ILLOVO SUGAR (MALAWI) PLC PRIVACY NOTICE
Privacy Notice – ILLOVO SUGAR (MALAWI) PLC
Illovo Sugar (Malawi) Plc, whose registered address is Churchill Road, Limbe, Malawi Private Bag 580 (the “Company”, “we”, “us”, “our”) takes data protection seriously. We recognise and value the trust that individuals/data subjects place in us when providing us with personal information and we are committed to taking reasonable steps to safeguard the privacy and secure personal information we may collect from visitors to our websites, visitors to our premises, our service providers, our customers, and our employees.
This privacy notice aims to set out how we use and protect your personal information in accordance with the Data Protection Act, 2024 (the “DPA”), and other applicable Malawian laws. Further notices highlighting certain uses we wish to make of your personal information together with the ability to opt in or out of selected uses may also be provided to you when we collect personal information from you. This privacy notice supplements other notices and privacy policies we may provide to you from time to time and is not intended to override them.
Disclaimer: This privacy notice does not apply to, and the Company is not responsible for, any third-party websites which may be accessible through links from our website. If you follow a link to any of these third-party websites, they will have their own privacy policies and you will need to check these policies before you submit any personal information to such third-party websites.
1. Who we are and what we do
Illovo Sugar (Malawi) Plc is a leading sugar producer in Malawi and a member of the Illovo Sugar Africa group, which is part of Associated British Foods PLC, with operations across Europe and Africa. The divisional headquarters are based in the UK and South Africa (ABF Sugar (Pty) Ltd), plus eight operating businesses: Azucarera (Spain), British Sugar (United Kingdom), Illovo Sugar South Africa, Illovo Sugar Malawi, Illovo Sugar Kigali (Rwanda), Kilombero Sugar Company (Tanzania), Ubombo Sugar (Eswatini), Vivergo Fuels (United Kingdom), and Zambia Sugar.
Our operations include the cultivation of sugarcane and the manufacturing, marketing, and distribution of sugar and related products within Malawi and for export.
This Notice is issued by and pertains to Illovo Sugar (Malawi) Plc.
2. What personal information we collect about you
We may collect and process different types of personal information in the course of operating our business. These may include, (but are not limited to):
Basic personal details such as your name, age, date of birth, sex, national identification number, and job title;
Contact information such as your telephone number and postal or email address;
Financial information such as payment-related information or bank account details;
Demographic information such as your postal address, preferences, or interests;
Technical information such as details of your website usage and identifiers or information collected through cookies and other tracking technologies;
Personal information provided to us by you or generated by us in the course of providing our services;
Transaction records details of transactions or services that we carry out for you as well as records of correspondence or enquiries from you or anyone acting on your behalf;
Background verification information such as a copy of passports or utility bills or evidence of beneficial ownership or the source of funds to comply with “know your client”/anti-money laundering laws and collected as part of our client acceptance and ongoing monitoring procedures;
Recruitment related information such as your curriculum vitae, your education and employment history, details of professional memberships and other information relevant to potential recruitment to the Company;
Event information that you may provide to us in the course of registering for and attending events or meetings, including access and dietary requirements;
Visual images, CCTV footage which is recorded via our CCTV cameras at our offices and premises;
Sensitive personal data in limited circumstances and where permitted by law (with your explicit consent or for substantial public interest), we may process sensitive
personal data such as trade union membership or as defined in the DPA, which includes data about your health, biometric data.
3. How we obtain the personal information about you
We may collect or receive your personal information in a number of different ways:
Directly from you, for example, by corresponding with us by email, tendering to contract with us, concluding an agreement with us, or via other direct interactions with us such as completing a form on our website or at our premises.
From third parties, for example, where we collect information about you to assist with compliance checks as part of our supplier on-boarding procedures, from credit bureau, or from recruitment agencies for a specific related purpose.
From publicly available sources, we may, for example, use such sources to help us keep the contact details we already hold for you accurate and up to date.
4. How we use your personal information
We will only use your personal information where we are permitted to do so by applicable law, including the Data Protection Act, 2024. The principal legal grounds that justify our use of your personal information are:
- Consent: Where you have given us your clear, specific, and informed consent.
- Contract performance: Where your information is necessary to enter into or perform our contract with you.
- Legal obligation: Where we need to use your information to comply with our legal obligations.
- Legitimate interests: Where we use your information to achieve a legitimate interest and our reasons for using it outweigh any prejudice to your data protection rights for network and information security, fraud prevention, or direct marketing.
- Vital interests: Where the processing is necessary to protect your vital interests or those of another person.
- Legal claims: where your information is necessary for us to defend, prosecute or make a claim on behalf of you, us or a third party.
- Public interest: Where the processing is necessary for the performance of a task carried out in the public interest.
We may use your personal information in the following ways:
- To conduct our business – to administer and provide our products, including to carry out our obligations arising from any agreements entered into between you and us (please note that our Standard Trading Conditions will apply where indicated) and for operational auditing, legal and record-keeping purposes;
- To facilitate use of our websites and to ensure content is relevant – to respond to requests for information or enquiries from visitors to our website and to ensure that content from our websites is presented in the most effective manner for you and for your device;
- For marketing and business development purposes – to provide you with details of new products, updates and invites to events where you have chosen to receive these. We will provide an option to unsubscribe or opt-out of further communication on any electronic marketing communication sent to you or you may opt out by contacting us as set out in paragraph 12 below;
- For research and development purposes – analysis in order to better understand your and our clients’ services and marketing requirements and to evaluate, develop and improve our services and offerings;
- For recruitment purposes – to enable us to process applications for employment submitted via our website or via email, and to assess your suitability for any position for which you may apply at the Company;
- To fulfil our legal, regulatory, or risk management obligations – to comply with our legal obligations (performing due diligence checks, anti-money laundering, anti-bribery, identifying conflicts of interests, sanctions or reputational risk screening); for the prevention of fraud and/or other relevant background checks as may be required by applicable law and regulation and best practice at any given time; to enforce our legal rights, to comply with our legal or regulatory reporting obligations and/or to protect the rights of third parties. Disclaimer: if false or inaccurate information is provided and a financial crime is identified or suspected, details may be passed to the Financial Intelligence Authority, and the information may be recorded by us or by them;
- To ensure that we are paid – to recover any payments due to us and where necessary to enforce such recovery through the engagement of debt collection agencies or taking other legal action including the communication and carrying out of legal and court proceedings;
- To inform you of changes – to notify you about changes to our goods, standard terms and conditions, or changes to this privacy notice.
- To reorganise or make changes to our business – in the event that we undergo a re-organisation, for example, if we merge, combine or divest a part of our business, we may need to transfer some or all of your personal information to the relevant third party or its advisors as part of any due diligence process or transfer to that re-organised entity or third party for the same purposes as set out in this privacy notice or for the purpose of analysis any proposed re-organisation.
The supply of your personal information is voluntary. However, where we need to collect personal information by law, or under the terms of a contract we have with you, and you fail to provide that information when requested, we may not be able to perform the contract we have or are trying to enter into with you. In this case, we may not be able to proceed with a particular engagement we have or intend to have with you, but we will notify you if this is the case at the time.
5. Who we share your personal information with
The Company is ultimately owned by Associated British Foods, a publicly listed company in the United Kingdom. As such, any personal information that we collect or you provide to us may be shared with and processed by other entities within the Illovo Sugar Africa group and Associated British Foods, including those outside of Malawi, subject to the requirements for cross-border data transfers as set out in Section 6 below.
We may also share your personal information with a variety of the following categories of third parties for the purposes of providing goods and/or performing obligations under an agreement, and for the reasons included in paragraph 4 above:
- Our professional advisers (legal, financial, business, risk management or other advisers), bankers and auditors;
- Our insurers and insurance brokers;
- Third party service providers (IT service providers, logistics companies, payment processors); and/or
- Regulatory, government, and law enforcement agencies as required or permitted by law in connection with enquiries, proceedings or investigations by such parties anywhere in the world or where compelled to do so.
We require all third parties to respect the security of your personal data and to treat it in accordance with the law. We do not allow our third-party service providers to use your personal data for their own purposes and only permit them to process your personal data for specified purposes and in accordance with our instructions.
6. Cross-border transfers of your personal information
As part of a global group, we cannot limit our processing of a data subject’s personal information to the country in which that data subject is based. As such, in the course of providing our services, we may need to transfer your personal information to locations outside Malawi, including to the United Kingdom and South Africa.
Where we transfer your personal data to countries outside Malawi, we will ensure that appropriate safeguards are in place as required by the Data Protection Act, 2024. These may include:
- Ensuring the recipient country is deemed to provide an adequate level of data protection.
- Using specific contracts approved by the Data Protection Authority which give personal data the same protection it has in Malawi.
- Relying on approved certification mechanisms or binding corporate rules.
You can obtain more information about the safeguards we use for international transfers by contacting us using the details in paragraph 12.
7. How long we keep your personal information
We will only retain your personal information for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements. Our retention periods are based on our business needs, legal obligations, and good practice. When it is no longer necessary to retain your personal data, we will dispose of it securely.
8. How we protect your personal information
We recognise that information security is an integral element of data protection. While no data transmission (including over the Internet or any website) can be guaranteed to be secure from intrusion, we implement appropriate technical and organisational security measures to prevent your personal data from being accidentally lost, used, or accessed in an unauthorized way, altered, or disclosed in accordance with data protection law requirements.
Information that you provide to us is stored on our or our service providers’ secure servers and accessed and used subject to our security policies and standards, or those agreed with our service providers.
Everyone at the Company and any third-party service providers we may engage that process personal information on our behalf (for the purposes listed above) are also contractually obligated to respect the confidentiality of personal information.
Alongside our role, please also note that where we have given you (or where you have chosen) a password which enables you to access certain parts of our websites or online services, you are responsible for keeping this password confidential and for complying with any other security procedures that we notify you of. We ask you not to share a password with anyone.
9. Your rights in relation to your personal information
Under the Data Protection Act, 2024, you as a data subject has several rights regarding your personal information. You have the right to:
- Request access to your personal information;
- Request correction of the personal information that we hold about you;
- Request erasure of your personal information;
- Request the suspension of processing of your personal information, for example, if you want us to establish the data’s accuracy;
- Request the transfer of your personal information to you or a third party;
- Object to the processing of your personal information;
- Not to be subject to a decision based solely on automated processing, including profiling, that produces a legal or similarly significant effect on you.
- Withdraw consent at any time where we are relying on consent to process your personal information;
- Lodge a complaint with the Data Protection Authority (the Malawi Communications Regulatory Authority).
You may also instruct us not to process your personal information for marketing purposes at any time by using the unsubscribe facility in any marketing communication.
To exercise any of these rights, please contact us using the details in Section 13. We may need to request specific information from you to help us confirm your identity. This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it.
It is It is important that the information that we hold about you is accurate and up to date. Please let us know if any of the personal information that you have provided to us changes.
While it is our policy to respect the rights of data subjects, please be aware that your exercise of these rights are subject to certain exemptions to safeguard the public interest (e.g. the prevention or detection of crime), our interests (e.g. the maintenance of legal privilege) and some of these rights may be limited (for example the right to withdraw consent) where we are required or permitted by law to continue processing your personal information to defend our legal rights or meet our legal and regulatory obligations.
If you contact us to exercise any of these rights, we will check your entitlement and respond within 30 days. If you are not satisfied with our use of your personal information or our response to any exercise of these rights, you have the right to complain to the Data Protection Authority, whose current contact details are set out below:
The Data Protection Authority
Email:
info@dpa.mw
Contact Number:
+265 991 80 21 80
Address: 1st Floor Green Heritage House, 2 Khonje Close, City Centre Lilongwe | P.O Box 30214
10. How we use cookies and similar technologies
When you visit our websites we may send a cookie(s) to your computer. This is a small data file stored by your computer to help improve functionality or tailor information to provide visitors with more relevant pages. You can view and edit your cookies through your browser settings. Please note that if you do not accept some cookies, you may not be able to use some of our services.
We may also, directly or through third-party service providers, identify and analyse website traffic in order to improve and tailor our website/our services.
11. Changes to this privacy notice
We may amend this notice from time to time. We therefore encourage you to review this privacy notice when you visit the website to stay informed of how we are using personal information. The date of the last update will be posted at the top of this notice.
If there are any material changes to this privacy notice, you will be notified by our posting of a notice on the Website prior to the change becoming effective.
If you have any questions about this privacy notice or how we process your personal information, including to exercise any of your legal rights, please contact our Information Officer :
Email: informationofficer@illovo.co.za
