Applicant Privacy Notice

Introduction

• Thungela Operations (Pty) Ltd or its relevant associated companies, “Company","we",";us" and "our"), to which you are submitting a job application, will be the data controller of your personal data. In addition, where processing of personal data is undertaken by other associated companies of the Company for their own independent purposes, these associated companies may also be controllers of your personal data.
• The Company will hold and process data on all applicants, interview candidates ("applicants" or "you" or "your") and third parties whose information you provide to us in connection with your job application (e.g. referees).
• We take your data protection rights and our legal obligations seriously. Your personal data will be treated in a secure and confidential manner and only as set out below or otherwise notified to you in writing and in accordance with this Privacy Notice.
• Compliance with data protection legislation means the data protection laws and any data protection obligations contained within the national legislation of South Africa and any other jurisdiction, where the relevant data subject is located or personal information is being processed, stored or used, including any of the following where relevant, but not limited to, the South African Protection of Personal Information Act 4 of 2013 (“POPIA”), the UAE Federal Decree-Law No. 45/2021 on the Protection of Personal Data (PDPL 2021), the UK Data Protection Act 1998, the EU Data Protection Directive 95/46/EC, the EU Directive on Privacy and Electronic Communications 2002/58/EC, Commission decisions and guidance, and the European Union General Data Protection Regulation (“GDPR”)
• The following Privacy Notice describes the categories of personal data we may process, how your personal data is processed, for what purposes we process your data and how your privacy is safeguarded in the course of our relationship with you. It is intended to comply with our obligations to provide you with information about the Company's processing of your personal data under relevant privacy laws.
• If you have any questions about this Privacy Notice or would like to access the information it contains in a different format please contact our Data Protection Team at dataprotection@thungela.com.

Processing of personal data

The Company collects and processes your personal data for the purposes described in this Privacy Notice. "Personal data" means any information describing or relating to an identified or identifiable individual. An identifiable individual is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that individual. Reference to “personal data” in this Privacy Notice shall also be deemed to include reference to “special categories of personal data” (as defined under applicable privacy laws), where applicable.

What data do we process?

Where permitted by applicable laws and regulations (and with your consent, where this is required by law) we collect various types of personal data about you for the purposes described in this Privacy Notice including:

Personal details: your name, gender, nationality, civil/marital status, date of birth, age, personal contact details (e.g. address, telephone or mobile number, e mail), national ID number, immigration and eligibility to work information, driving licence, passport,

Recruitment and selection data: skills and experience, qualifications, references, CV and application, interview and assessment data (including results of psychometric tests, if appropriate), information related to the outcome of your application, interview notes and records, details of any offer made to you;

Financial information: your bank details, tax information, social security information, student loan information (if applicable) and previous employment details (where relevant);

Vetting and verification data: vetting and verification information (e.g. results of right to work verification, credit reference check, global watch list check and a basic disclosure criminal record check relating to unspent convictions, where carried out and permitted by applicable law);

Role information: including job title, start date and salary;

Equality and diversity data: where permitted by law and provided voluntarily, data regarding gender, age, race, nationality, religious belief and sexuality (stored anonymously for equal opportunities monitoring purposes); and

Any other personal data which you choose to disclose to us during the course of your application and onboarding, whether verbally or in written form.

Certain additional information may be collected where this is necessary and permitted by local applicable laws. 

Special categories of data

To the extent permitted by applicable laws the Company may, during the job application process, collect and process a limited amount of personal data within the above data listed at falling into special categories, sometimes called "sensitive personal data". Where the South African Protection of Personal Information Act applies, this term means information relating to:

• racial or ethnic origin;
• political opinions;
• religious or philosophical beliefs;
• physical or mental health (including details of accommodations or adjustments);
• trade union membership;
• sex life or sexual orientation;
• biometric and genetic data; and
• criminal records and information regarding criminal offences or proceedings.

Where other data protection laws apply, “sensitive personal data” or “special categories of personal data” shall have the meaning (if any) defined in such laws (as amended from time to time).

How does the Company collect data?

The Company collects and records your personal data from a variety of sources, but mainly directly from you. You will provide this information directly to the Company, enter it into our systems (for example, the Company's job application portal) or the individuals with whom you interact during the job application process.

In addition, further information about you will come from the individuals with whom you interact during the job application process. We also obtain some information from third parties: for example, via recruitment agencies and search agencies, references from a previous employer, information from tax authorities, referrals from existing employees, or where we employ a third party to carry out a background check (where permitted by applicable law) or occasionally from clients.

Where we ask you to provide personal data to us on a mandatory basis, we will inform you of this at the time of collection and in the event that particular information is required by the contract or statute this will be indicated. Failure to provide any mandatory information will mean that we cannot carry out certain processes. For example, we will be unable to verify your eligibility to work in certain jurisdictions if you do not provide us with your qualifications, nationality or immigration information. In some cases it may mean that we are unable to continue with your application as the Company will not have the personal data we believe to be necessary in determining whether to proceed with your application.

Apart from personal data relating to you, you may also provide the Company with personal data of third parties, notably your referees, for purposes of administration and management of your application. Before you provide such third party personal data to the Company you must first inform these third parties of any such data which you intend to provide to the Company and of the processing to be carried out by the Company and obtain the requisite consent from these third parties (where required by applicable laws), as detailed in this Privacy Notice. 

What are the purposes for which data is processed and what is our legal basis (if applicable) for carrying out the processing?

Your personal data are collected and processed for various business purposes, in accordance with applicable laws and any applicable collective bargaining agreements. We have set out in this Privacy Notice the purposes for which we may use your personal data. Personal data may occasionally be used for purposes not obvious to you where the circumstances warrant such use. We may, where we think it is necessary and required by applicable laws, provide you with additional information to ensure that you understand how your personal data may be used. 

The legal basis on which we process your personal data Whenever the Company processes your personal data we do so on the basis of a legal basis or justification for that processing. Processing of special categories of data is always justified on the basis of an additional lawful condition. In the majority of cases, the processing of your personal data will be justified on one of the following basis:

The processing is necessary for compliance with a legal obligation to which the Company is subject (for example, disclosing the information to any relevant tax and social security authorities, avoiding unlawful discrimination, meeting statutory record keeping requirements or health and safety obligations); and/or

Where there is no legal obligation we will process your data where the processing is necessary in order to take steps at your request prior to entering into an employment contract or contract for services or similar (for example collecting bank details to pay your remuneration or processing information to provide you with the contractual benefits you are entitled to); and/or

Where the above two grounds do not apply we may process your personal data where the processing is necessary for the legitimate interests pursued by the Company, except where such interests are overridden by your interests or fundamental rights and freedoms which require protection of personal data. The Company considers that it has a legitimate interest in processing data for the purposes set out above. This is necessary to ensure fair and effective recruitment of suitable personnel and the effective reward, administration, support, development and management of applicants. This is important to ensure that the Company continues to meet its business objectives and goals both in the short and long term; maintains its reputation; and continues to attract and retain high calibre applicants.

We may on occasion process your personal data for the purpose of legitimate interests pursued by a third party, except where such interests are overridden by your interests or fundamental rights and freedoms which require protection of personal data (for example to meet the security requirements of our clients).

In exceptional circumstances where we have no legitimate interest in processing but you ask us to process data for a particular purpose we may carry out the processing on the basis of your consent. Where we rely on this we will make this clear at the time.

We have set out below the purposes we may use your personal data for and the legal basis we rely on in each case.

If applicable privacy law(s) does not enable collection, use and disclosure of personal data upon such legal bases, we will obtain your consent to such processing in accordance with those law(s).

The purposes we use personal data for and the legal basis that applies

We have identified a number of purposes for collecting and processing your personal data. These are set out below. Where required under applicable laws, we will seek your consent to these purposes in accordance with those laws. Where we are not required to seek consent for the processing of your personal data, the purposes, together with the legal basis we rely on in each case are as follows:

Additional legal basis we rely on where we process special category data (if the personal data processing activity falls within the jurisdiction of South Africa)

The special categories of personal data that are processed by the Company are set out above. Where we process special categories of personal data it will be justified by a condition set out in "the legal basis on which we process your personal data" above and also by one of the following additional conditions:

• The processing is necessary for the purposes of carrying out the obligations and exercising the rights of you or the Company in the field of employment law, social security and social protection law, to the extent permissible under applicable laws;
• The processing is necessary to protect your vital interests or of another person where you are physically or legally incapable of giving consent (for example in exceptional emergency situations, such as a medical emergency);
• The processing is necessary for reasons of substantial public interest;
• The processing is necessary for the establishment, exercise or defence of legal claims; or
• In exceptional circumstances the processing is carried out subject to your explicit consent.

Additional legal basis we rely on where we process special category data (if the personal data processing activity falls within the jurisdiction of Australia)

The special categories of personal data that are processed by the Company are set out above. Where we Process special categories of data in Australia, it will be justified by:

• A condition set out in "the legal basis on which we process your personal data"above, provided applicants have also consented to the collection of the information; or
• One of the following conditions is met:
• The collection of the information is required or authorised by, or under, an Australian law or a court / tribunal order;
• A ‘permitted general situation’ (within the meaning of that term in section 16A of the Privacy Act 1988 (Cth)) exists in relation to the collection of the information; or
• A ‘permitted health situation’ (within the meaning of that term in section 16B of the Privacy Act 1988 (Cht)) exists in relation to the collection of the information.

Additional legal basis we rely on where we process special category data (if the personal data processing activity falls within the jurisdiction of United Arab Emirates)

The special categories of personal data that are processed by the Company are set out above. Where we process special categories of data in the United Arab Emirates, it will be justified by Article 5 of the PDPL which provides that personal data must be processed in accordance with the following rules:

• processing shall be performed lawfully, fairly, and in a transparent manner;
• personal data must be adequate and limited to what is necessary in relation to the purpose for which it is processed; and
• personal data shall be accurate and, where necessary, kept up to date.

The purposes we use special category personal data for and the additional legal basis that applies

We have identified a number of purposes for collecting and processing your special category personal data. These are set out below. Where required by applicable laws, we will seek your consent to such processing for these purposes. Otherwise the purposes together with (where applicable) the additional legal basis we rely on in each case are as follows:

Consent

We may seek your consent to certain processing of your personal data which is not otherwise justified under one of the above basis or applicable privacy laws require us to obtain your consent.

If you are in the South Africa, Australia or the United Arab Emirates, if consent is required for the processing in question; (a) such consent will be sought from you separately to ensure that it is freely given, informed and explicit; (b) information regarding such processing will be provided to you at the time that consent is requested, along with the impact of not providing any such consent; and (c) you should be aware that it is not a condition or requirement of your employment to agree to any request for consent from the Company.

Processing data relating to criminal convictions and offences

• Personal data relating to criminal convictions and offences will only be processed where authorised by applicable laws, (and where required by applicable laws with your consent). For example, a criminal record check may be carried out as part of your recruitment.

Automated decision making

• Automated decision-making takes place when an electronic system uses personal data to make a decision without human intervention. We do this only where we have your consent (if required by applicable laws), or where it is necessary to perform the contract with you and appropriate measures are in place to safeguard your rights.
• When recruiting for certain roles, we may automatically reject applicants based on their answers to some screening questions. This will happen where there are legal requirements pertaining to the role (e.g. right to work or minimum qualifications or certifications). If this applies, the candidate will be unsuccessful in their job application. All requirements of the role will be clearly articulated in the job description.
• For certain roles, we may use artificial intelligence to scan job applications and CVs to assess their alignment with the requirements of the role, as described in the job description. This will result in applicants being ranked based on the outcome of the scanning. Hiring decisions will then be made by a human being.
• In a limited number of cases, we may also automatically reject applicants if they do not achieve a pass score in an assessment test that they take as part of the application process. If this applies, the applicant will be unsuccessful in their job application.
• In any specific situation described above and subject to local laws, you have 21 days to request a reconsideration of any decision taken by automated means.

Retention of personal data

• The Company endeavours to ensure that personal data are kept as current as possible and that irrelevant or excessive data are deleted or made anonymous as soon as reasonably practicable.
• The Company generally retains personal data for as long as is required to satisfy the purpose for which it was collected. This will usually be the period of your application, plus the time in which you can make an appeal or take other legal action. If successful, your personal data will be retained for the period of your employment/contract with us plus the length of any applicable statutory limitation period following your departure, although some data, such as pension information, may need to be kept for longer. The Company may keep some specific types of data, for example, tax records, for different periods of time, as required by applicable law. However, some personal data may be retained for varying time periods in order to comply with legal and regulatory obligations and for other legitimate business reasons. 

Disclosures of personal data

Your personal data (with your consent, where required by applicable law) can be accessed by or may be disclosed internally on a need to know basis within the Company to:

• Members of local, regional and global Human Resources teams, including managers and team members;
• local, regional and executive management responsible for managing or making decisions in connection with your application to the Company or when involved in a process concerning your application to the Company; 
• system administrators; and
• where necessary for the performance of specific tasks or system maintenance by members of Company teams such as the Global Shared Service centre, Finance and IT Departments and the Global HR information systems support team.

Your personal data is also accessed by third parties who provide us with services. For example:

• Screening and referencing providers;
• Assessment providers (e.g. for psychometric tests and medical assessments); and
• External software / data hosting providers;
• Where the third parties described above act as a "data processor"they carry out their tasks on our behalf and upon our instructions for the above-mentioned purposes. In this case your personal data will only be disclosed to these parties to the extent necessary to provide the required services.
• In addition, we may share personal data with national authorities in order to comply with a legal obligation to which we are subject. This is, for example the case in the framework of imminent or pending legal proceedings or a statutory audit.

Security of data

The Company is committed to protecting the confidentiality and security of the personal data you share with us. The Company uses a variety of technical and organisational methods (e.g. encryption, breach notification plan, regular audits and inspections) to secure your personal data in accordance with applicable laws.

International transfer of personal data

• From time to time your personal data (including special categories of personal data) will be transferred to associated companies of the Company to process for the purposes described in this Privacy Notice. This will be applicable for example where the relevant company or a manager from that company is responsible for conducting or approving the relevant process.
• These associated companies or managers may be located within South Africa and elsewhere in the world (including but not limited to, Australia and The United Arab Emirates).
• Personal data may also be transferred to third parties (e.g. service providers or regulators as set out above), who may have systems or suppliers located outside the country or jurisdiction where you are located.
• As a result, your personal data may be transferred to countries outside of the country or jurisdiction in which you are located.
• The Company will ensure that appropriate or suitable safeguards are in place to protect your personal data and that transfer of your personal data is in compliance with applicable data protection laws.
• Where required by applicable data protection laws, the Company has ensured that service providers (including other Company associated companies) sign standard contractual clauses or such other contractual or other measures as approved or indicated by other supervisory authority with jurisdiction over the relevant Company exporter. You can obtain a copy of any standard contractual clauses in place which relate to transfers of your personal data by contacting dataprotection@thungela.com.
• If you are located in the European Union or the United Kingdom, you have a right to request a copy of any data transfer agreement under which your personal data is transferred, or to otherwise have access to the safeguards used. Any data transfer agreement made available to you may be redacted for reasons of commercial sensitivity. To request sight of these contact contacting dataprotection@thungela.com.

Your rights as a data subject

Whether these rights apply to you will depend on the nature of the personal data processing activity, and the jurisdiction in which the processing takes place.

Right to access, correct and delete your personal data

• The Company aims to ensure that all personal data are correct. You also have a responsibility to ensure that changes in personal circumstances are notified to the Company so that we can ensure that your data is up to date.
• You have the right to request confirmation and/or access to any of your personal data that the Company may hold, and to request correction of any inaccurate data relating to you.
• If your request is to delete your personal data, please send this request to dataprotection@thungela.com
• You can see and update some of this data yourself via the ESS/MSS portal once you become an employee. To amend data in relation to a job application, please log into our recruitment system, SmartRecruiter, via the Company’s careers page, or by contacting the recruitment team you have been liaising with.

Data portability

Where we are relying upon your consent or the fact that the processing is necessary for the performance of a contract to which you are party as the legal basis for processing, and that personal data is processed by automatic means, you have the right, if you are located in the European Union or the United Kingdom, to receive all such personal data which you have provided to the Company in a structured, commonly used and machine readable format, and also to require us to transmit it to another controller where this is technically feasible.

Right to restriction of processing:

If you are located in South Africa, you have the right to restrict our processing of your personal data where:

• you contest the accuracy of the personal data until we have taken sufficient steps to correct or verify its accuracy;
• where the processing is unlawful but you do not want us to erase the data;
• where we no longer need the personal data for the purposes of the processing, but you require them for the establishment, exercise or defence of legal claims; or
• where you have objected to processing justified on legitimate interest grounds (see below) pending verification as to whether the Company has compelling legitimate grounds to continue processing.

Where personal data is subjected to restriction in this way we will only process it with your consent or for the establishment, exercise or defence of legal claims.

Right to withdraw consent

Where we have obtained your consent, or relied on your consent to process particular information and you have provided us with your consent to process data, you have the right to withdraw such consent at any time. You can do this by contacting dataprotection@thungela.com.

Right to object to processing justified on legitimate interest grounds

If you are located in South Africa, and we are relying upon legitimate interest to process data, then you have the right to object to that processing. If you object, we must stop that processing unless we can either demonstrate compelling legitimate grounds for the processing that override your interests, rights and freedoms or where we need to process the data for the establishment, exercise or defence of legal claims. Where we rely upon legitimate interest as a basis for processing we believe that we can demonstrate such compelling legitimate grounds, but we will consider each case on an individual basis.

Right to object to automated decision making

If you are located in South Africa, you have the right to object to any decision that significantly affects you being taken solely by a computer or other automated process. In such a case, you have the right to obtain human intervention, to express your point of view, and to contest the automated decision. Right to de-register an account

• For further information regarding your rights, or to exercise any of your rights, please contact: our Data Protection Team at dataprotection@thungela.com.
• You also have the right to lodge a complaint with us or with a supervisory authority if you consider that the processing of your personal data infringes applicable law.

• We ask that you please attempt to resolve any issues with us before contacting any supervisory authority. 

Additional Privacy Notices

We may undertake certain processing of personal data which are subject to additional Privacy Notices and we shall bring these to your attention, and (where required to do so) obtain your consent, where relevant.

Notice of changes

• The Company may change or update this Privacy Notice at any time.
• Should we change our approach to data protection, you will be informed of these changes or made aware that we have updated the Privacy Notice so that you know which information we process and how we use this information. Where required under applicable laws, we will obtain your consent to these changes.
• The date this Privacy Notice was last updated and reviewed is displayed below.