RVZ International Group (Pty) Ltd ("RVZ") handles confidential information belonging to clients, candidates, artists, guests, travellers, suppliers and employees across all its divisions. This policy explains what RVZ treats as confidential, the duties RVZ and its people accept, what RVZ expects of clients and suppliers who receive its confidential information, and the limits that the law places on confidentiality — in particular, that no confidentiality obligation may silence a protected disclosure or a statutory right. It gives effect to the common law of confidence, the Protection of Personal Information Act 4 of 2013 ("POPIA"), the Copyright Act 98 of 1978, the Trade Marks Act 194 of 1993 and the Protected Disclosures Act 26 of 2000.
1.1 Confidential Information is non-public commercial, technical, creative, financial, personal or strategic information disclosed in connection with a contract or relationship and identified as confidential or reasonably understood to be confidential (Terms clause 17.1). Where non-public and legitimately protected, it includes:
1.2 Information is classified (public, internal, confidential, restricted) and accessed only for authorised need. Seniority alone does not create a right of access.
Information is not confidential to the extent the recipient proves it was lawfully public other than through a breach, already lawfully known to the recipient without a duty of confidence, lawfully received from a third party without restriction, or independently developed without use of the protected information (Terms clause 17.3). A person's general knowledge, skill, experience and professional capability remain their own. Information is not excluded merely because individual elements are public if the non-public compilation, analysis or arrangement has legitimate confidential value.
When you share confidential information with RVZ we will: use it only for the purpose for which it was given and the contract between us; protect it with at least reasonable care and the security measures in section 8; disclose it internally only to people who need it for that purpose and who are bound by equivalent duties, and externally only with your authority, under law, or to operators and suppliers bound by written confidentiality and (where personal information is involved) POPIA operator terms; tell you promptly if we become aware of unauthorised access or disclosure; and return or securely delete it when the purpose ends, subject to lawful retention (Terms clauses 17.2 and 13.7).
4.1 Every employee signs the RVZ Employee NDA and Intellectual Property Agreement on engagement; contractors, freelancers and placed workers sign an equivalent. Under it they must keep Confidential Information secure, use it only for authorised duties, disclose it only to a person with a legitimate need and authority, and follow classification, access, retention and security instructions.
4.2 They may not copy, download, photograph, record, scrape, transmit, memorise for later exploitation, reverse engineer or remove information except as required for authorised work; nor use RVZ or third-party information to compete unfairly, obtain personal gain, assist another person, solicit a transaction through misuse, or prejudice the information owner.
4.3 Accidental disclosure must still be reported immediately; prompt good-faith reporting is a risk-control duty and does not by itself establish misconduct.
4.4 The NDA does not prohibit an employee from working for a competitor, client or supplier after employment and does not by itself restrict lawful solicitation; it prohibits only misuse of protected information, personal data, intellectual property and other unlawful conduct. Any restraint of trade must be separately negotiated, supported by a legitimate protectable interest, reasonable in scope and legally reviewed.
A client, supplier or other party who receives RVZ's Confidential Information under our Terms and Conditions must use it only for the contract, protect it with at least reasonable care, and disclose it only to authorised persons bound by equivalent duties (Terms clause 17.2). A client that receives candidate records may share them internally only with decision-makers for the stated vacancy, and may not add candidates to marketing lists or retain unsuccessful records beyond the lawful purpose (Terms Schedule 2.8). Suppliers acting as POPIA operators must comply with clause 13.7 and the operator agreement.
Personal information is always confidential, whether or not marked so, and is processed under POPIA and our Privacy Policy. Our people may not collect information "just in case", reuse it for a new purpose without approval, access records out of curiosity, share passwords, disclose it to family or friends, or move data to an unapproved account or tool. Special personal information (POPIA section 26), children's information (section 34), criminal, health, biometric, banking, identity and screening data require enhanced protection and access only where expressly authorised. Data-subject, regulator and law-enforcement requests are referred to the Information Officer.
Consistent with POPIA section 19, RVZ requires approved devices and accounts; multi-factor authentication; unique credentials; screen locking; prompt updates; no unapproved removable media; clean-desk and secure-disposal controls; and no forwarding of protected information to personal email or consumer cloud accounts, discussion in public or insecure places, or exposure on screens to unauthorised persons. Remote work and travel require private communication, secure connectivity and physical control of devices and documents. Systems enforce role-based access, encrypted transport, hashed credentials, server-side restriction of documents and logging.
Confidential Information, personal information, source files, credentials, unreleased music and client material may not be submitted to a public or unapproved AI, translation, transcription, design, coding, storage or collaboration service. Approved services are used within their authorised account, purpose, region, retention and training-data settings, with identifiers minimised and output verified. See our Responsible AI Policy and Terms clause 16.5.
Where law, a subpoena, a regulator's direction or court process requires disclosure, the recipient may disclose only the minimum required and must, where lawful and practicable, give the owner prompt notice and reasonable assistance to seek protective treatment (Terms clause 17.4). This notice requirement does not apply where the law prohibits notice or the protected-disclosure carve-out in section 11 applies. Requests under the Promotion of Access to Information Act 2 of 2000 are handled under our PAIA Manual, which applies the third-party confidentiality protections in PAIA sections 63 to 65 and 68.
11.1 Nothing in this policy, in any NDA, employment contract, settlement agreement or supplier contract with RVZ prohibits or penalises a disclosure or communication protected by the Protected Disclosures Act 26 of 2000, the Labour Relations Act, the Employment Equity Act, the Occupational Health and Safety Act, POPIA, the Companies Act section 159 or any other law. A term purporting to do so is void (PDA section 2(3)).
11.2 In particular, any person may seek confidential legal advice; report crime, corruption, harassment, discrimination, safety danger or a regulatory breach to the appropriate authority; participate in a lawful investigation or proceeding; communicate with a trade union as the law permits; and give evidence to the CCMA, a bargaining council, a court, a regulator or a law-enforcement body. An internal-authorisation requirement does not override statutory protection. See our Whistleblowing and Protected Disclosures Policy.
11.3 Confidentiality is never used to conceal unlawful conduct, to prevent a consumer from exercising a right under the Consumer Protection Act (CPA section 48 and 51), or to prevent a data subject from exercising a right under POPIA.
Confidentiality duties apply during the relationship and continue for five years after it ends; trade secrets, and information that remains lawfully confidential, are protected for as long as they retain that character; and personal information remains protected for as long as it is retained or processed (Terms clause 17.5; NDA clause 18). A longer period may apply where the law, client terms known to the recipient, or the nature of the information requires.
Neither RVZ nor a client may issue a press release or imply endorsement without the other's approval (Terms clause 17.6). RVZ may identify completed public-facing work in its portfolio only after public release and subject to confidentiality, third-party restrictions and any written opt-out; personal information, unreleased music and sensitive campaign data require specific permission (Terms clause 15.9). RVZ's people may not include confidential, client-owned, candidate, personal or unreleased work product in a portfolio or social post without prior written approval from the rights owner and RVZ, must use the authorised version, credit and release timing, and must remove it if rights or confidentiality later require.
On request, role change, suspension or the end of a relationship, Confidential Information is returned or securely deleted, access is stopped, and current passwords are transferred through an approved process; no copies may be retained in any form. Deletion occurs only after authorised transfer and subject to legal hold, backup and statutory retention rules; a person may not wipe devices or accounts independently. Records a person is legally entitled to keep (their own payslips, signed contract and tax records) are not confidential merely because they relate to employment, though third-party data within them remains protected.
15.1 A suspected leak, misdirected communication, lost device, phishing, suspicious access or other security incident must be reported immediately through the channels in our Whistleblowing Policy or to info@rvzgroup.co.za; evidence is preserved and containment instructions followed. Only the Information Officer or authorised incident lead notifies the Information Regulator, data subjects, clients, media or law enforcement on RVZ's behalf (POPIA section 22), without restricting a legally protected external report.
15.2 A breach may cause harm not fully remedied by damages; an affected party may seek urgent interdictory relief, delivery-up, preservation, specific performance, proven damages or other lawful relief. RVZ imposes no automatic penalty, predetermined damages, automatic dismissal or automatic attorney-and-client costs: employment discipline requires a fair reason and procedure, and civil remedies require proof in a competent forum. Prompt good-faith reporting, intent, harm prevention and cooperation are taken into account. A breach by a supplier or representative may result in remediation, suspension, termination and referral to an authority. RVZ does not make retaliatory or misleading take-down demands.
Where a project requires it, RVZ will sign a mutual non-disclosure agreement with a client or supplier before receiving or sharing sensitive information. RVZ's standard NDA identifies the legitimate confidential information and permitted use, mirrors clause 17 of our Terms, includes the POPIA operator terms where personal information will flow, and contains the protected-disclosure carve-out in section 11. RVZ will not sign an NDA term that purports to silence a protected disclosure, to prevent a report to a regulator, or to waive a consumer's or data subject's statutory rights.
This page is the public edition of RVZ's Confidential Information, Intellectual Property and Brand Assets policy (POL-IP-01) as it concerns confidentiality; intellectual property and brand use are covered in our Copyright Notice and Brand Assets page. It reflects the law as at the date shown above and is not legal advice.