Privacy Policy

1. Purpose

1.1. Huawei Technologies South Africa (Pty) Ltd (collectively, "Huawei", "we", "us", and "our") respect your privacy and strives to comply with the applicable laws and regulations relating to privacy, more especially to the Protection of Personal Information Act 4 of 2013 (“POPI”). This Policy sets forth the basic principles (referred to as Processing Conditions) which Huawei applies when processing personal information. This policy also outlines the responsibilities of Huawei Africa's respective business departments and employees while Processing Personal Information of consumers, customers, suppliers, business partners, employees and other individuals. This Policy applies to Huawei websites, products, and services that display or provide links to this Policy.

2. Scope

2.1. This Policy describes how Huawei processes your personal data, however, it may not address all possible data processing scenarios. Huawei may inform you of product or service specific data collection through supplementary policies or notices provided before collection thereof. Any breach of this Policy shall lead to serious misconduct which may result in disciplinary action

3. 8 (eight) basic principles to be applied in relation to Privacy Protection and Personal Data being processed (Processing Conditions):

3.1. Principle 1: Accountability

3.1.1. Huawei must ensure that the Processing Conditions are complied with.

3.1.2. Huawei will appoint an Information Officer (“IO”) as per section 56 of POPI to assist with the overall compliance with POPI.

3.1.3. The IO is responsible for drafting an information security standards policy addressing access to information, classification of Personal Information and document retention.

3.1.4. In support of the IO, Huawei will designate individuals to monitor compliance with information security standards policy within each business area.

3.1.5. Constant training and/or awareness sessions for employees on information security will be conducted.

3.2. Principle 2: Processing Limitation

3.2.1. Personal Information may only be Processed if, given the purpose for which it is Processed, it is not excessive, adequate, and relevant.

3.2.2. Huawei requires a justification to Process Personal Information. To this end, and where possible and necessary, Huawei endeavours to obtain voluntary, informed and specific consent by means of an expression of will from Data Subjects, before collecting their Personal Information. Huawei may seek to rely on one of the exceptions to having obtain consent set out in section 11 of POPI, in the event that consent cannot be obtained.

3.2.3. At any given time may a Data Subject withdraw consent and same will should be noted. Furthermore, a Data Subject may object on reasonable grounds, to the Processing of its Personal Information, save if legislation (including POPI) provides for such Processing. Subsequent thereto, Huawei will no longer Process the Personal Information, unless it is authorised to do so under relevant laws.

3.3. Principle 3: Purpose specification

3.3.1. Data Subjects need to be aware of Personal Information where the Personal Information is Processed for specific, explicitly defined and legitimate reasons relating to the functions or activities of Huawei.

3.3.2. Personal Information will only be collected for the specific purpose notified to the Data Subject, unless it is not reasonably practicable to do so in the circumstances or collection will not affect a legitimate interest of the Data Subject. Any Personal Information collected outside the purpose will not be collected unless the consent of the Data Subject is obtained.

3.3.3. Personal Information may only be kept for as long as necessary for achieving the purpose for which the information was collected or subsequently Processed, unless:

3.3.3.1. retention for an extended period is required or authorised by law;

3.3.3.2. the Data Subject or a competent person, where the Data Subject is a child, has consented to the retention of the record;

3.3.3.3. Huawei reasonably requires the record for lawful purposes related to its functions or activities;or

3.3.3.4. retention of the record is required by a contract between Huawei and a third party thereto.

3.3.4. Personal Information will therefore not be kept longer than is necessary. After expiration of such a time, the Personal Information will be destroyed or deleted in a manner that prevents its reconstruction as soon as reasonably practicable after Huawei is no longer authorised to retain the record.

3.4. Principle 4: Further Processing limitation

3.4.1. The Data Subject must consent to Further Processing of Personal Information in accordance with the purpose of collection.

3.4.2. Personal Information, once collected will only be Processed for the purpose notified to the Data Subject under Principle 3 or for other purposes which are compatible with such purpose. Therefore, Personal Information will not be collected for one purpose and then used for another incompatible purpose. Any change to the purpose which the Personal Information was to be Processed, the Data Subject will be informed of the new purpose and the consent will be obtained before any Processing occurs. Where this is not possible, the IO should be consulted.

3.4.3. Where Personal Information is transferred to a third party for further Processing, the further Processing must be compatible with the purpose for which it was initially collected.

3.5. Principle 5: Information quality

3.5.1. Huawei will endeavor to collect Personal Information that is complete, accurate, not misleading and updated where necessary in light of the purpose for which such information is collected.

3.5.2. Personal Information which is incorrect, misleading or is not accurate, Huawei endeavor to take reasonable steps to check the Personal Information at the point of collection and at regular intervals afterwards. Inaccurate or out-of-date information will be destroyed and/or deleted.

3.5.3. The IO will develop appropriate Processes to ensure compliance with the above as well as the applicable provisions of the POPI.

3.6. Principle 6: Openness

3.6.1. Huawei must take practicable reasonably steps to ensure that the Data Subject is aware of:

3.6.1.1. the Personal Information being collected and where the information is not collected from the Data Subject, the source from which it is collected;

3.6.1.2. the name and address of Huawei ;

3.6.1.3. the purpose for the Personal Information being collected;

3.6.1.4. whether or not the supply of the information by that Data Subject is voluntary or mandatory;

3.6.1.5. the consequences of failure to provide the information;

3.6.1.6. any applicable law and/or regulation authorising or requiring the collection of the information;

3.6.1.7. where applicable, the fact that Huawei intends to transfer the information to a country or international organisation and the level of protection afforded to the information by that country or international organisation;

3.6.1.8. any further information such as the recipient or category of recipients of the information, the nature or category of the information and the existence of the right of access to and the right to rectify the information collected;

3.6.1.9. the existence of the right to object to the Processing of Personal Information; and

3.6.1.10. the right to lodge a complaint to the Regulator and the contact details of the Information Regulator.

3.7. Principle 7: Security safeguards

3.7.1. Huawei will take reasonable practical measures to ensure that all Personal Information is secure against the risk of loss, unauthorised access, interference, modification, destruction or disclosure and conduct regular risk assessments to identify and manage all reasonably foreseeable internal and external risks to Personal Information under its control.

3.7.2. Duty in Respect of Operators

3.7.2.1. Operators (i.e. third parties which may further Process Personal Information collected by Huawei on its behalf) include, but is not limited to, call centres, outsourced payroll administrators, marketing database companies, recruitment agencies, psychometric assessment centres, document management warehouses, external consultants, credit bureaus and persons who clear the payment instructions of Huawei's clients.

3.7.3. Huawei will implement the following obligations in respect of Operators:

3.7.3.1. The Operator may not Process Personal Information on behalf of Huawei without the knowledge and written authorisation of Huawei;

3.7.3.2. Huawei will ensure that the Operator implements the security measures required in terms of Principle 7: Security Safeguards;

3.7.3.3. A contract between Huawei and the Operator will be concluded which requires the Operator to maintain the confidentiality and integrity of Personal Information Processed on behalf of Huawei;

3.7.3.3.1.  The contract will include the mandatory provisions set out in sections 19 to 21 of POPI; and

3.7.3.4. If the third party is located outside of South Africa, Huawei will consult the IO.

3.7.4.  Duties relating to Security Compromises

3.7.4.1. In the event that Personal Information has been compromised, or if there is a reasonable belief that a compromise has occurred, Huawei (or the Operator) will comply with the notification requirements set out in section 22 of POPI.

3.8. Principle 8: Data Subject participation

3.8.1. Request for Information

3.8.1.1. Huawei recognises that a Data Subject has the right to request Huawei to confirm, free of charge, whether or not it holds Personal Information about the Data Subject and request same to provide a record or a description of the Personal Information held, including information about the identity of all third parties, or categories of third parties, who have, or have had, access to the information at a prescribed fee.

3.8.1.2. Huawei South Africa’s PAIA manual, which can be found at https://www-file.huawei.com/-/media/corporate/local-site/za/pdf/paia-manual-2021.pdf and must be consulted in respect of any access to Personal Information requests by Data Subjects and Data Subjects must also follow the request procedure as stipulated therein.

3.8.2 Request to Correct or Delete

3.8.2.1. The Data Subject may request Huawei to:

3.8.2.1.1. correct or delete Personal Information of the Data Subject in its possession or under its control that is inaccurate, irrelevant, misleading or obtained unlawfully; or

3.8.2.1.2. destroy or delete a record of Personal Information about the Data Subject that Huawei is no longer authorised to retain.

3.8.2.1.3. provide credible proof to the Data Subject of the action that has been taken in response to the request (deletion or destroying or to correct).

3.8.2.1.4. inform all third parties to whom the information has been disclosed of such changes if any changes to the Personal Information are made and has an impact on any decisions to be made in respect of the Data Subject.

3.8.3. Building Privacy Protection and the Processing Conditions into Business Activities

3.8.3.1. Notification to Data Subjects:

3.8.3.1.1. Taking Principle 6 into consideration, before Processing Personal Information in respect of products, services or marketing activities, Huawei will use reasonable endeavours to notify Data Subjects of:

3.8.3.1.1.1. the types of Personal Information that will be Processed;

3.8.3.1.1.2. the purpose/s of the Processing;

3.8.3.1.1.3. the Processing methods that will be used;

3.8.3.1.1.4. the Data Subjects’ rights with respect to their Personal Information; and

3.8.3.1.1.5. Huawei's security measures to protect the Personal Information that is being Processed.

3.8.4. Data Subject's choice and consent:

3.8.4.1. Taking Principle 2 into consideration, the Processing of Personal Information will be based on the Data Subject's consent or other lawful grounds and a record of such consent or authorisation must be retained and stored. Huawei will also provide Data Subjects with the option to withdraw the consent given by them to Process their Personal Information.

3.8.4.2. Processing of Personal Information which includes collection of Personal Information:

3.8.4.2.1. When Processing the Personal Information of a Data Subject, Huawei will strive to collect the least amount of Personal Information possible to achieve the purpose of the Processing and ensure that the Personal Information being Processed is:

3.8.4.2.1.1. relevant to the purpose of the Processing;

3.8.4.2.1.2. necessary for the purpose/s of the Processing;

3.8.4.2.1.3.  is not excessive considering the purpose/s of the Processing.

3.8.4.3. In the event that Personal Information is collected from a third party, Huawei will try to ensure that the Personal Information is Processed in accordance to applicable laws and regulations.

3.8.4.4. Use, retention, and disposal:

3.8.4.4.1. Taking Principle 3 into consideration, the use, purpose(s) for Processing, method/s of Processing and the retention period of Personal Information should be consistent with the information contained in the notice to the Data Subject(s). Huawei endeavor to maintain the accuracy, integrity and relevance of Personal Information based on the purpose(s) of the Processing.

3.8.4.5. Taking Principle 7 into consideration, security mechanisms designed to protect Personal Information shall be used to prevent Personal Information from being stolen, leaked, damaged, accessed unlawfully, misused, abused, disseminated unlawfully or without approval. For example:

3.8.4.5.1. Personal Information should be anonymised or de-identified in a manner that makes re-identification impossible where practicable and appropriate or aggregate data, such as statistical or research results that does not identify an individual, should be used, if possible.

3.8.5. Huawei encourages Pseudonymisation, if possible, to reduce the ability to link Personal Information to a Data Subject.

3.8.6. Access to and Processing of Personal Information will be controlled. As such, methods like encryption or alternatives should be used to help ensure the ongoing confidentiality, integrity, availability and resilience of Processing systems.

3.8.7. Personal Information should be restored in a timely manner in the event of a data security incident.

3.8.8. Security measures should be evaluated regularly.

3.8.9. Disclosure to third parties:

3.8.9.1. Taking Principle 7 into consideration, when Huawei authorises a third party to Process Personal Information on behalf of them, i.e. act as an Operator, Huawei should seek to ensure that the third party provides security measures to safeguard Personal Information that are appropriate to the risks associated with the Personal Information.

3.8.9.2. Huawei should also ensure that the third party provides the same level of data protection as Huawei would have provided through the conclusion of a contract containing data protection provisions.

3.8.9.3. The third party should only Process Personal Information to the extent necessary to carry out its contractual obligations to Huawei or upon the instruction of Huawei and not for any other purpose.

3.8.9.4. When Huawei Processes Personal Information jointly with an independent third party, the respective responsibilities of Huawei and the third party will be specified in the relevant contract.

3.8.10. Cross-border transfer of Personal Information:

3.8.10.1. Huawei may transfer and Process Personal Information worldwide for routine business operations. As different countries may impose different requirements for the cross-border transfer of Personal Information with various limitations and/or prohibitions against transfers of certain types of Personal Information out of the country, Huawei endeavours to monitor the regulations relating to cross-border transfers of Personal Information. Before transferring Personal Information out of a country, the IO and/or Legal Department must be consulted.

3.8.10.2. Unless the transfer of Personal Information complies with another safeguard set out in section 72 of POPI, the Data Subject(s) written consent must be obtained prior to the information being transferred out of the Republic of South Africa.

3.8.11. Access to Personal Information by Data Subjects:

3.8.11.1. Taking Principle 8 into consideration and when acting as a Responsible Party, Huawei should provide the Data Subject (s) with a mechanism which will enable them to:

3.8.11.1.1. access their Personal Information;

3.8.11.1.2. request that the Personal Information relating to them that is being Processed be updated, rectified, erased and/or deleted; and

3.8.11.1.3. object and/or withdraw their consent to the Processing of their Personal Information.

3.9. The Processing of Special Personal Information:

3.9.1. In most cases when Special Personal Information is being Processed, the explicit consent of the Data Subject will usually be required.

3.9.2. Examples of when Special Personal Information which is likely to be Processed are set out below and may include, but are not necessarily limited to:

3.9.2.1. information about the Data Subject’s physical or mental health;

3.9.2.2. the Data Subject’s racial or ethnic origin or religious or similar information.

3.10. Authorisation from the Regulator:

3.10.1. Authorisation from the Regulator, in terms of section 58 of POPI, will be obtained by Huawei prior to any processing in the event that Huawei plans to-

3.10.1.1. process any unique identifiers of Data Subjects for a purpose other than the one for which the identifier was specifically intended at collection; and with the aim of linking the information together with information processed by other responsible parties;

3.10.1.2. process information on criminal behaviour or on unlawful or objectionable conduct on behalf of third parties;

3.10.1.3. process information for the purposes of credit reporting; or

3.10.1.4. transfer special personal information, the personal information of children under the age of 18, to a third party in a foreign country that does not provide an adequate level of protection for the processing of personal information as referred to in section 72 of POPIA.

3.11. Organisation and Responsibilities:

3.11.1. The IO endeavours to manage Huawei's Privacy protection program and is responsible for the development and promotion of end-to-end Privacy protection policies. The IO responsible for:

3.11.1.1. development of the privacy protection policies and guidance on the implementation thereof;

3.11.1.2. determine privacy protection roles and responsibilities;

3.11.2. audit data protection compliance and promotes improvements.

3.12. Response to Personal Information security breach incidents:

3.12.1. Taking Principle 7 into consideration, if Huawei obtains knowledge of an actual or suspected Personal Information security breach incident, Huawei undertakes to perform an internal investigation and take appropriate remedial measures, as soon as reasonably possible.

3.12.2. If there are reasonable grounds to believe that a security breach occurred and it is required by applicable law, Huawei's authorised representative/s should notify the competent regulatory authority, the Data Subject and any affected stakeholders in a manner and within the time period required by law.

4. Direct Marketing

4.1. The Personal Information of Data Subject(s) will only be Processed for Direct Marketing purposes, in compliance with relevant legislation, including POPI and the Data Subject consents thereto.

5. Audit and Accountability:

5.1. Huawei undertakes to implement this Policy and various audits will be done relating to same.

5.2. Huawei's employees who act in contravention of this Policy may be subjected to disciplinary action within Huawei and the employee may also be subjected to civil or criminal proceedings if his or her conduct is in breach of applicable laws or regulations.

6. Policy Hierarchy

6.1. This is Huawei's policy for privacy protection practice. This Policy will be applied as an additional privacy protection compliance requirement, based on applicable laws and regulations.

7. Conflicts of Law

7.1. This Policy is intended to comply with the applicable laws and regulations of South Africa, including POPI, or any other applicable jurisdiction (the “Applicable Laws”). In the event of any conflict between this Policy and Applicable Laws, the latter shall prevail.

8. Interpretation and Maintenance

8.1. The IO of Huawei is responsible for interpreting and maintaining this Policy.

9. Date of Validity

9.1. This policy takes effect on the day it is issued.

10. Definitions

10.1. Anonymisation: means irreversibly de-identifying Personal Information such that the person cannot be identified by using reasonable time, cost, technology either by the Responsible Party or by any other person to identify that individual (also known as de-identification);

10.2. Child / Children: means a natural person under the age of 18 (eighteen) years old and who is not legally competent to legally make certain decisions;

10.3. Data Subject: means the natural or juristic person to whom the Personal Information relates;

10.4. Direct Marketing: means to approach a Data Subject, either in person or by mail or electronic communication, for the direct or indirect purpose of -

10.4.1. promoting or offering to supply, in the ordinary course of business, any goods or services to the Data Subject; or

10.4.2. requesting the Data Subject to donate any kind for any reason.

10.5. IO: means the information officer appointed by Huawei in terms of section 56 of POPI and who will have the ultimate responsibility to ensure that compliance with the provisions of POPI;

10.6. Operator: means a person who Processes Personal Information for a Responsible Party in terms of a contract or mandate, without coming under the direct authority of that party;

10.7. Personal data: means any data that, either on its own or jointly with other data, can be used to identify a natural person. The collection of the data can be through:

10.7.1. Usage of our websites, products, or services;

10.7.2. Creating a Huawei account; and

10.7.3. Contacting us for support on the website.

10.8. Personal Information: means information relating to an identifiable and living natural person, and where it is applicable, an identifiable existing juristic person, including, but not limited to:

10.8.1. information regarding race, gender, sex, pregnancy, marital status, national, ethnic or social origin, colour, sexual orientation, age, physical or mental health, wellbeing, disability, religion, conscience, belief, culture, language and birth of the person;

10.8.2. information regarding education or the medical, financial, criminal or employment history of the person;

10.8.3. any identifying number, symbol, email address, physical address, telephone number, location information, online identifier or other particular assignment to the person;

10.8.4. the biometric information of the person;

10.8.5. the personal opinions, views or preferences of the person;

10.8.6. correspondence sent by the person that is implicitly or explicitly of a private or confidential nature or further correspondence that would reveal the contents of the original correspondence;

10.8.7. inContact messages from the query system on the website;

10.8.8. information relating to the website you visit or the products and services that the Data Subject uses;

10.8.9. the views or opinions of another individual about the person; and

10.8.10. the name of the person if it appears with other Personal Information relating to the person or if the disclosure of the name itself would reveal information about the person.

10.9. Processing/Process/Processed: means any operation or activity or any set of operations, whether or not by automatic means, concerning Personal Information, including: (a) the collection, receipt, recording, organisation, collation, storage, updating or modification, retrieval, alteration, consultation or use; (b) dissemination by means of transmission, distribution or making available in any other form; or (c) merging, linking, as well as restriction, degradation, erasure or destruction of information;

10.10. Policy: means this Privacy Protection Policy;

10.11. Pseudonymisation: means the Processing of Personal Information in such a manner that the Personal Information can no longer be attributed to a specific Data Subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organisational measures to ensure that the Personal Information are not attributed to an identified or identifiable natural person. Pseudonymisation reduces, but does not completely eliminate, the ability to link Personal Information to a Data Subject;

10.12. Responsible Party: means a public or private body or any other person which, alone or in conjunction with others, determines the purpose of and means for Processing Personal Information;

10.13. Special Personal Information: includes Personal Information concerning the religious or philosophical beliefs, race or ethnic origin, trade union membership, political persuasion, health or sex life or biometric information of a Data Subject; or the criminal behaviour of a Data Subject to the extent that such information relates to the alleged commission by a Data Subject of any offence; or any proceedings in respect of any offence allegedly committed by a Data Subject or the disposal of such proceedings.