GDPR and Data Protection

Last Updated: January 2024

Our Commitment to Data Protection

zen-saga is committed to protecting your personal data and respecting your privacy rights. While we are a South African company primarily subject to the Protection of Personal Information Act (POPIA), we also recognise the rights of individuals protected under the European Union's General Data Protection Regulation (GDPR) when applicable.

Applicable Data Protection Laws

Depending on your location and circumstances, your personal data may be protected by:

• POPIA (South Africa): The Protection of Personal Information Act governs how we process personal information of South African residents.
• GDPR (European Union): The General Data Protection Regulation may apply if you are located in the EU/EEA or if we offer services to individuals in those regions.

We apply the highest applicable standard of data protection to all individuals whose data we process.

Data Controller Information

For the purposes of data protection legislation, the data controller is:

zen-saga
124 Rivonia Road
Sandton, Johannesburg
Gauteng, 2196
South Africa

Data Protection Contact: [email protected]

Your Data Protection Rights

Under applicable data protection laws, you have the following rights:

• Right to Access: You have the right to request a copy of the personal data we hold about you and information about how we process it.
• Right to Rectification: You have the right to request that we correct any inaccurate or incomplete personal data we hold about you.
• Right to Erasure: In certain circumstances, you have the right to request that we delete your personal data.
• Right to Restrict Processing: You have the right to request that we restrict the processing of your personal data in certain circumstances.
• Right to Data Portability: Where technically feasible, you have the right to receive your personal data in a structured, commonly used format and to transmit it to another controller.
• Right to Object: You have the right to object to processing of your personal data based on legitimate interests or for direct marketing purposes.
• Right to Withdraw Consent: Where processing is based on consent, you have the right to withdraw that consent at any time.
• Right to Lodge a Complaint: You have the right to lodge a complaint with a supervisory authority if you believe your rights have been violated.

How to Exercise Your Rights

To exercise any of your data protection rights, please contact us using the following methods:

• Email: [email protected]
• Post: zen-saga, 124 Rivonia Road, Sandton, Johannesburg, 2196, South Africa

When submitting a request, please provide sufficient information to verify your identity and specify which right you wish to exercise. We will respond to your request within 30 days (or within one month for GDPR requests). If we need additional time, we will inform you of the reason and extension period.

Legal Basis for Processing

We process personal data only when we have a valid legal basis to do so. The legal bases we rely on include:

• Contract: Processing necessary for the performance of a contract with you or to take steps at your request before entering into a contract.
• Legitimate Interests: Processing necessary for our legitimate business interests, provided those interests do not override your fundamental rights and freedoms.
• Consent: Processing based on your explicit consent for specific purposes.
• Legal Obligation: Processing necessary to comply with legal requirements.

International Data Transfers

Your personal data may be transferred to and processed in countries outside your country of residence. When we transfer data internationally, we ensure appropriate safeguards are in place to protect your data, including:

• Transfers to countries with adequate data protection laws.
• Standard contractual clauses approved by relevant authorities.
• Other appropriate safeguards as required by applicable law.

Data Security

We implement appropriate technical and organisational measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access. These measures include:

• Encryption of data in transit and at rest where appropriate.
• Access controls and authentication procedures.
• Regular security assessments and updates.
• Employee training on data protection and security.

Data Retention

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, to comply with legal obligations, to resolve disputes, and to enforce our agreements. When personal data is no longer required, we securely delete or anonymise it.

Supervisory Authorities

If you believe your data protection rights have been violated, you may lodge a complaint with the relevant supervisory authority:

• South Africa: Information Regulator - www.justice.gov.za/inforeg/
• European Union: Your local data protection authority (for EU/EEA residents)

We encourage you to contact us first to resolve any concerns before filing a complaint with a supervisory authority.

Updates to This Notice

We may update this GDPR and Data Protection notice from time to time. Any changes will be posted on this page with an updated revision date.

Contact Us

For any questions about this notice or our data protection practices, please contact:

Data Protection Officer
zen-saga
124 Rivonia Road
Sandton, Johannesburg
Gauteng, 2196
South Africa

Email: [email protected]