POPIA Notice

1. Our commitment to privacy

Wisani serves families at important and often difficult moments. Protecting personal information is part of that responsibility.

This Privacy Policy explains what personal information we collect, where we obtain it, why we use it, when we share it, how we protect and retain it, and the rights available to you under POPIA.

We process personal information lawfully, reasonably and transparently, and only where it is adequate, relevant and not excessive for the purpose for which it is required.

2. Who this policy applies to

This policy applies when you:

• visit or use the Wisani website, online portal or digital services;
• ask for information, a quotation or assistance;
• apply for, hold, pay for or manage a funeral policy or benefit;
• are added to a policy as a spouse, child, dependant, extended member or beneficiary;
• make, support or receive payment of a claim;
• arrange or receive funeral-related products or services;
• visit a branch, contact us, participate in a survey or promotion, or communicate with us by telephone, email, web form, WhatsApp, SMS or another channel;
• act for a policyholder, policy member, claimant, supplier, service provider or other person; or
• apply to work with Wisani or work for Wisani.

3. The parties responsible for your information

The responsible party under POPIA depends on the product, service or interaction concerned.

In this policy, “Wisani”, “we”, “us” or “our” means Wisani Burial Society CC and/or Wisani Administrators CC, as the context requires. Nothing in this policy makes one entity responsible for processing independently controlled by another entity.

4. How to contact Wisani about privacy

Privacy enquiries and requests may be directed to:

Please use the subject line “POPIA request” and identify the Wisani product or service concerned. We may need to verify your identity before acting on a request.

5. What personal information we collect

Depending on your relationship with Wisani, we may process the following categories of information:

5.1 Identity and demographic information

• full name, title, identity or passport number, date of birth, age, gender, nationality, marital status and preferred language;
• copies of identity documents and supporting verification records; and
• photographs, signatures or other identifiers where reasonably required.

5.2 Contact and location information

• residential, postal and delivery addresses;
• telephone and mobile numbers, email addresses and communication preferences; and
• branch, pay-point or service location information relevant to providing the requested service.

5.3 Policy, family and beneficiary information

• policy, membership, plan, cover, premium and payment information;
• names, identity details, ages and relationships of spouses, children, dependants, extended members, policy members, nominees and beneficiaries;
• application forms, policy certificates, membership records, instructions, amendments, cancellations and reinstatement records; and
• proof of relationship, dependency, guardianship, customary marriage, adoption or other eligibility information where required.

5.4 Payment and financial information

• bank-account details, debit-order information, payment references and payment history;
• receipts, arrears, refunds, claim-payment details and transaction records; and
• information required by payment providers, banks or collection channels. Payment-card details entered on a payment provider's secure service are handled in accordance with that provider's terms and privacy practices.

5.5 Claim and funeral-service information

• claim forms and claim correspondence;
• identity documents of claimants, informants, beneficiaries and policy members;
• death notifications, death certificates, police reports, bank statements and supporting evidence;
• information about the circumstances of a death where required to assess a claim or deliver a funeral service; and
• funeral arrangements, locations, dates, service selections, transport and supplier records.

Records relating to a deceased person may also contain personal information about living relatives, claimants, beneficiaries, informants or other people. We protect that information in accordance with this policy and applicable law.

5.6 Special personal information and children's information

We may process health, biometric, criminal-behaviour, religious or other special personal information only where relevant and permitted by law. We may process children's personal information when they are included on a policy or benefit, and only with the authorisation of a competent person or another lawful justification under POPIA.

5.7 Communications and service records

• calls, emails, messages, web forms, complaints, compliments, survey responses and support requests;
• records of advice, disclosures, consent, preferences and notices; and
• recordings of telephone calls where recording is lawful and you have been appropriately notified.

5.8 Website and device information

• internet protocol address, browser and device type, operating system, date and time of access, pages viewed, links selected and referring pages;
• cookie identifiers and preference data; and
• information submitted through online calculators, forms, portals or chat tools.

5.9 Business, supplier and employment information

• business contact details, registration and tax information, contracts, invoices and payment information;
• due-diligence, compliance and performance records; and
• job application, qualification, reference, employment and personnel information, where applicable.

We do not intentionally collect personal information that is unrelated to a legitimate Wisani purpose.

6. Where we obtain personal information

We may collect information:

• directly from you through applications, forms, branches, pay points, telephone calls, digital channels and service interactions;
• from a policyholder, competent person, beneficiary, claimant, family member, representative or employer acting with appropriate authority;
• from Wisani Burial Society CC, Wisani Administrators CC or King Price Life where sharing is necessary for the relevant product or service;
• from banks, payment and collection providers, funeral-service suppliers and other authorised service providers;
• from identity, fraud-prevention, verification, credit-control or public-record sources where permitted by law;
• from regulators, ombuds, law-enforcement bodies, courts or other authorities; and
• automatically when you use our website or digital services.

If you give us information about another person, you must have authority to do so and must, where reasonably practicable, make that person aware of this policy before providing the information. You should provide only information that is accurate and necessary for the relevant product or service.

7. Why we process personal information

We process personal information for specific, lawful purposes, including to:

• provide information, quotations and assistance requested by you;
• assess, issue, administer, maintain, change, renew, reinstate or cancel policies and benefits;
• add and verify policy members, dependants, beneficiaries and other covered persons;
• collect, allocate and reconcile premiums and other payments;
• arrange and deliver funeral services and value-added products and services;
• receive, validate, investigate, decide, pay and audit claims;
• verify identity, eligibility, authority, relationships, bank details and information supplied to us;
• detect, prevent and investigate fraud, misrepresentation, money laundering, crime, misconduct or security threats;
• communicate policy, claim, service, payment, regulatory and operational information;
• answer enquiries and manage complaints, disputes, compliments and requests;
• provide financial services, fulfil mandates and comply with binder or administration obligations;
• maintain records, perform audits, manage risk and meet governance, reporting and legal obligations;
• improve our products, services, branches, digital channels and customer experience;
• compile statistics, research and business insights, preferably using aggregated or de-identified information where appropriate;
• manage suppliers, partners, staff and job applicants;
• establish, exercise or defend legal rights and claims; and
• send marketing where permitted by law and in accordance with your communication preferences.

We will not further process personal information in a way that is incompatible with the purpose for which it was collected unless POPIA permits it.

8. Our lawful reasons for processing

Depending on the circumstances, Wisani processes personal information because:

• you or a competent person has consented;
• processing is necessary to take steps at your request or to conclude or perform a contract;
• processing is required to comply with a legal or regulatory obligation;
• processing protects your legitimate interests;
• processing is necessary for Wisani's legitimate interests or those of a third party, provided that the processing is lawful, reasonable and does not unjustifiably infringe your privacy; or
• another justification or authorisation under POPIA applies, including the lawful processing of special personal information or children's information.

Applicable requirements may arise under POPIA, the Promotion of Access to Information Act 2 of 2000 (PAIA), financial-sector and insurance legislation, tax and accounting laws, court orders and other South African laws. Depending on the activity, these may include the Financial Advisory and Intermediary Services Act 37 of 2002, the Insurance Act 18 of 2017, the Long-term Insurance Act 52 of 1998 and the Financial Intelligence Centre Act 38 of 2001.

Where we rely on consent, you may withdraw it at any time. Withdrawal does not affect processing that was lawful before withdrawal, or processing that remains lawful on another ground.

9. When information is mandatory

Providing information is voluntary unless a law, contract, policy requirement or service requirement makes it mandatory. We will indicate required information where reasonably practicable.

If required information is not provided, Wisani or the insurer may be unable to:

• verify your identity, authority, eligibility or payment details;
• give advice or provide a quotation;
• issue, administer or change a policy;
• add or verify a policy member or beneficiary;
• collect or allocate a premium;
• assess or pay a claim;
• arrange or deliver a funeral service; or
• meet a legal obligation or respond fully to a request.

Marketing consent is not a condition of receiving a Wisani product or service unless the communication is necessary to provide or administer that product or service.

10. Who we may share information with

We share personal information only where necessary and lawful. Recipients may include:

• Wisani Burial Society CC and Wisani Administrators CC, for the functions described in this policy;
• King Price Life and, where applicable, its affiliates, reinsurers, administrators and service providers;
• beneficiaries, claimants, policyholders, competent persons or authorised representatives, after appropriate verification;
• banks, debit-order processors, payment gateways, collection channels and payment outlets;
• mortuaries, funeral-service providers, transporters, suppliers, cemeteries, medical practitioners and other parties involved in a claim or funeral service;
• identity and document-verification, fraud-prevention, tracing, investigation, credit-control and risk-management providers;
• communications, call-centre, hosting, cloud, software, data-storage, archiving, cybersecurity and support providers;
• professional advisers, auditors, accountants, compliance officers, lawyers and debt-recovery providers;
• regulators, ombuds, government departments, law-enforcement bodies, courts and other authorities; and
• a successor or prospective purchaser in a lawful restructuring, merger or sale, subject to appropriate safeguards.

Service providers that process personal information for Wisani must be subject to written confidentiality and security obligations appropriate to the information and services concerned.

We do not sell personal information.

11. Cross-border processing

Some service providers, systems, group companies, reinsurers or recipients may process or store personal information outside South Africa. Where this occurs, Wisani will transfer personal information only where permitted by section 72 of POPIA, including where the recipient is subject to an adequate law, binding corporate rules or a binding agreement that provides an appropriate level of protection, or where another lawful basis for the transfer applies.

You may contact us for information about the safeguards relevant to a material cross-border transfer of your information.

12. Automated decision-making

Wisani may use rules, systems or tools to support verification, fraud detection, risk management, payment allocation, policy administration or claim handling. If a decision that has legal or substantial effects on you is made solely through automated processing, we will apply the protections required by POPIA, including appropriate notice and an opportunity for human intervention where required.

13. How we protect personal information

Wisani uses reasonable and appropriate technical and organisational safeguards based on the nature of the information, foreseeable risks and available safeguards. Measures may include:

• access controls, authentication and role-based permissions;
• confidentiality obligations, staff training and acceptable-use rules;
• secure storage, backups, system monitoring and malware protection;
• encryption or other protective measures where appropriate;
• supplier due diligence and operator agreements;
• record-management, incident-response and business-continuity processes; and
• regular review and improvement of safeguards.

No system is completely secure. If we have reasonable grounds to believe that an unauthorised person has accessed or acquired personal information, we will investigate and notify the Information Regulator and affected data subjects as soon as reasonably possible where POPIA requires this.

14. How long we keep information

We keep personal information only for as long as reasonably necessary for the purpose for which it was collected, or for a longer period where:

• a law, regulatory rule, contract or code requires or permits retention;
• Wisani reasonably needs the record for a lawful purpose, including policy administration, claims, complaints, audit, fraud prevention or legal proceedings;
• you or a competent person has consented; or
• the information is retained for historical, statistical or research purposes with appropriate safeguards.

Retention periods depend on the type of record, the product or service, the sensitivity of the information and applicable legal requirements. When Wisani is no longer authorised to retain identifiable information, we will securely destroy or delete it, or de-identify it, as soon as reasonably practicable.

15. Marketing and service communications

We may send service messages needed to administer a policy, payment, claim, funeral service, legal notice or customer request. These are not marketing messages and may continue even if you opt out of marketing.

We send electronic direct marketing only where permitted by POPIA. This may be because you have consented or, where the law allows, because we obtained your contact details in connection with a Wisani product or service and are marketing our own similar products or services. Each electronic marketing message will identify the sender and provide a practical way to opt out.

You may withdraw marketing consent or object to direct marketing at any time, free of charge, by using the unsubscribe method in the message or contacting us using the details in section 4.

16. Cookies and digital services

Wisani's website and digital services may use cookies and similar technologies to:

• operate and secure the service;
• remember choices and information during a session;
• understand website performance and usage; and
• support analytics or advertising where lawfully implemented.

Where required, Wisani will obtain an appropriate choice or consent before placing non-essential cookies. You can also control cookies through your browser settings, although disabling essential or functional cookies may affect the service.

The website may contain links to third-party websites or services. Wisani is not responsible for how an independent third party processes personal information, and you should read that party's privacy notice.

17. Your rights under POPIA

Subject to POPIA and PAIA, you may:

• ask whether Wisani holds personal information about you;
• request access to that information and, where applicable, information about third parties or categories of third parties that have had access to it;
• ask us to correct or update inaccurate, incomplete, excessive, outdated, misleading or unlawfully obtained information;
• ask us to delete or destroy information that Wisani is no longer authorised to retain;
• request restriction of processing in circumstances recognised by POPIA;
• object, on reasonable grounds relating to your situation, to processing based on certain legitimate interests;
• object to direct marketing at any time;
• withdraw consent where processing depends on consent;
• request information about an applicable automated decision; and
• lodge a complaint with Wisani or the Information Regulator.

Some rights are subject to lawful limitations. For example, Wisani may need to retain information to comply with law, administer an active policy, resolve a claim or dispute, protect another person's rights, or establish, exercise or defend a legal claim.

18. How to exercise your rights

Send your request to the Information Officer using the contact details in section 4. Please state:

• your full name and contact details;
• the policy, claim, membership or reference number, if applicable;
• the Wisani entity, product or interaction concerned;
• the right you want to exercise; and
• enough detail for us to locate the information and understand the request.

We may ask for proof of identity and authority to protect personal information from unauthorised disclosure or change. A representative must provide proof of authority. Any fee will be charged only where permitted by law and communicated in advance.

We will respond within the period and in the manner required by applicable law. Access to records may also be governed by Wisani's PAIA manual, available through the legal section of the Wisani website or on request.

19. Complaints to the Information Regulator

Please contact Wisani first so that we can try to resolve your concern. You also have the right to lodge a complaint with the Information Regulator (South Africa):

Regulator contact details and processes may change. Please use the regulator's website to confirm the latest complaint channel.

20. Changes to this policy

Wisani may update this policy when our services, processing activities or legal obligations change. The updated version will be published on the Wisani website with a revised effective date. Where a change materially affects how we use personal information, we will take reasonable steps to provide additional notice where required.