We collect personal information about existing and potential suppliers, to assess whether you are a suitable supplier, or whether you qualify to lease commercial property from us.

We collect:

• full name, registered company name and contact details of potential or existing suppliers to UP
• ID documents or CIPC registration certificates
• VAT Numbers
• bank details
• BBBEE certificates
• tax compliance status issued by SARS or Tax Clearance certificate
• trade references
• company profiles and annual turnover
• if any of the directors, members, or proprietors, or any of the family members of suppliers or potential suppliers, are employed at UP
• proof of insurance
• proof of registration with a professional body
• details of previous projects worked on
• financial statements

We generate records about you.

We generate:

• an online profile for all tender applicants that you can use to apply for a UP tender electronically
• a tender evaluation report on each applicant
• minutes of the committee meeting documenting the decision when a current or potential supplier has been awarded a tender or commercial lease
• an online profile for all UP registered suppliers that we use for payment and other day-to-day administration
• an online profile for UP registered suppliers where we upload the relevant contract that can be used for contract management at UP

When we collect and use your personal information

Why we collect your personal information

• When we process and consider your application to provide goods or services to UP, or to lease commercial property from UP.
• When we verify the details of your application with your listed trade references and SARS.

We process this information to conclude a contract with you and to meet our contractual obligations with you.

• When you contact us by email, telephone, or online chat, we use the information we collect to reply to, investigate, and resolve your query, complaint, or request.

We process this personal information because it is in your or our legitimate interest to do so.

• When we produce reports and returns for funding agencies, government departments, and public bodies.
• When independent auditors conduct our annual financial audits we are required by law to share your information with them.

We process this information as a legal requirement under the Higher Education Act. For example, the Higher Education Act (Regulations for Reporting by Public Higher Education Institutions) encourages all South African public higher education institutions to comply with the corporate governance standards as set out in the King Code III.

In addition, the Act requires all South African public universities to comply with the International Financial Reporting Standards. These requirements mean that UP must submit an independent auditor report in our annual report to the Department of Higher Education.

We only use service providers we trust and who will keep your information secure. We have contracts in place to ensure that they do - whether they are local or abroad.

We use service providers to help us

• communicate with you
• monitor the effectiveness of our services
• manage our business, for instance accountants and professional advisors
• provide IT services
• process tender applications
• conduct independent annual financial audits

We only use suppliers and service providers we trust, and who have agreed to keep your information secure and confidential, and to only use your information for the purposes for which we shared it with them.

Some of the service providers that we use may be located in other countries. These countries may not have the same levels of protection of personal information as South Africa, in which case they must undertake to protect your personal information to the same level that we do.

We provide for appropriate safeguards by means of contracts between us and our foreign service providers.

Sometimes the law requires that we share your information, such as the Higher Education Act and its regulations pertaining to public higher education institutions.

We have reasonable security measures in place to protect your personal information.

Our security measures are in place to protect your personal information from

• loss
• misuse
• unauthorised access
• being altered
• being destroyed

We base our security measures on the sensitivity of the personal information that we hold.

We regularly monitor our systems for possible vulnerabilities and attacks.

No system is perfect, and we cannot guarantee that we will never experience a breach of any of our physical, technical, or managerial safeguards, but we regularly monitor our systems for vulnerabilities.

We will let you know of any breaches that may affect your personal information.

If something should happen, we have taken steps to minimise the threat to your privacy, and we will let you know if your personal information has been compromised. We will also let you know how you can help minimise the impact of the breach.

You can help to keep your information secure by being aware of how you communicate.

While our servers are protected, emails can still be intercepted. It is better not to share personal information with us in an email. Instead, give us a call or complete our online contact forms.

You may ask us about your personal information.

You have the right to know when we collect and use your personal information, and to ask us what we know about you and what we do with that information.

You may access your personal information.

You may ask to access your personal information at [email protected]. We may take one month to respond to your request and may charge a fee in some circumstances. We will let you know if this is the case.

You have control over your personal information.

You may ask that we update incorrect personal information, or complete personal information that may be incomplete.

You may ask that we delete your personal information.

You may ask to receive your personal information in a structured, commonly used, and machine-readable format.

You may ask that we reuse your personal information for your own purposes across different services.

Under certain circumstances you may object to the processing of your personal information.

You may object to automated decision-making and profiling.

You may ask that a human review any automated decisions that we make about you, you may express your point of view about it, and obtain an explanation of the decision. You may challenge any automated decision made about you.

You may ask that we restrict our use of your personal information.

You have the right to unsubscribe

You have the right to unsubscribe from any direct marketing we send you.