We are MTN Group Management Services (Pty) Ltd].

In this privacy notice “MTN”, “we”, “our” and “us” refers to MTN Group Management Services (Pty) Ltd.

This notice applies to individuals that are:

• any person(s) who contracts with us for the provision of products and services, or who purchases a product from us (“customers”), including potential customers to the extent MTN Processes your Personal Data;
• any person(s) who uses our website, mobile applications or any products or services (“users”);
• all suppliers, contractors and service providers of MTN (“suppliers”) including potential suppliers to the extent MTN Processes your Personal Data
• resellers such a MTN distributors and agents as well as partners (“resellers”) including potential resellers to the extent MTN Processes your Personal Data; and
• any other persons (save for employees and job applicants) who share Personal Data with MTN including beneficiaries, trustees or donors to MTN trusts or charitable causes; MTN guests (“other Data Subjects”).

Data Subject:
Means an identified or identifiable natural person. An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier or one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person. It shall also include any additional persons afforded data privacy rights and protection of Personal Data in terms of Applicable Data Privacy Law(s).

Local Regulatory Requirements: 
Legal, statutory, regulatory, license conditions rules, guidelines, Ministerial/National Security orders or directives, and Directives relating to Public safety (where applicable) and Data Sovereignty* related requirements with which MTN is required to comply by applicable authorities in the jurisdictions in which MTN operates.
*Data Sovereignty relates to the laws and governance structures that Personal Data is subject to, due to the geographical location of where it is Processed.

Personal Information or Personal Data: 
Means any information relating to an identifiable, living natural person, and where applicable, an identifiable, existing juristic person. Examples of “Personal Data” includes, but is not limited to, the following:

• a name;
• any identifying number, symbol;
• contact information (e.g. e-mail address, postal address, telephone number);
• location data or physical address;
• online identifier or other assignment to the person;
• the biometric information of the Data Subject;
• the personal opinions, views or preferences of the Data Subject;
• correspondence sent by the Data Subject that is implicitly or explicitly of a private or confidential nature or further correspondence that would reveal the contents of the original correspondence;
• the views or opinions of another person about the Data Subject;
• the name of the Data Subject if it appears with other Personal Data relating to the Data Subject or if the disclosure of the name itself would reveal information about the Data Subject; and
• Special Personal Information.

Processing:
Any operation or set of operations which is performed on Personal Data or on sets of Personal Data, whether or not by automated means, including collection, receipt, recording, organisation, structuring, collation, storage; adaptation or alteration, updating, retrieval, consultation, use, dissemination, distribution, disclosure by means of transmission; or otherwise making available, alignment or combination, merging, linking, restriction, erasure, destruction, and/or degradation.

Special Personal Information:
A sub-set of Personal Data which is considered more sensitive than other categories of Personal Data. Special Personal Information includes but is not limited to Personal Data revealing a Data Subject’s racial or ethnic origin; political opinions or persuasions; religious or philosophical beliefs; trade union membership; criminal behaviour relating to the alleged commission of a crime or proceedings relating to the alleged commission of a crime; genetic data; biometric data; data concerning health; and/or data concerning a Data Subject’s sex life or sexual orientation.

To run our business, we may be required to collect, use, store and otherwise Process your Personal Data. The Personal Data that we may collect and Process can vary depending on the MTN products and services that you use, contract for or that you supply to us; how you may be using or delivering those products and services; and the means by which you may be interacting with us.
We will only collect the Personal Data of yours that is adequate, relevant and limited to what is needed in relation to the specific purposes for which we are collecting it, as described in this privacy notice.
The Personal Data collected and Processed by us may include:

• account and contact information: which may include your name, contact information (email address, postal address, residential address, telephone number), date of birth, identifying numbers (identity document number, passport numbers and/or other national ID numbers as required); billing information; financial information; any other information required to comply with regulatory requirements;
• location information: we collect information regarding your physical location / geolocation when you use your device, our products or services and they connect with cellphone towers, wifi routers, bluetooth, beacons, GPS satelites and/or other MTN technologies or infrastructure;
• network performance: we collect information which inform our network performance such as your use of our products, services or equipment
• financial information: such as your bank account or credit card details; financial history (including information to determine your creditworthiness);
• usage of your devices, our services and products: data usage (including browsing history); telephone records (including information regarding your incoming and outgoing telephone calls); text message records; video streaming (including your selected packages and usage); purchase activities; and other similar information;
• web browsing and application usage: we collect your Personal Data when you visit our website or use our mobile applications. This may include, your IP address, browser type; operating system; mobile carrier; your ISP; URLs of sites from which you arrive or leave the website and mobile applications and sites that have our platform technology embedded; time you spend on our website or mobile applications; links or advertisements you see; purchases made through our website; first party cookies and other webtracking technologies. We may also collect information identifying or related to equipment accessing our networks including the software, configuration, equipment type and other unique identifiers (such as your username and password). Third party cookies will also be collected from our selected marketing technology partner(s), third party websites and applications.
• supplier, reseller, contract and service provider information: which may include name, contact information, billing information, background checks, financial history, employment history, tax information, information related to your performance; any other information which may be required in terms of regulatory requirements applicable to MTN and/or our policies;
• multimedia data: such as unaltered photographs, audio recordings, or video recordings;
•  social media information: we collect your information related to your interaction with our social media accounts, content and marketing campaigns (including your details when you enter into a competition or interact with an advertisements; your comments, your reactions (i.e. ‘likes’)), Personal Data available from your public profile and information you have allowed social media platforms to share with us in terms of your privacy preferences on that platform; and your social media handles;
• biometric information: such as images of you, fingerprints, voice recording or voiceprint, scan of your face in order to identify you;
• demographic information: we may collect information related to your gender, race or ethnic origin, age, education, financial status;
• views, opinions and interests: we collect information regarding your views, opinions and preferences (for example when you participate in a survey or when you provide feedback regarding our products or services or online based behaviour) as well as your interests. In the case of suppliers and resellers, we will obtain the views and opinions of others regarding your performance (e.g. references).

In most circumstances we collect Personal Data directly from you, for instance, when you buy or use any of our products or services, visit our website, interact with our customer services departments.
In some instances, however, we will also collect your Personal Data indirectly from third parties, such as from:

• Credit check or vetting agencies;
• Social media platforms;
• Marketing agencies;
• Other entities within the MTN Group (e.g. based on the usage of their applications, websites and sharing of Personal Data);
• Resellers in respect of the Personal Data of customers, users and suppliers;
• Third parties providing supplier and reseller references.

MTN will use your Personal Data for purposes of:

• Verification: we Process Personal Data necessary to verify your identity when you are purchasing our products and services, when you make contact with us, or when we contact you;
• Credit checks: we perform credit checks, including using the services of a credit bureau, where you are applying for a contract for products and/or services with us, and to assess your application;
• Contracting and processing orders: we Process your Personal Data in order to conclude and contract, to process your request to provide products and services and to keep you updated with your order progress and to provide our products and services to you;
• Billing and collection: your Personal Data is Processed to perform billing of your account for your use of our products and services. We also Process your Personal Data to collect outstanding monies due to us through our collection processes;
• Monitor and improve services: we perform research and statistical analysis on our customers’ and/or users’ behaviour for purposes of monitoring the performance of our network, products and services and maintaining or improving our products and services to you;
• Improve value proposition: we analyse our customers and/or users preferences and interests based on their use of MTN websites, mobile applications, products, services and/or social media interactions to improve on our services, products, to perform marketing, online behavioural advertising and to develop new services or products which may be suitable to you;
• Network performance: we Process your Personal Data to protect our network and manage the volume of calls, texts and other use of our network. For example, we identify peak periods of use, so we can ensure the network can handle the volume during those times.
• Marketing: we use your Personal Data to promote and/or market our products and services to you by means of text and voice messaging, email, post, telephone calls, or through social media campaigns, but only if this is permitted in terms of our policies, local regulations and you have not opted-out from the type of direct marketing communications (e.g., where you have opted-out of certain categories of direct marketing but not all categories of direct marketing).
• Fraud and crime prevention: we Process your Personal Data to detect and prevent fraud or criminal activity through the use of our products or services;
• Security: we Process your Personal Data to prevent Personal Data Breaches, and to safeguard our IT systems, networks, assets, buildings and places of work;
• Compliance and Reporting: we Process your Personal Data where this is required to comply with any legal obligations imposed on MTN by applicable law or in response to directives from law enforcement or court orders (for example “know your client” requirements) and to discharge any prescribe reporting obligations.
• Customer service: we Process your Personal Data to provide you with customer services including to respond to any question, query, requests, concerns or complaints you may have about MTN, including our network, products, services, employees or our Processing activities.
  MTN will not further Process Personal Data for any purpose that is incompatible with the original purpose that the Personal Data was collected for unless:
  • such further Processing is authorised in terms of applicable data privacy laws;
  • we have obtained your consent to the further Processing;
  • the further Processing is necessary to comply with an obligation imposed by Local Regulatory Requirements or for conducting proceedings in a court or tribunal; or
  • it is for scientific or historical research purposes or statistical purposes.

We are allowed to Process your Personal Data, so long as we have a legal basis to do so (i.e. there is a justification to Process your Personal Data in terms of laws applicable to MTN and/or our policies permit such Processing). When we Process your Personal Data, we will rely on one of the following legal bases, as appropriate, having regard to the purpose of Processing:

• Performance of a contract: this is when the Processing of your Personal Data is necessary to conclude a contract or perform our obligations under a contract entered into with you
• Legal obligation: this is when we are required to Process your Personal Data to comply with a legal obligation
• Legitimate interests of MTN or a third party: we will Process information about you where it is in our or a third party’s legitimate interest provided these interests are not overridden by your interests and fundamental rights and freedom to data privacy
• Legitimate interests of the data subject or another natural person: the Processing is necessary to protect a legitimate interest of the relevant Data Subject or of another natural person
• Your consent: in some cases, we will ask you for specific permission to Process some of your Personal Data. This consent may withdrawn at any time.

In those instances when we Process your Special Personal Information, we will rely on one of the following legal bases as appropriate having regard to the purpose of Processing:

• You have given explicit consent to the Processing of your Special Personal Information for one or more specified purposes. You may withdraw such consent at any time;
• Processing relates to Special Personal Data which was intentionally made public by you;
• Processing is necessary for the establishment, exercise or defence of a right or obligation in law;
• Processing is for scientific or historical research purposes or statistical purposes to the extent that a) the purpose serves a public interest and the processing is necessary for the purpose concerned and or b) it appears impossible or would involve disproportionate effort to ask for consent, and sufficient guarantees are provided to ensure that the processing does not adversely the individual privacy of the data subject to a disproportionate extent;
• Processing of Personal Data related to criminal behaviour is obtained and used in accordance with Local Regulatory Requirements.
• Personal information relating to race and ethnic origin is processed when necessary to identify a data subject and to comply with laws or other measures designed to protect or advance persons, or categories of persons, disadvantaged by unfair discrimination.

It is not mandatory for you to provide any Personal Data to us. However, failing to provide certain Personal Data to us, particularly where that Personal Data has been requested by us may impact our ability to, amongst other things:

• provide our products or services to you;
• to support you with and manage our products and services;
• provide you full functionality to all our webpages;
• on-board you as supplier, reseller, contractor or service provider;
• to allow you access to our premises or buildings.

MTN will not make decisions based solely on automated processing (including profiling) of your personal data which results in legal consequences or similarly significant effects for you.

However, MTN may process personal data using automated tools, including AI technologies where such processing is:

• necessary for entering into or performing a contract with you;
• based on your explicit consent;
• authorised under applicable data protection regulatory requirements; or
• approved by the Group Data Privacy Officers following a comprehensive risk assessment.

In all cases, MTN will implement appropriate measures to safeguard your rights and legitimate interests, including:

• providing meaningful information about the logic involved in the automated decision-making process;
• allowing you to request human intervention, express your point of view, and contest the decision

We will not retain your Personal Data for any longer than is necessary for achieving the purpose(s) for which the Personal Data is Processed, unless:

• retention of the Personal Data is required or authorised by Local laws;
• you have consented to the retention of the Personal Data; or
• the Personal Data is required for historical, statistical or research purposes and provided that we have established appropriate safeguards against the Personal Data being used for any other purposes.

We will ensure that Personal Data which is no longer required, or which we are no longer authorised to retain, is as soon as reasonably practicable, de-identified or destroyed through secure means, alternatively through permanent erasure by appropriate and effective mechanisms.

Yes, we do share Personal Data with affiliated third parties, as necessary for our legitimate business needs, to carry out your requests, and/or as required or permitted by law. This would include:

• Our service providers: We transfer your Personal Data to our third-party service providers, such as our (IT) systems providers, our hosting providers, consultants (such as legal advisers) and other goods and services providers. These providers Process your Personal Data on behalf of MTN in terms of a binding agreement with appropriate security safeguards. MTN will only transfer Personal Data to such a service provider when they meet our strict standards on the Processing of personal data and data security. We only share Personal Data that allows our service providers to provide their services and they are not allowed to Process your Personal Data for any other purpose.
• If we are reorganized or sold to another organisation: MTN may disclose Personal Data in connection with the sale, assignment, or other transfer of the business to which the data relates.
• Courts, tribunals, law enforcement, or regulatory bodies: MTN may disclose Personal Data in order to respond to requests of courts, tribunals, government, or law enforcement agencies or where it is necessary or prudent to comply with applicable laws, court or tribunal orders or rules, or government regulations.
• Audits: disclosures of Personal Data may be needed by our auditors including to perform financial audits, data privacy or security audits and/or to investigate or respond to a complaint or security threat.
• Insurers: our business requirements mean that we carry significant insurance cover in respect of business activities. There are several different participants in the insurance market (e.g., brokers, insurers, and reinsurers, as well as their professional advisors and other third parties involved should there be a claim). Some of these insurance market participants will require that we disclose Personal Data about you to them. The information will be used by the insurance market participants in the underwriting and ongoing administration of the insurance products, where there is a claim that you are relevant to and to allow the insurance market participants to comply with their legal and regulatory obligations. Some of these insurance market participants will handle this information on our behalf (like our service providers described above), but others will want to Process information about you independent of us.
• Other third parties: we may share information with other third parties who use MTN platforms / systems to advertise their product. However, the Personal Data collected is anonymised and/or aggregated prior to sharing with such third parties.

Yes, MTN transfers Personal Data outside of South Africa/Dubai but only if such transfers are permitted in terms of Local Regulatory Requirements.

MTN may transfer your Personal Data to other entities within the MTN group of companies. All MTN entities are bound by binding corporate rules which ensures that the MTN entity receiving your Personal Data protects your Personal Data in accordance with those binding corporate rules.

MTN also transfers certain Personal Data outside of South Africa/Dubai to third parties working with us or on our behalf for the purposes described in this Privacy Notice. When transferring Personal Data internationally to third parties we ensure your Personal Data will continue to be protected for example, by entering to binding data transfer agreements or by ensuring there are adequate data privacy laws, which requires the relevant third party to adhere to the data handling and data protection requirements, acceptable to MTN.

MTN secures the integrity and confidentiality of the Personal Data in its possession or under its control by implementing appropriate, reasonable technical, physical, and organisational measures to prevent:

• accidental loss of, damage to, or unauthorised destruction of your Personal Data;
• unlawful or unauthorised access to your Personal Data; and
• unlawful or unauthorised Processing of your Personal Data.

As part of its processes, MTN takes reasonable measures to regularly identify and assess all reasonably foreseeable internal and external risks to Personal Data in its possession or under its control and implements reasonable and appropriate technical, physical and organisational security measures to protect against the identified risks.

While MTN implements reasonable measures to prevent or reduce the likelihood and impact of Personal Data Breaches, this risk can’t be completely eliminated. If MTN becomes aware of or reasonably suspects a Personal Data Breach has occurred or that the integrity or confidentiality of Personal Data has been compromised, MTN adheres to its incident management Policies, Procedures and supporting documents governing the handling and reporting of Personal Data Breaches.

If MTN Processes Personal Data about you, you have the following rights:

• • Access and correction: you have the right to access the Personal Data retained by MTN. This is sometimes called a ‘Data Subject Access Request’. If we agree that we are obliged to provide Personal Data to you, we will provide it to you free of charge. Before providing Personal Data to you, we may ask for proof of identity and sufficient information about your interactions with us that we can locate your Personal Data. If the Personal Data we hold about you is incorrect, you are entitled to ask us to correct any inaccuracies in the Personal Data.
  • Object to Processing: you have the right to object to us Processing your Personal Data, on grounds relating to your particular situation, under certain circumstances (including to receiving direct marketing from us). For example, if we are Processing your Personal Data on the basis that is necessary for purposes of our or a third party’s legitimate interest or in the public interest. You may also object if you believe there is no legal basis for us to Process your Personal Data anymore.
  • Withhold consent: you have the right to withhold your consent without any fear of negative repercussions in circumstances that we seek your consent to Process your Personal Data. If you experience any intimidation or negative repercussions for withholding your consent you should report this to your local whistleblower hotline at anonymous@tip-offs.net
  • Withdraw consent: you also have the right to withdraw your consent at any time and we will cease Processing your Personal Data unless there is an alternative legal basis to continue Processing your Personal Data. We will advise you if we intend to continue Processing your Personal Data in these circumstances.
  • Automated processing: you have the right, under certain circumstances, not to be subjected to a decision based solely on automated processing of your personal data.
  • Disposal / Restrictions: in addition, you may have rights to have your information deleted / destroyed if we are keeping it too long or have no legal basis to Process it. You may also request that the Processing of your Personal Data is restricted in certain circumstances.
  • Deletion (Erasure): You have the right to request the deletion of your Personal Data under certain circumstances, including when the data is no longer necessary for the purposes for which it was collected, when you withdraw consent and there is no other legal basis for processing, when you object to processing and there are no overriding legitimate grounds, when the data has been unlawfully processed.
  • Data Portability: You have the right to request that we provide your Personal Data in a structured, commonly used, and machine-readable format, and to transmit that data to another controller, where technically feasible in line with applicable data privacy applicable. This right applies when:
    • The processing is based on your consent or on a contract; and
    • The processing is carried out by automated means. MTN will endeavour to accommodate reasonable requests in line with applicable laws.

• Lodge complaints: you have the right to lodge a complaint regarding the way your Personal Data is being Processed with MTN or if you believe there has been a breach of MTN privacy policies and/or data privacy laws.
• Civil proceedings: you have the right to institute civil proceedings regarding the alleged interference with the protection of your personal data.

You can make a request or exercise these rights by contacting MTN at Groupdataprivacy@mtn.com and we will make all reasonable and practical efforts to comply with your request, so long as it is consistent with applicable laws and internal policies.
Finally, you always have the right to lodge a complaint with the supervisory authority responsible for the protection of Personal Data.

If you are located in, or your Personal Data is processed in South Africa, you may contact the Information Regulator (South Africa) using the contact details available at:

• PO Box 31533, Braamfontein, Johannesburg, 2017
• Enquiries@inforegulator.org.za
• (010) 023 5241
• inforegulator.org.za

If you are located in, or your Personal Data is processed in the Dubai International Financial Centre (DIFC), you may contact the DIFC Commissioner of Data Protection, the supervisory authority responsible for enforcing the DIFC Data Protection Law at:

DIFC Commissioner of Data Protection

• Level 14, The Gate
• Dubai International Financial Centre (DIFC)
• P.O. Box 74777, Dubai
• United Arab Emirates
• commissioner@dp.difc.ae 
  +971 4 362 2222

If you have any questions, concerns, or requests regarding this Privacy Notice or the processing of your Personal Data, you may contact us through our MTN offices at the details below:

MTN South Africa Office

• Address:
  MTN Group Limited, Innovation Centre,
  216 14th Avenue, Fairland, Gauteng, 2195, South Africa
• Postal Address:
  Private Bag 9955, Cresta, 2118, South Africa
• Phone:
  +27 11 912 3000
• Website:
  www.mtn.com

MTN (Dubai) Limited

• Address:
  Level 8, Central Park Offices, DIFC, Dubai,
  United Arab Emirates, 506735
• Phone:
  +971 4 423 7800
• Website:
   www.mtn.com 

MTN may modify this Privacy Notice from time to time to reflect our current privacy practices. When we make changes to this notice, any changes affecting you will be communicated to you through an appropriate channel, depending on how we normally communicate with you.

“Data Subject” It means an identified or identifiable natural person, including prospective, current and former MTN subscribers, customers, Employees and Third Parties. An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier or one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person. It shall also include any additional persons afforded information privacy rights and protection of Personal Information in terms of Applicable Information Privacy Law(s).

“Employee/s” all persons employed by MTN and/or an MTN Entity whether permanent, time-limited, full-time, or part-time, including directors, trainees, secondees, and external contractors.

“Information Officer” a designated Director or senior member of MANCO management duly appointed and authorised by MTN Group to occupy and discharge the responsibilities of this position.

“Processing” Any operation or set of operations which is performed on Personal Information or on sets of Personal Information, whether or not by automated means, including collection, receipt, recording, organisation, structuring, collation, storage; adaptation or alteration, updating, retrieval, consultation, use, dissemination, disclosure by means of transmission; or otherwise making available, alignment or combination, merging, restriction, erasure, destruction, and/or degradation.

“Private body” means a natural person who carries or has carried on any trade, business or profession in that capacity, a partnership or juristic person.

“Requester” in relation to a private body means any person, including, but not limited to, a public body or an official thereof, making a request for access to a record of that private body or any person acting on behalf of that person.

Company name: MTN Group Management Services (Pty) Ltd

Registration number: 2004/006943/07

Postal address: Private Bag 9955, Cresta, 2118

Physical address: Innovation Centre, 216 – 14th Avenue, Fairland, Roodepoort, 2195

Information Officer: Ferdi Moolman

Deputy Information Officer: Mohamed Basson

Email for purposes of PAIA queries: groupdataprivacy@mtn.com

Email for purposes of POPIA queries: groupdataprivacy@mtn.com

Information Officer phone number: 011 912 3000

Fax number: 011 912 3168

MTN contact email: groupdataprivacy@mtn.com

Website: www.mtn.co.za

Please contact us by email whenever possible.

If you would like further guidance on how you can get access to information under PAIA, you may contact the Information Regulator to find out more information about PAIA. The Information Regulator has a guide in each of the official languages of South Africa on how to exercise any right under PAIA.

Their contact details are as follows:

Phone number: 011 023 5200

Postal address: P.O Box 31533, Braamfontein, Johannesburg, 2017

Physical address: JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001

Website: https://inforegulator.org.za/

For further guidance on how you can get access to information, please contact the Information Regulator by visiting their website at https://inforegulator.org.za/.

We hold various subjects and categories of records, including company records, business records, financial records, insurance records, personnel records, policies and directives, agreements or contracts, regulatory documents, published information, customer information and reference materials. No automatically available information have been detailed in line with requirements of a private body.

Company records are all our records related to the incorporation and administration of our company. Some of them are available from the Companies and Intellectual Property Commission (CIPC).

Business records include any documents that have economic value to the business.

Financial records are all our records related to our finances.

Insurance records are all our records related to our insurable assets.

Personnel records are all our records about anyone who works for us, provides services to us, or provides services on our behalf and who receives or is entitled to receive remuneration, including our employees, contractors, and other personnel.

Policies and directives include both internal and external documents.

Agreements or contracts include the documents themselves and all related documents.

Regulatory documents include any documents required to comply with any laws.

Published information includes any document that we prepare and produce.

Customer information includes any information about anyone that we provide goods or services to, including our customers, leads, or prospects.

Reference materials include any sources of information that we contribute to.

Records are kept in accordance with legislation as is applicable to MTN, which include (but may not be limited to) the following legislation:

• Basic Conditions of Employment Act 75 of 1997
• Companies Act 61 of 1973
• Companies Act 71 of 2008
• Compensation for Occupational Injuries and Disease Act 130 of 1993
• Consumer Protection Act 68 of 2008
• Electronic Communications and Transactions Act 25 of 2002
• Employment Equity Act 55 of 1998
• Income Tax Act 58 of 1962
• Labour Relations Act 66 of 1995
• Occupational Health and Safety Act 85 of 1993
• Pension Funds Act 24 of 1956
• Protection of Personal Information Act 4 of 2013 (POPIA)
• Regulation of Interception of Communications and Provision of Communication Related Information Act 70 of 2002
• Skills Development Levies Act 9 of 1999
• Unemployment Insurance Act 63 of 2001
• Value Added Tax Act 89 of 1991

We have authorised and designated our Information Officer to deal with all matters relating to PAIA in order to comply with our obligations in terms of PAIA.

To request access to a record, please complete Form 2 which is available from the website of the Information Regulator at https://inforegulator.org.za/wp-content/uploads/2020/07/InfoRegSA-PAIAForm02-Reg7.pdf.

Please submit the completed form to our Information Officer together with the relevant request fee (details appear at Annexure B to the PAIA Regulations, available here: https://inforegulator.org.za/wp-content/uploads/2020/07/20210827gg45057gon757-PAIAregulations.pdf) at our Information Officer’s email address, our physical address, or by fax in terms of our details provided above.

Please ensure that the completed form:

• has enough information for the Information Officer to identify you, the requested records, and which form of access you require;
• specifies your email address, postal address, or fax number;
• describes the right that you seek to exercise or protect;
• explains why you need the requested record to exercise or protect that right;
• provides any other way you would like to be informed of our decision other than in writing; and
• provides proof of the capacity in which you are making the request if you are making it on behalf of someone else (we will decide whether this proof is satisfactory).

If you do not use the standard form, we may:

• reject the request due to lack of procedural compliance;
• refuse it if you do not provide sufficient information; or
• delay it.

We may have to refuse you access to certain records in terms of PAIA to protect:

• someone else’s privacy;
• another company’s commercial information and personal information;
• someone else’s confidential information and personal information;
• the safety of individuals and property;
• records privileged from production in legal proceedings; or
• research information.

We will notify you in writing whether your request has been approved or denied within 30 calendar days after we have received a completed request for access form. If we cannot find any requested record or it does not exist, then we will notify you by way of affidavit that it is not possible to give access to that particular record.

We will evaluate and consider all requests to us in terms of PAIA. If we approve your request for access to our records, then we will decide how to provide access to you – unless you have asked for access in a specific form. Publication of this manual does not give rise to any rights to access information records, except in terms of PAIA.

You must pay us a request fee as required by law when submitting a request for access to information. The prescribed fees are as set out in the Fee Schedule which is available from Annexure B of the PAIA Regulations at this link: https://inforegulator.org.za/wp-content/uploads/2020/07/20210827gg45057gon757-PAIAregulations.pdf.

You must pay us the fees before we will hand over any information. You may have to pay a further access fee if we grant the request for any time that has exceeded the prescribed hours to search and prepare the record for disclosure.

We process the personal information of various categories of people/data subjects for various purposes as set out in this clause.

Categories of Data Subjects:

We process the personal information relating to:

• customers or clients;
• prospects or leads;
• employees;
• recruiters and medical practitioners providing services related to employees;
• contractors, vendors, or suppliers;
• children and their guardians;
• debtors and creditors;
• dealers; and
• directors and shareholders.

Purposes for Processing Personal Information

PAIA not only requires us to inform you when we use your personal information as part of our processing, but also to notify you of the purpose for which we process it, to ensure we deliver on our commitment to you.

Operational Purposes for Processing Your Personal Information

The below is a list of activities where we use your personal information and if you were to object to this use (unless we do not have another lawful ground for processing), we would not be able to deliver the service or product, or our delivery would be negatively impacted. Accordingly, the operational purpose of these activities is to:

• Verification: we process Personal Data necessary to verify your identity when you are purchasing our products and services, when you make contact with us, or when we contact you.
• Credit checks: we perform credit checks, including using the services of a credit bureau, where you are applying for a contract for products and/or services with us, and to assess your application.
• Contracting and processing orders: we process your Personal Data in order to conclude and contract, to process your request to provide products and services and to keep you updated with your order progress and to provide our products and services to you.
• Billing and collection: your Personal Data is processed to perform billing of your account for your use of our products and services. We also process your Personal Data to collect outstanding monies due to us through our collection processes.
• Monitor and improve services: we perform research and statistical analysis on our customers’ and/or users’ behaviour for purposes of monitoring the performance of our network, products and services and maintaining or improving our products and services to you.
• Improve value proposition: we analyse our customers and/or users preferences and interests based on their use of MTN websites, mobile applications, products, services and/or social media interactions to improve on our services, products, to perform marketing, online behavioural advertising and to develop new services or products which may be suitable to you.
• Network performance: we process your Personal Data to protect our network and manage the volume of calls, texts and other use of our network.
• Marketing: we use your Personal Data to promote and/or market our products and services to you by means of text and voice messaging, email, post, telephone calls, or through social media campaigns, but only if this is permitted in terms of our policies, local regulations and you have not opted-out from the type of direct marketing communications.
• Fraud and crime prevention: we process your Personal Data to detect and prevent fraud or criminal activity through the use of our products or services.
• Security: we process your Personal Data to prevent Personal Data Breaches, and to safeguard our IT systems, networks, assets, buildings and places of work.
• Compliance and Reporting: we process your Personal Data where this is required to comply with any legal obligations imposed on MTN by applicable law or in response to directives from law enforcement or court orders and to discharge any prescribed reporting obligations.
• Customer service: we process your Personal Data to provide you with customer services including to respond to any question, query, requests, concerns or complaints you may have about MTN, including our network, products, services, employees or our processing activities.

Regulatory Purposes for Processing Your Personal Information

We might also process your personal information for regulatory purposes. There are pieces of legislation that have been enacted which require us by law to process personal information and failure to do so will place us in violation of that law. An example of this is that we need to comply with the Regulation of Interception of Communications and Provision of Communication-Related Information Act 70 of 2002 (RICA) which requires us to process information such as your name, identity number and physical address.

POPIA makes a clear distinction between the two categories of personal information.

The first category is personal information (PI). This type of information relates to both natural and juristic persons. Examples of personal information include your name, surname, identification number, date of birth, passport number, cellphone number, email address, marital status, nationality, language, views, pregnancy status, bank account details etc. Insofar as juristic entities are concerned, this includes confidential personal information that are not made public in ordinary circumstances.

The second category of personal information is special personal information (SPI). Examples of special personal information include your physical or mental health status, criminal status, religion, biometrics, disability, sexual orientation etc.

We apply various security controls during the collection and processing of both personal information and special personal information and make every reasonable effort to ensure that it is not lost, stolen or compromised in any way.

We may disclose your personal information to third parties who assist us in carrying out our functions to fulfil our obligations to our customers, clients or in relation to our commercial activities. Where we disclose your personal information to any third party, the latter will be obliged to use that personal information for the reasons and purposes it was disclosed for.

To this end, we have agreements in place with these third parties to ensure this and to ensure an adequate level of security and confidentiality for your personal information.

We give the following third parties personal information that we process in the ordinary course of business:

• contractors, vendors, or suppliers;
• agents, distributors, or other resellers;
• operators, other responsible parties, or co-responsible parties; and
• third party vendors (such as software developers) to help us maintain our services.

As a global communications partner, we send personal information outside of South Africa to various countries, especially on the African continent. We will ensure compliance with POPIA in relation to any cross-border transfers of personal information.

We will only transfer data to other countries who have similar privacy laws to South Africa’s and/or ensure that the third party who is the recipient of the information is subject to a binding agreement which provides for an adequate level of protection similar to POPIA.

We secure our data (electronic and physical records) by maintaining reasonable measures to protect personal information from loss, misuse, and unauthorised access, disclosure, alteration and destruction.

We also take reasonable steps to keep personal information accurate, current, complete, and reliable for its intended use.

The Information Regulator nor the Minister of Justice and Constitutional Development have made any regulations prescribing any other information that needs to appear in this manual.

MTN will inform the requester within 30 days after receipt of the request of its decision whether or not to grant the request.

The 30-day period may be extended by a further period of not more than 30 days if the request is for a large number of records or requires a search through a large number of records and compliance with the original period would unreasonably interfere with the activities of MTN.

Please visit the website of the Information Regulator at https://inforegulator.org.za/paia-forms/ for all PAIA related forms to exercise your rights.

This manual is available in English and will be available on our website, and at our company offices. The manual is also electronically available on our website at: Legal – Terms and conditions | MTN Group.

The Information Regulator has, in terms of section 10(1) of PAIA updated and made available the revised Guide on how to use PAIA in an easily comprehensible form and manner, as may reasonably be required by a person who wishes to exercise any right contemplated in PAIA.

Members of the public can inspect or make copies of the Guide from MTN (at the details set out above) during normal working hours. The Guide is available in English. The Guide can also be obtained upon request to the Information Officer or from the website of the Regulator at https://www.justice.gov.za/inforeg/.

This manual will be updated whenever we make material changes to the current information.