UJ collects, stores, uses, and protects personal information that can be associated with any of its stakeholders (data subjects), whether natural or legal persons, and which can be used to identify you or that person. UJ must collect and process applicable personal information about you when you engage with us. This enables us to manage our relationship with you and run the relevant university operations.

This Privacy Notice sets what type of personal information we collect from you when:

• you are a student, prospective student, recipient of UJ’s services someone who has signed up to receive marketing communications from UJ, member of the public, donor, sponsor, or are just browsing UJ’s website.
• You are applying (or enquiring) to become an employee, staff member, contractor, consultant, temporary or agency worker at UJ.
• Someone else (such as an UJ Alumni, supplier, or press contact).

This Privacy Notice also applies to personal information which we collect from you when you visit UJ’s website and utilise our online activities.

We reserve the right to change this Privacy Notice from time to time. If we make changes to this Privacy Notice, we will provide the updated Privacy Note on the website. If you want to make sure that you are up to date with the latest changes, we advise that you frequently visit the website and this page.

It is important that you read this Privacy Notice, together with any other notice we may provide on specific occasions when we are collecting or processing personal information about you, so that you are aware of how and why we are using such information.

We, as a responsible party in terms of the Protection of Personal Information Act, 2013 (“POPIA”), will adhere to and comply with the requirements relating to the lawful processing of personal information. Accordingly, when we collect and process your personal information we will do so in accordance with the following conditions:

• Accountability – we will remain responsible for ensuring that your personal information is collected and processed in accordance with POPIA.
• Processing Limitation – we will process your personal information in a reasonable manner which is adequate, relevant, and not excessive and which does not infringe on your privacy.
• Purpose Specification – we will only collect your personal information for a specific, explicitly defined, and lawful purpose. We will not retain records of your personal information for longer than it is necessary for us to achieve the purpose for which it was collected.
• Further Processing Limitation – further processing of your personal information must be compatible with the purpose for which that personal information was initially collected.
• Information Quality – we will take reasonable steps to ensure that your personal information which we process is complete, accurate, not misleading, and updated where necessary.
• Openness – we will maintain records of our processing operations and we will use reasonable efforts to notify you when we collect your personal information.
• Security Safeguards – we will ensure that we, and anyone who processes your personal information on our behalf, maintains the integrity and confidentiality of your personal information.
• Data Subject Participation – you are entitled to request records of your personal information which we hold, and to ask us to update, correct, or, some cases, destroy your personal information which we hold.

Under POPIA, you have the following rights, which we will always work to uphold:

• to be informed about our collection and use of your personal information, as well as what records of your personal information we have. This Privacy Notice should tell you everything you need to know, but you can always contact us to find out more or to ask any questions;
• to request access to and the right to rectify, correct, or delete, the personal information which has been collected about you;
• to object to the processing of your personal information at any time; and
• to lodge a complaint with the Information Regulator if you believe that we have violated any of your rights. You can contact the Information Regulator at mailto: POPIAComplaints@inforegulator.org.za

Who are you?

I am…

…a student, prospective student, recipient of UJ’s services someone who has signed up to receive marketing communications from UJ, member of the public, or are just browsing UJ’s website

• What types of personal information do we collect and where do we get it from?

The personal information we process about you broadly falls into five main categories: (i) Contact Information; (ii) Identity and Other Regulatory Information; (iii) Billing Information; (iv) Marketing Preferences; and (v) Browsing and Device Usage Information.

We collect your personal information from various sources. The table below sets out the different types of personal information that we collect and the sources we collect it from.

Please note that if you do not provide us with your Contact Information we may not be able to provide you with any information you request, and if you do not provide us with your Contact Information, Identity and Other Regulatory Information or certain Billing Information, we may not be able to assist you.

• What do we do with your personal information, and why?

We use your personal information for a few different purposes. We will ensure that we always have a lawful basis (i.e. a reason prescribed by law) for processing your personal information, such as where you have given your consent, where the processing is necessary for the performance of our obligations to you under a contract, where we are required by law to process your information, or where the processing is necessary for pursuing our legitimate interests or protecting your legitimate interests.

With your permission and/or where permitted by law, we will use your personal information for marketing purposes, which may include contacting you by email and/or telephone with information, news and offers on our services, courses and university life. You will not be sent any unlawful marketing or spam. We will always work to fully protect your rights and comply with our obligations under applicable, and you will always have the opportunity to opt-out.

We will only use your personal information for the purpose(s) for which it was originally collected unless we reasonably believe that another purpose is compatible with that or those original purpose(s) and need to use your personal information for that purpose.

The purposes applicable to you will vary according to the relevant holder of your personal information. For some processing activities, we consider that more than one lawful basis may be relevant – depending on the circumstances.

We may also process certain special categories of personal information, such as information concerning your religious or philosophical beliefs, race, health or sex life, or personal information of minors, which require a higher standard of protection under applicable laws. For these special categories of personal information, different lawful bases apply. The purposes applicable to you will vary according to the relevant holder of your personal information. For some processing activities, we consider that more than one lawful basis may be relevant – depending on the circumstances. We also have policies in place explaining our procedures for ensuring compliance with applicable laws in connection with the processing of special categories of personal information.

• Purposes for processing personal information

Taking payment from you in respect of our services
Sending you electronic direct marketing communications
Analysing how our electronic marketing communications are used by you (including whether you open them and click through to access their contents)				(We need this information to ensure we are providing you with information that you are interested in)
Conducting surveys for benchmarking, continuous improvement and marketing purposes				(We need to collect your feedback in relation to our activities, in order to resolve any problems or complaints and improve and innovate)
For our general record- keeping and relationship management				(As a university, we need to store student related files so we can refer to them)
Managing our relationship with you and resolving any complaints from or disputes with you				(We need to be able to try and maintain our position of being a high quality university and to resolve any complaint or dispute you might raise with us)
Managing and administering the user accounts and profiles you have with us, collecting information about how you use them and your preferences and tailoring and improving our offerings accordingly				(We need to tailor our offerings in accordance with feedback and preferences)
Legal and Regulatory Compliance and Reporting
Performing identity, financial and credit searches,

screening and checks against third party sources for identity verification, anti-fraud, and demographic reporting purposes
Monitoring our systems and processes to identify, record and prevent fraudulent, criminal and/or otherwise illegal activity				(We need to be able to monitor our systems in this way to help protect them, us and you from illegal activity)
Complying with instructions, orders and requests from law enforcement agencies, any court or otherwise as required by law
Complying with our general regulatory and statutory obligations (including our responsibilities under codes of conduct and anti-bribery laws)
General Business Requirements
Managing, planning and delivering our business and marketing strategies				(As a high quality university, we need to implement effective business development and marketing strategies)
Purchasing, maintaining, and claiming against our insurance policies				(It is in our interests to protect our business against specified losses)
Training our staff				(Sometimes, it is appropriate for us to use your personal information so that we can provide our staff with training to manage risk and improve the quality of our interactions)

• Purposes for processing special categories of personal information

accommodation and dining options	requirements)	or emergencies)
Enrolling you as a student and providing our service offerings to you
Investigating, evaluating, demonstrating, monitoring, improving and reporting on our compliance with relevant legal and regulatory requirements
Complying with (or assisting others’ compliance with) regulatory requirements involving steps being taken to establish the existence of any unlawful act, dishonesty, malpractice or other seriously improper conduct
Complying with our general regulatory and statutory obligations
Responding to

binding requests or search warrants or orders from courts, governmental, regulatory and/or enforcement bodies and authorities or sharing information (on a voluntary basis) with the same
Obtaining legal advice, establishing, defending and enforcing our legal rights and obligations in connection with, any legal proceedings (including prospective legal proceedings)

…you are applying (or enquiring) to become an employee, staff member, contractor, consultant, temporary or agency worker at UJ

• What types of personal information do we collect and where do we get it from?

We collect many different types of personal information about you for lots of reasons. We cannot administer your application without your personal information. Where we don’t need your personal information, we will make this clear, for instance we will explain if any data fields in our application forms are optional and can be left blank.

We collect your personal information from you directly and sometimes we obtain it from other people and organisations, including some public sources, such as publicly available directories and online resources, your emergency contacts, your use of UJ provided assets, systems and platforms, your line manager and co-workers, your dependants and beneficiaries, and third party benefits providers.

If any of the personal information you have given to us changes, such as your contact details, please inform us without delay.

The table below sets out the different types of personal information that we collect and the sources we collect it from.

• What do we do with your personal information, and why?

We use your personal information for a few different purposes in connection with your application or engagement with us, and in connection with the management and administration of recruitment activities and strategies.

We will ensure that we always have a lawful basis (i.e. a reason prescribed by law) for processing your personal information, such as where you have given your consent, where the processing is necessary for the performance of our obligations to you under a contract, where we are required by law to process your information, or where the processing is necessary for pursuing our legitimate interests or protecting your legitimate interests.

We will only use your personal information for the purpose(s) for which it was originally collected unless we reasonably believe that another purpose is compatible with that or those original purpose(s) and need to use your personal information for that purpose.

We may also process certain special categories of personal information, such as information concerning your religious or philosophical beliefs, race, health or sex life, or personal information of minors, which require a higher standard of protection under applicable laws. For these special categories of personal information, different lawful bases apply.

The purposes applicable to you will vary according to the relevant holder of your personal information. For some processing activities, we consider that more than one lawful basis may be relevant – depending on the circumstances.

We also have policies in place explaining our procedures for ensuring compliance with applicable laws in connection with the processing of special categories of personal information.

• Purposes for processing personal information

	Lawful basis
Purposes of processing	Your consent	To perform a contract with you	To comply with a legal obligation	For our legitimate interests
New Joiner Activities
Developing, operating and collecting feedback on recruitment activities and employee selection processes
Administering your application for a job with us and considering your suitability for the relevant role
Obtaining, considering and verifying your employment

references and employment history
Reviewing and confirming your right to work
Conducting verification and vetting, including criminal background checks and credit checks where required by law
Conducting background checks, credit checks, verification and vetting which are not required by law but needed by us to assess your suitability for your role
Making a job offer to you and entering into a contract of employment with you
Identifying and assessing our strategic business direction, resourcing needs and areas for development
Analysing recruitment and retention objectives, processes and employee turnover rates
Communicating with you and providing you with information in connection with your application or engagement with us from time to time
General staff administration, including workforce management and facilities operations

Managing our health and safety compliance obligations
Determining whether any adjustments are necessary to enable you to carry out a role
Considering your suitability for existing and future vacancies
Handling grievances and complaints, including investigating issues, considering appropriate resolution and mitigating actions and reviewing outcomes
Security and Governance
Monitoring the security of UJ’s physical premises and systems, networks and applications
Identifying and authenticating applicants and other individuals
Identifying, investigating and mitigating suspected misuse of UJ’s assets, systems and platforms
Ensuring compliance with UJ policies and procedures
Legal and Regulatory Compliance and Responsibilities
Managing and administering our employment equity and

related reporting
Responding to binding requests or search warrants or orders from courts, governmental, regulatory and/or enforcement bodies and authorities
Responding to non-binding requests or search warrants or orders from courts, governmental, regulatory and/or enforcement bodies and authorities
Complying with disclosure orders arising in legal proceedings
Investigating, evaluating, demonstrating, monitoring, improving, reporting on, and meeting UJ’s compliance with relevant legal and regulatory requirements
Investigating, evaluating, demonstrating, monitoring, improving, reporting on, and meeting UJ’s compliance with best practice and good governance responsibilities
UJ’s Business Operations
Implementing, adapting and enhancing systems and processes to develop or improve our business and/or our recruitment process
Managing, planning and delivering events, projects and initiatives in connection

with our other strategies (for example arranging group conferences)
Supporting our diversity programmes and targets
Supporting, updating and maintaining our technology infrastructure
Analysing recruitment-related objectives and results
Collecting feedback in relation to our recruitment and HR activities and processes for continuous improvement purposes

• Purposes for processing special categories of personal information

Conducting background checks, verification and vetting which are not required by law but needed by us to assess your suitability for your role
General application management and administration
Managing our health and safety compliance obligations
Determining whether any adjustments are necessary to enable you to carry out a role
Security and governance
Identifying and authenticating Applicants and other individuals
Identifying, investigating and mitigating suspected misuse of our assets, systems and platform
Legal and regulatory compliance and responsibilities
Managing and administering our equal opportunities reporting
Responding to binding requests or search warrants or orders from courts, governmental, regulatory and/or enforcement bodies and authorities or sharing information (on a voluntary basis) with the same
Responding to non-binding requests or search warrants or orders from courts, governmental, regulatory and/or enforcement

bodies and authorities
Complying with disclosure orders arising in legal proceedings
Investigating, evaluating, demonstrating, monitoring, improving and reporting on our compliance with relevant legal and regulatory requirements
Investigating, evaluating, demonstrating, monitoring, improving, reporting on and meeting our compliance with best practice and good governance responsibilities

Where our processing is based on your consent, you can withdraw your consent at any time. If you do this, it won’t impact any processing we’ve done prior to that date. However, if you fail t provide your personal information, or your consent to us to process your personal information in certain instances, this may affect our ability to perform our obligations to you or due in law and may further impact our ability to enter into a contract of employment or engagement with you.

…someone else (such as an UJ Alumni, supplier, or press contact)

• What types of personal information do we collect and where do we get it from?

The personal information we process about you broadly falls into four main categories: (i) Contact Information; (ii) Identity and Other Regulatory Information; (iii) Request Information; and (iv) Browsing and Device Usage Information.

We collect your personal information from various sources. The table below sets out the different types of personal information that we collect and the sources we collect it from.

Please note that if you do not provide us with your Contact Information we may not be able to provide you with any information you request, and if you do not provide us with your Contact Information, Identity and Other Regulatory Information, we may not be able to assist you.

• What do we do with your personal information, and why?

We use your personal information for a few different purposes. We will ensure that we always have a lawful basis (i.e. a reason prescribed by law) for processing your personal information, such as where you have given your consent, where the processing is necessary for the performance of our obligations to you under a contract, where we are required by law to process your information, or where the processing is necessary for pursuing our legitimate interests or protecting your legitimate interests.

We will only use your personal information for the purpose(s) for which it was originally collected unless we reasonably believe that another purpose is compatible with that or those original purpose(s) and need to use your personal information for that purpose.

The purposes applicable to you will vary according to the relevant holder of your personal information. For some processing activities, we consider that more than one lawful basis may be relevant – depending on the circumstances.

We may also process certain special categories of personal information, such as information concerning your race, health or sex life, or personal information of minors, which require a higher standard of protection under applicable laws. For these special categories of personal information, different lawful bases apply. The purposes applicable to you will vary according to the relevant holder of your personal information. For some processing activities, we consider that more than one lawful basis may be relevant – depending on the circumstances. We also have policies in place explaining our procedures for ensuring compliance with applicable laws in connection with the processing of special categories of personal information.

• Purposes for processing personal information

	Lawful basis
Purposes of processing	Your consent	To perform a contract with you	To comply with a legal obligation	For our legitimate interests
Matter Related Purposes
Responding to your enquiries
Resolving any complaints from or disputes with you
Performing identity checks (including those against third party sources) for identity verification purposes
Legal and Regulatory Compliance and Reporting
Monitoring our systems and processes to identify, record, and prevent fraudulent, criminal and/or otherwise illegal activity
Complying with instructions, orders and requests from law enforcement agencies, any court or otherwise as required by law
Complying with our general regulatory and statutory obligations
Purchasing, maintaining and claiming against our insurance policies
Training our staff

UJ does will not sell your personal information, but we may sometimes share the personal information which we collect from you, third parties, or the website with the following third parties:

• other universities or educational institutions with whom UJ collaborates
• contracted third parties to UJ who assist it with its business operations, including and not limited to fraud prevention, bill collection, marketing and technology services (in which case such providers are contractually obliged to use your personal information only with the services they supply and not for their own benefit)
• credit bureaus to report financial information, as permitted by law
• banking partners as required by credit card association rules for inclusion on their list of terminated merchants (in the event that you utilise the services to receive payments and you meet their criteria)
• with law enforcement as subpoena or court order requires
• with law enforcement or security companies for the purposes of the protection and safety of any individual or the general public.
• with regulators as law or regulatory audits require

In some cases, the third parties may require access to some or all of your personal information. Where any of your personal information is required for such a purpose, we will take all reasonable steps to ensure that your personal information will be handled safely, securely, and in accordance with your rights.

We may transmit or transfer your personal information outside of South Africa to a foreign country and process it in that country, where allowed by law. We will not transfer your personal information in a foreign country whose laws regarding processing of personal information are less stringent, unless you have consented to such transfer, or it is otherwise permitted by law.

We are committed to securing your personal information and keeping it confidential. We have done everything in our power to prevent unauthorized access to, and disclosure of, your personal information by implementing technologies and software which help us safeguard all the information we collect online.

We will retain your personal information only for as long as necessary for the achieving the purposes outlined above, to comply with our legal obligations, resolve disputes, and enforce our rights.

At some point, you might wish to restrict the use and collection of your personal information. You can achieve this by doing the following:

When you are filling the forms on the website, make sure to check if there is a box which you can leave unchecked, if you don’t want to disclose your personal information.

If you have already agreed to share your information with us, feel free to contact us via the website and we will be more than happy to change this for you.

UJ will not lease, sell, or distribute your personal information to any third parties, unless we have your permission. We might do so if the law forces us. Your personal information will be used when we need to send you promotional materials if you agree to this Privacy Notice.

Another part of our priority is adding protection for children while using the internet. We encourage parents and guardians to observe, participate in, and/or monitor and guide your children’s online activity.

We do not knowingly collect any personal information from children under the age of 13. If you think that your child has provided this kind of personal information on our website, we strongly encourage you to contact us immediately and we will use our best efforts to promptly remove such personal information from our records.

Website Terms and Conditions

By using UJ’s website and submitting your information on the website, you accept the website’s Terms and Conditions and explicitly consent to the collection, use, and disclosure of your personal information in the manner described in this Privacy Notice.

Cookies and Browser Information

For information on how UJ deals with cookies when you use the website, please refer to

our Cookies Policy. Please note that cookies don’t allow us to gain control of your computer in any way. They are strictly used to monitor which pages you find useful and which you do not so that we can provide a better experience for you.

Please note that other websites visited before entering the website might place personal information within your URL during a visit to it. UJ has no control over such websites.

Accordingly, a subsequent website that collects URL information may log some personal information.

Hyperlinks To Third Party Sites

The website may include links to other third-party websites. These links are provided for your convenience to provide further information. They do not signify that we endorse the website(s). We have no responsibility for the content of the linked website(s). UJ is not responsible for, gives no warranties, nor makes any representations in respect of the privacy policies or practices of any third-party.

We advise you to consult the respective privacy policies, notices, or documents of these website(s) for more detailed information regarding their treatment of your personal information. These notices may include their practices and instructions about how to opt-out of certain options.

If you want to know what personal information we have about you, or if you have any questions or concerns arising from this privacy notice or the way in which the University handles your personal information, please contact popi@uj.ac.za.

You can ask us for details of your personal information and for a copy of it (where any such personal information is held). This is known as a “data subject access request”.

All data subject access requests should be made in writing and made through the POPIA and PAIA tab of the website.

There is normally no charge for a data subject access request. If your request is ‘manifestly unfounded or excessive’ (for example, if you make repetitive requests) a fee may be charged to cover our administrative costs in responding.

We will respond to your subject access request as soon as reasonably possible from the time of receiving it. In some cases, however, particularly if your request is more complex, more time may be required. You will be kept fully informed of our progress.

Should you wish to contact the South African Information Regulator, we have provided their contact details:

Telephone: 012 406 4818      Fax: 086 500 3351

Email enquiries: enquiries@inforegulator.org.za