MAZDA SA INFORMATION PROCESSING POLICY

Mazda Southern Africa Data Protection Policy — Effective date: 30‑Jun‑2021

WHO WE ARE

When we refer to “we”, “us”, “our” or “MAZDA SA”, herein we are referring to Mazda Southern Africa (Pty) Ltd (Registration Number 2013/113879/07) and its affiliated companies, or any of them, as the context requires, as well as our successors in title.

Our principal place of business is at 90 Bekker Road, Building J, Unit FL02, Hertford Office Park, Vorna Valley, Midrand, 2196. Please contact us by telephone at +27 (0) 861 370 134 or by email at customercare@mazda.co.za.

The Protection of Personal Information Act, 2013 (Act. 4 of 2013) regulates the manner in which personal information may be processed. We process personal information in accordance with the stipulations of the Act. Which data is processed and how it is used depends largely on the services requested or agreed in each case.

“Personal information” refers to information relating to an identifiable, living, natural person, and where applicable, an identifiable, existing juristic person. It includes any information that lets Mazda identify you as a unique individual (for example: name, physical address, contact details, passport/identity number), and information that uniquely identifies a legal entity (for example: trading name combined with company registration number).

Personal information may be provided to, or collected by, Mazda in writing (including application forms), electronically, telephonically, via social media or online at www.mazda.co.za.

ACCOUNTABILITY

MAZDA SA is committed to protecting your privacy. This policy governs our processing of your personal information and sets out:

How we collect your personal information
What types of personal information we collect and retain
The purposes for which we use such personal information
Your rights to the personal information held by us

Information Officer responsibilities

The Information Officer has the following responsibilities (including but not limited to):

Developing, publishing and maintaining a POPI policy that addresses relevant provisions of the Act
Reviewing the Act and periodic updates
Ensuring POPI induction training and periodic awareness communications for staff
Developing and publishing Privacy Notices for internal and external purposes
Handling data subject access requests and approving unusual disclosures
Approving contracts with Data Operators and ensuring information quality and security safeguards
Managing relations with the Regulator and directing any Deputy Information Officer
Annually consider re-appointment or replacement of the Information Officer and appointment of Deputies if needed

HOW WE COLLECT INFORMATION

We collect information about you directly from you and also from third parties and publicly accessible sources. Collection methods include:

When you use our website, enquire about products, subscribe to services or newsletters, or enter into agreements with us
From public registers, credit bureaus, money-laundering, fraud prevention and law-enforcement agencies
From our business partners and service providers (e.g. debt collection, communications, data hosting and processing)
From persons or entities legally entitled to provide us information about you, or with your consent

We may collect data at point of purchase for safety-critical recalls and to comply with the Consumer Protection Act.

COOKIES

When you visit our website we may collect certain information about usage preferences and history via cookies. Cookies are stored on your computer by your browser to assist and improve your use of our site. Most browsers accept cookies automatically but you can change your browser settings to prevent automatic acceptance. If you disable cookies, you may not be able to use all features of our website. Please consult the MAZDA SA Manage Cookie Policy for details.

We also store web server logs showing your IP address, pages viewed, request success/failure and browser used. This data is used only for statistical and personalisation purposes to help us understand site usage and performance.

INFORMATION WE HOLD ABOUT YOU

We may record and hold the following types of information:

Communications between you and us (including IP addresses, emails, social-media messages, telephone numbers and the content of the communications)
Information submitted via forms, requests or orders
Details you provide when subscribing to or using our services (name, contact details, location, identity number, place of residence)
Information received from public registers, credit bureaus and enforcement agencies
Your service preferences and enquiries
Details relating to vehicles/products purchased from MSA or MSA Dealers (purchase date, dealer, financing details). If finance is via Mazda Finance we may record repayment period and monthly instalments and relevant finance application information. If finance is through another financier we may record the financier identity and financing period.

RECORD RETENTION

We will hold your personal information for a period which exceeds the maximum period permitted by applicable law and will destroy or delete it as soon as the responsible party is no longer authorised to retain the record. We are subject to various retention obligations from legislation and may retain records longer where required.

We may use personal information for statistical, historical or research purposes after the retention period (in de‑identified form). After that period we will destroy or de‑identify the information as soon as reasonably possible.

Processing of your personal data may involve transferring your data to other countries (including but not limited to Japan and Europe) where data protection standards may differ from those in South Africa.

THE PURPOSES FOR WHICH WE USE YOUR PERSONAL INFORMATION

We process mandatory information where necessary to enable you to participate in our services and to execute orders. This particularly includes providing manufacturer warranty and service plans, optional extended warranty, recall campaigns (Consumer Protection Act no. 68 of 2008), roadside assistance, maintenance of digital service records, and goodwill processes.

Mandatory information includes:

Your name, contact details, identity number and place of residence
Your preferences regarding our products, offers and services
Geographic location information when you submit data related to products or services
Information received from public registers, credit bureaus and enforcement agencies
Information provided by you and third parties that we need to verify accuracy and completeness

FURTHER PROCESSING LIMITATION

Information we hold that we do not need for core services (but for which you have given consent) will only be used for the agreed purposes, including:

Advertising or market opinion research (unless you object)
Updates on products and services
Historical, statistical or research purposes (not published in identifiable form)
Benchmarking and customer satisfaction surveys
Responding to enquiries and providing requested services (including via our call centre)
Product and service development and system/process improvement
Monitoring or recording telephone conversations for quality control and training

SHARING YOUR INFORMATION

Keeping your personal and financial information secure is one of our most important responsibilities. We will not disclose your information unless legally permitted. We do not sell client lists or provide your information to third parties for marketing, except where you have consented or where lawful disclosure is required.

You agree that we may transfer your information to:

Persons in our employ or our affiliated companies (directors, employees, contractors, auditors, legal advisors)
Governmental, judicial, regulatory and law-enforcement bodies (including SARS and the National Credit Regulator)
Persons employed to provide services on our behalf (delivery, debt collection, data hosting, processing)
Any person to whom we assign or transfer our rights or obligations under agreements with you
Your legal guardian, executor of estate or curator
Other persons permitted by law or where you have consented

INFORMATION QUALITY

We will take reasonable steps to ensure your information is complete, accurate and not misleading. You have the right to ask us to update, correct or delete your personal information. We will require proof of identity (ID document and NATIS vehicle document) before making changes.

SECURITY

We implement reasonable technical and organisational measures to protect your information against unauthorised or accidental access, processing, damage or loss. Where we use third-party processors we require similar safeguards from them. If we believe unauthorised access to your information has occurred and we are not prevented by law-enforcement or regulatory agencies, we will notify you and the regulator without undue delay and provide information to help you take protective measures.

YOUR RIGHTS REGARDING YOUR INFORMATION

Provided you give suitable proof of identity, you have the right to:

Know which records we hold about you
Withdraw consent where processing relied on it (this will not affect lawfulness of prior processing)
Object to further collection, use, sharing or processing where not required by agreement or law
Require correction, erasure or cessation of processing for information that is inaccurate, excessive, out of date, incomplete, misleading or unlawfully obtained

Requests may be submitted by contacting us at customercare@mazda.co.za. We will notify you of steps taken. We may refuse requests where prohibited by law, where compliance would prejudice legitimate interests, or where we have a legal basis to deny the request. We may require a reasonable period to comply.

If your complaint is not resolved satisfactorily you may lodge a complaint with the regulator via https://www.justice.gov.za/inforeg.

RIGHT TO AMEND THIS DATA PROTECTION STATEMENT

Mazda Southern Africa reserves the right to change this statement at any time. All changes will be posted on the MSA website. Unless otherwise stated, the current version supersedes and replaces previous versions.