Privacy Statement

The ACCESS Programme ("ACCESS") is a University of the Free State (UFS) subsidiary programme administered through Engaged Scholarship within the Division of Student Affairs.

ACCESS recognises the importance of protecting the privacy and personal information of students, prospective participants, staff members, community members, partners, volunteers, beneficiaries, service providers and other individuals who interact with the Programme.

This Privacy Statement explains how personal information may be collected, processed, used, stored, disclosed and protected when an individual participates in or interacts with ACCESS.

ACCESS operates within the governance, policies, procedures and legal obligations of the University of the Free State. Accordingly, personal information processed through ACCESS is subject to the University's applicable privacy, information-security, records-management and data-protection requirements.

ACCESS is committed to processing personal information responsibly and transparently and in accordance with applicable South African legislation, including the Protection of Personal Information Act 4 of 2013 (POPIA) and, where applicable, the Promotion of Access to Information Act 2 of 2000 (PAIA).

ACCESS is a programme of the University of the Free State and does not operate as a separate legal entity from UFS.

For purposes of personal-information processing, the University of the Free State remains the relevant institutional responsible party where UFS determines the purposes and means of processing personal information.

The Programme is administered through Engaged Scholarship within Student Affairs, and the relevant UFS structures, officials and authorised personnel may process personal information in the course of delivering ACCESS activities and services.

ACCESS may work with: UFS faculties and departments; Student Affairs units; Engaged Scholarship structures; Student organisations; Community organisations; Non-governmental organisations; Government institutions; Corporate or private-sector partners; Donors and funding partners; Service providers; Academic and research partners; and other approved stakeholders.

Any sharing or processing of personal information involving such parties will be subject to applicable legal, institutional and contractual requirements.

The purpose of this Privacy Statement is to explain: what personal information ACCESS may collect; how personal information may be collected; why personal information is processed; the lawful basis for processing; how information is stored and protected; when information may be shared; how long information may be retained; the rights of individuals whose information is processed; how privacy concerns and complaints can be raised; and how ACCESS and UFS seek to protect personal information throughout its lifecycle.

This Privacy Statement should be read together with any specific consent forms, application forms, programme notices, research-information sheets, event notices, agreements or other privacy notices applicable to a particular ACCESS activity.

This Privacy Statement applies to individuals interacting with ACCESS, including: UFS students; prospective students; programme participants; student volunteers; community members; community beneficiaries; youth participants; programme facilitators; mentors; UFS staff; academic staff; researchers; project coordinators; external partners; donors and sponsors; service providers; event participants; applicants; survey and questionnaire respondents; and other individuals who voluntarily provide information to ACCESS or UFS in connection with ACCESS activities.

For purposes of this policy, personal information refers broadly to information relating to an identifiable, living natural person and, where applicable, an identifiable existing juristic person.

5.1 Identification Information: Name and surname; student number; identification number; passport number; programme or participant identification number; and other information required to establish identity.

5.2 Contact Information: Email address; telephone or mobile number; postal address; residential address where necessary; emergency contact information; and other communication details.

5.3 Academic and Programme Information: Faculty and programme information; year of study; academic status; participation history; training records; programme attendance; skills-development information; volunteer activities; and programme outcomes.

5.4 Engagement Information: Workshops; training; community-engagement activities; outreach programmes; events; surveys; interviews; focus groups; projects; volunteer activities; student-development initiatives; and other ACCESS activities.

5.5 Digital and Technical Information: IP address; device information; browser information; login information; access dates and times; website interaction information; and other technical information necessary for the operation and security of digital services.

Certain personal information receives enhanced protection under POPIA. Depending on the nature and purpose of an ACCESS activity, the Programme may process special personal information, including information concerning: health or disability; biometric information; religious or philosophical beliefs; race or ethnic origin; political opinions; trade-union membership; criminal behaviour or allegations of criminal behaviour; and other information classified as special personal information under applicable legislation.

ACCESS will only collect or process special personal information where there is a lawful basis for doing so and where appropriate safeguards are in place. Where such information is not necessary for a specific ACCESS activity, it should not be collected.

Some ACCESS activities may involve persons under the age of 18. ACCESS recognises that children's personal information requires particular protection.

Where personal information relating to a child is processed, ACCESS and UFS will comply with applicable legal requirements and will obtain the required consent or rely on another lawful basis permitted by law. Where appropriate, ACCESS may require consent from a parent, guardian or competent person before a child participates in an activity involving the collection or processing of personal information.

Particular care will be taken when processing: photographs; video recordings; audio recordings; interviews; testimonials; health information; contact information; and other information that could identify a child.

ACCESS may collect personal information through: online application forms; registration forms; consent forms; questionnaires; surveys; interviews; focus groups; workshops; events; attendance registers; programme assessments; UFS student systems; email correspondence; telephone communication; digital platforms; websites; social-media platforms; research activities; community-engagement activities; referrals from authorised UFS structures; and direct communication with individuals.

Where practical, ACCESS will inform individuals at the point of collection about: what information is being collected; why it is being collected; whether providing the information is mandatory or voluntary; who may receive the information; how the information will be used; and applicable rights relating to the information.

ACCESS will process personal information only where a lawful basis exists. Depending on the circumstances, processing may be undertaken where: the individual has provided consent; processing is necessary to provide a requested programme or service; processing is necessary for the performance of an agreement; processing is required to comply with a legal obligation; processing is necessary for legitimate institutional purposes; processing is necessary to protect the legitimate interests of an individual; processing is authorised by applicable legislation; processing is necessary for authorised academic, research or community-engagement purposes; or another lawful basis recognised under POPIA applies.

Consent will not be requested where another lawful basis legitimately permits processing, although individuals will be informed where appropriate.

ACCESS may process personal information for purposes including: registering participants; administering ACCESS activities; managing participation; communicating programme information; organising events and activities; managing volunteers; providing training and development; monitoring programme participation; evaluating programme outcomes; providing participant support; coordinating community-engagement activities; managing partnerships; reporting to authorised UFS structures; preparing institutional reports; monitoring programme performance; conducting authorised research and evaluation; maintaining programme records; meeting legal and regulatory obligations; preventing fraud or misuse; protecting the safety and security of participants; improving ACCESS services; and any other compatible and lawful purpose communicated at the time of collection.

ACCESS activities may involve photography, videography or audio recording for legitimate programme, institutional, communication, educational, reporting or promotional purposes. Where appropriate, participants will be informed when recording is taking place.

Where consent is required, ACCESS will obtain appropriate consent before using identifiable photographs, videos, recordings or testimonials for the specified purpose. Individuals may be informed about: the purpose of the recording; how the material may be used; where it may be published; the period for which it may be retained; and how they may exercise applicable rights.

Particular care will be taken when recording children or vulnerable participants.

ACCESS may conduct or support monitoring, evaluation, research and impact-assessment activities. Where research involves personal information, the activity must comply with applicable UFS research-governance, ethics, privacy and data-management requirements.

Where reasonably practicable, personal information used for reporting, research or statistical purposes will be anonymised, de-identified or aggregated. Research participants will receive appropriate information regarding: the purpose of the research; the information being collected; how the information will be used; confidentiality arrangements; voluntary participation where applicable; withdrawal rights where applicable; and applicable ethical and privacy safeguards.

ACCESS will not sell, rent or trade personal information. Personal information may be shared with authorised parties where there is a lawful basis to do so.

This may include relevant: UFS departments; Student Affairs units; Engaged Scholarship personnel; academic or research personnel; UFS management structures; approved service providers; programme partners; funding or donor partners where legally permissible; government or regulatory bodies where required; professional advisers; emergency or safety personnel where necessary; and other authorised parties.

ACCESS will seek to limit information sharing to what is reasonably necessary for the relevant purpose.

ACCESS may use third-party service providers to support programme activities. Examples may include providers of: information technology; cloud storage; website hosting; communication services; event-management systems; survey platforms; data-management systems; transport or logistics; training services; payment administration; and other operational services.

Where such parties process personal information on behalf of UFS, appropriate contractual and security measures should be implemented in accordance with applicable law and UFS requirements.

Certain digital platforms or service providers used by ACCESS or UFS may store or process information outside South Africa. Where personal information is transferred to or accessed from another country, UFS will take reasonable steps to ensure compliance with POPIA's requirements concerning cross-border transfers.

Appropriate safeguards, contractual arrangements, consent or another lawful mechanism will be used where required.

ACCESS, through UFS, will take reasonable technical and organisational measures to protect personal information. Measures may include: access controls; password protection; user authentication; encryption where appropriate; secure storage; access restrictions; confidentiality obligations; staff training; data-backup procedures; security monitoring; incident-response procedures; and secure disposal of information.

Access to personal information should be restricted to authorised persons who require the information to perform their functions.

If UFS becomes aware of a security compromise involving personal information processed through ACCESS, the University will take reasonable steps to: identify and contain the incident; assess the information affected; mitigate potential harm; investigate the incident; strengthen relevant security measures; and notify affected individuals and/or the Information Regulator where legally required.

ACCESS will retain personal information only for as long as reasonably necessary for the purpose for which it was collected or where continued retention is required or permitted by law or UFS's records-management requirements.

Retention periods may depend on: the type of information; the purpose for which it was collected; legal requirements; UFS records-management requirements; funding or reporting requirements; research requirements; audit requirements; dispute resolution; and other legitimate institutional requirements.

When personal information is no longer required, appropriate steps will be taken to securely delete, destroy, anonymise or otherwise dispose of it.

ACCESS will take reasonable steps to ensure that personal information is: accurate; complete; not misleading; and updated where necessary. Participants are encouraged to notify ACCESS or the relevant UFS office if their personal information changes or is incorrect.

Subject to applicable law, individuals whose personal information is processed by ACCESS may have the right to: request access to their personal information; request correction of inaccurate information; request updating of information; request deletion where legally permissible; object to certain processing; withdraw consent where consent is the applicable lawful basis; object to direct marketing; request information about how their information is being processed; and lodge a complaint concerning the processing of their personal information.

Requests may be subject to identity verification and other lawful requirements.

Where ACCESS relies on consent as the lawful basis for processing, an individual may withdraw consent by contacting the relevant ACCESS or UFS office. Withdrawal of consent does not necessarily invalidate processing that occurred before withdrawal.

Where UFS has another lawful basis for processing the information, withdrawal of consent may not require UFS to stop processing the information.

ACCESS may communicate with participants concerning: programme activities; events; training; opportunities; announcements; surveys; programme updates; and other relevant institutional or programme information.

Where direct marketing through electronic communications requires consent under applicable law, appropriate consent will be obtained. Individuals may opt out of marketing or non-essential communications where applicable.

Where ACCESS operates a website, webpage or digital platform, cookies and similar technologies may be used. These technologies may assist with: website functionality; security; user preferences; analytics; performance monitoring; and improving user experience.

Where required by law, consent will be obtained before using non-essential cookies or tracking technologies. Users may manage cookies through their browser or device settings.

ACCESS may use social-media platforms to communicate programme information and promote activities. Social-media platforms are operated by third parties and are subject to their own terms and privacy policies.

Individuals should exercise caution before posting personal information publicly. Where ACCESS wishes to use identifiable participant photographs, videos, testimonials or similar material for programme publicity, appropriate consent will be obtained where required.

ACCESS personnel, volunteers, service providers and other authorised persons who have access to personal information must maintain confidentiality and may only use information for authorised purposes. Confidentiality obligations may continue after an individual's participation in ACCESS has ended.

Where ACCESS collects information concerning community organisations, beneficiaries, partner organisations or other stakeholders, the information will be processed only for legitimate programme, administrative, reporting, monitoring, evaluation or other lawful purposes.

ACCESS will take reasonable steps to avoid collecting unnecessary personal information. Where information concerning vulnerable individuals or communities is collected, additional safeguards may be applied where appropriate.

ACCESS recognises that certain programme participants may be particularly vulnerable. Where activities involve children or vulnerable individuals, ACCESS will implement appropriate safeguards concerning: consent; photography and recording; disclosure of information; access to records; communications; safeguarding; storage; and retention.

Additional institutional policies and safeguarding procedures may apply.

ACCESS or UFS websites may contain links to external websites. ACCESS and UFS are not responsible for the privacy practices, security or content of third-party websites. Users should review the privacy policies of external websites before submitting personal information.

ACCESS will seek to incorporate privacy considerations into the design and implementation of programme activities. This includes, where appropriate: collecting only information reasonably required; limiting access to authorised persons; using anonymised or aggregated information where appropriate; applying appropriate security controls; providing privacy information at the point of collection; avoiding unnecessary disclosure; and securely disposing of information when it is no longer required.

Where ACCESS uses automated decision-making, artificial intelligence, profiling or similar technologies in a manner that may significantly affect an individual, such processing will be subject to applicable UFS policies and legal requirements. ACCESS will take reasonable steps to ensure that such technologies are used responsibly, transparently and lawfully.

Requests relating to personal information processed through ACCESS should be directed through the appropriate UFS privacy or information-management channels. A request may require: verification of identity; sufficient information to identify the relevant record; completion of a prescribed form; payment of a lawful fee where applicable; and compliance with relevant UFS procedures and legislation.

Individuals are encouraged to raise privacy concerns with ACCESS or the relevant UFS office in the first instance. A complaint may relate to: unauthorised collection; unauthorised disclosure; incorrect information; excessive collection; unauthorised access; security concerns; unwanted communications; failure to respect a privacy request; or any other concern regarding personal information.

ACCESS will refer matters requiring institutional intervention to the appropriate UFS authority.

If an individual believes that their personal information has been processed unlawfully and the matter cannot be satisfactorily resolved through UFS's internal procedures, they may lodge a complaint with the Information Regulator of South Africa, subject to applicable procedures. The University's privacy and information officers can provide appropriate guidance regarding the University's internal processes.

ACCESS Programme, University of the Free State — Division: Student Affairs, Unit: Engaged Scholarship, Programme: ACCESS.

Physical Address: Examination Centre, Office Door No. 27, Food Environment Office.

Email: dikotsems@ufs.ac.za

Telephone: +27 51 401 9241

UFS Information Officer — Email: dikotsems@ufs.ac.za, Telephone: +27 51 401 9241

UFS Webmaster: webmaster@ufs.ac.za or varsityhub@outlook.com

ACCESS reserves the right to recommend amendments to this Privacy Statement where necessary to reflect: changes in legislation; changes to UFS policies; changes to ACCESS operations; new technologies; changes to data-processing activities; regulatory developments; or changes in institutional governance.

Any amendments will be subject to the appropriate UFS approval and governance processes before implementation. The most recent approved version will be made available to relevant ACCESS participants and stakeholders.

This Privacy Statement is governed by the laws of the Republic of South Africa. The processing of personal information through ACCESS is subject to applicable South African legislation and the relevant policies, procedures and governance frameworks of the University of the Free State.

By participating in ACCESS or submitting personal information to the Programme, an individual acknowledges that they have been provided with or had reasonable access to information explaining how their personal information may be processed.

Where consent is required by law, consent will be obtained through an appropriate consent mechanism. Participation in ACCESS will not automatically constitute consent to every possible use of personal information. Where a separate consent is legally or ethically required for a particular activity, ACCESS will obtain that consent separately.