INTERNAL PROCESSING NOTICE FOR

EMPLOYEES, DIRECTORS, JOB APPLICANTS,

LEARNERSHIP APPLICANTS

IN TERMS OF SECTION 18 OF THE PROTECTION OF PERSONAL INFORMATION ACT 4 OF 2013

1.               PURPOSE OF THIS NOTICE

• We, Tuning Fork (Pty) Ltd and our subsidiaries and trading partners, collectively referred to as “us”, “we”, “the Group”, in our capacity as a Responsible Party, in order to engage with you, will have to process your Personal Information, and in doing so, will have to comply with a law known as the Protection of Personal Information Act, 2013 (hereinafter referred to as “POPIA”), which regulates and controls the processing of a legal entity’s and or an individual’s Personal Information in South Africa (also referred to as the “Data Subject”), which processing includes the collection, use, and transfer of a Data Subject’s Personal

• For the purpose of this Processing Notice, please take note of the following words and phrases which will be used throughout this Processing Notice:

• "consent", means the consent, which you in your capacity as Data Subject, may have to give to us, under certain circumstances, to process your Personal Information. This consent must be voluntary, specific and informed. Following this, once we have explained to you why we need your Personal Information and what we will be doing with it, you are then, in relation to certain uses of the information, required to give us your permission to use it, which permission or consent can be express or implied; implied meaning that consent may be demonstrated by way of your actions;

• "Data Subject", means you, the person who owns and who will provide us with your Personal Information for processing;

• "Operator" is any person who processes your Personal Information on our behalf as a contractor, in terms of a contract or mandate, without coming under the direct authority of These persons for illustration purposes may include verification agencies, advertising and public relations agencies, call centres, service providers, auditors, legal practitioners, organs of state, government, provincial and municipal bodies;

• "Personal Information", means Personal Information relating to any identifiable, living, natural person, and an identifiable, existing juristic person, including, but not limited to:

-     In the case of an individual:

• your name, address, contact details, date of birth, place of birth, identity number, passport number, bank details, details about your employment, tax number and financial information;
• vehicle registration;
• dietary preferences;
• financial history;
• information about your next of kin and or dependents;
• information relating to your education or employment history; and

• Special Personal Information including race, gender, pregnancy, national, ethnic or social origin, colour, physical or mental health, disability, criminal history, including offences committed or alleged to have been committed, membership of a trade union and biometric information, such as images, fingerprints and voiceprints, blood typing, DNA analysis, retinal scanning and voice recognition;

-     In the case of a legal entity:-

• Name, address, contact details, registration details, financial and related history, B-BBEE score card, registered address, description of operations, bank details, details about your employees, business partners, customers, tax number, VAT number and other financial information.

• "processing" / “process” or processed”, means in relation to Personal Information, the collection, receipt, recording, organisation, collation, storage, updating or modification, retrieval, alteration, consultation or use; dissemination by means of transmission, distribution or making available in any other form; merging, linking, as well as restriction, degradation, erasure or destruction of information; or sharing with, transfer and further processing, including physical, manual and automatic means. This is a wide definition and therefore includes all types of usage of your Personal Information by us including the initial processing when we first collect your Personal Information and any further and ongoing processing;

• “Purpose” means the reason why your Personal Information needs to be processed by us;

• "Responsible Party, means us, the person who is processing your Personal Information;

• “You” means you, the potential or actual employee, director, learner or bursary holder, known under POPIA, as the Data Subject, who will be providing us, the Responsible Party with your Personal Information, for

• In terms of POPIA, where a person processes another’s Personal Information, such processing must be done in a lawful, legitimate and responsible manner and in accordance with the provisions, principles and conditions set out under

• In order to comply with POPIA, a person processing another’s Personal Information must:

• provide the Data Subject or owner of the Personal Information with a number of details pertaining to the processing of the Personal Information, before such information is processed; and

• get permission or consent, explicitly or implied, from the owner / Data Subject, to process the Personal Information, unless such processing:

• is necessary to carry out actions for the conclusion or performance of a contract to which the owner / Data Subject of the Personal Information is a party;

• is required in order to comply with an obligation imposed by law; or

• is for a legitimate purpose or is necessary to protect the legitimate interest (s) and / or for pursuing the legitimate interests of i) the owner / Data Subject of the Personal Information;

1. ii) the person processing the Personal Information; or iii) that of a third party to whom the Personal Information is supplied; or

• is necessary for the proper performance of a public law duty by a public body or on behalf of a public

• In accordance with the requirements of POPIA, and because your privacy and trust is important to us, we set out below how we, and our affiliates and associated companies (hereinafter referred to as “the Group”, “we”, “us”, or “our”) collect, use, and share your Personal Information and the reasons why we need to use and process your Personal

2.               APPLICATION

• This Processing Notice applies to the following persons:

• Applicants: persons who wish to apply for an employment position within our Group, or who wish to apply for a

• Employees and Directors: persons who are employed by us or who have been appointed as directors or committee

3.               PURPOSE FOR PROCESSING YOUR PERSONAL INFORMATION

Your Personal Information will be processed by us for the following purposes:

• Employment: potential - legitimate purpose: To conduct and communicate with you regarding recruiting and human resource administration, to manage recruitment including legal eligibility for work and vetting

• Due diligence purposes - legitimate purpose: To carry out ongoing due diligence exercises including obtaining, verifying and updating your details and or credentials, such as receiving and verifying your identity, education, qualifications and employment history, medical and health history and related records, financial, credit and tax status and history, and or any employee performance related

• Employment: actual or ongoing - to contract with you: To conclude an employment contract with you, to manage recruitment, promotion and succession planning; and to conduct and communicate with you regarding your employment; your ongoing employment; and to perform human resources administration, financial administration, comply with labour, Tax and B-BEEE laws, management and organizational administration, training, and skills development, including performance assessments and disciplinary

• Employment benefits - legitimate purpose and to manage the contract: To manage your benefits, including administering remuneration, relocation, insurance, payroll, pensions and other employee benefits and tax, including disclosure to other affiliates within the Group and to others such as payroll providers, accountants, occupational health providers, insurers, pensions administrators, hosting service providers and legal advisers;

• Operational issues - compliance with law and manage the contract: To communicate, enforce and ensure you comply with policies, including in relation to claims, disciplinary actions or legal requirements and conducting investigations and incident response, including reviewing your communications in these situations in accordance with relevant internal policies and applicable law;

• Occupational health - compliance with laws: To manage occupational health and absence and fitness for work and notifying family members in emergencies;

• Travel - contractual: To facilitate business travel, travel-related support including conference attendance, bookings, and emergency support services;

• B-BBEE - compliance with laws: To monitor equal employment opportunities, in respect of

diversity categories including but not limited to age, gender, ethnicity, nationality, religion, disability, sexual orientation, and marital or family status;

• IR and Labour relations - compliance with laws: To manage membership to trade unions and collective agreements for administering collective employee arrangements where these are in place

• Communications - legitimate purpose: To make contact with you and to communicate with you generally or in respect of our requirements, or instructions, or to respond to you in order to comply with your specified or general

• Risk assessment and anti- bribery and corruption matters - legitimate purpose: For internal and external auditing, assurance and risk management purposes; and to carry out organizational and enterprise wide risk assessments, in order to detect and prevent bribery, corruption, fraud and abuse, to comply with all relevant laws, as well as to identify and authenticate your access to our goods, services or premises and generally to ensure the security and protection of all persons including employees, and persons when entering or leaving our sites and / or to exercise our rights and to protect our and others’ rights and / or property, including to take action against those that seek to violate or abuse our systems, services, customers or employees and / or other third parties where

• Legal obligation and public duties: To comply with the law and our legal obligations, including to register with Regulators, obtain and hold permits and certificates, register for VAT, Tax, PAYE, SDL, COIDA and UIF etc, to submit reports or provide various notices or returns, to litigate and / or to respond to a request or order from a SAP official, investigator or court official, regulator, or public

• Security purposes - legitimate purpose and to comply with laws: To permit you access to our offices, facilities, manufacturing or parking areas, as well as to controlled areas, for the purposes of monitoring via CCTV, your interaction and access in and from our facilities described above, and for general risk management, security and emergency incident control purposes as well as for providing IT access and support and for employee authentication and for data and cybersecurity

• For internal research and development purposes - consent required: For statistical analysis and research purposes in the context of employment, including predictive modelling and people

• Effectuate the sale, merger, acquisition, or other disposition of our business (including in connection with any bankruptcy or similar proceedings) - Legitimate interest: to comply with our legal obligations and to change our business structure we may disclose your Personal Information in connection with proceedings or investigations anywhere in the world to third parties, such as public authorities, law enforcement agencies, regulators and third-party litigants. We may also provide relevant parts of your Personal Information to any potential acquirer of or investor in any part of the Group’s business for the purpose of that acquisition or

4.               DETAILS OF THE PERSONAL DATA OR INFORMATION WE COLLECT FROM YOU

In order to engage and / or interact with you, for the purposes described above, we will have to process certain types of your Personal Information, as described below:

• Your contact information, such as name, alias, address, identity number, passport number, security number, phone number, cell phone number, vehicle make and registration number, social media user identity, email address, and similar contact data, serial numbers of equipment, details regards the possession of dangerous weapons, and other contact

information including details of your previous employers, memberships or affiliations, including professional bodies and trade unions, and similar data, which are required for various legitimate interest, contractual and / or lawful reasons pertaining to your application for employment or actual employment within the Group.

• Career, Education, and Employment Related Information, such as job preferences or interests, work performance and history, salary history, nationality and immigration status, demographic data, professional licensure information and related compliance activities, accreditations and other accolades, education history (including schools attended, academic degrees or areas of study, academic performance, and rankings), and similar data, which are required for contractual or employment related matters or which are required to comply with laws and public

• Specific identifiers, known as Special Personal Information, which are required in order to protect legitimate interests, comply with legal obligations or public legal duties, or in order to accommodate you in our workplaces, such as your race, disability-related information (B- BBEE related), religion (correct and fair treatment related), sexual and medical history including any medical conditions (to comply with laws and related to correct and fair treatment issues), trade union matters (to comply with laws and related to correct and fair treatment issues), and financial, credit, deviant and criminal history, (to protect our legitimate interests and to perform risk assessments), as well as children’s details (benefits related) and biometrics such as finger prints, which are required in order to provide you with access to our facilities, give you access to our information technology infrastructure, for security monitoring purposes and in order to comply with health and safety requirements in the

• Demographic Information, such as country, preferred language, age and date of birth, marriage status, gender, physical characteristics, personal or household / familial financial status and metrics, and similar data, which are required for various legitimate interests, as well as contractual and / or lawful reasons pertaining to your actual employment with the

• Your Image, still pictures, video, voice, and other similar data, which are required in order to provide you with access to our facilities, give you access to our IT infrastructure, for security monitoring purposes as well for other lawful reasons pertaining to your employment with the Group.

• Public issued Identity Information, such as government-issued identification information, tax identifiers, social security numbers, other government-issued identifiers, and similar data, which are required to comply with laws and public duties as well for other lawful reasons pertaining to your employment with the

• Tax and Financial Information, banking details, and tax registration number and status, which are required to perform contractual matters and / to comply with tax laws and public duties.

• IT Information, including IT security-related information (including IT user names

and passwords, authentication methods, and roles), and similar data, which are required for various legitimate interests, contractual and / or lawful reasons pertaining to your actual employment with the Group.

• Health history and records, which is classified as Special Personal Information, such as medical status and history, examinations, blood type, medical aid history, disability-related information, biometrics, medicals, psychometrics and similar data, which are required for contractual or employment related matters or which are required to comply with laws and public

• Social Media and Online activities and presence, such as information placed or posted in social media and online profiles, online posts, and similar data, which are required for contractual or employment related matters or which are required to comply with laws and public

5.               SOURCES OF INFORMATION - HOW AND WHERE WE COLLECT YOUR PERSONAL INFORMATION FROM YOU

• Depending on your requirements, we will collect and obtain Personal Information about you either directly from you, from certain third parties or from other sources which are described below:

• Direct collection: You provide Personal Information to us when you:

• interact with us;
• enquire about, or apply for a position within our organization, including requesting or signing up for information;
• express an interest in working with us or apply for a job or position or bursary, learnership or sponsorship with us;
• take up a job or position with us;
• conclude a contract with us;
• communicate with us by phone, email, chat, in person, or otherwise;
• complete a questionnaire, or other information request

• Automatic collection: We collect Personal Information automatically from you when you:

• search for, visit, interact with, or use our websites, applications, mobile applications, or social media portals or platforms;
• access, use, or download content from us;
• open emails or click on links in emails or advertisements from us;
• Otherwise interact or communicate with

• Collection from third parties: We collect Personal Information about you from third parties, such as:

• recruitment or employment agencies, previous employees and colleagues;
• your previous employer;
• regulators, professional or industry organizations and certification / licensure agencies that provide or publish Personal Information related to you;
• third parties and affiliates who deal with or interact with us or you;
• service providers and business partners who work with us and that we may utilize to deliver services;
• SAP, Home Affairs, Credit bureaus and other similar agencies;
• Government agencies, regulators and others who release or publish public records;
• Other publicly or generally available sources, such as social media sites, public and online websites, open databases, and data in the public

6.               HOW WE SHARE YOUR INFORMATION

We share Personal Information for the purposes set out in this Processing Notice with the following categories of recipients:

• Our employees, the Group and our affiliates. We may share your Personal Information amongst our employees, affiliates and the companies within our Group for employment, HR, IR, business and operational

• Your Contacts and other We may share your Personal Information with others

with whom you have a relationship in order to fulfil or perform a contract or other legal obligation, including with third parties that arrange or provide you with goods or services and who we pay in connection with such access. We may also share your Personal Information with other employees in the Organization.

• Business Partners and Third Party Service Providers, as well as Operators. We may share your Personal Information with our third party service providers to perform tasks on our behalf and which are related to our relationship with you, including financial, benefits, health and medical, and wellness benefits etc and to assist us in offering, providing, delivering, analyzing, administering, improving, and personalizing such services or

• Third Party Content Providers. We may share your Personal Information with our third party content providers to perform tasks on our behalf and to assist us in providing, delivering, analyzing, administering, improving, and personalizing content related to our relationship with you, including financial, benefits, health and medical, and wellness benefits etc and may to this end pass certain requests from you to these

• Cyber Third Party Service Providers. We may share your Personal Information with our third party cyber service providers to perform tasks on our behalf and which are related to our relationship with you, including those who provide technical and/or customer support on our behalf, who provide application or software development and quality assurance, who provide tracking and reporting functions, research on user demographics, interests, and behavior, and other products or These third party service providers may also collect Personal Information about or from you in performing their services and/or functions. We may also pass certain requests from you to these third party service providers.

• We may share your Personal Information with advertisers, advertising exchanges, and marketing agencies that we engage for advertising services, to deliver advertising, and to assist us in advertising our brand and products and services.

• Users. We may aggregate information from public records, phone books, social networks, marketing surveys, business websites, and other sources made available to us to create listings and profiles that are placed into user listings and directories. Additionally, if you choose to include your Personal Information in any reviews, comments, or other posts that you create, then that Personal Information may be displayed other users as part of your posting.

• Regulators and law enforcement We may disclose your Personal Information to regulators and other bodies in order to comply with any applicable law or regulation, to comply with or respond to a legal process or law enforcement or governmental request.

• Other Disclosures. We may disclose your Personal Information to third parties if we reasonably believe that disclosure of such information is helpful or reasonably necessary to enforce our terms and conditions or other rights (including investigations of potential violations of our rights), to detect, prevent, or address fraud or security issues, or to protect against harm to the rights, property, or safety of the group, our employees, any users, or the public.

• In the Event of Merger, Sale, or Change of Control. We may transfer this Processing Notice and your Personal Information to a third party entity that acquires or is merged with us as part of a merger, acquisition, sale, or other change of control (such as the result of a bankruptcy proceeding).

7.               HOW WE SECURE YOUR INFORMATION

• The security of your Personal Information is important to Taking into account the nature, scope, context, and purposes of processing personal information, as well as the risks to individuals of varying likelihood and severity, we have implemented technical and organizational measures designed to protect the security of personal information. In this regard, we will conduct regular audits regarding the safety and the security of your Personal Information.

• Your Personal Information will be stored electronically which information, for operational reasons, will be accessible to persons employed or contracted by us on a need to know basis, save that where appropriate, some of your Personal Information may be retained in hard

• Once your Personal Information is no longer required due to the fact that the purpose for which the Personal Information was held has come to an end, such Personal Information will be retained in accordance with the applicable Group entity’s records retention schedule, which varies depending on the type of processing, the purpose for such processing, the business function, record classes, and record We calculate retention periods based upon and reserve the right to retain Personal Information for the periods that the Personal Information is needed to: (a) fulfil the purposes described in this Processing Notice, (b) meet the timelines determined or recommended by regulators, professional bodies, or associations, (c) comply with applicable laws, legal holds, and other legal obligations (including contractual obligations), and (d) comply with your requests.

• Please note that notwithstanding the contents of this clause, no method of electronic storage is 100% secure. Therefore, while we strive to use commercially acceptable measures designed to protect Personal Information, we cannot guarantee its absolute

8.               ACCESS BY OTHERS AND CROSS BORDER TRANSFER

• We may from time to time have to disclose your Personal Information to other parties, including our holding company or subsidiaries, trading partners, agents, auditors, organs of state, regulatory bodies and / or national governmental, provincial, or local government municipal officials, or overseas trading parties or agents, but such disclosure will always be subject to an agreement which will be concluded as between ourselves and the party to whom we are disclosing your Personal Information to, which contractually obliges the recipient of your Personal Information to comply with strict confidentiality and data security

• Where Personal Information and related data is transferred to a country which is situated outside South Africa, your Personal Information will only be transferred to those countries which have similar data privacy laws in place or where the recipient of the Personal Information concludes an agreement which contractually obliges the recipient to comply with strict confidentiality and data security conditions and which in particular will be to a no lesser set of standards than those imposed by

• However, please note that no method of transmission over the Internet or method of electronic storage is 100% secure. Therefore, while we strive to use commercially acceptable measures designed to protect personal information, we cannot guarantee its absolute

9.               YOUR RIGHTS

You as a Data Subject have certain rights, and to check how we have processed your personal information, which can be done by following the process set out under our PAIA Manual which can be accessed in the link following: www.linexyamaha.co.za ; www.linexyamaharandburg.co.za; www.linexyamahalynnwood.co.za; www.worldofyamaha.co.za

10.            CHANGES TO THIS PROCESSING NOTICE

As our Group changes over time, this Processing Notice is expected to change as well. We reserve the right to amend the Processing Notice at any time, for any reason, and without notice to you other than the posting of the updated Processing Notice on the Website and in this regard encourage you to visit our Website frequently in order to keep abreast with any changes.

11.            CONTACT US

Any comments, questions or suggestions about this Processing Notice or our handling of your Personal Information should be emailed to [email protected]

Any comments/questions/complaints received may be re-directed onto the appointed Information Officer to which the matter may relate.

Alternatively, you can contact us at the following postal address or telephone number:

Group Deputy Information Officer:

Kim Hudson Piccione

Postal Address : Private Bag X15, Kelvin, 2054

Phone: +27 – 011 259 7700

Our telephone switchboard is open 9:00 am – 4:00pm GMT, Monday to Friday. Our switchboard team will take a message and ensure the appropriate person responds as soon as possible.

12.            PROCESSING PERSONAL INFORMATION OF ANOTHER

• If you process another’s Personal Information, you will keep such information confidential and will not, unless authorised to do so, process, publish, make accessible, or use in any other way such Personal Information unless in the course and scope of your duties, and only for the purpose for which the information has been received and related to the duties assigned to

• You will also observe The Bidvest Group Data Protection Policy which sets out the rules and regulations regarding the processing and protection of Personal Information and/or data to which you as employee has access in the course and scope of your duties; and you shall report any infringement relating to the manner in which Personal Information or other data is processed to the employer’s company’s appointed Information Officer without

13.            COMPLAINTS

• Should you wish to discuss a complaint, please feel free to contact us using the details provided above.

• All complaints will be treated in a confidential

• Should you feel unsatisfied with our handling of your Personal Information, or about any complaint that you have made to us, you are entitled to escalate your complaint to the South African, Information Regulator who can be contacted at < https://justice.gov.za/inforeg/>.

14.         ACCEPTANCE

• By providing us with the Personal Information which we require from you as listed under this Processing Notice:

• You acknowledge that you understand why your Personal Information needs to be processed;

• You accept the terms which will apply to such processing, including the terms applicable to the transfer of such Personal Information cross border;

• Where consent is required for any processing as reflected in this Processing Notice, you agree, by way of providing us with your Personal Information, that we may process this particular Personal

• Where you provide us with another person’s Personal Information for processing, you confirm and warrant that that you have obtained the required permission from such person(s) to provide us with their Personal Information for processing and indemnify and hold us harmless against any liability or loss which may be incurred by us or our employees as a result of any breach of such