Protecting your privacy is as important to us as it is to you. For us, it is more than just making sure we comply with the relevant legislation; you trust us with your personal information, and we respect that trust. This Privacy Statement explains why and how we collect, use, and store your personal information. The processing of personal information must be transparent and secure, in conformity with the privacy legislation of the countries in which Shoprite Group operates including the Protection of Personal Information Act 4 of 2013 (POPIA).

This Privacy Statement contains the information required by POPIA and other relevant data privacy legislation. For purposes of this Privacy Statement, the term "data privacy legislation" means all law relating to data protection and privacy or of similar purposes or effect as amended, updated, re-enacted, or replaced from time to time including, but not limited to, POPIA. Furthermore, any term which refers to a POPIA concept or process (for example, personal information, data subject, operator, or responsible party) shall be deemed to include a reference to the equivalent concept or process in any other jurisdiction in which this Privacy Statement may apply.

1. What is this notice about?

We want you to understand who you are sharing your information with, what kind of information we collect and how we use the information. In your day-to-day dealings with the Shoprite Group of Companies we obtain information about you. We want you to know exactly what that information is and what we do with it. This Privacy Statement describes how we collect, use, process, and disclose your personal information, in conjunction with your access to and use of Shoprite Group’s web and app platforms.

POPIA protects you. The Protection of Personal Information Act (POPIA) is aimed at protecting your personal information and prescribes what we must and must not do with it. POPIA created an Information Regulator who checks that companies like Shoprite manage personal information in a responsible manner that respects your privacy.

Other legislation applies to your personal information. As Shoprite conducts its business activities in various countries throughout Africa, the data privacy legislation applicable in these countries also applies to our processing of your personal information. In certain respects, the data privacy legislation applicable in these countries may differ or provide for more extensive protections than POPIA. To this end, please refer to Annexure A for specific data privacy exemptions not mentioned in this Privacy Statement. Furthermore, other legislation also applies to your personal information. For instance, if you are applying for a Shoprite Money Transfer account, the Financial Intelligence Centre Act 38 of 2001 (FICA) must be complied with, or if you buy a SIM card, the Regulation of Interception of Communications and Provision of Communication-Related Information Act 70 of 2002 (RICA) must be complied with. This means that from time to time we will be obligated to process your personal information in a certain way (or keep it for a certain period).

This Privacy Statement is part of our agreement with you. This Privacy Statement forms part of our agreement with you as a natural person or as a business. You should read it along with the terms and conditions that apply. These terms and conditions can be accessed on the specific Shoprite Group websites or products, and www.shopriteholdings.co.za.

This notice may change from time to time. From time to time, we may have to amend this notice to accommodate changes in our business or services or if legal requirements change. It is your responsibility to check that you have read the latest version.

2. Who you are sharing your information with

Your personal information is shared within the Shoprite group of companies. Shoprite is a group of companies or brands. For this document we will refer to the Shoprite Group. Our principal place of business is at Cnr William Dabbs Street & Old Paarl Roads, Brackenfell, 7561 but we recommend you contact our Compliance Officer at privacy@shoprite.co.za.

We may also create an audience list based on your shopping behaviour and share your information with external entities for the purpose of direct marketing the external entities’ products and services.

3. When this Privacy Statement applies

This Privacy Statement applies:

• When you use any of our products or services;
• When you apply to us for a job or work placement;
• When you supply services to us where this involves any personal information;
• As a result of your relationship with our clients; and/or
• To any information collected from or shared with third parties.

This Privacy Statement also applies to our websites, apps and online services as well as any publications or newsletters that you request.

4. What information we collect

‘Personal information’ is any information that can be used to identify you or that we can link to you as a natural person or juristic person. Where you use our services, we will collect personal information directly from you. The information you provide may include current and historical personal information including your name, contact details, title, identification, employment, positions held and enquiry/complaint details and information about the organisation with which you are affiliated, employee/personnel personal information and financial information (account number, payments and history) and company name and registration number.

We may also collect personal information from third parties such as your employing organisation, regulatory authorities, recruitment agencies, credit reporting agencies, publicly available records, and the third parties described in this Privacy Statement.

Information that you voluntarily provide to us

We collect information that you voluntarily provide to us including when you communicate with us via forms, email or other channels; when you sign up for newsletters, alerts, or other materials; and when you respond to our communications or requests for information.

Information from other sources

We may collect information from other sources, such as social media platforms, operators, and third-party service providers (e.g., Peach Payments, Yonder).

Information collected during your use of online services

• Your name and address
• Your delivery address (if different)
• Cookies
• Your contact telephone number
• Credit/debit card information
• Competition or live chat content
• Password and credential information

If you apply for a job with us
We may request personal information relating to education, employment, racial background, state of health, and conduct screening checks.

We collect information when you contact our call centres
Calls may be recorded for quality control. Do not provide bank details or passwords to agents.

We collect information while you use our websites
Server logs record your IP address, browser type, page requests, and interaction data.

We use cookies
Cookies optimise your experience but can be disabled (with possible reduced functionality).

Our stores and facilities may be monitored by CCTV cameras

We do not collect information of persons under 18 without parental consent

5. Why we need your personal information

We use your personal information to provide our products and services to you, including processing payments, delivering orders, responding to queries, creating audience lists, or complying with legal obligations.

• Processing your payment card details in order to complete any purchase;
• Processing your orders and transactions for goods and services;
• Delivering products that you order online;
• Responding to your queries and comments;
• Sending you service-related and transactional communications such as registration confirmations, verification emails, notifications, security alerts, and updates to our terms or policies;
• Creating an audience list based on your shopping behaviour;
• When we have a legal duty to use or disclose your information.

If you apply for credit
Your information is used to assess your creditworthiness, verify your identity, and process credit applications.

We use your personal information to learn more about products and services that interest you

• Market research
• Creating audience lists
• Providing offers related to your interests

6. Sharing your information

Your privacy is important to us, and we undertake not to use or share your personal information unless for business purposes.

• Shared within the Shoprite Group
• Shared with trusted service providers who help us provide our services to you and who are required to keep your information secure
• Shared with third-party service providers who send emails on our behalf, such as transactional and verification emails (including Mailgun, a Sinch company)
• Shared with advertisers/businesses for campaigns
• Shared with banking institutions and payment card issuers
• Shared with external entities for audience list–based marketing
• Shared with governmental, judicial, regulatory and law enforcement bodies when legally required

We make use of trusted third-party email delivery partners to send certain types of communications (including verification emails, notifications, and service updates). These providers process your email address and limited technical information on our behalf solely for delivery and monitoring of such communications.

Cross-border transfers may occur but only where adequate protection is ensured, and only where the receiving party agrees to treat your information with the same level of protection required under applicable data privacy legislation.

7. Your rights and preferences

You have the right to:

• Ask what personal information we hold about you
• Ask what information was sent to third parties
• Ask us to update or correct your information
• Unsubscribe from direct marketing
• Submit a complaint to a supervisory authority
• Object to processing
• Request deletion (subject to legal constraints)
• Request processing restrictions

Some information is available online via your profile. Other corrections can be requested via privacy@shoprite.co.za.

8. Security

We implement reasonable safeguards including TLS encryption. You must also play a role by keeping your passwords and PINs secure.

Email communication is not encrypted. Do not send sensitive personal information via email.

If a data breach occurs that affects your personal information, we will notify you in accordance with applicable legislation.

Annexure A: Country Specific Data Privacy Rights

Ghana: Right to be informed of logic behind automated decisions.

Zambia: Right to data portability.