Facebook-f Youtube Instagram

Data Processing Agreement

This Data Processing Agreement sets out the terms that will govern the Processing of Personal Information between Historical Homes of South Africa Limited and you (the “Counterparty”).

1. Recital
  1. The Parties hereby agree that in the case of any Contract or ongoing relationship between the Parties, and where the provisions of POPIA apply to the Processing of Personal Information in relation to the Services, these terms and conditions shall apply to and supplement the terms and conditions of such Contract.
  2. The purpose of this Agreement is to define the parameters of Processing Personal Information between the Parties and to regulate the permissible sharing of Personal Information in accordance with applicable laws.

  3. In the event of a conflict between the provisions of this Agreement and a Contract, the provisions of this Agreement will take precedence in regard to all aspects pertaining to any Processing of Personal Information by the Parties.

  1. ” Agreement” means this Data Protection Agreement and all annexures or schedules attached thereto.
  2. ” Affiliate” means with respect to a Party any person, partnership, joint venture, corporation or other form of enterprise, domestic or foreign, including but not limited to Subsidiaries and associates that directly or indirectly, Control, are Controlled by, or are under common Control with a Party. For purposes of this Agreement, the term “Subsidiaries” shall have the meaning ascribed thereto in the Companies Act, 2008.
  3. ” AI System” means any software, model or service (including machine-learning, large language model, generative AI, predictive analytics or similar technology) that ingests data in order to generate, transform or analyse content, patterns or predictions, whether hosted on-premises, in a private cloud environment or offered as a public, commercial or open-access service.
  4. ” AI Output” means any content, analysis, model weight, prompt, machine-learning artefacts, or other data generated, transformed or otherwise produced by an AI System using, derived from or informed by Confidential Information or Personal Information.

  5. ” Business Day” means any day from Monday to Friday and excludes any public holiday as gazetted in the Republic of South Africa.

  6. ” Confidential Information” means any information or data of any nature, tangible or intangible, oral or in writing and in any format or medium, which (i) by its nature or content is, or ought reasonably to be identifiable as, confidential and/or proprietary to the Disclosing Party or a third party associated to the Disclosing Party, or (ii) is provided or disclosed in confidence, and which the Disclosing Party or any person acting on behalf of the Disclosing Party may disclose to the Receiving Party, or (iii) may come to the knowledge of the Receiving Party by whatsoever means. Without limitation, Confidential Information shall include the following:
    • information relating to the Disclosing Party’s business activities, business relationships, products, services, processes, data, and Staff, including agreements to which the Disclosing Party is a party (including this Agreement);
    • information contained in or constituting or relating to the Disclosing Party’s technology and telecommunications systems including third party hardware and software, and associated material, and information or incidents concerning faults or defects therein;
    • the Disclosing Party’s technical, scientific, commercial, financial and market information, methodologies, formulae and trade secret;
    • the Disclosing Party’s architectural information, demonstrations, plans, designs, drawings, processes, process maps, functional and technical requirements and specifications and the data relating thereto;
    • intellectual property that is proprietary to the Disclosing Party or that is proprietary to a third party;
    • information relating to the Disclosing Party’s current and existing strategic objectives, strategy documents and plans for both its existing and future information technology, processing, business processing and business process outsourcing;
    • any AI Output and any content used as a prompt or input to an AI System, that is itself confidential information, or that is derived from or incorporates confidential information or Personal Information; and
    • personal Information.
  7. ” Contract” means any agreement and any annexures or schedules thereto, entered into between the Parties in respect of the provision of Services by one Party or both Parties to each other.
  8. ” Control” means the ability, by virtue of ownership, right of appointment, voting rights, management agreement, or agreement of any kind, to control or direct, directly or indirectly, the board or executive body or decision making process or management of such entity.
  9. ” Data Subject” means any person to whom the specific Personal Information relates, as contemplated in POPIA.
  10. ” Disclosing Party” means the Party that discloses Confidential Information to the Receiving Party in terms of this Agreement.
  11. ” Operator” has the meaning set out in section 1 of POPIA.
  12. ” Party” or ” Parties” means either the Historical Homes of South Africa Limited or the Counterparty or both, as the context may require.
  13. ” Personal Information” has the meaning set out in section 1 of POPIA, and includes special personal information as defined in section 26 of POPIA and relates only to Personal Information obtained by the Operator as a result of the Contract.
  14. ” POPIA” means the Protection of Personal Information Act, 2013.
  15. ” Processing” has the meaning set out in POPIA and includes any operation or activity or any set of operations, whether or not by automatic means, concerning Personal Information, including:
    • the collection, receipt, recording, organisation, collation, storage, updating or modification, retrieval, alteration, consultation or use;
    • dissemination by means of transmission, distribution or making available in any other form; or
    • merging, linking, as well as restriction, degradation, erasure or destruction of Personal Information.
  16. ” Receiving Party” means the Party receiving Confidential Information from the Disclosing Party in terms of this Agreement.
  17. ” Responsible Party” has the meaning set out in section 1 of POPIA.
  18. ” Security Compromise” means an incident where there has been, or there are reasonable grounds to believe that, Personal Information that is Processed pursuant to this Agreement has been accessed or acquired by an unauthorised person.
  19. ” Services” means any supply or rendering of services by the between the Parties in terms of a Contract and in terms of which a Party or both Parties inter alia Processes Personal Information of Data Subjects.
  20. ” Signature Date” means the date of signature of this Agreement by the last Party to do so in time.

  21. ” Staff” means any employee, independent contractor, agent, consultant, subcontractor or other representative of either Party.

  1. Words importing
    • any one gender includes the other gender;
    • the singular includes the plural, and vice versa; and
    • natural persons include created entities (corporate or unincorporated) and vice versa.
  2. Any reference to “days” shall be construed as being a reference to calendar days unless qualified by the word “business”. When any number of days is prescribed in this agreement, same shall be reckoned exclusively of the first and inclusively of the last day unless the last day falls on a Saturday, Sunday or public holiday in the Republic of South Africa, in which case the last day shall be the next succeeding day which is not a Saturday, Sunday or public holiday in the Republic of South Africa.
  3. The words “include”, “includes”, and “including” means “include without limitation”, “includes without limitation”, and “including without limitation”. The use of the word “including” followed by a specific example/s shall not be construed as limiting the meaning of the general wording preceding it.

  4. Any substantive provision, conferring rights or imposing obligations on a Party and appearing in any of the definitions in clause 2 or elsewhere within the Agreement, shall be given effect to as if it were a substantive provision within the body of the Agreement.

  5. Terms other than those defined in the Agreement and terms appearing in the lower case but which in the title case are defined in the Agreement, will be given their plain English meaning.
  6. Any Party shall, where relevant, be deemed to be references to, or to include, as appropriate, their respective successors or permitted assigns.
  7. References to statutory provisions shall be construed as references to those provisions as respectively amended, consolidated, extended or re-enacted from time to time and shall be construed as including references to the corresponding provisions of any earlier legislation directly or indirectly amended, consolidated, extended or replaced by those statutory provisions or re-enacted and shall include any orders, ordinance, regulations, instruments or other subordinate legislation made under the relevant statute.
  8. Expressions defined in the main body of this Agreement shall bear the same meanings in schedules to this Agreement which do not themselves contain their own conflicting definitions.
  9. If figures are referred to in numerals and in words in this Agreement and if there is any conflict between the two, the words shall prevail.

This Agreement shall commence on the Signature Date hereof and shall continue to be of force and effect for as long as the Parties remain in possession of any Confidential Information, including Personal Information of the Data Subjects as a result of a Contract, regardless of any expiration or termination of a Contract.

  1. The Parties agree that, depending on the circumstances, each Party may constitute an Operator and/or Responsible Party.
  2. Each Party shall comply at all times with the provisions of POPIA when performing its obligations under this Agreement and a Contract and shall not perform any of their respective obligations under this Agreement or a Contract in such a way as to cause the other Party to breach any of that other Party’s obligations under applicable laws.
  3. In respect of all Personal Information provided to the other Party and in respect of the use of that Personal Information under this Agreement and a Contract, each Party shall ensure that:
    1. all necessary Processing notices have been provided to Data Subjects, and where required, consents have been obtained from Data Subjects;
    2. all necessary steps have been taken to ensure that Personal Information has been collected and Processed in accordance with the principles set out in POPIA; and
    3. the Personal Information it shares with the other Party is accurate and up to date.
    4. The Parties shall co-operate and assist each other with consultations with or notifications to relevant regulatory authorities and/or Data Subjects that a Party considers are relevant pursuant to POPIA in relation to the Personal Information Processed in terms of the Contract.
    5. Each Party acknowledges that the other Party may disclose Personal Information to any regulator or law enforcement authority with jurisdiction which requests access to the Personal Information.
    6. The Parties shall at all times comply with applicable industry or professional rules and regulations, in relation to the safeguarding of Personal Information, which may apply to it and take steps to keep abreast and ensure that it and its Staff comply fully with all applicable laws and regulations that are applicable to the Agreement.
  1. Each Party undertakes to Process Personal Information in accordance with the technical and organisational security measures as set out in Schedule 1 or as agreed to by the Parties.
  2. Each Party shall secure the integrity and confidentiality of Personal Information provided by the other Party by taking appropriate, reasonable technical and organisational measures to prevent:
    1. loss of, damage to or unauthorised destruction of personal information;
    2. unlawful access to or processing of personal information; and
    3. must take reasonable measures to:
      1. identify all reasonably foreseeable internal and external risks to Personal Information in its possession or under its control;
      2. establish and maintain appropriate safeguards against the risks identified;
      3. regularly verify that the safeguards are effectively implemented; and
      4. ensure that the safeguards are continually updated in response to new risks or deficiencies in previously implemented safeguards.
  3. Within 5 (five) Business Days of a request from a Party, the other Party shall provide to the requesting Party a written explanation and full details of the technical and organisational measures taken by or on behalf of the other Party to demonstrate and ensure compliance with this clause 6.
  1. The Receiving Party shall notify the Disclosing Party in writing immediately and in any event, no later than 24 (twenty-four) hours if there has been a Security Compromise.
  2. The Receiving Party shall as soon as is reasonably possible investigate the Security Compromise and furnish the Disclosing Party with:
    1. a preliminary report within 24 (twenty four) hours from its initial notification to the Responsible Party in terms of clause 7.1 above setting out the details of the Data Subjects affected by the Security Compromise and the nature and extent of the Security Compromise, including details of the identity of the unauthorised person who may have accessed or acquired the Personal Information; and
    2. daily reports on progress made at resolving the compromise.
    3. The Receiving Party shall take reasonable steps to mitigate the effects and to minimise any damage resulting from a Security Compromise and assist the Disclosing Party in remediating or mitigating any potential damage from the breach to the extent that such remediation or mitigation is within the Receiving Party’s control as well as reasonable steps to prevent a recurrence of such a Security Compromise, including interviewing and the possible removal of Staff from the performance of Services for the Disclosing Party.
  1. Where a Party acts as an Operator, such Party acknowledges and agrees that the other Party (i.e. Responsible Party) retains all right, title and interest in and to the Personal Information and that the Personal Information shall constitute the Responsible Party’s Confidential Information.
  2. Unless required by law, the Operator shall Process the Personal Information only:
    1. in compliance with this Agreement and a Contract;
    2. for the purposes connected with the provision of the Services; or
    3. as specifically otherwise instructed or authorised by the Responsible Party in writing.

  3. If the Operator is ever unsure as to the parameters or lawfulness of the instructions issued by the Responsible Party, the Operator will, as soon as reasonably practicable, revert to the Responsible Party for the purpose of seeking clarification or further instructions.

  4. The Operator shall treat the Personal Information that comes to its knowledge or into its possession as confidential and shall not disclose it without the prior written consent of the Responsible Party, unless required to do so by law.
  5. Without limiting the Operator’s obligations under this Agreement, the Operator shall comply with the Responsible Party’s data privacy and protection policies, applicable industry or professional rules and regulations, in relation to the safeguarding of Personal Information, which may apply to it and take steps to keep abreast and ensure that it and its Staff comply fully with all applicable laws and regulations that are applicable to the Agreement.
  6. Access Requests
    1. The Operator shall provide the Responsible Party with full co-operation and assistance in relation to any requests for access to, correction of or complaints made by the Data Subjects relating to their Personal Information.
    2. The Operator shall notify the Responsible Party in writing:
      1. within 3 (three) Business Days of receipt thereof, of any request for access to or correction of the Personal Information or complaints received by the Operator relating to the Responsible Party’s obligations in terms of POPIA and provide the Responsible Party with full details of such request or complaint; and
      2. promptly of any legally binding request for disclosure of Personal Information or any other notice or communication that relates to the Processing of the Personal Information from any supervisory or governmental body.
  7. Audit Rights
    1. The Responsible Party or its agent shall have the right to audit the Operator at any time, with reasonable notice, if there is a reasonable suspicion that the Operator is not complying with the provisions of this Agreement or where there is a suspicion that the confidentiality, integrity and accessibility of Personal Information is likely to be compromised. Such audit rights shall include the right of access to systems, procedures and software, and inspection of the physical security of the Operator’s premises.
    2. The Operator shall offer reasonable assistance and co-operation to the Responsible Party and/or its auditors or inspectors in the carrying out of such auditing exercise.
    3. To the extent that the Operator engages an independent auditor in relation to the provisions of applicable data privacy and protection legislation to carry out an audit of its operations, the Operator agrees to provide the Responsible Party with copies of the audit reports of all such audit exercises.
    4. Nothing in this clause 8.7 should be read as providing the Responsible Party with unlimited access to audit the Operator without just cause.
  1. The Parties agree and undertake in favour of each other:
    1. to treat and safeguard the Confidential Information as strictly private, secret and confidential, and in the same manner, and with the same endeavour, of a reasonable person protecting his/her own Confidential Information and agrees to store and handle the Confidential Information in such a way as to prevent unauthorised disclosure;
    2. not to use or permit the use of the Confidential Information, whether directly or indirectly, to obtain a commercial, trading, investment, financial or other benefit or advantage over the Disclosing Party and/or its Affiliates, or otherwise use it to the detriment of the Disclosing Party and/or its Affiliates;
    3. except as permitted by this Agreement, not to utilise, employ, exploit or in any other manner use the Confidential Information for any purpose whatsoever other than in connection with this Agreement or a Contract or disclose or publish any Confidential Information in any manner, for any reason or purpose whatsoever, without the prior written permission of the Disclosing Party, and if the Confidential Information is proprietary to a third party, it shall also be incumbent upon such Party to obtain the prior written consent of such third party;
    4. not to copy, reproduce or publish the Confidential Information by any means without the prior written consent of the Disclosing Party, it being recorded that any copies shall be and remain the property of the Disclosing Party;
    5. not to decompile, disassemble or reverse engineer the whole or any part of the Confidential Information;
    6. to restrict the dissemination of the Confidential Information to only those of its Staff who are actively involved in the activities for which use of Confidential Information is authorised and then only on a “need to know” basis, and take all necessary steps, both before and after disclosure, to impress upon the Staff who are given access to Confidential Information the secret and confidential nature thereof. In this regard, the Receiving Party shall ensure that it procures written undertakings, on substantially the same terms and conditions contained in this Agreement, from its Staff who have access to the Confidential Information, in favour of the Disclosing Party in respect of the Confidential Information;
    7. to initiate, maintain and monitor internal security procedures reasonably acceptable to the Disclosing Party to prevent the unauthorised disclosure, theft, damage, or loss of the Confidential Information by the Recipient; and
    8. not to, and to procure that its Staff shall not, directly or indirectly provide or upload any Confidential Information (whether in whole, in part or in an anonymised, aggregated or transformed form) to a public AI System. The Receiving Party may only process Confidential Information using an approved AI System, provided that:
      1. the Receiving Party has carried out and documented a technical and legal due-diligence exercise confirming that an approved AI System:
        1. does not make Confidential Information or AI Output available to the AI System provider or any other third party for model training, fine-tuning or other purposes;
        2. maintains logical separation of the Receiving Party’s data from that of other customers; and
        3. allows the Receiving Party to comply fully with its obligations under this Agreement;
      2. the use of an approved AI System is strictly necessary for the purpose of performing the obligations under this Agreement or a Contract;
      3. any AI Output is treated as Confidential Information and used solely for the purposes related to this Agreement or a Contract; and
      4. prior to first use, the Receiving Party has provided the Disclosing Party with a written summary of the intended processing and obtained the Disclosing Party’s written consent (such consent not to be unreasonably withheld or delayed).
  2. The obligations of each Party with respect to each item of Confidential Information shall endure for an indefinite period from receipt of that item of Confidential Information. The obligations referred to in this clause 9 shall endure notwithstanding any termination of this Agreement, any other agreement entered into between the Parties or any discussions between the Parties.

Each Party shall:

  1. limit the Processing of and access to the Personal Information to those Staff who need to know the Personal Information to enable the other Parties to render or receive the Services;
  2. ensure that its Staff will not Process Personal Information: (i) except in accordance with the provisions of this Agreement; and (ii) procure that its Staff are contractually obligated to maintain the security and confidentiality of any Personal Information and this obligation continues even after their engagement ends; and
  3. take all reasonable steps to ensure the Staff Processing Personal Information receive adequate training on compliance with this Agreement and POPIA applicable to the Processing.
  1. A Party may not subcontract the performance of any of its obligations under this Agreement without the other Party’s prior written consent having been obtained. All references to a Party’s Staff shall be deemed to include the employees of any subcontractor of such Party.
  2. In the event that a Party agrees to the subcontracting of certain or all of the other Party’s obligations, the other Party must only do so by way of a written contract with the subcontractor which contract must impose the same obligations on the subcontractor as are imposed on the such Party in terms of this Agreement insofar as: (i) the Processing of Personal Information; and (ii) the use and access to Confidential Information, by the subcontractor is concerned.
  1. It is hereby recorded and agreed that in order for a Party to be able to fulfil its obligations in terms of the Contract, it may be necessary for such Party to transfer Personal Information to a third party outside of South Africa.
  2. In the event of such cross-border transfer, the transferring Party hereby warrants and undertakes in favour of the other Party that:
    1. it shall procure the third party’s compliance with all the obligations of this Agreement insofar as the Processing of Personal Information by the third party is concerned;
    2. it shall at all times be responsible to the other Party for fulfilment of all the transferring Party’s obligations under the Contract and remain the other Party’s sole point of contact regarding the Services, including with respect to payment;
    3. the third party is prevented from further transferring Personal Information to other third parties;
    4. it shall ensure that the third party has implemented the appropriate technical and organisational security measures in the relevant jurisdiction in which the Personal Information is being transferred, as contained in Schedule 1; and
    5. it has implemented and taken technical and organisational security measures to safeguard the security of the Personal Information in-transit.
  3. The transferring Party hereby agrees that the other Party shall solely hold it responsible for the fulfilment of all obligations under this Agreement and it hereby indemnifies and holds the other Party harmless from any and all losses arising from any claim or action brought against the other Party by any party, including by any regulator, arising from or due to the transferring Party’s or the offshore third party’s breach of the obligations contained in this Agreement in relation to the lawful Processing of Personal Information in South Africa or anywhere else in the world.

Unless otherwise agreed to the contrary, the Parties hereby agree that any Historical Homes of South Africa Limited Affiliate shall be entitled to rely on all the provisions of this Agreement, which provisions are binding between the Historical Homes of South Africa Limited Affiliate and the Counterparty, in respect of any contract that might be entered into between the Counterparty and the Historical Homes of South Africa Limited Affiliate in terms of which the Counterparty will be Processing Personal Information on behalf of the Historical Homes of South Africa Limited Affiliate. For the avoidance of doubt, this Agreement is applicable and binding in respect of all contracts concluded between the Counterparty and Historical Homes of South Africa Limited or the Historical Homes of South Africa Limited Affiliate where the Counterparty Processes Personal Information on behalf of Historical Homes of South Africa Limited or the Historical Homes of South Africa Limited Affiliate.

To the extent required by the Disclosing Party, the Receiving Party shall Process the Personal Information in relation to the Services separately from Personal Information, data and property relating to the Receiving Party or any third party, and may not be combined or merged with information of another party unless otherwise agreed to in writing by the Disclosing Party.

  1. The Disclosing Party may, at any time on written request to the Receiving Party, require that the Receiving Party immediately return to it any Confidential Information and may, in addition, require that the Receiving Party furnish a written statement to the effect that upon such return, it has not retained in its possession or under its control, whether directly or indirectly, any such Confidential Information or material.

  2. Alternatively, the Receiving Party shall, as and when required by the Disclosing Party on written request, destroy all such Confidential Information, including Personal Information, and material and furnish the Disclosing Party with a certificate of destruction to the effect that the same has been destroyed, unless the law prohibits such from doing so. In that case, the Receiving Party agrees that it will maintain the confidentiality of the Personal Information and will not actively Process the Personal Information any further.

  3. The Receiving Party shall comply with any request in terms of this clause 15 within 7 (seven) days of receipt of such request.
  1. Each Party hereby indemnifies the other Party in respect of all losses, claims, damages, costs, expenses, fines and penalties arising from and in connection with such Party’s (including its Staff) actions and/or omissions relating to this Agreement.
  2. Any financial caps or limitation of liability set out in the Contract shall not apply to this indemnity.
  1. In the event of either of the Parties committing a breach of any of the conditions of this Agreement and failing to remedy such breach within 7 (seven) Business Days of receipt of a notice from the other Party requesting it to remedy such breach, then the other Party shall be entitled to cancel this entire Agreement forthwith and claim such losses as it may have suffered. In the event of termination of this Agreement, the Party terminating this Agreement shall have a right to also exercise its rights of termination under the Contract.
  2. Notwithstanding anything to the contrary contained in this Agreement, the Parties shall be entitled to terminate this Agreement by mutual agreement in writing.
  3. The provisions of this clause 17 shall not affect or prejudice any other rights/remedies which the Parties may have in law or in any other Contract between the Parties.
  1. The termination of this Agreement shall not affect the rights of either of the Parties that accrued before termination of this Agreement or which specifically survives the termination of the Agreement.
  2. Upon termination of this Agreement or upon request by the Disclosing Party, the Receiving Party shall return or destroy any material containing, pertaining or relating to the Personal Information disclosed pursuant to this Agreement to the Disclosing Party in terms of clause 15 unless the law prohibits the Receiving Party from doing so. In that case, the Receiving Party agrees that it will maintain the confidentiality of the Personal Information and will not, under any circumstance, Process the Personal Information any further.
  1. Failure or delay by either Party in exercising any right will not constitute a waiver of that right.

  2. No waiver of any of right under this Agreement will be binding unless it is in writing and signed by the Party waiving the right.

If any part of this Agreement is found to be invalid or unenforceable, it shall be severed from the remainder of this Agreement, which shall remain valid and enforceable.

Neither Party may cede its rights or delegate its obligations in terms of this Agreement, without the prior written consent of the other Party, which consent shall not be unreasonably withheld.

  1. This Agreement and any dispute or claim arising out of or in connection with it or its subject matter or formation (including non-contractual disputes or claims) shall be governed by and construed exclusively in accordance with South African law.
  2. The Parties consent and submit to the jurisdiction of the High Court of South Africa, Western Cape Local Division, Cape Town in any dispute arising from or in connection with this Agreement. Without prejudice to any other rights or remedies which the Parties may have, the Parties acknowledge that nothing herein shall preclude the other Party from seeking urgent relief or specific performance from a court of competent jurisdiction.
  1. This Agreement and any dispute or claim arising out of or in connection with it or its subject matter or formation (including non-contractual disputes or claims) shall be governed by and construed exclusively in accordance with South African law.
  2. The Parties consent and submit to the jurisdiction of the High Court of South Africa, Western Cape Local Division, Cape Town in any dispute arising from or in connection with this Agreement. Without prejudice to any other rights or remedies which the Parties may have, the Parties acknowledge that nothing herein shall preclude the other Party from seeking urgent relief or specific performance from a court of competent jurisdiction.

This Agreement constitutes the whole of the agreement between the Parties hereto relating to the subject matter hereof and the Parties shall not be bound by any terms, conditions or representations whether written, oral or by conduct and whether express or tacit not recorded herein.

People, Awareness and Training

  • Employees with access to the Personal Information to sign an NDA.
  • Regular awareness training on POPIA for all employees with access to the Personal Information.

Organisation Control

  • Internal data privacy policies and procedures which comply with requirements of POPIA.
  • Data privacy is implemented and audited on compliance on an annual basis.

Physical Security to Personal Information

  • Access control and visitor management systems implemented for all visitors/guests.
  • CCTV surveillance to protect restricted area.
  • Locked cabinets for where paper files are stored.

Security to Personal Information Required

  • Encryption: Encryption is required.
  • Anti-virus protection: It is required that all service providers working with and storing Historical Homes of South Africa Limited data have a reputable and suitable Anti-Virus product installed.
  • E-mails are automatically scanned by anti-virus and anti-spam software.
  • Windows and software patching: It is critically important that all operating systems and software running on the devices are updated and patched as often as possible.
  • Password management: Use a strong, secure password when accessing any Historical Homes of South Africa Limited systems.
  • Sharing of sensitive information: When sharing Historical Homes of South Africa Limited sensitive information, it is required that secure communication mechanisms are used.

Access Control to Personal Information

  • Employees are given access on a need to know basis.
  • Access logging and control to Personal Information.

Subcontractors

  • As agreed in writing between the parties.