Introduction

We are committed to protecting your privacy and to ensuring that personal information provided to us is collected and used properly, lawfully and transparently in line with the Protection of Personal Information Act 4 of 2013 (“POPIA“).

The purpose of this Privacy Policy (“Policy“) is to explain –

how Sorbet Holdings and its subsidiaries (“Sorbet Holdings and its subsidiaries“, “we“, “us“) collects, protects, shares, uses and otherwise processes your personal information collected by us from you directly, through the use of our website, the use of our products and services and/or your electronic communications with us; and
the rights you have in relation to your personal information in terms of the Protection of Personal Information Act 4 of 2013 (“POPIA“) and we will, to the extent possible, inform you of what information is voluntary or mandatory for you to provide and the consequences of failing to provide the requested information.

By providing us with your personal information either directly, using our website, our products and services and/or communicating electronically to us, you –

agree to this policy and consent to the processing and transfer of your personal information as set out in this policy; and
authorise us, our affiliates and other third parties to process your personal information for the purposes stated in this policy.

This Policy must be read together with any other legal notices or terms and conditions provided or made available to you on our website and/or when you complete or use any documents provided by us to you in respect of any of our products and/or services.

This Policy is not intended to reproduce laws or regulations, but rather set out guidelines for our conduct in any operations which involve the processing of personal information.

Who we are

Establishment

Sorbet Holdings and its subsidiaries is a public company trading on the Johannesburg Stock Exchange and is an investment holding company. As a lifestyle-themed group, Sorbet Holdings and its subsidiaries are invested in a portfolio of assets which incorporates retail, wholesale, manufacturing, service, merchandising, distribution and e-commerce.

Sorbet Holdings and its subsidiaries aim to operate a decentralised management structure, providing financial, strategic and management support to its investor companies. The intention of Sorbet Holdings and its subsidiaries is to take a long-term view on investments, while retaining the agility to take advantage of opportunities as they arise.

Structure

Sorbet Holdings and its subsidiaries has several wholly-owned subsidiaries and is divided into five key brands with the operating entities each having their own centralised management team. The five key brands, including the operating companies in each division, are –

• Sorbet Salon
• Sorbet Nailbar
• Sorbet MAN
• Sorbet Hairbar
• Candi&Co

What is personal information and what personal information we collect

The term “personal information” as used in this Policy is defined as “information which relates to an identifiable, living, natural person, and where it is applicable, an identifiable, existing juristic person. The person or juristic person i.e. entity to whom personal information relates is referred to as the “data subject” (“data subject“, “you” and “your“).

Sorbet Holdings and its subsidiaries collect and process personal information to provide data subjects with access to our service and products, to help us improve our offerings and for other purposes explained below.
Sorbet Holdings and its subsidiaries collects the following types of personal information including, but not limited to –

• full names;
• identity numbers;
• addresses;
• contact information such as telephone numbers and email addresses;
• job title/description;
• banking details; and
• financial information (including VAT and tax information).
• When personal information is collected, Sorbet Holdings and its subsidiaries will indicate the purpose for the collection and whether the information required is compulsory or voluntary.

How do we collect personal information?

• We collect your personal information mainly directly from you in order to render our products and services to you and to improve our service and product offerings to you.
• The personal information we collect about you can vary depending on –
  • the products and services that you use;
  • when you visit our offices;
  • how you interact with us even if you are not a customer (including records of communications you have with us, your attendance at our events, interviews in the course of applying for a job with us and when you visit our website);
  • what we have obtained from a third party with permission to share your personal information with us (including law enforcement agencies); and
  • when you make your information public.

How do we use your personal information? 

• We will use and process your personal information in the ordinary course of the business of providing products and services to you.
• We will primarily use your personal information only for the purpose for which it was originally collected. In circumstances where we have to use your personal information for a secondary purpose, we will only do so if such purpose constitutes a legitimate interest and is closely related to the original and/or primary purpose for which the personal information was collected.
• We may use your personal information for the following purposes –
  • to provide products or services to you, to carry out the transaction you requested and maintain our relationship with you;
  • to conduct credit checks;
  • to confirm and verify your identity or to verify that you are an authorised user for security purposes;
  • for the detection and prevention of fraud, crime, money laundering or any other malpractice;
  • process requests for the collection, updating, access or deletion of your personal information;
  • for audit and record keeping purposes;
  • in connection with legal proceedings; and
  • to comply with applicable laws, regulatory requirements or industry codes to which we subscribe or which apply to use.

Disclosure of personal information to third parties 

• We may disclose personal information provided to us to third parties who are (i) involved in delivery of products and service that we deliver and (ii) who assist us in giving effect to the above purposes at paragraph 5.
• These third parties include, amongst others, suppliers, service providers, consultants, subcontractors and other vendors who need access to such information to carry out work on our behalf. Any such parties only have access to such information as is necessary to perform their functions and may not use it for any purpose other than to provide services to us.
• Where we disclose your personal information to the above parties, they will be bound to use that personal information for the reasons and purposes it was provided to them and not for any other purpose. To this end, we will enter into agreements with these third parties.
• In addition to the above, we may be obliged to disclose your personal information where we have a duty to disclose in terms of law or where we believe it is necessary to protect our rights.

Information security 

• Sorbet Holdings and its subsidiaries will take reasonable and appropriate technical and organisational measures to ensure that your personal information is kept secure and is protected against unauthorised or unlawful processing, accidental loss, destruction or damage, alteration disclosure or access.
• We will, on a regular basis, continue to review our security controls and related processes to ensure that your personal information is secure.
• As stated above, when we contract with third parties, we conclude agreements with them in terms of which we impose appropriate security, privacy and confidentiality obligations on them to ensure that personal information is kept secure.
• Whilst we will do all things reasonably necessary to protect your rights of privacy, we cannot guarantee or accept any liability whatsoever for unauthorised or unlawful disclosures of your personal information, whilst in our possession, made by third parties who are not subject to our control, unless such disclosure is as a result of our gross negligence.
• If you disclose your personal information to a third party, such as an entity that operates a website linked to our website or anyone other than Sorbet Holdings and its subsidiaries, WE SHALL NOT BE LIABLE FOR ANY LOSS OR DAMAGE, HOWSOEVER ARISING, SUFFERED BY YOU AS A RESULT OF THE DISCLOSURE OF SUCH INFORMATION TO THE THIRD PARTY. This is because we do not regulate or control how that third party uses your personal information. You should always ensure that you read the privacy policy of any third party.

How to access and correct your personal information

• We undertake to provide you with access to your personal information and provide mechanisms that any personal information found to be inaccurate or incomplete may be corrected or amended as feasible subject to any requirement or rule for such personal information to be retained by law. For further information on how to exercise these rights, please refer to our procedure for data subject access to, objection to, correction or deletion of personal information processed by Sorbet Holdings and its subsidiaries as set out in the PAIA/POPIA here.
• Prior to the amendment, correction or removal of your personal information, we will require you to identify yourself and to identify the portion of information requested to be amended, correct or removed. A request for the amendment, correction or removal of personal information may be declined if the process of the request is unlawful, unreasonably repetitive, requires disproportionate technical effort, jeopardises the privacy of others or would be impractical.
• Please note that any such access request and request to correct may be subject to the payment of a legally allowable fee and we will inform you of the cost thereof at the time of your request.
• It is important that any information you provide directly to us is accurate and correct. Please inform us as soon as you are able to or become aware if any information we hold about you is no longer correct. Providing false or inaccurate information in order to obtain a product or service may also result in our services being restricted or cancelled.

Retention of personal information 

• We will not retain your personal information longer than the period for which it was originally needed, unless we are required by law to do so, or if you consent to us retaining such information for a longer period.
• We may also retain your personal information to the extent and duration that we have a legitimate interest to process your personal information depending on, amongst others, the nature and lifespan of our services or products provided to you.
• We will upon your request, promptly return or destroy any and all of your personal information in our possession or control, save for what is set out above and for that which we are legally obliged to retain.

Cross-border personal information transfers

Section 72 of POPIA provides that personal information may only be transferred out of the Republic of South Africa if certain conditions are satisfied. Sorbet Holdings and its subsidiaries complies with the requirements set out in section 72 of POPIA in respect of cross border transfer of personal information.

Cookies 

The website makes use of “cookies” to automatically collect information and data through the standard operation of the Internet servers. “Cookies” are small text files a website can use (and which we may use) to recognise repeat users, facilitate the user’s on-going access to and use of a website and allow a website to track usage behaviour and compile aggregate data that will allow the website operator to improve the functionality of the website and its content, and to display more focused advertising to a user by way of third party tools. The type of information collected by cookies is not used to personally identify you. If you do not want information collected through the use of cookies, there is a simple procedure in most browsers that allows you to deny or accept the cookie feature. Please note that cookies may be necessary to provide you with certain features available on our website, and thus if you disable the cookies on your browser you may not be able to use those features, and your access to our Website will therefore be limited.

Your rights as a data subject 

• As a data subject, you have a number of data privacy rights. These rights include the right to request from Sorbet Holdings and its subsidiaries access to, correction or deletion of your personal data or restriction of processing concerning your data or to object to the processing of your personal information. For further information on how to exercise these rights, please refer to our procedure for data subject access to, objection to, correction or deletion of personal information processed by Sorbet Holdings and its subsidiaries as set out in the PAIA/POPIA Manual which is available here.
• All the rights of a data subject are contained in POPIA. The information on these rights can be found on the Information Regulator’s website at https://www.justice.gov.za/inforeg/, to whom you have the right to make a complaint, if we do not resolve your concern.

Contact us 

If you have any questions about this Policy, our treatment of your personal information or wish to exercise any of your rights please contact us using the details here.