CPC África SA respects individual privacy and values the confidence of its customers, employees, vendors, consumers, business partners and others. CPC África SA strives to collect, store, process and distribute personal information in respect for the laws of Angola and has a tradition of upholding the highest ethical standards in its business practices. This Data Protection and Privacy Policy (the “Policy”) sets forth the privacy principles that CPC África SA follows with respect to the collection, use and transfer of personal information from anywhere in the world.

CPC África SA educates its employees concerning compliance with this Policy and has self-assessment procedures in place to assure compliance. CPC África’s SA Board is available to any of its valued employees, customers, vendors, business partners or others who may have questions concerning this Policy or data security practices.

I. DEFINITIONS

For purposes of this Policy, the following definitions shall apply:

“Agent” means any third party that processes personal information provided by CPC África SA to perform tasks on behalf of or at the instruction of CPC África SA.

“Personal Information” means any information or set of information that identifies or could be used by or on behalf of CPC África SA to identify an individual. Personal information does not include information that is anonymized, or publicly available information that has not been combined with non-public personal information.

“Sensitive Personal Information” means personal information that reveals race, ethnic origin, trade union membership, political opinions, or religious or philosophical beliefs, which concerns health or sex life, or that contains criminal records. In addition, CPC África SA will treat as sensitive personal information any personal information received from a third party where that third party treats and identifies the personal information as sensitive.

II. SCOPE

This Policy applies to all personal information received by CPC África SA in any format including electronic, paper or verbal. CPC África SA collects, stores and processes personal information concerning current and former employees, as well as applicants for employment through its internet websites, its intranet site, electronic mail and manually. CPC África SA will not sell or share this information with third parties in ways different than what is disclosed in this Policy. On a global basis, CPC África SA will establish and maintain business procedures that are consistent with this Policy. These policies are consistent with Angola data protection law.

CPC África SA collects, stores, and processes personal information from current and past employees and applicants for employment, such as name, contact information, government identifier, financial account information, and family information. This information is maintained at the CPC África’s SA HR Department. CPC África SA collects personal information for employment related purposes and legitimate human resource business reasons such as personnel and job candidate administration and assessment, recruitment and staffing; payroll administration; absence monitoring; training and development; management planning; appraisal and promotion; production and publication of company address books and telephone and e-mail directories; managing email and other communication systems; production of employee identity cards; monitoring the use of company resources; information to contact close relatives in case of emergency; filling employment positions; administration and operations of its benefit and compensation programs; meeting governmental reporting requirements; security, health and safety management; performance management; company network access; facilitating workplace communications; workforce analytics, and authentication. CPC África SA does not request or gather information regarding political opinions, religion, philosophy, or sexual orientation. To the extent CPC África SA maintains information on medical health, race or ethnicity, CPC África SA will protect, secure and process that information in a manner consistent with this Policy and applicable law.

CPC África SA also collects, stores, and processes personal information from prospective customers, consumers, vendors, professional advisers and consultants, distributors, dealers, suppliers business partners and others, such as name, contact information, assist in the administration of employee benefit and compensation programs, and financial or other payment information. This information may be maintained at its corporate offices and its authorized agents, consistent with Angola legislation.          CPC África SA collects this personal information for, among other things, legitimate business reasons such as processing and fulfilling orders; customer service; the provision of services or products to CPC África SA, product, warranty and claims administration; meeting governmental reporting and records requirements; maintenance of accurate accounts payable and receivable records; marketing; internal marketing research; safety and performance management; financial and sales data; and contact information. All personal information collected by CPC África SA will be used for legitimate business purposes consistent with this Policy.

CPC África SA may process and disclose personal information to service providers, advisors, potential transactional partners, or other third parties in connection with the consideration, negotiation, or completion of a corporate transaction in which an CPC África SA business is acquired by or merged with another business, or sells, liquidates, or transfers all or a portion of its assets.

CPC África SA also may process or disclose personal information as is reasonably necessary or legally required on important public interest grounds, to respond to lawful requests by public authorities (including to meet national security or law enforcement requests), to meet governmental reporting or records requirements, or for the establishment, exercise or defense of legal claims by CPC África SA or other companies within its corporate group.

III. PRIVACY PRINCIPLES

CPC África SA commits to subject the personal information covered by this policy to the following principles:

(1)  NOTICE: Where CPC África SA collects personal information directly from individuals, it will inform them about the purposes for which it collects, stores and processes personal information about them, the types of non-Agent third parties to which CPC África SA discloses that information, and the choices and means, if any, CPC África SA offers individuals for limiting the use and disclosure of their personal information. Notice will be provided in clear and conspicuous language when individuals are first asked to provide personal information to CPC África SA, or as soon as practicable thereafter, and in any event before CPC África SA uses the information for a purpose other than that for which it was originally collected.

(2)  CHOICE: CPC África SA will offer individuals the opportunity to choose (opt-out) whether their personal information is (a) to be disclosed to a non-Agent third party, or (b) to be used for a purpose other than the purpose for which it was originally collected or subsequently authorized by the individual.

For sensitive personal information, CPC África SA will give individuals the opportunity to consent (opt-in) the disclosure of the information affirmatively and explicitly to a non-Agent third party or the use of the information for a purpose other than the purpose for which it was originally collected or subsequently authorized by the individual.

CPC África SA will provide individuals with reasonable mechanisms to exercise their choices should requisite circumstances arise.

(3)  DATA INTEGRITY AND PURPOSE LIMITATION: CPC África SA will use personal information only in ways that are compatible with the purposes for which it was collected or subsequently authorized by the individual. CPC África SA will take reasonable steps to ensure that personal information is relevant to its intended use, accurate, complete, and current.

(4)  ACCOUNTABILITY FOR ONWARD TRANSFER: CPC África SA uses third-party Agents to assist us in accomplishing the purposes described in this Policy, for example to support our customers, perform technical operations, and store and transmit data. CPC África SA will confirm that any third party to which it discloses personal information will appropriately safeguard the privacy of that personal information. Examples of appropriate privacy safeguards include: a contract obligating the third party to provide at least the same level of protection as is required by the relevant privacy principles or applicable standards. Where CPC África SA has knowledge that a third party is using or disclosing personal information in a manner contrary to this Policy, CPC África SA will take reasonable steps to prevent or stop the use or disclosure. CPC África SA holds third parties to which it discloses personal information accountable for maintaining the trust our employees and customers place in the company.  

(5)  ACCESS AND CORRECTION: Upon request, CPC África SA will grant individuals reasonable access to personal information that it holds about them. In addition, CPC África SA will take reasonable steps to permit individuals to correct, amend or delete information that is demonstrated to be inaccurate or incomplete. Any employees that desire to review or update their personal information can do so by contacting HR Department.

(6)  SECURITY: CPC África SA will take reasonable precautions to protect personal information in its possession from loss, misuse and unauthorized access, disclosure, alteration, and destruction. CPC África SA protects data in many ways. Physical security is designed to prevent unauthorized access to database equipment and hard copies of sensitive personal information. Electronic security measures continuously monitor access to our servers and provide protection from hacking or other unauthorized access from remote locations. This protection includes the use of firewalls, restricted access, and encryption technology. CPC África SA limits access to personal information and data to those persons in CPC África SA organization, or as Agents of CPC África SA, which have a specific business purpose for maintaining and processing such personal information and data. Individuals who have been granted access to personal information are aware of their responsibilities to protect the security, confidentiality and integrity of that information and have been provided training and instruction on how to do so.

Suppliers, vendors and other third parties shall report any data breaches or potential data breaches of personal information by email to rh@cpcafrica.com.

(7)  RECOURSE, ENFORCEMENT AND LIABILITY: CPC África SA will conduct compliance audits of its relevant privacy practices to verify compliance with this Policy and the relevant privacy principles. Any employee that CPC África SA determines is in violation of this Policy will be subject to disciplinary action up to and including termination of employment.

 IV. DISPUTE RESOLUTION

Any questions or concerns regarding the use or disclosure of personal information should be directed to the CPC África’s SA HR Department at the email given above. CPC África SA will investigate and attempt to resolve complaints and disputes regarding use and disclosure of personal information in accordance with the principles contained in this Policy. For complaints that cannot be resolved between CPC África SA and the complainant, CPC África SA agrees to participate in the dispute resolution procedures to resolve disputes pursuant to the relevant privacy principles.  In some circumstances, complainants may be able to appeal these decisions by invoking binding arbitration.

V. INTERNET PRIVACY

CPC África SA sees the Internet, intranets and the use of other technologies as valuable tools for communicating and interacting with consumers, employees, vendors, business partners and others. CPC África SA recognizes the importance of maintaining the privacy of personal information collected through websites that it operates. CPC África SA sole purpose for operating its websites is to provide information concerning products and services to the public. In general, visitors can reach CPC África SA on the Web without revealing any personal information. Visitors on the Web may elect to voluntarily provide personal information via CPC África SA websites but are not required to do so. CPC África SA collects information from visitors to the websites who voluntarily provide personal information by filling out and submitting online questionnaires concerning feedback on the website, requesting information on products or services, or seeking employment. The personal information voluntarily provided by website users is contact information limited to the user’s name, home and/or business address, phone numbers and email address. CPC África SA collects this information so it may answer questions and forward requested information. CPC África SA does not sell this information.

 VI. CHANGES TO THIS POLICY

The practices described in this Policy are current personal data protection policies as of December 2022. CPC África SA reserves the right to modify or amend this Policy at any time consistent with the requirements of the relevant principles and applicable law. Appropriate notice will be given concerning such amendments.