SPAR Zimbabwe

Data Protection Policy

Welcome and thank you for using the SPAR Rewards 2.0 App. This mobile application site is owned and operated by SPAR Zimbabwe of 216 The Chase, Mount Pleasant, Harare, Zimbabwe. This mobile application is hosted and managed in the Netherlands for the exclusive purpose of providing users with convenient access to promotional, financial and other information relating to SPAR and products stocked or sold by SPAR Zimbabwe (the "Products")

The Company is committed to business practices in compliance with all relevant legislation.

Rewards 2.0 Terms & Conditions (SPAR Zimbabwe)

These online shopping terms and conditions apply to all purchases made with the Rewards 2.0 online or mobile application. Please read them carefully and print a copy for future reference. You are required to register with us before benefitting from any Rewards 2.0 offers. Please click on Register to complete the registration form.

Registration and/or use of our Rewards 2.0 membership constitute your acceptance and agreement to be bound by the Terms & Conditions.

Please read these terms carefully. Your use of our electronic voucher services (including via any of our websites) will be subject to the current version of these terms published on our website at www.spar.co.zw at the time of your use. If you do not accept these terms, you may not use our electronic voucher services and we may refuse to redeem electronic vouchers issued to you.

1.           Introduction

SPAR Zimbabwe respects the right to privacy and confidentiality and is committed to maintaining the privacy and security of its employees, customers, retailers, suppliers, agents, consultants and contractors, ("stakeholders") information.

2.           Purpose

This policy sets out SPAR Zimbabwe's commitment, principles and practices to protecting the privacy and confidentiality of stakeholders' data.

3.           Scope

This policy applies to the processing of personal information by all employees, employed by the Company, all business units of the Company and all stakeholders who interact with the Company and is fully binding on all stakeholders.

Employees, business units and stakeholders are expected to be familiar with, and to comply with this policy. Failure to do so by employees may result in disciplinary action.

The Company will ensure that all contracts with third parties will comply with the principles set out in this policy.

4.           Consent

The supply of information to the Company by any of its stakeholders is at the stakeholders' discretion. By supplying SPAR Zimbabwe with any information, stakeholders are accepting the principles, practices and terms contained in this policy.

SPAR Zimbabwe will not process stakeholders' information without obtaining stakeholders' consent.

In respect of all marketing activities relating to the Company's services and/or products, consent to collect or use information will be obtained. Consumers will be given an option to opt-in or opt-out of any electronic communication.

In respect of other activities, consent to collect or use will be obtained via acknowledgement by the stakeholder concerned that the Company is collecting his or her personal information. This acknowledgment will be contained in all documents where personal information is collected, including any contracts concluded with the Company or the stakeholder will be specifically requested to sign an acknowledgment of the collection of personal information.

If information is collected through a third party, the third party will be requested to sign a declaration that they comply with the SPAR Zimbabwe data protection requirements.

It is to be noted that SPAR Zimbabwe:

•            has different business units, that process and share stakeholder information internally and will share information relating to that stakeholder internally in instances where required; and

•            Is obliged to disclose certain categories of information relating to regulatory and legal purposes.

5.           Collecting Information

The type of information collected varies. Information includes any personal information, but is not limited to details such as name, age, ID numbers, registration numbers, addresses and other contact details.

Stakeholders* information in general refers to information submitted to SPAR

Zimbabwe through:

• recruitment;
• its website that identifies or relates to an online visitor or customer, whether they are an individual or a business;
• its customer care line;
• competitions;
• marketing activities, such as SPAR Rewards 2.0. It is to be noted that for purposes of marketing campaigns, that further processing of personal information will be compatible with the original purpose of collection;
• security measures, such as image recording from video surveillance systems (if any) placed on premises belonging to the Company, including access control devices;
• agreements and/or contracts concluded with the Company; third party sources, where allowed to do so in law; emails;
• social media; registers; and other communications sources.

6            Uses of Information

SPAR Zimbabwe uses information to identify its stakeholders. Stakeholders' information is necessary to enable SPAR to:

•            make contact, if and when required, to promote its services and/or products or in relation to a customer care query;

•            perform its duties in pursuance of any contract;

•            comply with any regulatory or other business obligation;

•            Carry out market research, business and statistical analysis;

•            carry out any other reasonable business operations; and

•            employment of personnel.

Information may also be used for other purposes for which permission is given, or if required to do so by law, or if it is of public interest to disclose such information.

SPAR undertakes to only process information that is required and relevant for the purposes set out above.

The Company will not intentionally collect information about children and will only process information about children with the consent of a parent or guardian, or if otherwise required to do so by law.

The Company does not intend to process any 'special' personal information, which includes for example political, religious or health-related information, and will only process special personal information with the stakeholders' consent, or if otherwise allowed to do so in law.

Stakeholders may on reasonable grounds object to the processing of information, after which SPAR Zimbabwe undertakes not to continue to process, except when required to do so by law.

Information will be retained as long as necessary for the purpose it was collected and in line with the Company's Record Retention Policy (drafted in line with regulations governing the duration information should be kept).

7.           Sharing of Information

SPAR Zimbabwe will only share information with third parties with a stakeholder's consent or if otherwise required to do so by law.

SPAR Zimbabwe has trusted relationships with selected third parties who perform services on its behalf. All service providers are bound by contract to maintain the security of SPAR Zimbabwe's stakeholders' information and to use it only as permitted by SPAR Zimbabwe.

8.           Safeguarding of Information

SPAR Zimbabwe understands the value of information and will take all reasonable steps to protect the information from loss, misuse, or unauthorised access.

SPAR Zimbabwe's responsibility is to:

• protect and manage information that it holds about its stakeholders;
• make use of electronic and computer safeguards, such as firewalls and data encryption, to secure stakeholders' information;
• have physical and electronic access control to its premises; and
• only authorise access to information to those employees who require it to fulfil their designated responsibilities.

SPAR Zimbabwe is committed to using appropriate technical and other security measures in line with acceptable industry standards to safeguard stakeholders' information.

Stakeholders can also help maintain the security of information by implementing their own security measures and procedures.

9.           Access to Information

Stakeholders have the right to access information, including certain personal information held by SPAR. Requests for information must be made to the Business Intelligence Department:

Mr Rocco Malahias

30 Domboshava Road, Borrowdale, Harare

Email: rocco.malahias@spar.co.zw

Tel: +263 8677009108

A stakeholder, having provided adequate proof of identity, has the right to -

• request a responsible party to confirm whether or not SPAR Zimbabwe holds personal information about the stakeholder; and
• request from SPAR Zimbabwe the record or a description of the personal information about the stakeholder held by SPAR Zimbabwe, including information about the identity of all third parties, or categories of third parties, who have, or have had, access to the information.

A stakeholder may, in the prescribed manner, request SPAR Zimbabwe to -

• correct or delete personal information about the stakeholder in its possession or under its control that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading, or obtained unlawfully; or
• destroy or delete a record of personal information about the stakeholder that
• SPAR Zimbabwe is no longer authorised to retain.

10.        Administration of this Policy

The custodian of this policy is the Group Business Intelligence Department who will be responsible for the administration, revision, interpretation and application of this policy, which will be reviewed triennially or as and when required.

Any alteration of this policy is subject to approval by the Board/Risk Committee.

11.        Data Deletion

All data collected by using the platform can be deleted upon request, or by deleting your account via the SPAR Rewards app. All personal data is removed from all transactions. Once your account has been deleted, it is not possible to retrieve it. A new account will need to be created if you wish to receive the benefits of the SPAR Rewards Loyalty Program.