Privacy Policy

• Cookies. You can manage cookies through your browser settings, by enabling an opt-out preference signal or universal opt-out mechanism such as Global Privacy Control (GPC), or through our cookie preference centre where available. To learn more about cookies generally, visit www.allaboutcookies.org.
• Do Not Track. Your browser may offer a "Do Not Track" (DNT) option. There is no universally agreed standard for how organisations should respond to DNT signals, and we do not currently take action in response to them.
• Universal Opt-Out Mechanisms. We treat recognised opt-out preference signals, such as GPC, as a valid request to opt out of the sale or sharing of personal information linked to that browser or device, as required by the CCPA, and will otherwise honour such signals where required by applicable law.
• Communication Preferences. With your consent, BroadReach communicates with you via a variety of digital and print media. You may opt out of receiving marketing emails from us at any time by using the unsubscribe link at the bottom of our emails, or by contacting us using the details in the Contacting Us section below.
• Analytics. We use analytics tools, including Google Analytics, to help us understand how visitors use the Site. You can learn more about how Google uses information at policies.google.com/privacy and opt out of Google Analytics at tools.google.com/dlpage/gaoptout.

How We Use and Share Your Personal Information

BroadReach only collects and uses your personal information when we have a lawful basis for doing so. We use the personal information we collect to administer our websites, provide services, communicate with you, and facilitate changes in our business, as required by law or with your consent. For instance, we may use or disclose personal information for the purposes of:

• Responding to inquiries and fulfilling requests for information about BroadReach and our projects and services, including information you ask to receive by signing up for newsletters and alerts.
• Providing web and email content that reflects your interests, informing you about events, and targeting content and communications to you.
• Enabling you to apply for vacancies or register as a consultant or vendor with BroadReach.
• Preventing malicious activity and unwanted communications and ensuring website security
• Performing data analysis, audits, and fraud monitoring and prevention to enhance and improve our website, identify usage trends, determine programme effectiveness, and carry out and expand our business activities.
• Maintaining appropriate records for internal administrative purposes and enforcing our terms, policies, and agreements

Sharing Your Information

We may share personal information as follows:

• With our employees who need the information for the purposes described above
• With third-party vendors and service providers who provide us with IT services, cloud storage, website hosting, data analysis, payment processing, information technology, auditing, and similar services related to our business.
• When we believe disclosure is necessary and appropriate to prevent physical, financial, or other harm, injury, or loss, including fraud, or where there is an emergency involving imminent danger to any person.
• With governmental or judicial authorities as required or ordered by those authorities or applicable laws or regulations
• In connection with legal action, such as responding to subpoenas or investigating suspected illicit or illegal activities.
• Where we are bound by contract or law to enable a client or business partner to comply with applicable laws
• In connection with a business transfer, sale, restructuring, or merger involving BroadReach.
• With your consent or at your direction, such as when you choose to share information or publicly post content and comments on our websites.

BroadReach does not sell your personal information. Where you have consented to analytics or advertising cookies, limited information about your use of the Sites may be made available to analytics and advertising providers, as described in the Use of Cookies and Tracking Technologies section and the California Privacy Rights (CCPA) section below.

Our Lawful Bases for Processing

In GDPR and POPIA terms, our lawful bases for processing your personal information are as follows:

• To take steps at your request prior to entering into a contract with you, or to perform a contract with you (for example, providing services you request, registering you as a consultant or vendor, or processing your job application)
• Where necessary for due diligence and compliance in line with our legal obligations (for example, verifying eligibility to work, employment equity reporting, record-keeping, and responding to lawful requests from authorities)
• To pursue our legitimate business interests, where these are not overridden by your interests or fundamental rights (for example, administering and securing our Sites, preventing fraud, improving our services, communicating with existing business contacts, and establishing or defending legal claims)
• In some cases, with your consent (for example, sending you newsletters and marketing communications, setting non-essential cookies, and keeping your application on file for future opportunities)

Third-Party Links

Our Sites may contain links to other websites, such as social media platforms, partner websites, and event websites. These websites are not covered by this Privacy Notice. Please review the privacy notices of those websites to understand their own privacy practices.

International Transfers of Personal Information

BroadReach operates across multiple countries, and your personal information may be transferred to, stored, and processed in a country other than the one in which it was originally collected, including South Africa and other countries in which BroadReach and its service providers operate. Where we transfer personal information across borders, we take steps to ensure it continues to receive an appropriate level of protection, consistent with GDPR, POPIA, and other applicable data protection laws, including by relying on adequacy decisions where available, or by entering into Standard Contractual Clauses approved by the European Commission and binding agreements that meet the requirements of section 72 of POPIA. You may request a copy of the relevant safeguards by contacting us using the details in the Contacting Us section below.

How Long We Keep Your Personal Information

BroadReach keeps your personal information for as long as we need it to carry out the purpose for which it was collected, or as required by applicable laws and regulations. In deciding how long to keep personal information, we consider the length of our relationship with you, any applicable legal, regulatory or client retention obligations, and any legal positions we may need to defend (such as in connection with a statute of limitations). Afterwards, personal information is securely destroyed and deleted from our databases. In some circumstances we may instead choose to aggregate or de-identify data so that it can no longer be associated with an individual, in which case it is no longer personal information, and we may retain it for as long as needed.

How We Keep Your Personal Information Safe

We use administrative, organisational, technical, and physical safeguards to protect the personal information we collect and process. Our security controls are designed to maintain data confidentiality, integrity, and an appropriate level of availability. No data transmission or storage system can be guaranteed to be 100% secure; if you have reason to believe your interaction with us is no longer secure, please contact us using the details in the Contacting Us section below.

Children's Privacy

Our Sites are not directed at children under the age of 18, and we do not knowingly collect personal information from them. If you believe we have inadvertently received personal information from a child under 18, please contact us using the details in the Contacting Us section below so that we can delete that information.

Additional Information for Job Applicants

Personal Information We Collect and How We Collect It

If you apply online for a job with BroadReach, or register online to be considered for future opportunities, BroadReach collects a broader range of personal information, including:

• Your name, email address, mailing address, and telephone number/s.
• Your education, employment history, work experience, skills, and qualifications
• Whether you are over 18 years of age
• Whether you are legally authorised to work in the relevant country

We collect this information in several ways. Much of it is provided by you when you complete the application or registration forms. In addition, we may obtain information from your resume, CV, or any other documents you upload, or from your LinkedIn profile. We may also seek information from third parties, such as recruitment agencies, references supplied by former employers, and, where permitted by law, background-check providers.

How We Use and Share Your Personal Information

We use this personal information to:

• Manage and keep records of the recruiting process.
• Assess the qualifications and suitability of job candidates and make hiring decisions.
• Enable BroadReach to assess your qualifications and suitability for later opportunities.
• Comply with our legal obligations, such as our obligation to verify your legal eligibility to work in the country you applied to
• Respond to and defend against legal claims.

Where required or permitted by applicable law, we may ask you to provide information about your race or ethnic origin, for example to meet employment equity reporting obligations under South Africa's Employment Equity Act or equal employment opportunity reporting obligations in the United States. Providing this information is voluntary, will not affect the outcome of your application, and is used only to compile aggregate statistics and meet those legal obligations. Where we conduct background checks, including criminal record checks, we do so only where permitted by applicable law, with your knowledge and, where required, your consent. We may also collect information about whether an applicant has a disability requiring reasonable accommodation, to facilitate the exercise of employment rights.

We may share your personal information internally with people involved in the recruitment and hiring processes, and others who need access to perform their jobs, including recruiters, HR staff, Procurement or Contract Management staff, IT staff, proposal staff, hiring managers, and interviewers. We will not share your data with third parties unless they are involved in the employment process, such as former employers providing references or background-check providers.

How Long We Keep Your Personal Information

If your application for employment is successful, the personal information we collect during the recruitment process will be transferred to your HR personnel file (electronic and/or paper) and retained during your employment and thereafter for the periods outlined in BroadReach’s Record Retention Policy, which can be requested if required.

If your application for employment is unsuccessful, we will keep your personal information on file for as long as we are required to do so by applicable law.

Data Subject Rights and Changes

Your Rights

If you are in South Africa or the European Economic Area, you have the right to:

• Access or request a copy of the personal information we hold about you.
• Obtain, or have transferred to another controller, a copy of certain personal information in a commonly used, machine-readable form.
• Object to processing for direct marketing, or to processing for scientific, historical, or statistical research purposes, except where necessary for performance of a task carried out for reasons of public interest.
• Object, on grounds relating to your particular situation, to processing based on our legitimate interests.
• Not be subject to a decision based solely on automated processing, including profiling, which produces legal or similarly significant effects for you.
• Restrict processing of your personal information.
• Review your personal information for completeness or accuracy and ask to have it corrected or completed as applicable.
• Have your personal information deleted from our files and data stores in certain circumstances, such as withdrawal of consent or where the data is no longer necessary for the purpose for which it was collected or processed.
• Withdraw your consent in situations where our collection and use of your personal information is based solely on your consent.

If you are located in a jurisdiction outside South Africa or the European Economic Area, you may have similar rights under the data protection laws that apply to you. We will honour requests we receive to the extent required by the applicable law of your jurisdiction.

• We will not discriminate against you for exercising any of these rights, such as by denying you goods or services or providing a different level or quality of service.
• Data subjects may exercise these rights by contacting BroadReach’s Information Officer (who also acts as our Data Protection Officer) at Operations@brhc.com or dataprotection@brhc.com. BroadReach will notify the data subject of action taken on the request within 30 days after receipt. Where applicable law permits an extension, for example, by up to two further months under the GDPR, or by up to a further 30 days under South African law, we will let you know within the initial 30-day period. You may also lodge a complaint with the relevant supervisory authority for your country.

California Privacy Rights (CCPA)

This section of our Privacy Notice applies to consumers who reside in the State of California and who interact with BroadReach’s US entities, branches, and Sites. We adopt this section to comply with the California Consumer Privacy Act, as amended by the California Privacy Rights Act, and its implementing regulations (collectively, the "CCPA").

• If you are a job applicant applying via our Sites, this section, together with the Additional Information for Job Applicants section above, describes how we handle your personal information.

If you are a California resident, you may be able to exercise the rights described below. We will honour requests we receive to the extent required by applicable law and within the time provided by law.

Right to Know and to Access Personal Information

You have the right to know, and to request that we disclose to you (i.e., access), the categories and/or specific pieces of personal information we have collected about you (including, where required by the CCPA, information collected more than twelve months ago), including:

• The categories and specific pieces of personal information we collected about you.
• The categories of sources from which the personal information was collected.
• Our business or commercial purpose for collecting or selling the personal information.
• The categories of third parties with whom we shared personal information.
• The categories of personal information about you, if any, that we disclosed for monetary or other valuable consideration, and the categories of third parties to which we disclosed it.
• The categories of personal information about you that we disclosed for a business purpose, and the categories of third parties to which we disclosed it.
• The categories of sensitive personal information we collected, the purposes for which we collected or used it, and whether we sold or shared it.

Right to Deletion of Personal Information

You have the right to request that we delete personal information about you that we have collected from you. As permitted by the CCPA, we, our service providers, and our contractors may be unable to comply with such a request where the personal information is necessary to:

• Complete the transaction for which it was collected, provide a good or service you requested, or otherwise perform a contract between us and you.
• Prevent, detect, and investigate security incidents, or protect against malicious, deceptive, fraudulent, or illegal activity.
• Debug to identify and repair errors that impair existing intended functionality.
• Exercise free speech or another right provided for by law.
• Comply with the California Electronic Communications Privacy Act
• Engage in public or peer-reviewed scientific, historical, or statistical research in the public interest, where deletion would seriously impair the research and you have provided informed consent.
• Enable solely internal uses reasonably aligned with your expectations based on your relationship with us.
• Comply with a legal obligation.

Right to Correct Personal Information

You have the right to request that we correct inaccurate personal information that we maintain about you.

Right to Opt Out of Sale or Sharing

BroadReach does not sell personal information for any monetary consideration. However, we recognise that some privacy laws define "sale" or "sharing" broadly enough that making certain identifiers available to a third party, including for purposes such as targeted advertising or analytics, may be considered a "sale" or "sharing" under the CCPA. To the extent this applies, you have the right to opt out of such sale or sharing. To submit an opt-out request, please use the "Do Not Sell or Share My Personal Information" link in our website footer, contact us at Operations@brhc.com or dataprotection@brhc.com, or use the cookie preference tools referenced in the Use of Cookies section above. We will act on opt-out requests within 15 business days of receipt.

Right to Limit Use or Disclosure of Sensitive Personal Information

To the extent we use or disclose sensitive personal information for purposes other than those permitted under the CCPA, you have the right to limit that use or disclosure. BroadReach does not use sensitive personal information for purposes other than those permitted under the CCPA.

Right to Non-Discrimination

We will not discriminate against you for exercising any of your CCPA rights, including by denying products or services, charging different prices or rates (including through discounts, benefits, or penalties), providing a different level or quality of product or services, or suggesting you will receive a different price, rate, level, or quality of product or services.

We may offer financial incentives permitted under the CCPA that reasonably relate to the value of your personal information. Participation in any such programme requires your prior opt-in consent, which you may withdraw at any time. BroadReach Group does not currently operate any such financial incentive programme; if this changes, we will update this Notice to describe the material terms, including how the incentive relates to the value of the personal information involved.

How to Exercise Your California Privacy Rights

You, or your authorised agent, may make a request to know or access, correct, or delete personal information, or to opt out of the sale or sharing of personal information, by:

• Submitting a request to Operations@brhc.com or dataprotection@brhc.com
• Calling us at +27 21 514 8300

You may also make a verifiable consumer request on behalf of your minor child if you believe we have inadvertently received personal information about a minor. We may take steps to verify your identity and residency before granting access or acting on your request, which may include asking for your email address or additional verifying information. If you use an authorised agent, we may also require proof of the written authorisation you have given the agent.

We will confirm receipt of your request, and if applicable describe our verification process, within 10 business days of receipt. We will respond to your request within 45 days of receipt, or let you know if we need additional time, as permitted by law.

Data Sharing for Direct Marketing Purposes

California Civil Code § 1798.83 permits California residents to request information regarding our disclosure of personal information to third parties for their own direct marketing purposes. If you are a California resident, you may ask us to refrain from sharing your personal information with certain of our affiliates and other third parties for their marketing purposes by contacting us using the details in the Contacting Us section below.

Minors

We do not have actual knowledge that we sell or share the personal information of consumers under 18 years of age. See also the Children's Privacy section above.

Personal Information We Collect About California Consumers

We may collect the following categories of personal information about California consumers, and retain each category for the period indicated (or based on the criteria described in the How Long We Keep Your Personal Information section above):

Personal Information Disclosed for a Business Purpose

We may disclose the following categories of personal information about California consumers to the following categories of third parties, for the following business purposes:

Personal Information Sold or Shared

BroadReach does not sell personal information for monetary consideration. BroadReach does not "sell" (as that term is defined under the CCPA) any category of personal information about California consumers. Where our use of analytics or advertising cookies may be considered "sharing" under the CCPA's broad definition, this is limited as follows:

You can opt out of this limited sharing at any time using the cookie preference tools described in the Use of Cookies section, or by contacting us as described above.

Changes to This Privacy Notice

We may update this Privacy Notice from time to time to reflect changes in our practices or applicable law. When we make these updates, we will change the "Revision Date" above. If there are any material changes to this Privacy Notice, we will post a notice on this website. We encourage you to periodically review this page to make sure you have the most current information on our privacy practices. By continuing to use the Sites or providing us with information following such an update, you agree that you will be deemed to have agreed to be bound by the Privacy Notice as changed.

Contacting Us

The responsible party (controller) for personal information processed under this Notice is BroadReach Group LLC, of 1250 Connecticut Avenue NW, Suite 700, Washington DC 20036.

All comments, questions, concerns, or complaints regarding your personal information or this Notice should be forwarded to us as follows —

Information Officer and Data Protection Officer: Rayhana Harvey

Tel: +27 21 514 8300

Email: Operations@brhc.com ; dataprotection@brhc.com

Physical Address: SPACES Century City Business Centre, 1 Bridgeway, Bridgeway Precinct, Century City, Cape Town 7441, South Africa

If you are unsatisfied with the manner in which we address any complaint regarding our processing of personal information, you can contact the office of the Regulator, the details of which are set out below —

Website: https://inforegulator.org.za/

Physical Address: Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191

Tel: 010 023 5200 | Toll-free: 0800 017 160

Email: POPIAComplaints@inforegulator.org.za (complaints) or enquiries@inforegulator.org.za (general enquiries)

Governing Law

This Notice, and its interpretation and enforcement, will be governed by the laws of the Republic of South Africa, and any legal action instituted in connection with this Notice must be instituted in the Republic of South Africa, without prejudice to any mandatory rights you may have under the data protection laws of the country in which you reside, including your right to lodge a complaint with your local supervisory authority.