Protection of Personal Information (POPI) Policy

1. Introduction

Orchid Risk Services (Pty) Ltd (“Orchid”, “we”, “us” or “our”) is committed to protecting the privacy and personal information of everyone we deal with, including clients, prospective clients, sub-brokers, intermediaries, insurers, suppliers and website visitors. This Policy explains how we collect, use, store, share and protect personal information in compliance with the Protection of Personal Information Act 4 of 2013 (“POPIA”) and, where applicable, the Financial Advisory and Intermediary Services Act, 2002 (“FAIS”).

This Policy applies to personal information processed by Orchid in the course of providing short-term insurance risk management, broker support and policy administration services, and to personal information collected through our website.

2. Definitions

Personal information: information relating to an identifiable, living natural person or, where applicable, an identifiable existing juristic person, including (but not limited to) contact details, identity numbers, financial and insurance information, employment history, and views or opinions of or about the person.

Processing: any operation performed on personal information, including collection, receipt, recording, organisation, storage, updating, retrieval, use, dissemination or destruction.

Data subject: the person to whom personal information relates (e.g. a client, policyholder or website user).

Responsible party: the entity that determines the purpose and means of processing personal information. Orchid acts as a responsible party for the information described in this Policy, and in some instances as an operator on behalf of insurers or underwriting managers.

Information Officer: the person responsible for ensuring Orchid's compliance with POPIA.

3. What Personal Information We Collect

Depending on our relationship with you, we may collect:

• Identifying information – full name, identity number, date of birth, contact details and address.
• Insurance and risk information – policy details, claims history, insured assets, risk assessments and underwriting information.
• Financial information – banking details, premium payment history and, where relevant, credit information.
• Broker and intermediary information – FSP details, mandates and commission information.
• Website and technical information – IP address, browser type, device information and pages visited on our website.
• Special personal information – in limited cases (e.g. health information relevant to certain insurance products), collected only with consent or another lawful basis under POPIA.

4. How We Collect Your Information

We collect personal information directly from you (e.g. when you complete a proposal form, contact us, or use our website), from our sub-brokers and intermediaries acting on your behalf, from insurers and underwriting managers, and, where necessary, from publicly available sources or third parties such as credit bureaus.

5. Purpose of Processing

We process personal information to:

• Provide risk management consulting and short-term insurance policy administration services.
• Arrange, place, administer and renew insurance policies on behalf of clients and sub-brokers.
• Assess risk, underwrite policies and process claims.
• Comply with legal, regulatory and FAIS obligations, including record-keeping.
• Communicate with clients, brokers, insurers and other stakeholders.
• Improve our services and, where consented to, for direct marketing.
• Detect and prevent fraud.

6. Lawful Basis for Processing

We rely on one or more of the following grounds recognised under POPIA: your consent; the necessity of processing to conclude or perform a contract to which you are a party (such as an insurance policy); compliance with a legal obligation; protection of a legitimate interest; or performance of a public law duty. Where we rely on consent, you may withdraw that consent at any time, without affecting the lawfulness of processing carried out before withdrawal.

7. Disclosure and Sharing of Personal Information

We may share personal information with the following third parties, only to the extent necessary for the purposes described above:

• Insurers, underwriters and underwriting managing agents, for the purpose of placing and administering policies and settling claims.
• Reinsurers, where required for risk placement.
• Sub-brokers and intermediaries involved in servicing your policy.
• Regulators and industry bodies, including the Financial Sector Conduct Authority (FSCA) and the Information Regulator, where legally required.
• Credit bureaus and fraud prevention agencies, where relevant to underwriting or claims.
• Service providers who support our operations (e.g. IT hosting, auditors), under confidentiality and data protection agreements.

We do not sell personal information to third parties. Any sharing with parties outside South Africa is limited to what is necessary for the services described above and is subject to appropriate safeguards; we do not currently transfer personal information across borders as a matter of course.

8. Data Retention

We retain personal information for as long as necessary to fulfil the purposes for which it was collected, and thereafter for a period of five (5) years after the relevant insurance policy lapses, is cancelled or expires, in order to meet our legal, regulatory (including FAIS) and contractual record-keeping obligations. After this period, personal information is securely deleted or anonymised, unless a longer retention period is required by law or an ongoing legal matter.

9. Security Safeguards

Orchid implements appropriate technical and organisational measures to protect personal information against loss, unauthorised access, interference, modification or disclosure, including access controls, secure storage systems, staff confidentiality obligations and agreements with our service providers requiring equivalent security standards.

10. Your Rights as a Data Subject

Subject to POPIA, you have the right to:

• Be informed that your personal information is being collected and for what purpose.
• Access the personal information we hold about you.
• Request correction, updating or deletion of inaccurate, outdated or unlawfully held personal information.
• Object to the processing of your personal information on reasonable grounds, including for direct marketing purposes.
• Withdraw consent, where processing is based on consent.
• Lodge a complaint with the Information Regulator if you believe your rights under POPIA have been infringed.

To exercise any of these rights, please contact our Information Officer using the details in section 13 below.

11. Direct Marketing

We will only use your personal information for direct marketing purposes with your consent, or where you are an existing client and the marketing relates to similar products or services, in line with POPIA. You may opt out of direct marketing communications at any time by contacting us.

12. Cookies and Website Usage

Our website may use cookies and similar technologies to improve functionality and understand how visitors use our site. You can control cookies through your browser settings. Disabling cookies may affect the functionality of the website.

13. Information Officer

Orchid's Information Officer is responsible for ensuring compliance with POPIA and for handling requests relating to personal information. To contact our Information Officer, or to submit any request or query relating to this Policy, please contact us:

Please mark all correspondence “Attention: Information Officer” so that it can be directed appropriately.

14. Complaints to the Information Regulator

If you are not satisfied with how we have handled your personal information or a request relating to it, you have the right to lodge a complaint with the Information Regulator of South Africa:

15. Changes to this Policy

Orchid may update this Policy from time to time to reflect changes in our practices or legal requirements. The updated version will be published on our website with a revised effective date. We encourage you to review this Policy periodically.

16. Contact Us

If you have any questions about this Policy or how we handle your personal information, please contact us at info@orchidrisk.co.za.