Privacy Notice

The Organiser's privacy policy for the purposes of the Exhibition Terms and Conditions 

1. WHO WE ARE 

    1.1 This Privacy Notice is given by Specialised Exhibitions (Pty) Ltd (registration number 1969/007402/07), trading as Montgomery Group Africa, of Auditorium Building, Gate 2, Expo Centre, corner Rand Show and Nasrec Roads, Nasrec, Johannesburg, 2013 (we, us, our). 

    1.2 We are a South African company. We organise and stage exhibitions and events in South Africa. When we process your personal information in connection with those events, we are the responsible party under the Protection of Personal Information Act 4 of 2013 (the Act). 

    1.3 We form part of the Montgomery group of companies, whose parent is based in the United Kingdom. The group publishes its own privacy policy covering processing by the United Kingdom group companies. This Notice covers our processing and prevails in respect of it. Where personal information is shared with the group, clause 9 applies. 

    1.4 Our Information Officer is Gary Corin, Managing Director. Our Deputy Information Officer is Charlene Hefer, our Portfolio Director. Their contact details are in clause 17. 

2. WHAT THIS NOTICE COVERS 

2.1 This Notice explains what personal information we collect, why we collect it, what we do with it, who we share it with, how long we keep it, and what rights you have. 

2.2 It applies to exhibitors and their representatives, contractors and their workers, suppliers, visitors and registered attendees, and anyone else whose personal information we process in connection with our events. 

2.3 This is the only privacy notice we give. It is written to serve everyone whose personal information we process, including a worker deployed to our premises by a contractor. There is no shorter or separate notice, and nothing in this Notice is summarised or replaced elsewhere. 

2.4 This Notice is published on our website and in the exhibitor zone. If you are a worker deployed to our premises by a contractor, that contractor is required to give you this Notice before you are deployed or accredited, whichever comes first. This Notice is the worker privacy notice referred to in our Immigration and Right-to-Work Compliance Policy, and a contractor gives that notice by giving you this one. 

2.5 A contractor who gives you this Notice does so on our behalf. That does not make the contractor responsible for our processing, and it does not transfer to the contractor our own duty to tell you about it. 

3. THE PERSONAL INFORMATION WE COLLECT 

3.1 Depending on your relationship with us, we may collect: 

3.1.1 identity information, being your name and surname, your job title or trade, and, where a credential is issued to you, your identity number or passport number; 

3.1.2 contact information, being your work electronic mail address, telephone number and postal address; 

3.1.3 company information, where you represent a business, being the company name, registration number, value-added tax number, addresses and contact details; 

3.1.4 payment information, where we pay you or you pay us, being banking details and transaction records; 

3.1.5 event information, being your registration details, the stands or sessions you attend, and your access records; 

3.1.6 images, being photographs and video captured at our events, and footage from security systems on the premises; 

3.1.7 where you are a worker deployed to our premises by a contractor, the name of the contractor that deploys you, the work you will perform, and the dates and location at which you will be on site; and 

3.1.8 right-to-work information, where you are a foreign national working on our premises and we call for it under clause 4.4, being your visa or work permit type, number and expiry date, and the entity that employs you. 

3.2 We do not collect biometric information at our events. 

3.3 We do not ask for, and do not want, information that we do not need. In particular, if you are a worker on our premises we do not collect your home address, your banking details, your medical information, or your country of birth. 

4. WHERE WE GET IT FROM 

4.1 We collect most personal information directly from you, when you register, apply for space, contract with us or attend one of our events. Some of that information is collected through platforms operated for us by service providers, as described in clause 8. 

4.2 If you are a worker deployed to our premises by a contractor, we collect the information listed in clauses 3.1.1 and 3.1.7, from you or from the contractor that deploys you, because we require it in order to accredit you and to control access to the premises. That includes your identity number or your passport number, which is recorded against the credential issued to you. 

4.3 The contractor that deploys you, and not us, is responsible for verifying your right to perform the work. It does so against your original documents rather than copies, and it makes and keeps the record of that verification. We do not carry out that verification ourselves, we do not conduct any immigration assessment of our own, and we do not adjudicate a permit. 

4.4 Copies of passports, permits and identity documents are not to be sent to us unless we ask for them in writing. We may ask a contractor to produce its verification record, and we may ask for copies of the underlying documents, where we consider it necessary to satisfy ourselves that the verification was carried out. Where we do, we receive and process the particulars of those documents, and clauses 5.3 and 10 govern what we may use them for and how long we keep them. 

4.5 At the point of access we check that the person presenting is the person to whom the accreditation was issued. We do not keep copies of identity documents at the gate. 

4.6 We may also receive information from the venue, from accreditation and security providers, and from publicly available sources. 

5. WHY WE PROCESS IT, AND ON WHAT BASIS 

5.1 We process personal information only where the Act permits it. The table on the next page sets out why we process information about different groups of people, whether you have to provide it, and the lawful basis we rely on. 

5.2 Where we rely on your consent, you may withdraw it at any time. Withdrawing consent does not affect processing that took place before the withdrawal. 

5.3 Where we process information taken from a document you or your employer gives us as proof of compliance with immigration law, we use it solely to establish that your presence and your work on the premises are lawful, and for no other purpose. We do not use it for marketing, for profiling, or for any employment or recruitment decision, and we do not disclose it to any exhibitor, contractor or other third party, except as we need to in order to control access to the premises or as the law requires. 

6. IF YOU DO NOT PROVIDE IT 

6.1 Where the table in clause 5 says information must be provided, we cannot proceed without it. Depending on the circumstances, we will not be able to conclude or perform a contract with you, or you will not be granted access to the premises. 

6.2 If you are a worker, you are admitted to the premises only if you are accredited and the contractor that deploys you has given us its acknowledgment and undertaking. If you are not accredited, if the particulars you present do not match the accreditation issued, or if your right to perform the work cannot be established, you will not be admitted. That is an access control decision. It is not a finding about your immigration status. 

6.3 Where the table says information need not be provided, there is no consequence if you decline, other than that you will not receive what that information is used for, such as marketing. 

7. SPECIAL PERSONAL INFORMATION 

7.1 Special personal information means the categories listed in section 26 of the Act, including information about your religious or philosophical beliefs, race or ethnic origin, trade union membership, political persuasion, health or sex life, biometric information and criminal behaviour. 

7.2 We do not process special personal information unless the law permits it under section 27 of the Act, and then only with the express authority of our Information Officer. 

7.3 Your nationality and the country that issued your passport are not special personal information. We collect them only in connection with establishing your right to perform the work. We do not collect your race or ethnic origin for that purpose and do not record it on any access record. 

8. WHO WE SHARE IT WITH 

8.1 We share personal information only where it is necessary. Depending on the circumstances we may share it with: 

8.1.1 employees of ours who need it to do their job, such as accreditation, security, and health and safety personnel; 

8.1.2 the owner or operator of the venue at which the event is staged; 

8.1.3 service providers who act on our instruction, such as registration, accreditation, badge  and ticketing, security, information technology and storage providers; 

8.1.4 other companies in the Montgomery group, subject to clause 9; 

8.1.5 our professional advisers, including auditors, insurers and attorneys; and 

8.1.6 regulators, statutory authorities and government departments, where we are obliged by law to disclose. 

8.2 Every service provider who processes personal information on our behalf does so under a written contract that requires it to keep the information secure, to process it only on our instruction, and to tell us immediately if it is compromised. 

8.3 We do not sell or process personal information for monetary gain. We do not disclose our accreditation and site access records, any verification records produced to us by a contractor, or any copies of any personal information provided to us, to exhibitors, to other contractors, or to any person who does not have a lawful and legitimate purpose to ask for them. We will disclose them only where we are obliged by law to do so, and then only what we are obliged to disclose. 

9. SENDING INFORMATION OUTSIDE SOUTH AFRICA 

9.1 Personal information is sometimes processed outside South Africa if it is stored on a system or database controlled or hosted outside the Republic, or in instances where a person outside the Republic is able to control or access it. This is so whether or not the information is actively transferred or moved, and whether or not the servers responsible for storing or processing the information are located in South Africa. 

9.2 We share personal information with other companies in the Montgomery group, whose parent is in the United Kingdom, and we use service providers who may process personal information outside South Africa. 

9.3 Section 72 of the Act permits a transfer outside the Republic where the recipient is subject to a law, binding corporate rules or a binding agreement providing an adequate level of protection, where you have consented, where it is necessary for the performance of a contract with you, or where one of the other grounds in section 72(1) applies. 

9.4 You have the right to ask our Information Officer which countries your personal information is sent to and what protection is in place to safeguard it from abuse. 

10. HOW LONG WE KEEP IT 

10.1 We keep personal information only for as long as we need it for the purpose we collected it for, or for as long as the law requires or permits us to keep it. 

10.2 Our accreditation and site access records for an event, and the acknowledgements and undertakings given to us for that event, are kept for three (3) years after the last day of breakdown, only so that we can show that we complied with our legal obligations and defend any claim arising from the event. Three years is the ordinary period within which a claim of this kind must be brought. If a claim, enquiry or investigation is under way when that period ends, we keep the records until it is finally determined. After that they are securely destroyed. 

10.3 Where a contractor produces a verification record to us under clause 4.4, or gives us a copy of a document at our written request, we keep it only for as long as we need it for the purpose it was produced for, and in any event no longer than the period in clause 10.2. We do not add it to any consolidated record of workers. 

10.4 We are not your employer, and we do not keep records about you on that basis. Your employer keeps its own records and is responsible for them. 

10.5 When we destroy personal information we do so in a way that prevents it from being reconstructed. 

10.6 We may keep for longer a record that simply shows that a check was carried out, on what date and for which contractor. That record does not contain your name or any of your document numbers, so you cannot be identified from it. 

11. HOW WE PROTECT IT 

11.1 We take appropriate, reasonable technical and organisational measures to keep personal information secure, as section 19 of the Act requires. 

11.2 Those measures include limiting access to people who need it for their role, keeping records in access-controlled systems rather than on shared drives, requiring information to be submitted through a secure portal rather than by electronic mail, and requiring the same standards of anyone who processes information on our behalf. 

11.3 If personal information in our possession is compromised, we will notify the Information Regulator and, where required, the people affected, as soon as reasonably possible after we discover it. 

12. YOUR RIGHTS 

12.1 Under the Act you have the right to: 

12.1.1 be told that we are collecting information about you, and to be told if it has been  accessed by an unauthorised person; 

12.1.2 ask us what personal information we hold about you, and to be given a copy of it; 

12.1.3 ask us to correct or delete information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or unlawfully obtained; 

12.1.4 ask us to destroy or delete information we are no longer authorised to keep; 

12.1.5 object, on reasonable grounds, to us processing your information where we rely on legitimate interests; 

12.1.6 object at any time to your information being used for direct marketing; 

12.1.7 withdraw your consent, where we rely on it; and 

12.1.8 complain to the Information Regulator, and to bring proceedings in a court. 

12.2 We do not charge you a fee to ask us what information we hold about you. A fee may be payable for a request for access to a record made under the Promotion of Access to Information Act 2 of 2000, as set out in our PAIA Manual. 

13. HOW TO EXERCISE YOUR RIGHTS 

13.1 Write to our Information Officer using the details in clause 17. Requests to object to processing, or to correct or delete information, must be made on the forms prescribed in the Regulations made under the Act. We will send you the form and help you complete it if you ask. 

13.2 We will respond to a request for access within thirty (30) days of receiving it, and to a request to correct or delete as soon as we reasonably can, and in any event within thirty (30) days. 

13.3 We may need to confirm your identity before we act on a request. 

13.4 If we refuse a request we will tell you why in writing, and tell you what you can do about it. 

14. COMPLAINTS 

14.1 If you are unhappy with how we have handled your personal information, please raise it with our Information Officer first so that we have the chance to put it right. 

14.2 You may complain to the Information Regulator at any time. Information Regulator (South Africa), JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001. Telephone +27 10 023 5200. Complaints may be sent to complaints.IR@justice.gov.za. Website www.inforegulator.org.za. 

14.3 The Information Commissioner's Office in the United Kingdom is not the regulator for our processing. Complaints about our processing are made to the Information Regulator. 

15. CHANGES TO THIS NOTICE 

15.1 We review this Notice at least annually and whenever our processing changes materially. The current version is published on our website and in the exhibitor zone, is given to workers as described in clause 2.4, and is available from our Information Officer on request. 

15.2 Changes take effect when published. They do not apply retrospectively. 

16. HOW THIS NOTICE FITS WITH OUR OTHER DOCUMENTS 

16.1 Nothing in this Notice limits your rights under the Act. Where anything in it appears to, the Act applies and this Notice is read accordingly. 

16.2 This Notice is not a contract. Nothing you sign with us, and nothing in our Terms and Conditions, takes away what this Notice tells you about your rights. 

16.3 We also have internal policies that govern how we handle personal information, and a PAIA Manual that governs requests for access to our records. This Notice tells you what we do. Those documents tell our own people how to do it. Where they differ from this Notice on anything affecting you, this Notice applies. 

17. CONTACT US 

17.1 Information Officer: Gary Corin, Managing Director. Deputy Information Officer: Charlene Hefer, Portfolio Director. 

17.2 Electronic mail: charlene.hefer@montgomerygroup.com. Telephone: +27 10 003 3039. 

17.3 Postal address: Post Office Box 82196, Southdale, Johannesburg, 2135.