your dashboard or by emailing [email protected].

19.2 Effect of withdrawal. If you withdraw consent to the public display of your information, we can no longer provide you with the core Dragynn service, because that service consists of making you findable by employers. Withdrawal will therefore usually mean the closure of your candidate profile.

19.3 What we may retain. After deletion we may retain a limited record where we are legally obliged or entitled to do so — for example, financial records for tax purposes, records necessary to defend a legal claim, and a suppression record containing your email address so that we do not contact you again in error. We will not use retained information for any other purpose.

19.4 Information already in the hands of third parties. As explained in section 6, information already accessed by an employer or recruiter cannot be recalled by us. You may exercise your POPIA rights directly against that party.

20 Cookies, tracking and log data

20.1 We have a legitimate interest in the use of cookies in the pursuit of our business. Cookies and similar tracking technologies — such as tags, scripts, pixels and beacons — are small pieces of code stored on a device (computer, mobile phone, tablet) that enable us to personalise our content and that of our clients. We may use cookies in emails we send to you and on our website. Our website contains clear and easy-to-find information about our cookies.

20.2 We use the following categories of cookie:

20.3 You can instruct your browser to refuse all cookies or to indicate when a cookie is being sent. If you do not accept cookies, you may not be able to use some portions of the service.

20.4 “Do Not Track” signals. We do not currently respond to “Do Not Track” (“DNT”) signals. DNT is a preference you can set in your web browser to inform websites that you do not wish to be tracked. You can enable or disable DNT from the preferences or settings page of your browser.

21 Third-party services and links

21.1 In general, third-party providers used by us will only collect, use and disclose your information to the extent necessary to allow them to perform the services they provide to us.

21.2 Certain providers may be located in, or have facilities located in, a jurisdiction different from yours or ours. If you elect to proceed with a transaction that involves the services of a third-party service provider, your information may become subject to the laws of the jurisdictions in which that provider or its facilities are located.

21.3 Our service may contain links to sites that are not operated by us. The fact that we link to a website is not an endorsement, authorisation or representation of our affiliation with that third party. Once you leave our website or are redirected to a third-party website, you are no longer governed by this Privacy Policy or our Terms and Conditions.

21.4 We have no control over, and assume no responsibility or liability for, the content, privacy policies or practices of any third-party website or service. We encourage you to read their privacy statements before providing them with personal information.

22 PAIA manual

22.1 Dragynn maintains a manual in terms of section 51 of the Promotion of Access to Information Act, 2 of 2000, which sets out the records we hold, the procedure for requesting access to them and the prescribed forms and fees.

22.2 The manual is available free of charge from our website at /paia-manual or on request from [email protected].

23 Complaints

23.1 Talk to us first. If you are unhappy with how we have handled your personal information, please contact our Information Officer at [email protected]. We take complaints seriously and will investigate and respond as quickly as we reasonably can.

23.2 Complaints to the Regulator. You also have the right to lodge a complaint directly with the Information Regulator (South Africa) in terms of section 74 of POPIA. Complaints must be submitted in writing through the Regulator's eServices Portal, for which you must first register a user profile.

24 Changes to this Privacy Policy

24.1 Our services and business may change from time to time. We reserve the right to modify this Privacy Policy at any time, so please review it regularly.

24.2 Changes and clarifications take effect immediately upon posting on the website and our other platforms. Where we make material changes — particularly to how your information is displayed or shared — we will notify you by email or by prominent notice on the website before the change takes effect, so that you are aware of what information we collect, how we use it, and in what circumstances we disclose it.

24.3 Your continued use of the service after a change takes effect constitutes acceptance of the amended policy. Where a change requires fresh consent under POPIA, we will ask you for it.

25 Applicable law

25.1 This Privacy Policy is governed by the laws of the Republic of South Africa. You consent to the jurisdiction of the South African courts in respect of any dispute arising out of or in connection with the formation, interpretation, substance or application of this Privacy Policy.

25.2 If any provision of this policy is found to be invalid or unenforceable, the remaining provisions continue in full force and effect.

26 Questions and contact information

26.1 If you would like to access, amend, correct or delete any personal information we hold about you, withdraw your consent, register a complaint, or simply want more information, please contact us:

26.2 Please mark POPIA-related correspondence “For the attention of the Information Officer — POPIA request”.