WASPA Privacy Policy

WASPA’s Privacy Policy can be viewed in PDF format here. (PDF, 680KB).

Version	2.0 (Draft)
Draft date	5 August 2026
Effective date
Policy owner	Information Officer
Review cycle	At least annually and whenever material processing changes

Purpose and status of this Policy
Who WASPA is and how to contact us
Scope
Definitions and interpretation
WASPA’s role in processing personal information
Data subjects covered
Personal information WASPA may collect
How WASPA obtains personal information
Purposes for which personal information is processed
Legal justifications for processing
Website forms and specific processing activities
Information concerning other persons
Special personal information and information of children
Website, portal, cookies and technical information
Public information and publication
Disclosure of personal information
Operators and service providers
Cross-border transfers
Information quality and updating information
Security safeguards
Personal information security compromises
Retention, archiving and destruction
Data subject rights
How to exercise rights
Direct marketing and communications
Automated decision-making
Third-party websites and services
Changes to this Policy
Complaints and contact details

Schedule 1 – Processing activities
Schedule 2 – Indicative retention schedule
Schedule 3 – Cookie and similar technology categories

1. PURPOSE AND STATUS OF THIS POLICY

This Privacy Policy and Website Privacy Notice (Hereinafter referred to as this/the “Policy“) explains how The Wireless Application Service Providers’ Association (Hereinafter referred to as “WASPA“, “We“, “Us’ or “Our“) collects, receives, records, organises, stores, uses, shares, publishes, archives, restricts, deletes and otherwise processes Personal Information.
The Policy is intended to give effect to the Protection of Personal Information Act 4 of 2013, as amended (Hereinafter referred to as “POPIA“), the Promotion of Access to Information Act 2 of 2000, as amended (Hereinafter referred to as “PAIA“), the Electronic Communications and Transactions Act 25 of 2002, as amended (Hereinafter referred to as the “ECT Act“) and the Consumer Protection Act 68 of 2008, as amended (Hereinafter referred to as the “CPA“) and other applicable South African laws.
The Policy applies to the use of the Website and to Personal Information submitted through, generated by, or subsequently processed in connection with the Website, including information submitted by WASPA members, prospective members, member representatives, consumers, members of the public, mobile network operator personnel, regulators, service providers, adjudicators and other stakeholders.
This Policy is an external privacy notice. It does not limit any rights granted by law and does not replace any more specific privacy notice displayed on a particular form or service. Where a form-specific notice conflicts with this Policy, the more specific notice will apply to that processing activity, to the minimum extent allowable in law.
By using the Website or submitting information to WASPA, a person acknowledges that the information will be processed as described in this Policy. Acknowledgement of this Policy is not, by itself, treated as consent where POPIA requires a separate voluntary, specific and informed consent.

2. WHO WASPA IS AND HOW TO CONTACT US

WASPA is a South African nonprofit industry association whose mission includes providing a forum in which its members can address matters of common interest, engaging with industry stakeholders, network operators, government and regulatory bodies, and promoting ethical and reasonable practices in the wireless application services industry.

For purposes of this Policy, WASPA’s details are:

Name	The Wireless Application Service Providers’ Association
NPO number	115-491 NPO
Physical address	C/O First Floor, Block A, One the Boulevard, Westway Office Park, 7 Harry Gwala Road, Westville, 3629, KwaZulu-Natal, South Africa
Website	www.waspa.org.za
Information Officer	Anthony Ekerold
Information Officer email

WASPA may update these details from time to time. The current details displayed on the Website will apply if they differ from the details above.

3. SCOPE

This Policy applies to Personal Information processed through or in connection with:
1. the public WASPA website and any WASPA-controlled subdomain;
2. the WASPA member portal and related account-management functions;
3. online complaint forms and unsubscribe forms;
4. any and all files, correspondence and supporting documents uploaded to or generated through the Website;
5. case-management, adjudication, appeal, monitoring, member-administration and regulatory processes initiated through the Website;
6. Website logs, cookies, security tools and similar technologies; and
7. communications and records generated after a person submits information online, including email, telephone and/or written correspondence relating to the submission.
The Policy applies to Personal Information about natural persons and, where POPIA applies, identifiable existing juristic persons.
The Policy does not govern a third party’s independent processing merely because the Website links to that third party or because information is lawfully disclosed to that third party.

4. DEFINITIONS AND INTERPRETATION

“Child” refers to a natural person under 18 years who is not legally competent, without the assistance of a Competent Person, to take the relevant action or decision concerning his or her Personal Information;
“Competent Person” refers to a person legally competent to consent to an action or decision concerning a Child;
“Data Subject” refers to the person to whom Personal Information relates;
“Operator” refers to a person who processes Personal Information for WASPA under a contract or mandate without coming under WASPA’s direct authority;
“Personal Information” refers to information relating to an identifiable living natural person and, where applicable, an identifiable existing juristic person, as more fully defined in POPIA;
“Processing” refers to any operation concerning Personal Information, including collection, receipt, recording, organisation, storage, updating, retrieval, consultation, use, sharing, publication, linking, restriction, deletion or destruction;
“Responsible Party” refers to the person who, alone or together with others, determines the purpose of and means for Processing Personal Information;
“Special Personal Information” refers to Personal Information concerning religious or philosophical beliefs, race or ethnic origin, trade union membership, political persuasion, health or sex life, biometric information or criminal behaviour; and
“Website” refers to www.waspa.org.za and any online portal, database, subdomain, form or service operated by or on behalf of WASPA and expressly made subject to this Policy.
Words defined in POPIA or PAIA have the meanings assigned to them in those Acts. References to legislation include amendments, regulations and replacement legislation.

5. WASPA’S ROLE IN PROCESSING PERSONAL INFORMATION

WASPA will ordinarily act as the Responsible Party when it determines why and how Personal Information is Processed for its membership, consumer-support, complaints, governance, regulatory, Website, security and administrative functions.
A WASPA member, mobile network operator, regulator, adjudicator, appeal panel member, professional adviser or other recipient may act as a separate Responsible Party for information disclosed to it where it determines its own purposes and means of Processing.
Where WASPA Processes Personal Information only on the documented instructions of another Responsible Party, WASPA may act as an Operator. The applicable agreement or form-specific notice will govern that Processing.
Nothing in this Policy makes WASPA responsible for a member’s independent Processing of consumer information outside the WASPA process.

6. DATA SUBJECTS COVERED

WASPA may Process Personal Information relating to:
1. website visitors and portal users;
2. consumers, complainants members of the public;
3. a Child whose information is lawfully submitted by a Competent Person;
4. representatives, employees, officers, directors, owners and contacts of members and prospective members;
5. mobile network operator personnel and customers whose queries are submitted by an operator;
6. adjudicators, the WASPA Head of Complaints, appeal panel members, experts and witnesses;
7. regulators, public bodies, industry stakeholders and media representatives;
8. suppliers, contractors, professional advisers and service providers; and
9. any other identifiable person mentioned in a submission, attachment, communication or case record.

7. PERSONAL INFORMATION WASPA MAY COLLECT

Depending on the service used and the information voluntarily or lawfully provided, WASPA may Process the following categories:
1. Identity information: names, surnames, titles, identity or registration details, age or date of birth where relevant, signatures and proof of identity or authority.
2. Contact information: email addresses, mobile and fixed-line numbers, physical and postal addresses, and communication preferences.
3. Member and business information: registered and trading names, registration and tax details, websites, logos, public support contacts, addresses, service categories, network relationships, membership category, account status, representatives and billing contacts.
4. Consumer-service information: mobile numbers, network operator, billing and subscription details, network logs, short codes, service-provider details, message content (where allowable in law), dates and times, transaction references, cancellation or refund information, and complaint history.
5. Complaint and evidentiary information: allegations, responses, correspondence, witness information, screenshots, recordings, invoices, advertisements, contracts and other supporting material.
6. Portal and account information: usernames, email addresses, password credentials in protected form, access permissions, authentication events, profile information and activity logs.
7. Financial and administrative information: invoices, payments, banking details where necessary, tax records and transaction information.
8. Communications: emails, telephone notes, meeting records, media queries, survey responses and other correspondence.
9. Technical information: IP addresses, browser type, device information, date and time of access, referring pages, session identifiers, cookies, error logs and security events.
10. Special personal information: only where necessary and lawfully authorised, including information about health, race, political views, trade-union membership, alleged criminal conduct or other sensitive matters contained in a complaint or supporting document.
11. Children’s information: only where lawfully submitted and Processed under clause 13.
12. Publicly available information: information from public company records, member websites, public directories, regulatory publications, media reports and other lawful public sources.
WASPA does not require a person to submit bank-card data, account passwords, identity documents or Special Personal Information unless a particular process expressly requires it. Persons should redact irrelevant sensitive information before uploading documents.
WASPA may create case references, internal classifications, risk indicators, trend information, summaries, reports and de-identified or aggregated information derived from submitted information.

8. HOW WASPA OBTAINS PERSONAL INFORMATION

WASPA may obtain Personal Information:
1. directly from the Data Subject through a form, portal, email, telephone call, meeting or other communication;
2. from a person acting for or authorised by the Data Subject, including a mobile network operator employee lodging a query for a customer;
3. from a WASPA member responding to or escalating a query or complaint;
4. from adjudicators, appeal panels, legal advisers, the WASPA secretariat, experts and other participants in a WASPA process;
5. automatically through use of the Website and security or analytics technologies;
6. from public sources, regulators, mobile network operators, industry databases and lawful third-party sources; or
7. from another person where direct collection is not reasonably practicable or an exception in POPIA applies.
Where Personal Information is not collected directly from the Data Subject, WASPA will provide the information required by section 18 of POPIA before collection or as soon as reasonably practicable afterwards, unless an applicable exception permits otherwise.
Notification at the time of collection – Before collecting Personal Information directly from a Data Subject, or as soon as reasonably practicable after collecting it from another source, WASPA will take reasonably practicable steps to ensure that the Data Subject is informed of:
1. the Personal Information being collected and, where it is not collected directly from the Data Subject, the source from which it is obtained;
2. WASPA’s name, address and contact details;
3. the specific purpose for which the information is collected;
4. whether the provision of the information is voluntary or mandatory;
5. the reasonably foreseeable consequences of failing to provide the information;
6. any particular law which authorises or requires its collection;
7. any intended transfer to a foreign country or international organisation and the safeguards or level of protection applicable to that transfer;
8. the recipients or categories of recipients to whom the information may be disclosed;
9. the Data Subject’s rights of access, correction, deletion, objection and withdrawal of consent, where applicable; and
10. the right to lodge a complaint with the Information Regulator and the Regulator’s contact details.
Mandatory and optional information – Unless a particular form or notice states otherwise, the provision of Personal Information to WASPA is voluntary. Information marked as “required” or “mandatory” on a form must, however, be provided if the Data Subject wishes WASPA to process the relevant application, complaint, query, account request or other submission. Failure to provide required information may result in WASPA being unable to identify the relevant member or service provider, investigate or adjudicate a complaint, process a membership application, provide portal access, respond to the request or comply with an applicable legal obligation.
Form-specific notices – Where the voluntary or mandatory nature of information, the consequences of non-provision, the applicable legal authority or the intended recipients differ according to the service concerned, WASPA will provide a more specific notice on or alongside the relevant Website form.

9. PURPOSES FOR WHICH PERSONAL INFORMATION IS PROCESSED

WASPA may Process Personal Information for one or more of the following purposes:
1. to operate, maintain, secure, improve and administer the Website and member portal;
2. to verify identities, authority, affiliations and account access;
3. to receive, assess, route, investigate, mediate, adjudicate, appeal, resolve, monitor and report on complaints, spam/scam reports and unwanted-billing queries;
4. to identify the relevant WASPA member, service provider or mobile network operator;
5. to facilitate cancellations, unsubscribe requests, refunds, corrective action or other complaint outcomes;
6. to process membership applications and administer membership fees, Code of Conduct issues and/or member communications;
7. to communicate with Data Subjects about their submissions, accounts, membership, events, meetings, policy matters, regulatory developments or other legitimate WASPA activities;
8. to appoint and administer adjudicators, appeal panels, advisers and service providers;
9. to enforce the WASPA Constitution, Code of Conduct, membership requirements, rulings and lawful decisions;
10. to compile de-identified or appropriately aggregated statistics, trends, compliance insights and industry reports;
11. to publish member information and adjudication or appeal reports as described in clause 15;
12. to engage with mobile network operators, regulators, government bodies, industry stakeholders and law-enforcement bodies;
13. to comply with legal, regulatory, tax, accounting, audit, governance and record-keeping duties;
14. to establish, exercise or defend legal rights or claims;
15. to prevent, detect and investigate misuse, fraud, security incidents, malicious submissions and unlawful conduct; and
16. for any further compatible purpose permitted by POPIA or any additional purpose disclosed to the Data Subject.

10. LEGAL JUSTIFICATIONS FOR PROCESSING

WASPA will Process Personal Information only where a justification recognised by POPIA applies. Depending on the circumstances, this may include:
1. Consent: the Data Subject or Competent Person has given voluntary, specific and informed permission. Consent may be withdrawn, but withdrawal does not invalidate prior lawful processing.
2. Contract: Processing is necessary to conclude or perform a contract to which the Data Subject is party, including membership and service arrangements.
3. Legal obligation: Processing is necessary to comply with an obligation imposed by law.
4. Legitimate interests of the Data Subject: Processing protects or advances a legitimate interest of the Data Subject, such as helping resolve an unwanted-billing query.
5. Public-law duty: Processing is necessary for the proper performance of a public-law duty by a public body, where applicable.
6. Legitimate interests of WASPA or a third party: Processing is necessary to pursue a legitimate operational, governance, industry, security, dispute-resolution or legal interest, balanced against the Data Subject’s rights.
7. Other statutory authorisation: Processing of Special Personal Information or a Child’s information is authorised by POPIA or another law.
WASPA will not rely on consent where another lawful justification is more appropriate merely because a form contains a consent checkbox.
Where a person objects to Processing based on legitimate interests, WASPA will stop that Processing unless it can demonstrate a lawful basis to continue, including compelling legitimate grounds or the establishment, exercise or defence of a legal right.

11. WEBSITE FORMS AND SPECIFIC PROCESSING ACTIVITIES

Membership applications and member administration
1. WASPA Processes organisational information, public member information, representative and contact details, service information, network relationships, logos, billing contacts and related records to assess and administer membership.
2. Information identified on a membership form as public information may be displayed in WASPA’s public member directory or related service-search tools.
3. WASPA may use member contact details for Code of Conduct escalations, billing, governance, voting, meetings, notices, regulatory engagement and member services in a manner consistent with the membership agreement and WASPA’s governing documents.
Complaints and formal adjudication
1. WASPA may collect the complainant’s contact details, mobile numbers, network information, details of the member or service, allegations, affiliations, supporting documents, responses and procedural records to attempt informal resolution or conduct formal adjudication and appeal processes.
2. The information will ordinarily be disclosed to the relevant member and may be disclosed to the secretariat, complaint handlers, independent adjudicators, appeal panel members, Head of Complaints, legal advisers, experts, mobile network operators and regulators to the extent reasonably necessary.
3. A complainant should not expect that a complaint can be investigated anonymously where procedural fairness requires the member to know and answer the material case against it. WASPA may however withhold or redact information where lawful and appropriate.
4. WASPA may decline to Process a complaint or may request additional information where the available information is insufficient, excessive, irrelevant, unlawful, malicious or outside WASPA’s jurisdiction.
Spam/scam and unwanted-billing reports
1. WASPA Processes names, contact details, mobile numbers, message or billing information and service-provider information to identify the relevant member, facilitate removal, cancellation or resolution, monitor patterns and support Code compliance.
2. Where a report does not identify a member, the report may be retained in WASPA’s monitoring database and used to identify patterns, repeat senders, service providers or potential breaches.
3. Where a mobile network operator submits a consumer query, the operator must confirm that it has appropriate authority and has given the consumer the required privacy information. WASPA may rely reasonably on that confirmation, without limiting its own obligations.
General enquiries, media queries and stakeholder engagement
1. WASPA Processes contact details and correspondence to respond to enquiries, determine jurisdiction, engage with the media and stakeholders, and refer matters to a more appropriate member, operator, regulator or body where authorised or otherwise lawful.
Member portal and online accounts
1. WASPA Processes account details, credentials, permissions and activity records to authenticate users, provide access to member resources, permit member administrators to manage users, protect systems and maintain audit trails.
2. A member who creates or manages another user’s account must be authorised to provide and manage that person’s information.
3. Users must keep credentials confidential and notify WASPA promptly of suspected unauthorised access.

12. INFORMATION CONCERNING OTHER PERSONS

A person who provides WASPA with Personal Information about another person must ensure that:
1. the information is accurate, relevant and not excessive;
2. there is a lawful justification for providing it;
3. the person has authority to do so, including authority from a Competent Person where a Child is involved;
4. the other person has received any privacy notification required by law; and
5. supporting documents are redacted to remove unrelated Personal Information.
WASPA may contact the other person to verify authority, provide notice, obtain further information or protect that person’s rights.
WASPA may remove, restrict or refuse information that appears unlawfully obtained, irrelevant, excessive or unsafe to Process.

13. SPECIAL PERSONAL INFORMATION AND INFORMATION OF CHILDREN

WASPA does not intentionally solicit Special Personal Information or a Child’s information unless it is reasonably necessary for a particular complaint, legal, governance or employment-related process.
A person submitting such information must disclose only what is necessary and must select or complete any required declaration concerning the information.
WASPA may Process Special Personal Information only where the Processing is permitted by sections 26 to 33 of POPIA or another law, including where consent has been obtained, the information is necessary for the establishment, exercise or defence of a right or obligation in law, or the information was deliberately made public by the Data Subject.
WASPA may Process Personal Information concerning a Child only where section 35 of POPIA or another lawful authorisation applies, including prior consent of a Competent Person or where Processing is necessary for the establishment, exercise or defence of a right or obligation in law.
WASPA may request proof of age, guardianship or authority and may suspend Processing until adequate proof is provided.
WASPA will apply heightened access, disclosure, redaction, retention and security controls where the information creates an increased risk to a Child or another vulnerable person.

14. WEBSITE, PORTAL, COOKIES AND TECHNICAL INFORMATION

When a person accesses the Website, WASPA and its Operators may automatically Process technical information needed to provide, secure, diagnose and improve the service.
The Website may use cookies, local storage, session identifiers, scripts, pixels or similar technologies for the categories described in Schedule 3.
Strictly necessary cookies may be used without which the Website, portal, forms, security controls or requested functionality cannot operate properly.
Where non-essential technologies Process Personal Information, WASPA will use an appropriate POPIA justification and, where required or selected as the justification, obtain consent. A user may adjust browser or cookie settings, but disabling necessary technologies may impair functionality.
WASPA may use anti-spam, bot-detection, content-delivery, hosting, security, analytics and embedded-content services. Those services may receive IP addresses, device details and interaction information. WASPA will identify material third-party technologies in its cookie settings or a cookie schedule where reasonably practicable.
WASPA does not intentionally use website information for third-party behavioural advertising unless this is clearly disclosed and lawfully authorised.
Portal passwords should be stored only in a protected, non-readable form. WASPA will never ask a user to disclose an existing password by email.

15. PUBLIC INFORMATION AND PUBLICATION

WASPA may publish information that is intended to be public, including member names, logos, websites, service categories and customer-support details supplied for the public directory.
WASPA may publish adjudication and appeal reports to promote transparency, consistency, precedent, consumer protection and Code enforcement.
Before publication, WASPA will take reasonably practicable steps to redact or de-identify direct identifiers and information that is not necessary to understand the decision. However, a report may include correspondence, facts or other contextual information necessary for the report to be intelligible, procedurally fair and useful as precedent, including Personal Information pertaining to the member and/or the complainant.
WASPA will take particular care before publishing information of a Child, Special Personal Information, identity numbers, home addresses, personal contact details, bank information or other high-risk information.
Published reports and other public records may be indexed, copied, archived or republished by third parties. WASPA cannot guarantee complete removal from third-party systems after lawful publication.
A person may request correction, further redaction or removal of published personal information. WASPA will assess the request against POPIA, PAIA, procedural fairness, precedent, freedom of expression, public interest and its lawful record-keeping duties.

16. DISCLOSURE OF PERSONAL INFORMATION

WASPA may disclose Personal Information, to the extent necessary and lawful, to:
1. the WASPA member or prospective member concerned;
2. other parties to a complaint, query, adjudication or appeal;
3. the WASPA secretariat, Board, committees, office bearers and authorised personnel;
4. independent adjudicators, appeal panel members, experts and witnesses;
5. legal, regulatory, public-relations, accounting, audit, IT, hosting, security, communications and administrative service providers;
6. mobile network operators, aggregators and other industry participants able to identify or resolve a matter;
7. the Information Regulator, ICASA, the National Consumer Commission, the FPB, government departments, courts, tribunals, law-enforcement bodies or other competent authorities;
8. banks, auditors, insurers and professional advisers where relevant;
9. a successor, restructuring party or service provider involved in a lawful transfer or continuity arrangement; and
10. any other person authorised by the Data Subject or permitted or required by law.
WASPA will seek to disclose only information reasonably necessary for the recipient’s role.
WASPA may disclose information without consent where another POPIA justification applies, including legal obligation, legitimate interests, protection of rights, prevention or investigation of unlawful conduct, or compliance with lawful process.
De-identified or aggregated information that cannot reasonably be re-identified may be shared for statistics, research, policy, industry engagement and public reporting.

17. OPERATORS AND SERVICE PROVIDERS

WASPA may appoint Operators to host systems, manage forms and case records, provide email and communications, administer the secretariat, support accounts, process payments, provide legal or public-relations services, conduct security monitoring or perform other functions.
WASPA will require an Operator that Processes Personal Information for WASPA to:
1. Process the information only with WASPA’s knowledge or authorisation and in accordance with the applicable mandate;
2. treat the information as confidential;
3. establish and maintain appropriate security safeguards;
4. notify WASPA immediately of suspected security compromises;
5. assist WASPA with lawful Data-Subject requests and compliance duties; and
6. return, delete or securely dispose of information when the service ends, subject to lawful retention.
Certain professional advisers and independent adjudicators may be separate Responsible Parties rather than Operators because their professional or adjudicative independence requires them to determine aspects of their own Processing.

18. CROSS-BORDER TRANSFERS

Some Operators, cloud services, communications providers or recipients may Process or store Personal Information outside South Africa.
WASPA will transfer Personal Information to a third party in a foreign country only where:
1. the recipient is subject to a law, binding corporate rules or a binding agreement which provides an adequate level of protection substantially similar to the conditions for lawful Processing under POPIA and includes appropriate safeguards governing further transfers to third parties in other foreign countries;
2. the Data Subject consents to the transfer;
3. the transfer is necessary for the performance of a contract between the Data Subject and WASPA, or for the implementation of pre-contractual measures taken in response to the Data Subject’s request;
4. the transfer is necessary for the conclusion or performance of a contract concluded in the interests of the Data Subject between WASPA and a third party; or
5. the transfer is for the benefit of the Data Subject, it is not reasonably practicable to obtain consent and the Data Subject would likely have consented had it been reasonably practicable to obtain consent.
WASPA will take reasonably practicable steps to assess the safeguards applicable to material cross-border services and to impose suitable contractual protections where required.
Where reasonably practicable and required by section 18 of POPIA, WASPA will identify in a form-specific notice, cookie schedule or operator schedule the country or international organisation to which Personal Information is intended to be transferred and the nature of the protection applicable to that transfer.

19. INFORMATION QUALITY AND UPDATING INFORMATION

WASPA will take reasonably practicable steps, having regard to the purpose for which information is Processed, to ensure that Personal Information is complete, accurate, not misleading and updated where necessary.
Data Subjects should update information promptly.
WASPA may verify information against member records, public records, network information or other reliable sources where lawful and relevant.

20. SECURITY SAFEGUARDS

WASPA will secure the integrity and confidentiality of Personal Information in its possession or under its control by taking appropriate, reasonable technical and organisational measures to prevent loss, damage, unauthorised destruction, unlawful access or unlawful Processing.
In giving effect to clause 20.1, WASPA will:
1. identify all reasonably foreseeable internal and external risks to Personal Information in its possession or under its control;
2. establish and maintain safeguards appropriate to the risks identified;
3. regularly verify that those safeguards have been effectively implemented;
4. continually review and update the safeguards in response to new risks, incidents, technological developments or identified deficiencies; and
5. have due regard to generally accepted information-security practices and any applicable industry, professional, contractual or regulatory requirements.
Safeguards may include, as appropriate:
1. role-based access controls and least-privilege permissions;
2. password, authentication and account-management controls;
3. encryption in transit and, where appropriate, encryption or equivalent protection at rest;
4. secure backups and recovery procedures;
5. logging, monitoring, malware protection and vulnerability management;
6. confidentiality undertakings, staff training and access reviews;
7. Operator due diligence and written data-protection obligations;
8. secure development, patching and change-control practices;
9. physical safeguards for devices and records; and
10. secure deletion, destruction or de-identification.
No electronic transmission or storage system is completely secure. WASPA does not guarantee absolute security, but will review safeguards regularly and update them where reasonably necessary.
Users must not upload malicious files, share credentials, attempt unauthorised access or submit information through insecure channels where a secure alternative is available.

21. PERSONAL INFORMATION SECURITY COMPROMISES

Where there are reasonable grounds to believe that personal information has been accessed or acquired by an unauthorised person, WASPA will investigate and act in accordance with section 22 of POPIA.
WASPA will notify the Information Regulator and, unless the identity of the affected Data Subject cannot be established, the affected Data Subject as soon as reasonably possible after discovering the compromise. In determining the timing of notification, WASPA may take into account the legitimate needs of law enforcement and measures reasonably required to determine the scope of the compromise and restore the integrity of its information systems.
Notification to an affected Data Subject may be delayed only where a public body responsible for preventing, detecting or investigating offences, or the Information Regulator, determines that notification would impede a criminal investigation.
Notification to a Data Subject will be in writing and may be communicated by email, post, prominent notice on the Website, publication in appropriate media or another method directed by the Information Regulator.
The notification will contain sufficient information to enable the Data Subject to take protective measures and will include, where applicable:
1. a description of the possible consequences of the compromise;
2. the measures WASPA has taken or intends to take to address it;
3. recommendations to mitigate possible adverse effects; and
4. where known, the identity of the unauthorised person who may have accessed or acquired the information.
WASPA will comply with any direction from the Information Regulator requiring the compromise to be publicised in a specified manner.
Operators, members and other recipients must notify WASPA immediately if a compromise affects information Processed for or received through a WASPA process.

22. RETENTION, ARCHIVING AND DESTRUCTION

WASPA will not retain Personal Information longer than is necessary to achieve the purpose for which it was collected or subsequently lawfully processed, unless:
1. retention is required or authorised by law;
2. WASPA reasonably requires the record for lawful functions, complaints, precedent, audit, governance, security, legal claims or contractual purposes;
3. a contract requires retention;
4. the Data Subject or Competent Person consents; or
5. the information is retained for historical, statistical or research purposes with appropriate safeguards.
WASPA’s current general retention benchmark for website form information is 3 (Three) years, but the applicable period depends on the record and may be shorter or longer as set out in Schedule 2.
When retention is no longer authorised, WASPA will destroy, delete or de-identify the information in a manner that prevents reconstruction in an intelligible form.
WASPA may restrict information rather than delete it where accuracy is disputed, evidence must be preserved, legal claims are contemplated, or another lawful restriction ground applies.
Backups may retain residual copies for a limited rolling period. Such copies will remain protected and will not ordinarily be restored except for continuity, security or disaster-recovery purposes.
Published adjudication and appeal reports may be retained indefinitely as a historical and precedent archive, subject to appropriate redaction and lawful requests under clause 15.6.

23. DATA SUBJECT RIGHTS

Subject to POPIA, PAIA and any lawful ground of refusal, a Data Subject may:
1. obtain from WASPA, free of charge, confirmation as to whether WASPA holds Personal Information about the Data Subject;
2. request access to the record or a description of the Personal Information and information about categories of recipients;
3. request correction or deletion of inaccurate, irrelevant, excessive, outdated, incomplete, misleading or unlawfully obtained information;
4. request destruction or deletion of information that WASPA is no longer authorised to retain;
5. object, on reasonable grounds relating to the Data Subject’s particular situation, to Processing based on legitimate interests;
6. object at any time to Processing for direct marketing;
7. withdraw consent where Processing is based on consent;
8. request restriction while a dispute, verification or legal issue is resolved;
9. not be subject to certain decisions based solely on automated Processing;
10. be notified of collection and qualifying security compromises; and
11. lodge a complaint with the Information Regulator or institute proceedings where permitted by law.
These rights are not absolute. WASPA may refuse, limit or defer a request where PAIA, POPIA, privilege, confidentiality, procedural fairness, another person’s rights, legal proceedings, law-enforcement interests or another lawful ground applies.
Deleting information may prevent WASPA from continuing to Process a complaint, provide portal access, administer membership or comply with a legal obligation.

24. HOW TO EXERCISE RIGHTS

A request should be sent to the Information Officer using the details in clause 2 and should clearly identify:
1. the Data Subject and, if applicable, the authorised representative;
2. the information or Processing activity concerned;
3. the right being exercised and the outcome requested;
4. sufficient information to locate the record; and
5. the preferred contact method.
WASPA may require reasonable proof of identity and authority before disclosing or changing information. Proof will be used only for verification and related compliance purposes.
Requests for access to records must be made in accordance with PAIA and WASPA’s PAIA Manual. Requests for correction, deletion or objection may be made using the prescribed POPIA forms or a substantially similar written request.
WASPA will respond within the period required by applicable law and may charge only fees lawfully prescribed.
Where a request affects an active complaint, adjudication, appeal or legal process, WASPA may preserve or restrict the relevant information until the process and applicable review periods have concluded.

25. DIRECT MARKETING AND COMMUNICATIONS

Operational communications about a complaint, membership, account, meeting, ruling, invoice, regulatory matter or requested service are not treated as direct marketing merely because they are sent electronically.
WASPA will not Process Personal Information for direct marketing by means of unsolicited electronic communication unless:
1. the Data Subject has given valid consent; or
2. the Data Subject is an existing customer of WASPA and all the requirements of section 69(3) of POPIA are met.
Where consent is required, WASPA may approach a Data Subject only once to request consent, provided that the Data Subject has not previously withheld or withdrawn consent. Consent will be requested in the manner and form prescribed by applicable law.
WASPA may rely on the existing-customer exception only where:
1. the contact details were obtained in the context of the sale or provision of a product or service;
2. the marketing relates to WASPA’s own similar products or services; and
3. the Data Subject was given a reasonable opportunity, free of charge and without unnecessary formality, to object when the information was collected and in every subsequent marketing communication.
Every direct-marketing communication will identify WASPA or the person on whose behalf it is sent and will provide an address or other functional contact mechanism through which the recipient may request that the communications cease.
WASPA will honour objections and withdrawals of consent and may retain the minimum suppression information necessary to ensure that the person is not contacted again for the relevant marketing purpose.
A person may opt out of optional communications at any time. WASPA may retain the minimum information necessary to record and honour the objection.
Opting out of marketing will not prevent communications necessary to administer membership, an account, a complaint, a legal obligation, the Do-Not-Contact database or another requested service.

26. AUTOMATED DECISION-MAKING

WASPA may use automated tools to route forms, detect spam or malicious activity, match information to a member or service, generate case references, prioritise security events or assist administrative review.
WASPA does not currently subject a Data Subject to a decision which produces legal consequences or affects the Data Subject to a substantial degree where that decision is based solely on automated Processing intended to create or apply a profile of that person.
Material decisions concerning complaints, membership, sanctions and appeals will not be made solely through automated Processing and will be subject to meaningful human consideration.
If WASPA introduces automated decision-making falling within section 71 of POPIA and relies on an exception permitted by that section, WASPA will implement appropriate safeguards, including:
1. giving the Data Subject a reasonable opportunity to make representations concerning the decision; and
2. providing sufficient information about the underlying logic of the automated Processing to enable the Data Subject to make meaningful representations.

27. THIRD-PARTY WEBSITES AND SERVICES

The Website may link to third-party websites or services, including mobile network operators, regulators, members, social-media services, embedded content and a do-not-contact service.
A third-party service may collect information directly from the user and apply its own terms and privacy policy. WASPA is not responsible for independent third-party Processing that it does not control.
A link does not imply that WASPA endorses the third party’s privacy practices. Users should review the applicable third-party privacy notice before submitting information.

28. CHANGES TO THIS POLICY

WASPA may amend this Policy to reflect changes in law, guidance, technology, services, membership processes or Processing activities.
The updated Policy will be published on the Website with a revised effective date. Where a change materially affects an existing Processing activity, WASPA will take reasonably practicable steps to notify affected persons or obtain fresh consent where required.
Previous versions may be retained for accountability and audit purposes.

29. COMPLAINTS AND CONTACT DETAILS

Questions, objections, requests and complaints should first be directed to WASPA’s Information Officer:
Information Officer: Anthony Ekerold
Email:
Physical address: First Floor, Block A, One the Boulevard, Westway Office Park, 7 Harry Gwala Road, Westville, 3629, KwaZulu-Natal, South Africa
A person who is not satisfied with WASPA’s response may lodge a complaint with the Information Regulator:
Information Regulator (South Africa)
Physical address: Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191
Postal address: P.O. Box 31533, Braamfontein, Johannesburg, 2017
General enquiries:
POPIA complaints:
Telephone: 010 023 5200
Toll-free: 0800 017 160
The Information Regulator’s contact details and complaint channels may change. The current details on the Regulator’s official website or eServices portal should be used.

SCHEDULE 1 – PROCESSING ACTIVITIES

Activity	Typical information	Purpose and usual recipients	Primary justification
Website use	IP address, device, browser, logs, cookies, security events	Deliver and secure the Website; operators such as hosting, security and analytics providers	Legitimate interests; consent where applicable
Member portal	Account details, credentials, permissions, activity logs	Authenticate users, provide member services, audit and secure access; portal operators	Contract; legitimate interests
Membership application	Company details, representatives, support contacts, services, logos, network relationships	Assess and administer membership; Board/secretariat, advisers and relevant operators	Contract steps; legitimate interests; consent where required
Member directory	Member name, logo, website, services and public support details	Publish and maintain public member information	Contract; legitimate interests; consent for optional personal details
Complaints	Complainant details, mobile numbers, allegations, attachments, responses and procedural records	Resolve, adjudicate, appeal and enforce; member, adjudicators, advisers, MNOs and regulators	Legitimate interests; data-subject interests; legal rights; consent where required
Spam/scam reports	Name, mobile number, message content, sender, screenshots	Identify sender, facilitate removal, monitor trends and Code compliance	Data-Subject interests; legitimate interests
Unwanted billing	Name, mobile number, billing/service data, network, case updates	Identify and cancel services, resolve billing query; member/MNO	Data-Subject interests; legitimate interests
General/media enquiries	Name, contact details, organisation, message	Respond, refer or engage with the requester	Consent; legitimate interests
Adjudication publication	Decision, facts and necessary contextual information after redaction	Transparency, precedent, consumer protection and Code enforcement	Legitimate interests; legal rights
Regulatory engagement	Stakeholder contacts, submissions, meeting and policy records	Industry representation, compliance and public-policy engagement	Legitimate interests; legal obligations
Finance/administration	Billing contacts, invoices, payments and tax information	Membership billing, accounting, audit and tax compliance	Contract; legal obligation
Privacy/PAIA requests	Identity verification, request details and response records	Verify and fulfil rights requests; Information Officer and advisers	Legal obligation
Security/investigations	Logs, account activity, suspicious submissions, incident information	Prevent, detect, investigate and remediate misuse or compromise	Legitimate interests; legal obligation

SCHEDULE 2 – INDICATIVE RETENTION SCHEDULE

Record category	Indicative period	Notes
Abandoned or incomplete web forms	Up to 90 days	Unless required for security, troubleshooting or a pending submission.
General contact and media enquiries	3 years after closure	May be shorter for routine enquiries with no continuing value.
Spam/scam and unwanted-billing case records	3 years after closure	De-identified trend information may be retained longer.
Informally resolved complaints	3 years after closure	Longer where repeat conduct, enforcement, litigation or audit requires.
Formal adjudication and appeal case files	At least 5 years after final closure, although could also be indefinitely	May be longer for precedent, enforcement or legal claims.
Published adjudication and appeal reports	Indefinite	Subject to redaction, correction and lawful removal requests.
Unsuccessful or withdrawn membership applications	3 years after final decision	Unless a dispute or reapplication justifies longer retention.
Active member and portal records	Membership/account duration plus up to 5 years	Public directory data is removed or updated when membership changes, subject to archive needs.
Financial, tax and accounting records	As required by law, ordinarily at least 5 years	Applicable legislation and audit requirements prevail.
Consent, objections and communication preferences	5 years after last reliance or opt-out	Minimum suppression data may be retained to honour an objection.
Website and security logs	Usually 12 months	May be longer for an incident, investigation or legal requirement.
Security incident and breach records	At least 5 years after closure	Includes investigation, notification and remediation records.
POPIA and PAIA requests	5 years after final response	Longer if a complaint, review or litigation follows.
Operator and supplier records	Contract duration plus up to 5 years	Subject to tax, audit, claims and contractual requirements.
Backups	Rolling period, ordinarily not more than 180 days	Residual copies remain protected and are overwritten in the ordinary cycle.

SCHEDULE 3 – COOKIE AND SIMILAR TECHNOLOGY CATEGORIES

WASPA may use the following technology categories. The exact names, providers and durations should be made available through a cookie banner, settings tool or current cookie schedule after a technical scan of the Website.

Category	Purpose	Typical duration	Control
Strictly necessary	Session management, form operation, authentication, load balancing and core functionality	Session or short persistent period	Usually cannot be disabled without impairing the service
Security and anti-abuse	Bot detection, rate limiting, fraud prevention and protection against malicious submissions	Session to limited persistent period	Necessary or legitimate-interests processing; third-party controls may apply
Preferences	Remember language, display or user choices	Session to 12 months	Can ordinarily be cleared through browser or cookie settings
Analytics/performance	Measure visits, errors, page performance and aggregate usage to improve the Website	Typically up to 24 months	Consent or another appropriate justification; opt-out where applicable
Embedded content	Display maps, video, social-media or external content	Determined by provider	May require consent; provider’s privacy notice also applies

END OF POLICY

CONTENTS