Protection of Personal Information Policy

  1. Introduction

Catalyx committed to protecting the privacy and confidentiality of personal information that it processes in the course of its operations. This Protection of Personal Information Policy (the “Policy”) sets out how Catalyx complies with the Protection of Personal Information Act, No. 4 of 2013 (POPIA) and its commitment to ensuring the responsible handling of personal data.

 

 

  1. Purpose

The purpose of this Policy is to outline the processes by which Catalyx collects, stores, processes, and shares personal information in compliance with POPIA. It aims to protect personal data from misuse and to provide transparency to individuals whose personal information is collected.

 

 

  1. Scope

This Policy applies to all employees, directors, officers, contractors, and agents of Catalyx, as well as any third parties that process personal information on behalf of Catalyx. It covers all personal information that is processed by Catalyx, including but not limited to the following categories of data:

 

  • Client and investor information
  • Employee data
  • Contractor and supplier data
  • Shareholder data
  • Any other personal data related to the operations of Catalyx.

 

  1. Legal Framework

Catalyx complies with the following key provisions of POPIA:

  • Section 4: Conditions for lawful processing of personal information.
  • Section 11: The rights of data subjects.
  • Section 18: The obligations of data processors and data controllers.

Catalyx ensures that all personal information is processed in a manner that is lawful, transparent, and fair to the data subjects.

 

 

  1. Principles of Data Processing

Catalyx will adhere to the following principles when processing personal information:

  • Lawfulness, Fairness, and Transparency: Personal information will be processed lawfully, fairly, and transparently, and data subjects will be informed of the purposes for which their data is being processed.
  • Purpose Limitation: Personal information will be collected for specific, legitimate purposes and not further processed in a manner incompatible with those purposes.
  • Data Minimization: Personal information collected will be adequate, relevant, and limited to what is necessary for the purposes for which it is collected.
  • Accuracy: Personal information will be accurate and kept up to date.
  • Storage Limitation: Personal information will be retained for no longer than is necessary for the purposes for which it was collected.
  • Integrity and Confidentiality: Personal information will be processed securely, protecting it from unauthorized or unlawful processing, accidental loss, destruction, or damage.
  • Accountability: Catalyx will be accountable for ensuring compliance with these principles and the provisions of POPIA.

 

  1. Rights of Data Subjects

Catalyx recognizes the following rights of data subjects under POPIA:

  • Right to Access: Data subjects have the right to request access to their personal information held by Catalyx Capital.
  • Right to Correction: Data subjects have the right to request correction or updating of inaccurate personal information.
  • Right to Object: Data subjects have the right to object to the processing of their personal information, subject to certain conditions.
  • Right to Deletion: Data subjects may request the deletion of their personal information under certain circumstances, subject to legal requirements.
  • Right to Withdrawal of Consent: Where consent is the basis of processing, data subjects can withdraw consent at any time.

 

  1. Collection of Personal Information

Catalyx collects personal information through various channels, including but not limited to:

  • Direct interactions (e.g., in-person meetings, phone calls, emails, etc.)
  • Online forms and applications (e.g., website forms, investor applications, etc.)
  • Third parties (e.g., regulatory bodies, financial institutions, etc.)

All personal information will be collected for specified, legitimate purposes and will not be used for any other purposes without the consent of the data subject.

 

 

  1. Security Measures

Catalyx is committed to ensuring the security of personal information and will take all reasonable steps to prevent unauthorized access, loss, misuse, or alteration of personal data. These measures include, but are not limited to:

  • Encryption of sensitive personal data
  • Regular security assessments and audits
  • Implementation of access controls and authorization protocols
  • Staff training on data protection principles

 

  1. Sharing of Personal Information

Catalyx may share personal information with third parties, such as service providers or regulatory authorities, in compliance with POPIA. Personal information will only be shared if it is necessary for the fulfillment of a specific, legitimate purpose and subject to appropriate safeguards.

Catalyx will not sell or lease personal information to any third parties.

 

 

  1. Retention of Personal Information

Personal information will be retained for no longer than necessary to fulfill the purposes for which it was collected, or as required by applicable laws or regulations. Once the information is no longer required, it will be securely destroyed or anonymized.

 

 

  1. Data Protection Officer (DPO)

Catalyx has appointed a Data Protection Officer (DPO) who is responsible for overseeing the implementation and compliance with this Policy. The DPO can be contacted for any questions, concerns, or requests related to personal information protection.

 

 

  1. Breach Notification

In the event of a personal information breach that compromises the security, confidentiality, or integrity of personal data, Catalyx will notify affected individuals and the Information Regulator as per the requirements of POPIA.

 

 

  1. Compliance with POPIA

Catalyx will regularly review and update this Policy to ensure continued compliance with POPIA and any other applicable data protection laws. The company will also conduct regular audits and assessments to monitor compliance with this Policy.

 

 

  1. Training and Awareness

All employees and relevant stakeholders will be regularly trained on the principles of POPIA and data protection best practices to ensure the effective implementation of this Policy.

 

 

  1. Contact Information

For questions or concerns regarding this Policy or to exercise your rights under POPIA, please contact:

Data Protection Officer (DPO)
Andrew Hamman

Director: Catalyx Capital and Catalyx Investments