I. CHANGE CONTROL – DOCUMENT CHANGE HISTORY 

Version no.	4.0
Date of version	7 November 2023
Date of next review	31 October 2025
Policy owner	Elmarie Smuts
Approved by	Elmarie Smuts and Naeem Gabru

II. DOCUMENT APPROVAL 

Authorised	Name & Surname	Signature	Date of approval
Group Risk Officer	Elmarie Smuts		7 November 2023
Group CIO	Naeem Gabru		7 November 2023

Thank you for visiting our website. At IronTree we take the protection of personal information seriously and we are sensitive to your privacy interests. The purpose of this Privacy Policy is to describe how we collect, use, store and disclose personal information that data subjects provide to us, what we learn about data subjects from their visit to our website, as well as to explain the choices and rights that data subjects have regarding their personal information. 

All references to ‘our’, ‘us’, ‘we’ or ‘company’ within this policy are deemed to refer to Metrofile Holdings Limited (“Metrofile”), its subsidiaries, affiliates, parent companies and any of their respective associated companies and related businesses (“Metrofile Group” or “Group”). 

This Privacy Policy applies to all prospective, present and past Metrofile Group stakeholders, including, but not limited to, the following: 

• Visitors to our website available at: www.irontree.co.za 
• Employees (including permanent, temporary or contract employees) 
• Clients or prospective clients  
• Third parties, including but not limited to, suppliers and service providers to any member of the Metrofile Group 
• Investors 

All of the above collectively referred to as “you” 

It should be noted that additional privacy requirements and notices, as applicable, will be included subject to the relationships that we have with you. For example, where we process the personal information of data subjects on behalf of our clients (i.e. where we are acting in the capacity as an “operator”), additional privacy requirements may be stipulated in the binding legal contract/s between us and our client. In addition, where any third party processes personal information of our or our clients’ data subjects, (ie where such third party is acting in its capacity as an operator), additional privacy requirements will be included and/or required in binding legal contracts with such third party. 

In addition, by using our website, you agree to the terms of this Privacy Policy.  

We reserve the right to modify, add or remove certain sections of this Privacy Policy and we encourage you to visit this Privacy Policy on a continuous basis to familiarise yourself with this Privacy Policy. 

1. COLLECTION AND PROCESSING OF PERSONAL INFORMATION 

Website and web applications: 

While visiting our website or web applications/portals, you may be requested to provide certain personal information, which identifies you as an individual (including, but not limited to, your name and contact details). Such information may be collected in the following manner: 

• On registration on the web applications/portals; 
• When logging onto the web applications/portals we collect information about your online identifiers including your username and password to authenticate your access into the system; 
• On a voluntary basis when you submit an enquiry form, we request mandatory identifying information (including, your name, email address and phone number);  
• On a voluntary basis when you use the live chat functionality, where applicable; 
• On a voluntary basis when you sign up for our newsletter;  
• On a voluntary basis when you submit an enquiry or subscribe to content on our investor relations page. 

Clients, service providers, other third parties and employees: 

In order for the Metrofile Group to provide the products or services procured by its clients, it requires certain of the client’s personal information. The client’s personal information will be processed by IronTree in order to provide the products or services and will be processed in accordance with this Privacy Policy and applicable contracts between IronTree and its client.  

In addition, IronTree will process service providers/ employees’ personal information only to give effect to the processing activities of personal information as noted in this Privacy Policy and applicable contracts between IronTree and its service providers/ employees. 

1.1. CONSENT 

We will obtain your consent to collect your personal information to the extent we are required by applicable law to give effect to the processing of your information as noted in this Privacy Policy.  

At any time, should you not wish to receive direct marketing from us, please inform us at [email protected]  in order to unsubscribe. In addition, each time we send you marketing information by e-mail or any other means, we will provide an opportunity for you to unsubscribe from receiving further information from us. 

1.2. PURPOSE FOR COLLECTION

We may process your personal information in several ways including when you: 

• Visit our website, we may collect usage information which may include your IP address, geographical location, cookies, browser type and version, operating system, referral source, duration of visit, page views and website navigation paths, as well as information about the timing, frequency and pattern of your service use. This information may be processed for the purposes of analysing the use of the website and improving usability; 
• Provide personal information when purchasing our products and/ or services. The information is processed for use and/ or the administration of the contract with you and to supply the products and/ or services you require, communicating with you and establishing and maintaining a business relationship with you. The personal information we collect  may include, but is not limited to, your business name, registration number, vat number, directors’ and representatives’ first names and surnames, credit card information or bank account details, and, registered and/or business address and email address.  
• Provide personal information in the course of a submission of an enquiry, including an enquiry pertaining to available service provider opportunities, on our “contact us” page on our website. The personal information is processed for the purpose of responding to your enquiry. The personal information we collect may include, but is not limited to, your business name, directors and representatives’ first names and surnames, registered and/or business address and email address; 
• We may process personal information that you provide to us for the purpose of subscribing to our email notifications and/ or newsletters. This information may be processed for the purposes of sending you relevant notifications and/ or newsletters. You may choose to opt-out of receiving these communications at any given time by notifying us or by unsubscribing from the mailing list; 
• On an ad-hoc basis you may provide us with certain personal information on a voluntary basis when you fill out an enquiry form in the question section of our “contact us” page, contact us via social media, when you email us, or when you provide personal information to support a request logged by you to us for the above collection means; 
• Provide personal information for a supplier or service provider opportunity in the form of request for proposal (RFP), request for quotation (RFQ) and/ or request for information (RFI). The information is processed for the purpose of carrying out a proper tender process. Such information may include, but is not limited to, information about the incorporation or registered name of your business, tax information, B-BBEE information, business address and business’ contact person’s first name, surname and/ or email address; 
• Provide personal information when we appoint or use you as a supplier or third party to purchase your products and/ or services. The information is processed for use and/ or the administration of the contract with you, and to use the products and/ or services we procure from you.  The personal information we collect may include, but is not limited to, your business name, registration number, tax information, directors’ and representatives’ first names and surnames, bank details, registered and/or business address and email address;  
• Provide personal information when we enter an employer/ employee relationship; and/or  
• Provide personal information when you become a shareholder of the company.

Note: “Process” includes collecting, receiving, recording, organising, collating, storing, updating, modifying, retrieving, altering, consulting or using, disseminating, distributing or making available and merging, linking, blocking, degrading, erasing, destroying personal information. Processing of personal information is also performed to comply with applicable laws.

1.3. COOKIES 

As many other websites, we use “cookies” (or other types of tracking software) to help us gather information from visitors to our website about you, which is not personally identifiable. For example: 

• The IP address from which you access the site 
• The type of browser and operating system used to access the site 
• The date and time of your access to the site 
• The pages you visit 
• The internet address of the website from which you accessed the site 

A cookie is a small data file that our server sends to your browser when you visit the site. The use of cookies helps us to assist your use of certain aspects of the site. You can delete cookies at any time, or you can set your browser to reject or disable cookies. If you do disable cookies some functions on the site may not work correctly. 

No information which personally identifies you will be collected through cookies. You can obtain information about how to manage cookies at www.allaboutcookies.org.  

Third parties (including, but not limited to, software providers, advertisers and ad placement agencies) may also use tracking technologies by or through the site. We have no responsibility or liability for any tracking, data collection or other activities of such third parties. 

2. STORAGE 

We may keep your personal information in either electronic or hard copy form.  In both cases, we take reasonable and appropriate reasonable technical and organisational measures to ensure that the personal information is protected from misuse and loss and from unauthorised access, modification or disclosure. 

Moreover, we will only keep your personal information for as long as is necessary to fulfil the purposes described in this Privacy Policy, unless you have given us permission to keep it longer or we are otherwise legally permitted to do so. 

3.1. DISCLOSURE 

We are not in the business of selling personal information and therefore we will not disclose your personal information to anyone except as provided in this Privacy Policy. 

3.1. THIRD PARTY DISCLOSURE 

We may disclose your Personal Information to third parties where required by law, where it is necessary to give effect to a contract with you, or where we have a legal legitimate interest in doing so. For example, we may share your Personal Information with the following third parties: 

• Other subsidiaries and entities of the Metrofile Group, some of which may be located outside the borders of your jurisdiction;  
• Our hosting and software development partners, as well as other third party service providers who assist us with operating this website, or the products and/or services;  
• Researchers and analytics providers;  
• Lawyers, bookkeepers, auditors and accountants of the Metrofile Group  
• Third parties as required by law. 

Should there be a sale, merger, consolidation, change in control, transfer of assets, reorganisation or liquidation of any member of the Metrofile Group, we may transfer your information to third parties involved in the sale, merger, consolidation, change in control, transfer of assets, reorganisation or liquidation.  

By providing any personal information to us, you fully understand and clearly consent to the fact that we may transfer such personal information in these cases. 

Note: When we share personal information with these third parties, we will require them to honour this policy, to the full extent required by applicable law.

3.2. MANDATORY DISCLOSURE  

We may disclose your personal information if permitted by law or required to do so by law or where we believe such action is necessary to protect or defend our interests or the interests of our clients or users of our site. Such instances can include disclosing your personal information to the following third parties: 

• To regulators as law or governmental audit requires; 
• Law enforcement as subpoena or court order requires; or 
• Other third parties as applicable law requires. 

4. SECURITY 

We take protection of personal information seriously and we take precautions to keep your personal information secure. Therefore, with due regard to generally accepted information security and handling practices and procedures in our industry in the applicable jurisdictions, we seek to secure the integrity and confidentiality of personal information in our possession by taking appropriate, reasonable technical and organisational measures to prevent loss of, damage to or unauthorised destruction of personal information, and unlawful access to or processing of personal information. However, as the website is accessible via the internet, and the internet is inherently insecure, we cannot guarantee the security of information you send to us online (including that it will not be intercepted).  You send information to us online at your own risk. 

5. DATA SUBJECT RIGHTS 

As a data subject of IronTree you have the right and responsibility to ensure that the personal information we hold about you is accurate. In the absence of evidence to the contrary, we will assume that the information you provided to us is accurate. At your request, where the law requires us to do so, you can exercise your data subject rights as per the following, subject to verification and validation of your identity: 

• Request access to your personal information that IronTree holds about you; 
• Request rectification of your personal information that IronTree holds about you; 
• Request erasure, as permitted by law, of your personal information that IronTree holds about you; 
• Request restriction of processing of your personal information as permitted by law; 
• Object to processing of personal information as permitted by law; 
• Lodge a complaint as it pertains to the processing activities of your personal information. 

To exercise any of the above you can contact us on [email protected] 

6. CROSS-BORDER TRANSFERS 

As is common for websites and based on our international footprint, we may automatically transfer your personal information outside of the jurisdiction in which it was collected to a foreign jurisdiction. At times, we may transfer your information to our Group companies, some of whom may be located outside the borders of your jurisdiction, for business development, market research or to share it between Group companies for direct marketing purposes. We undertake to comply with the requirements in this regard as set out in the applicable data protection legislation.  

7. GOVERNING LAW  

As a multinational, IronTree, through Metrofile Group, adheres to applicable laws where it operates. 

8. THIRD PARTY LINKS 

This site may contain links or references to other websites outside of our control. Please note that our Privacy statement as contained in this Privacy Policy does not apply to these sites and that we do not control the privacy practices of these other sites. We encourage you to read the privacy statements of linked or referenced sites you enter. 

9. DISCLAIMER  

The information, software, products, and services included in or available through the IronTree website may include inaccuracies or typographical errors. Changes are periodically added to the information herein. IronTree and/ or its suppliers may make improvements and/ or changes on the IronTree website at any time. Advice received via the IronTree website is general advice and should not be relied upon for personal, medical, legal or financial decisions or for any other specific scenario and you should consult an appropriate professional for specific advice tailored to your situation. 

IronTree and/ or its suppliers make no representations about the suitability, reliability, availability, timeliness, and accuracy of the information, software, products, services and related graphics contained on the IronTree website for any purpose. To the maximum extent permitted by applicable law, all such information, software, products, services and related graphics are provided “as is” without warranty or condition of any kind. IronTree and/ or its suppliers hereby disclaim all warranties and conditions with regard to this information, software, products, services and related graphics, including all implied warranties or conditions of merchantability, fitness for a particular purpose, title and non-infringement. 

To the maximum extent permitted by applicable law, in no event shall IronTree and/ or its suppliers be liable for any direct, indirect, punitive, incidental, special, consequential damages, losses, liabilities, claims or expenses (“Losses”) or any Losses whatsoever including, without limitation, Losses for loss of use, data or profits, arising out of or in any way connected with the use or performance of the IronTree website, or any delay or inability to use the IronTree website or related services, or the provision of or failure to provide services, or for any information, software, products, services and related graphics obtained through the IronTree website, or otherwise arising out of the use of the IronTree website, whether based on contract, delict, negligence, strict liability or otherwise, even if IronTree or any of its suppliers has been advised of the possibility of such Losses. 

Because some states/ jurisdictions do not allow the exclusion or limitation of liability for consequential or incidental damages, the above limitation may not apply to you. If you are dissatisfied with any portion of the IronTree website, or with any of these terms of use, your sole and exclusive remedy is to discontinue using the IronTree website. 

10. CONTACT DETAILS 

For any further information regarding this Privacy Policy, or for any changes in your personal information, please contact IronTree at [email protected] or at the contact details provided in the “Contact Us” section on the website. 

The Metrofile Group Privacy Officer can also be contacted at [email protected] or at the contact details provided in the “Contact Us” section on the website. 

Key definitions 

Consent refers to voluntary agreement to some act, practice or purpose. It has two elements: knowledge of the matter agreed to, and voluntary agreement. Consent can be express or implied.  

Express consent is given explicitly, either orally or in writing.  Implied consent arises where consent may reasonably be inferred in the circumstances from the conduct of the individual and the organisation. 

Data subject refers to the person (natural or juristic, where applicable) to whom the personal information relates. 

Operator refers to a person who processes personal information for a responsible party in terms of a contract or mandate, without coming under the direct authority of that party. 

‘Our’, ‘us’, ‘we’ or ‘company’ refers to Metrofile Holdings Limited (“Metrofile”), its subsidiaries, affiliates, parent companies and any of their respective associated companies and related businesses (“Metrofile Group” or “Group”). 

Personal information refers to information relating to an identifiable, living, natural person, and where it is applicable, an identifiable, existing juristic person. 

Third party refers to any entity, individual, trust, partnership, or joint venture, whom is not part of the Metrofile Group organisational structure. Examples include consultants, outsourcers, etc. 

 

Copyright © 2023 Metrofile Holdings Limited. All rights reserved.