POPIA Compliance

1. Our Commitment

Coalyard Solutions recognises the importance of protecting personal information and is committed to processing all personal data in accordance with the principles set out in POPIA. Our commitment includes:

• Accountability: We take responsibility for the personal information we process and have appointed an Information Officer to ensure compliance.
• Processing Limitation: We only collect personal information that is necessary, adequate, and relevant for our stated purposes.
• Purpose Specification: We collect personal information for specific, explicitly defined, and lawful purposes and do not process it further in a manner incompatible with those purposes.
• Information Quality: We take reasonable steps to ensure that personal information is complete, accurate, and not misleading.
• Openness: We are transparent about the personal information we collect and how we use it, as detailed in our Privacy Policy.
• Security Safeguards: We implement appropriate technical and organisational measures to protect personal information against loss, damage, or unauthorised access.
• Data Subject Participation: We respect your right to access, correct, and delete your personal information.

2. Data Processing Activities

As a peer-to-peer coal trading platform, Coalyard Solutions processes personal information for the following activities:

3. Lawful Basis for Processing

Under POPIA Section 11, we process personal information based on the following lawful grounds:

• Consent (Section 11(1)(a)): You provide explicit consent at registration for the collection and processing of your personal information. You may withdraw consent at any time, though this may affect your ability to use the Platform.
• Contract Performance (Section 11(1)(b)): Processing is necessary to perform the contract between you and Coalyard Solutions, including facilitating transactions, managing escrow, and providing platform services.
• Legal Obligation (Section 11(1)(c)): Processing is necessary to comply with legal obligations, including FICA identity verification, SARS tax reporting requirements, and financial record-keeping regulations.
• Legitimate Interest (Section 11(1)(f)): Processing is necessary for our legitimate interests, including fraud prevention, platform security, and service improvement, provided these interests do not override your rights.

4. Your Rights as a Data Subject

Under POPIA, you have the following rights regarding your personal information:

5. Information Officer

In accordance with POPIA Section 55, Coalyard Solutions has appointed an Information Officer responsible for encouraging compliance with the conditions for the lawful processing of personal information, dealing with requests from data subjects, and cooperating with the Information Regulator.

6. How to Exercise Your Rights

To exercise any of your rights under POPIA, you may:

1. Email Request: Send an email to privacy@coalyardsolutions.co.za with the subject line "POPIA Request" and a clear description of the right you wish to exercise.
2. Account Settings: For data access and export, you can use the data export feature in your account settings to download a copy of your personal information.
3. Account Deletion: To request deletion of your account and associated personal data, use the account deletion option in your settings or contact our Information Officer.

We will respond to your request within a reasonable time and no later than 30 days of receiving it. We may need to verify your identity before processing certain requests. There is no fee for submitting a request, but we may charge a reasonable fee for requests that are manifestly unfounded or excessive.

7. Third-Party Data Processors

We use the following third-party service providers who process personal information on our behalf. All operators are contractually bound to process personal information in accordance with POPIA:

8. Data Breach Notification

In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify the Information Regulator and affected data subjects as soon as reasonably possible after becoming aware of the breach, as required by POPIA Section 22. The notification will include the nature of the breach, the likely consequences, the measures taken to address the breach, and recommendations for data subjects to mitigate potential adverse effects.

9. Cross-Border Data Transfers

Some of our service providers may process personal information outside of South Africa. In such cases, we ensure that the recipient country has adequate data protection legislation, or that appropriate contractual safeguards are in place, in compliance with POPIA Section 72. We do not transfer personal information to jurisdictions that do not provide an adequate level of protection without implementing additional safeguards.

10. Updates to This Page

We may update this POPIA Compliance page from time to time to reflect changes in our data processing activities or amendments to POPIA. Material changes will be communicated via the Platform and by email where appropriate.

For more detailed information about how we handle your personal information, please refer to our Privacy Policy and Terms of Service.