1. ACCOUNTABILITY

OHAfrica takes full responsibility for the management and confidentiality of the personal information under its control, that is, whether personal information is held within OHAfrica or transferred to a third party for processing.

Under its accountability obligations, OHAfrica shall (a) analyze all personal information handling practices within its organization including ongoing activities and new initiatives to ensure that they meet the fair information practices, (b) develop and implement personal information policies and practices, (c) inform and train staff on privacy policies and procedures; (d) make information available explaining these policies and procedures to parties working with OHAfrica (e.g., in brochures and on Web sites); and (e) include appropriate personal information protection provisions in contracts to ensure that the third-party processors provide the same level of protection as OHAfrica does.

2. IDENTIFYING PURPOSES

The purposes for which personal information is collected, used and disclosed shall be identified by OHAfrica, either orally or in writing, at or before the time personal information is first collected from any individual.

OHAfrica shall define the purposes for collecting personal information as clearly and narrowly as reasonably possible so each individual from whom personal information is collected can understand how OHAfrica will use and disclose his or her personal information.

OHAfrica will not use personal information for any purposes other than those originally identified to an individual, without first contacting the individual(s) concerned and identifying the new purpose(s).

3. CONSENT

The knowledge and consent of an individual shall be required for the collection, use or disclosure of personal information about such individual by OHAfrica.

In carrying out its obligations under this principle, OHAfrica shall (a) inform each individual personally in a meaningful way of the purposes for the collection, use or disclosure of personal data and obtain that individual’s consent before or at the time of collection; (b) repeat the procedure for obtaining consent whenever the new or expanded purposes are identified for personal information on file; (c) obtain consent only from the individual whose personal information is collected, used or disclosed except only for an individual who is a minor, seriously ill, or mentally incapacitated, where consent may be obtained from a legal guardian, or person having power of attorney or unless consent is otherwise exempted; (d) obtain express consent whenever possible and in all cases when the personal information is considered sensitive; and (e) review all personal information in its control and shall either destroy or make anonymous such personal information or shall contact all affected individuals and obtain their consent to use such personal information for expressly identified purposes.

4. LIMITING COLLECTION

The collection of personal information shall be limited to that necessary for the purposes identified by OHAfrica. Personal information shall be collected by OHAfrica using fair and lawful means.

5. LIMITING USE, DISCLOSURE AND RETENTION

Personal information shall not be used or disclosed for purposes other than those for which it was collected by OHAfrica, except with the consent of the individual or as otherwise expressly authorized. Personal information could be retained only as long as was necessary for fulfilment of those purposes. OHAfrica shall destroy, erase or render anonymous personal information that is no longer required for an identified purpose or a legal requirement.

6. ACCURACY

OHAfrica shall ensure that personal information is accurate, complete and up-to-date for the purposes for which it was collected. OHAfrica will not seek independent verification of any personal information supplied by an individual without that individual’s permission.

7. SAFEGUARDS

OHAfrica shall ensure that personal information under its control shall be protected by security safeguards appropriate to the sensitivity of the personal information concerned.

As part of its obligations under this principle, OHAfrica shall (a) develop and implement appropriate security policies and procedures to protect personal information, taking into account the sensitivity of the personal information concerned; (b) use security safeguards, as appropriate, to provide necessary protection including physical measures (locked filing cabinets, security systems), technological tools (passwords, encryption software, firewalls,) and organizational controls (security clearances, access restrictions and confidentiality agreements); and (c) train its employees on the importance of maintaining the security and confidentiality of personal information.

8. OPENNESS

OHAfrica shall be required to make specific information about its policies and practices relating to the management of personal information readily available to the general public.

9. INDIVIDUAL ACCESS

Upon written request by any individual, OHAfrica shall inform such individual whether or not OHAfrica holds any personal information about such individual under its control and, if OHAfrica does, in fact, hold any personal information on such individual, (a) OHAfrica shall provide an account of the use and any disclosure to third parties that has and is being made of such personal information, and (b) such individual shall be given access to that information and shall have the right to challenge its accuracy and completeness and have it amended by OHAfrica to the extent that the personal information on file is incorrect or deficient.

In complying with this principle of access, OHAfrica shall (a) keep personal information about individuals in one place to make retrieval easier or keep clear records of where all such personal information on each individual can be found; (b) never disclose personal information about an individual except to that individual or such other person who is expressly allowed to access an individual’s records, (c) never disclose personal information about an individual unless OHAfrica is sure of the identity of the requestor and that person’s right of access.

10. COMPLAINTS/CHALLENGING COMPLIANCE

An individual has the right to complain to OHAfrica about any alleged breaches of compliance. To ensure compliance with this principle, OHAfrica shall develop and implement easy to understand and easily accessible complaint procedures and complaint handling practices to ensure that (a) all complaints received are acknowledged promptly and investigated properly by persons within OHAfrica who have been trained to investigate complaints effectively and fairly; (b) all complainants are informed of all complaint procedures available through OHAfrica procedures, industry associations, regulatory bodies and the Privacy Commissioner of Canada; (c) complainants are notified of the outcome of investigations clearly and promptly, informing them of any relevant steps taken; (d) any inaccurate personal information or personal information handling practices and policies are properly and promptly corrected.

As privacy laws and regulations evolve, it may be necessary to revise or update our Privacy Policy without notice, but we will post those changes on our Web site’s home page so our users are aware of what information we collect, use and disclose. We will continue to be committed to protecting all identifiable personal information in accordance with the requirements of PIPEDa.