JCDECAUX ESWATINI – DATA PROTECTION – 4 MARCH 2022 PRIVACY AND PERSONAL DATA PROTECTION POLICY
JCDecaux Eswatini 1. PREAMBLE 2. SCOPE 3. DEFINITIONS 4. DATA COLLECTED 5. PURPOSES OF COLLECTION 6. DATA RECIPIENTS 7. DATA RETENTION 8. SECURITY 9. DATA TRANSFERS 10. RIGHTS OF DATA SUBJECTS 11. CHANGES TO POLICY 12. LINKS TO THIRD-PARTY WEBSITES 13. CONTACT US
1. PREAMBLE ► JCDecaux Eswatini takes the protection of privacy and personal data very seriously. ► To the extent that JCDecaux Eswatini collects or uses your personal data for the purposes of its own business, JCDecaux Eswatini is acting as the controller (hereinafter “JCDecaux Eswatini” or “we”, “us”, etc.) and as such, agrees to implement appropriate measures to ensure the protection, confidentiality and security of your personal data, in accordance with legal requirements and, in particular, the Data Protection Act 2022. ► The purpose of this privacy and data protection policy (hereinafter the “Data Protection Policy”) is to inform you about the commitments made by JCDecaux Eswatini to ensure your personal data are respected and protected.
2. SCOPE ► This Data Protection Policy applies to all processing of personal data implemented by JCDecaux Eswatini, acting as the controller, in the Kingdom of Eswatini, in relation to external persons (hereinafter “you”), including but not limited to clients, prospects, partners, job applicants, users of our products and services, suppliers, service providers and internet users.
3. DEFINITIONS ► “Controller”: the legal entity which determines the purposes of such processing and the means implemented. ► “JCDecaux Group”: includes JCDecaux SE, its direct & indirect subsidiaries and all the companies in which JCDecaux SE directly or indirectly has an interest. ► “Personal data”: any information that can be used to directly or indirectly identify a natural person. ► “Processing”: operation or set of operations which is performed on personal data, such as collection, recording, use, transmission or disclosure. ► “Processor”: the legal entity which processes personal data on behalf of the controller.
4. DATA COLLECTED ► JCDecaux Eswatini only collects and processes personal data that is relevant, adequate, not excessive and strictly necessary in relation to the purposes previously determined. JCDecaux Eswatini takes all useful measures to ensure that your data are accurate, complete and, where necessary, kept up to date. ► JCDecaux Eswatini agrees to obtain the consent of the data subjects whenever consent is required and to inform them of the processing of their data. ► We process personal data concerning you and which you have provided to us in the following contexts in particular: - When you subscribe to any of our services; - When you use our services; - When you provide us with products or services; - When you take part in events or public relations activities organised by JCDecaux Eswatini; - When you give your consent to receive commercial information from us; - When you wish to apply for a job offer at JCDecaux Eswatini; - When you wish to get in touch with us to ask a question, make a request or lodge a complaint. ► In these contexts, JCDecaux Eswatini may collect and process the following personal data: - Your identity: surname, name, preferred form of address (Mr./Mrs./Ms.), date of birth, photocopy of your identity card whenever necessary, and your function; - Your identifiers (in case you create an account upon subscription to a service): subscriber number, secret code; - Your contact details: postal address, email, phone number; - Your transactions and payment information: details of the transaction, bank cheque, bank account information; - Your job application information: CV, motivation letter, interview notes; - Any other information you directly and voluntarily provide to us in the course of your use of our services and any contracts you may enter into with us. ► The mandatory nature of any information to be completed by you is typically marked by an asterisk in the corresponding forms at the time such information is collected. Any failure to complete that information or any response JCDecaux Eswatini considers abnormal may result in JCDecaux Eswatini refusing to process your request. ► JCDecaux Eswatini may ask you to provide certain personal data for direct marketing/ communication purposes. You may give your free and explicit consent or not for the collection and processing of your personal data by ticking a consent box or signing a consent form. ► You agree that the personal data you provide about yourself to JCDecaux Eswatini will be current, accurate, complete and unequivocal.
5. PURPOSES OF COLLECTION ► JCDecaux Eswatini agrees to collect and process your personal data lawfully and fairly. ► The processing implemented by JCDecaux Eswatini pursues specified, explicit and legitimate purposes. ► Your data may be processed for the following purposes in particular: - To permit you to subscribe to/access our services (management of your service request and account); In this context, the legal ground for the processing is the performance of the contract between you and JCDecaux Eswatini. - To manage your subscription and your use of our services; In this context, the legal ground for the processing is the performance of the contract between you and JCDecaux Eswatini. - To process your transactions and your payments; In this context, the legal ground for the processing is either the performance of the contract between you and JCDecaux Eswatini when management of your transactions and payments is involved, or else compliance with legal requirements if JCDecaux Eswatini implements anti-fraud measures. - To manage the contractual relationship with our clients, service providers and partners (management of the contract, orders, deliveries, invoices, public relations, etc.); In this context, the legal ground for the processing is the performance of the contract between you and JCDecaux Eswatini. - To send you commercial information about us; In this context, the processing is based on the legitimate interest of JCDecaux Eswatini, and more specifically our financial interest in making you personalised offers, better understanding your needs and offering you adapted services. - To handle any questions or requests and deal with any complaints you may have; In this context, the legal ground for the processing is either the performance of the contract if the request or complaint concerns the contractual relationship between you and JCDecaux Eswatini, or else the legitimate interest of JCDecaux Eswatini, more specifically our financial interest in having clear communications with you and in understanding your needs and expectations.
- To handle your job application submitted to our office location or via email. In this context, the legal ground for the processing is the legitimate interest of JCDecaux Eswatini, more specifically our interest in responding to your job applications and finding suitable profiles for the positions available within JCDecaux Eswatini.
6. DATA RECIPIENTS ► JCDecaux Eswatini only discloses your personal data to determined authorised recipients, in compliance with applicable rules. ► JCDecaux Eswatini can provide access to your personal data to companies outside of Eswatini within JCDecaux Group, to government authorities or bodies, to its partners and to its possible third-party service providers, acting as processors, for the provision of services in connection with JCDecaux Eswatini’s services and IT applications (such as hosting, storage, analytical, data processing, database management or IT maintenance services). These third-party providers will act only on the instructions of JCDecaux Eswatini and will only have access to your personal data to achieve the purposes pursued upon collection of such data and shall be under the same security and confidentiality obligations as JCDecaux Eswatini. ► JCDecaux Eswatini agrees to obtain your prior consent before disclosing your data to partners for direct marketing purposes via any of the following ways: by ticking a consent box or signing a consent form. ► In addition, your personal data may be disclosed on the following grounds: - In the context of a merger or acquisition of all or part of JCDecaux Eswatini by a third party, as is hereby accepted by you; - In response to legal or administrative proceedings of any kind or enforcement measures requested by the relevant authorities; - To comply with legal obligations, protect the rights and/or safety of an individual, protect the rights and property of JCDecaux Eswatini, including the need to ensure that this Data Protection Policy is respected and to prevent any technical, security or fraud-related issues.
7. DATA RETENTION ► JCDecaux Eswatini will keep your personal data for as long as necessary to achieve the purposes for which they are collected and processed. JCDecaux Eswatini may, however, keep your personal data for a longer period whenever this a legal obligation for us or to take into account the applicable statute of limitation period to assert, exercise or defend legal claims. ► In defining an appropriate data retention period, JCDecaux Eswatini relies in particular on the following criteria: - Data on your subscription, payments and use of our services are kept for the entire period of your subscription / of the contractual relationship, then in accordance with applicable statute of limitation periods; - Data on the management of the commercial relationship with our service providers and partners are kept for the entire period of the contractual relationship, then in accordance with applicable statute of limitation periods; - When you agree to receive marketing communications, JCDecaux Eswatini will keep your personal data until you indicate that you no longer wish to receive such communications, or otherwise for the period defined by applicable legislation; - When your data are collected in the context of requests/queries relating to IT services and applications, JCDecaux Eswatini will keep your data for the period necessary to process such requests or queries; - Job application files can be kept up to 2 years from the date of last contact with the applicant, unless the applicant agrees to a longer period; in such case, the data can be archived in accordance with the applicable statute of limitation periods.
8. SECURITY ► JCDecaux Eswatini will ensure the security of your personal data through a data protection system that uses physical and logical security measures.
9. DATA TRANSFERS ► The companies outside of Eswatini within JCDecaux Group, service providers or other third parties listed above to us to whom JCDecaux Eswatini may disclose your personal data may be domiciled abroad, and in particular outside the Kingdom of Eswatini. ► In such case, JCDecaux Eswatini shall require them to take, in accordance with applicable legislation, all organisational and technical measures that permit ensuring an adequate level of protection of your personal data (in particular, by the use of Standard Contractual Clauses approved by the Eswatini Communications Commission – of which you may obtain a copy, as applicable, upon request to: olabimpe.alabi@jcdecaux.com
10. RIGHTS OF DATA SUBJECTS ► Under applicable data protection legislation, you have certain rights regarding the collection and processing of your personal data, namely: - A right to be informed: you have the right to be informed in a concise, transparent, intelligible and easily accessible form about the way in which your personal data are processed. - A right of access: you have the right to obtain (i) confirmation as to whether personal data concerning you are processed or not and, if processed, to obtain (ii) access to such data and a copy thereof. - A right to rectification: you have the right to obtain the rectification of any inaccurate personal data concerning you. You also have the right to have incomplete personal data completed, including by means of providing a supplementary statement. - A right to erasure: in some cases, you have the right to obtain the erasure of personal data concerning you. However, this is not an absolute right and JCDecaux Eswatini may have legal or legitimate grounds for keeping such data. - A right to restriction of processing: in some cases, you have the right to obtain restriction of the processing of your personal data. - A right to data portability: you have the right to receive the personal data concerning you which you have provided to JCDecaux Eswatini, in a structured, commonly used and machine-readable format, and you have the right to transmit those data to another controller without hindrance from JCDecaux Eswatini. This right only applies when the processing of your personal data is based on your consent or on a contract and such processing is carried out by automated means. - A right to object to processing: you have the right to object, on grounds relating to your particular situation, at any time to processing of personal data concerning you when such processing is based on the legitimate interest of JCDecaux Eswatini. JCDecaux Eswatini may, however, invoke compelling legitimate grounds for continued processing. When your personal data are processed for direct marketing purposes, you have the right to object at any time to the processing of such data. You may, in particular, exercise that right by clicking on the “unsubscribe” link provided at the bottom of any messages received. - A right to lodge a complaint with the Eswatini Communications Commission: you have the right to contact the Eswatini Communications Commission to complain about JCDecaux Eswatini’s personal data protection practices. ► To exercise these rights, you can send a request to: Data Protection Officer, JCDecaux Eswatini (Legal Department), by email to the following address: olabimpe.alabi@jcdecaux.com or by postal mail to the following address: Unit 10, King Sobhuza II Avenue, Matsapha – Eswatini, together with a copy of your identity document.
11. CHANGES TO POLICY ► JCDecaux Eswatini may update this Data Protection Policy at any time to reflect possible new practices. In such case, the date of the Data Protection Policy will be updated and indicate the date when such changes were made. We invite you to check for any possible updates of this Data Protection Policy, which will be posted in the “Data Protection” section of the internal Legal Service System and or JCDecaux’s intranet, or you could obtain an updated copy from the Legal Department by sending an email to olabimpe.alabi@jcdecaux.com If JCDecaux Eswatini makes any changes to this Data Protection Policy which it considers to be substantial, you will be informed via email.
12. LINKS TO THIRD-PARTY WEBSITES ► While receiving any written correspondences (including electronic communications e.g., email, SMS etc.) from JCDecaux Eswatini, you may come across content containing links to third-party applications and websites which for the avoidance doubt, includes websites and applications of companies outside of Eswatini within JCDecaux Group. JCDecaux Eswatini has no control over the cookies or other functions used by the aforementioned third-party applications and websites, and any personal data processing that may be implemented by such applications and websites are not governed by this Data Protection Policy. ► Accordingly, it is up to you to directly contact and/or visit such third-party applications and websites to obtain further information on their data protection guidelines.
13. CONTACT US ► If you would like more information about this Privacy and Personal Data Protection Policy, please contact: JCDecaux Eswatini Legal Department on olabimpe.alabi@jcdecaux.com ► JCDecaux Eswatini has also appointed a Data Protection Officer, who can be contacted at: olabimpe.alabi@jcdecaux.com
This Policy may be updated at any time, so we advise you to check for updates from time to time.
