RVZ International Group (Pty) Ltd ("RVZ", "we", "us", "our") is a South African multi-industry group operating through the divisions RVZ Marketing & Design, RVZ Personnel Services, RVZ Events & Functions, RVZ Productions, RVZ Travel, RVZ Business Solutions and the RVZ Shop. We are the responsible party, as defined in section 1 of the Protection of Personal Information Act 4 of 2013 ("POPIA"), for the personal information described in this policy.
This policy is the notification we are required to give you under POPIA section 18. It explains what personal information we collect, where we get it from, why and on what lawful basis we process it, who we share it with, whether it leaves South Africa, how long we keep it, how we protect it, and the rights you have and how to exercise them. It applies to rvzgroup.co.za, shop.rvzgroup.co.za, our client, vendor and staff portals, our recruitment services, and every other way you deal with us.
1.1 Under POPIA section 55, read with section 1 of the Promotion of Access to Information Act 2 of 2000 ("PAIA"), the head of a private body is its Information Officer. RVZ's Information Officer is its Chief Executive Officer, Ryan Massey-Hicks. The Information Officer is responsible for encouraging and ensuring RVZ's compliance with POPIA, dealing with requests made under POPIA and PAIA, and working with the Information Regulator in any investigation.
1.2 Requests, questions and complaints about your personal information should be addressed to the Information Officer at ryan@rvzgroup.co.za, or in writing to RVZ International Group (Pty) Ltd, Haberfeld Street, Klisser Ville, Kimberley, Northern Cape 8301. General enquiries may also be sent to info@rvzgroup.co.za.
2.1 Depending on how you deal with us, we may process the following categories of personal information:
2.2 Where a field is mandatory we tell you so on the form. Providing information that is not mandatory is voluntary; if you choose not to provide mandatory information we may be unable to respond to you or provide the service you have asked for (POPIA section 18(1)(d) and (e)).
3.1 In accordance with POPIA section 12 we collect personal information directly from you wherever reasonably possible — through our website forms, portals, email, telephone, WhatsApp, in person, or the documents you give us.
3.2 We collect information from other sources only where section 12(2) permits it, for example: from a client employer when it briefs us on a vacancy; from a referee you have nominated; from public sources such as CIPC or a professional register; from a travel supplier or venue in the course of managing your booking; from our payment provider to confirm a payment; or where you have consented.
4.1 POPIA section 13 requires us to collect personal information only for a specific, explicitly defined and lawful purpose related to our functions, and section 11 requires each processing activity to rest on one of the lawful grounds in section 11(1). The table below sets these out.
| Purpose | Lawful basis (POPIA s 11(1)) |
|---|---|
| Responding to an enquiry, providing a quotation, and providing the goods or services you request | Necessary to conclude or perform a contract to which you are a party (s 11(1)(b)) |
| Managing bookings, events, travel arrangements and creative projects, including sharing details with venues, suppliers and fulfilment partners | Contract performance (s 11(1)(b)); our and your legitimate interests (s 11(1)(f)) |
| Processing payments, issuing invoices and statements, credit control and debt recovery | Contract performance (s 11(1)(b)); compliance with the Tax Administration Act, VAT Act and Companies Act (s 11(1)(c)) |
| Recruitment, candidate assessment and placement | Steps at your request before a contract (s 11(1)(b)); consent for checks that require it (s 11(1)(a)); compliance with the Employment Services Act (s 11(1)(c)) |
| Operating client, vendor and staff portals, and keeping accounts secure | Contract performance (s 11(1)(b)); legitimate interests in security (s 11(1)(f)) |
| Sending our newsletter and marketing communications | Consent (s 11(1)(a)), or the existing-customer basis in s 69(3) with an opt-out in every message |
| Investigating and resolving complaints, grievances and whistleblowing reports | Legitimate interests (s 11(1)(f)); legal obligations under the CPA and Protected Disclosures Act (s 11(1)(c)) |
| Recording calls and messages for quality, training, dispute resolution and evidence of transactions | Legitimate interests (s 11(1)(f)); RICA s 4–6 where a party to the call records it |
| Complying with legal obligations, including tax, company-law, health-and-safety, labour and accounting record-keeping | Legal obligation (s 11(1)(c)) |
| Website analytics and improvement | Consent to non-essential cookies (s 11(1)(a)); legitimate interests in essential operation (s 11(1)(f)) |
| Establishing, exercising or defending legal claims; preventing fraud | Legitimate interests (s 11(1)(f)) |
4.2 Where we rely on our legitimate interests, we have assessed that those interests are not overridden by your rights, and you may object under section 11(3) — see section 17 below.
4.3 We do not process personal information for a purpose incompatible with the purpose for which it was collected, unless POPIA section 15 permits it (for example, with your consent, or where the further processing is required by law). Candidate information is never used for unrelated marketing.
4.4 We take reasonably practicable steps to keep personal information complete, accurate, not misleading and up to date, as section 16 requires. Please tell us if your details change.
5.1 "Special personal information" (POPIA section 26) includes information about your religious or philosophical beliefs, race or ethnic origin, trade-union membership, political persuasion, health or sex life, biometric information, and criminal behaviour. We process it only where one of the authorisations in sections 27 to 33 applies — most commonly your explicit consent, or where the processing is necessary for the establishment, exercise or defence of a right or obligation in law.
5.2 Examples in our business: dietary or accessibility requirements you give us for an event (health, processed with your consent to accommodate you); passport nationality and date of birth for travel (processed as necessary for the booking); race and gender information reported under the Employment Equity Act where we are a designated employer (section 27(1)(b)); and criminal-record or health checks in recruitment, only where lawful, relevant, proportionate and specifically authorised by you (see section 7).
6.1 Our services are directed at adults and businesses. Under POPIA section 34 we do not process the personal information of a child (a person under 18) unless section 35 applies — principally, with the prior consent of a competent person (a parent or guardian). Where a client provides us with a child's details for an event or travel booking, the client warrants that it has that consent.
6.2 If you believe we have collected a child's information without appropriate consent, please contact the Information Officer and we will delete it.
7.1 RVZ Personnel Services processes candidate and placed-worker information as a private employment service under the Employment Services Act 4 of 2014 and, for labour hiring, as an employer under section 198 of the Labour Relations Act 66 of 1995. Some recruitment functions are delivered through our related job platform at nhestate.co.za, which publishes its own privacy notice.
7.2 Candidate information may include your CV, identity number, qualifications, employment history, references, right-to-work documents, and remuneration expectations. Criminal-record, credit, qualification-verification, medical or social-media checks are performed only where lawful, relevant to the role, proportionate, and specifically authorised by you in writing, and a check report records its source and scope.
7.3 Your information is shared with a prospective employer only for a specific vacancy, only with the decision-makers for that vacancy, and only after you have agreed to be put forward. Our client agreements prohibit the client from adding you to marketing lists or retaining your details beyond the recruitment purpose.
7.4 We do not charge work seekers any fee, and we do not sell candidate data.
7.5 For placed workers, payroll, tax, UIF, COIDA, time and attendance, and health and safety records are processed as required by the Basic Conditions of Employment Act, the Income Tax Act, the Unemployment Insurance Act, COIDA and the Occupational Health and Safety Act, and are retained for the periods those Acts prescribe.
8.1 We do not sell personal information. We share it only as described here, only to the extent necessary, and under confidentiality obligations.
9.1 An "operator" (POPIA section 1) processes personal information for us under our instructions. Section 20 requires an operator to process only with our authorisation and to keep the information confidential, and section 21 requires us to have a written contract with each operator requiring it to maintain appropriate security safeguards and to notify us immediately of any suspected security compromise. Our operators include:
9.2 We assess each operator's security before appointing it, and our operator agreements incorporate the POPIA Data-Processing Addendum in Annexure C of our Terms and Conditions.
10.1 Some operators and suppliers process information outside South Africa — for example, our email and analytics providers, the print-on-demand fulfilment partner, and foreign airlines, hotels and tour operators for international travel.
10.2 POPIA section 72 permits a transfer only where the recipient is subject to a law, binding corporate rules or a binding agreement providing substantially similar protection to POPIA; or you consent; or the transfer is necessary to perform a contract with you or a contract in your interest; or it is for your benefit and consent is not reasonably practicable to obtain. We rely on binding agreements with our operators and, for travel and international orders, on the transfer being necessary to perform your contract. We do not transfer personal information abroad for any purpose beyond these.
11.1 POPIA section 14 requires us not to retain personal information longer than is necessary to achieve the purpose for which it was collected, unless the law requires or authorises longer retention, we reasonably need it for a lawful purpose related to our functions, retention is required by contract, or you have consented. Our baseline periods are:
| Record | Baseline retention | Basis |
|---|---|---|
| Enquiries that do not lead to a contract | 24 months after last contact | Legitimate interest in follow-up and dispute resolution |
| Quotations, orders, invoices, statements and payment records | At least 5 years after the end of the tax year, and 7 years for accounting records | Tax Administration Act 28 of 2011 s 29; Companies Act 71 of 2008 s 24 and Regulation 25 |
| Contracts and statements of work | Duration plus 7 years | Companies Act; prescription period for contractual claims |
| Client, vendor and portal account data | Life of the account plus 5 years | Contract and dispute resolution |
| Unsuccessful candidate records | 12 months after the vacancy closes, unless you ask us to keep your CV on file (then 24 months, renewable) | Employment Equity Act s 21 and Regulations; legitimate interest |
| Placed-worker employment, payroll and time records | 3 years after termination (BCEA s 31); 5 years for tax; longer where a dispute or COIDA claim exists | BCEA; Tax Administration Act; COIDA |
| Health and safety incident records | Period prescribed for the record type under OHSA regulations; serious-incident files longer | Occupational Health and Safety Act |
| Complaints, grievances and whistleblowing reports | 5 years after closure | CPA Regulations; Protected Disclosures Act; dispute resolution |
| Marketing consents and suppression records | For as long as the consent or opt-out is relied on, then 3 years as evidence | POPIA s 69; proof of compliance |
| Call recordings | 90 days, unless required for a dispute or legal hold | Legitimate interest; RICA |
| Website server logs | 90 days | Security and fraud prevention |
11.2 Where a dispute, investigation, regulator enquiry or legal hold applies, the affected records are retained until it concludes. When a retention period ends we destroy, delete or de-identify the information in a manner that prevents its reconstruction, as section 14(4) and (5) require.
12.1 POPIA section 19 requires us to secure the integrity and confidentiality of personal information through appropriate, reasonable technical and organisational measures. Our measures include: encrypted connections (TLS) to all our websites and portals; role-based access to our administration and portal systems, with staff seeing only what their role requires; strong authentication and session controls; hashed password storage; server-side access restrictions on uploaded documents; regular backups; vendor security assessment; staff training; and the operator contracts described in section 9.
12.2 We periodically review these measures against identified risks and generally accepted information-security practices, and our internal Information Security policy (POL-TECH-01) is aligned to ISO/IEC 27001 as a voluntary framework.
13.1 If we have reasonable grounds to believe that your personal information has been accessed or acquired by an unauthorised person, POPIA section 22 requires us to notify the Information Regulator and you as soon as reasonably possible after discovery. Our notification will describe the possible consequences, the measures we are taking, what you can do to mitigate any harm, and, where known, the identity of the unauthorised person. Notification may be delayed only where a law-enforcement body or the Regulator determines that it would impede a criminal investigation.
13.2 Our operators are contractually required to notify us immediately of any suspected compromise so that we can meet this duty.
14.1 We send electronic direct marketing (email, SMS, WhatsApp) only where POPIA section 69 permits: either you have consented, or you are an existing customer, your details were obtained in the context of a sale, the marketing relates to similar goods or services, and you were given a reasonable opportunity to object when your details were collected and in every message since.
14.2 If you are not yet a customer we may approach you for consent only once, and will not approach you again if you decline.
14.3 Every marketing message identifies RVZ and contains a simple, free unsubscribe. An opt-out is honoured without delay and recorded on a suppression list. You may also opt out at any time by emailing ryan@rvzgroup.co.za.
14.4 Telephonic and other direct marketing complies with the Consumer Protection Act, including the prohibited contact times in CPA Regulation 4, and with your right under CPA section 11 to pre-emptively block it. See our Consumer Protection and Service Delivery Policy.
15.1 POPIA section 71 gives you the right not to be subject to a decision that has legal or similarly significant consequences for you and that is based solely on automated processing intended to profile you. RVZ does not make such decisions. Every consequential decision about a person — a hiring recommendation, a credit or payment-terms decision, a complaint outcome — is made or meaningfully reviewed by a person with authority to change it.
15.2 We use artificial-intelligence tools for limited internal purposes such as drafting marketing copy and content, always with human review before publication. Under our AI Usage Policy and POL-TECH-05, personal information, special personal information and confidential client material may not be entered into public AI services, and any material use of generative AI in a client deliverable is disclosed and approved.
16.1 Our websites use strictly necessary cookies to function (session and security cookies, your cookie-consent choice) and, only if you consent through our cookie banner, analytics cookies set by Google Analytics through Google Tag Manager to understand how the site is used. We implement Google Consent Mode so that no analytics or advertising storage is used until you consent, and you can withdraw consent at any time. Full details are in our Cookie Policy.
17.1 Under POPIA you have the right to:
17.2 To exercise a right, contact the Information Officer at ryan@rvzgroup.co.za. For access requests you may use Form 2 prescribed under the POPIA Regulations, and for objections Form 1; we will accept a clear written request in any form. We may ask you to verify your identity proportionately before acting. We respond within the periods POPIA and PAIA prescribe — ordinarily within 30 days — and if we refuse a request in whole or part we will give you written reasons and tell you how to challenge the decision.
17.3 A request for access to a record that is not your own personal information is dealt with under PAIA; see our PAIA Manual.
18.1 If you are unhappy with how we have handled your personal information or a request, please raise it with the Information Officer first so that we can put it right. You are not obliged to do so before approaching the Regulator.
18.2 You may lodge a complaint with the Information Regulator (South Africa) under POPIA section 74:
JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001
Email: complaints.IR@justice.gov.za (complaints) | enquiries@inforegulator.org.za (enquiries)
Website: inforegulator.org.za
19.1 We review this policy at least annually and whenever our processing, systems, suppliers or the law change materially. The "last updated" date at the top of this page shows the current version. Where a change materially affects how we process your information we will notify you by email or a prominent notice on our website before it takes effect. Continued use of our services after that date constitutes acceptance of the updated policy, but does not affect any right you have already acquired.
This policy gives effect to RVZ's Protection of Personal Information and Privacy policy (POL-DATA-01) and reflects POPIA and the other legislation cited as at the date shown above. It is reviewed at least annually. It is not legal advice; if you require advice on your rights, consult a qualified South African attorney or the Information Regulator.