MANUAL

Prepared in terms ofSection 51 of The Promotion of Access to Information Act 2 of 2000
andThe Protection of Personal Information Act, 4 of 2013
for assistance in requesting information from:RGA Reinsurance Company of South Africa Limited(Registration No: 1997/020948/06),
a 100% owned subsidiary of
RGA South African Holdings (Proprietary) Limited(Registration No: 1997/020923/07)

11. Introduction
This Manual is published in terms of Section 51 of the Promotion of Access to Information Act, 2000(“PAIA”) and the Protection of Personal Information Act 2013 (“POPIA”). These Acts give effect to theprovisions of section 32 of the Constitution, which provides for the right of access to information heldby the State and to information held by another person that is required for the exercise and/ orprotection of any right.
The reference to any information in addition to that specifically required in terms of Section 51 of thePAIA does not create any right or entitlement (contractual or otherwise) to receive such information,other than in terms of the PAIA.
RGA South African Holdings (Proprietary) Limited acts as a holding company for the operating entity,
RGA Reinsurance Company of South Africa Limited (“RGA”) (together the “Companies”).
RGA was established in late 1998 as a foreign subsidiary of RGA Inc. RGA has grown to become asignificant competitor in the life reinsurance market. The Companies operate out of offices inJohannesburg and Cape Town.
RGA is entitled, through its registration under the Insurance Act 18 of 2017, to conduct the followingclasses of reinsurance business: Funeral Risk Fund Risk
 Credit Life
 Life Annuities
 Reinsurance
2. List of subjects and records held by the above companies to which you could be entitled toaccess:a. Policyholders and Beneficiaries
All records kept in terms of the provisions of the Insurance Act 18 of 2017 and the financial services
industry (in general) pertaining to the reinsurance products offered.
b. Companies Act Records
All records maintained in terms of section 26 and section 31 of the Companies Act, 2008 including: Memorandum of Incorporation
 Annual Financial Statements
 Minutes of Board Meetings
 Records of Companies’ Directors
 Securities Registerc. Employees
All records maintained in terms of applicable labour laws, including: CVs, offers of employment and other recruitment related documents
 Contracts of employment
 Performance appraisals
 Records of disciplinary actions
 Other employment related documents2

d. Other
All other records kept in terms of the legislation applicable to any of the abovementioned products
or services and the financial services industry (in general), including the Securities Register.
3. How to obtain information

A request for access to a record of the Company must be made in the form as prescribed in
section 53 of PAIA. Complete the prescribed application form available at this link:
https://www.justice.gov.za/legislation/acts/2000-002.pdf
A requester is required to complete the necessary application form and submit same to theInformation Officer of the Company using the contact details as follows:
Information Officer:
Email:Tel:
Fax:
Postal address:
Address:Michael Porter (Managing Director)
infosa@rgare.com(021) 4861811(021) 4861702
PO Box 13422
Mowbray7705
7th Floor, The Terraces Black River Park
2 Fir Street
Observatory
7825

The Information Officer will cause the application to be processed and inform the requester offees, if any to be paid and any outstanding requirements in order to finalise the application.
NOTE: Access to certain records may be denied on the grounds set out in the PAIA.
A copy of the guide by the South African Human Rights Commission (SAHRC) as described inSection 10 of PAIA may be obtained from the SAHRC using the following details:
The SAHRC Research and Documentation Department
Postal Address:
Private Bag 2700
Houghton
2041
Telephone:(011) 484 8300
Fax:(011) 484 1360
Website:www.sahrc.org.za

4.

Protection of Personal Information that is Processed by the Company
4.1 Chapter 3 of POPIA provides for the minimum Conditions for Lawful Processing of
Personal Information by a Responsible Party. These conditions may not be derogatedfrom unless specific exclusions apply as outlined in POPIA.
4.2 The Company needs Personal Information relating to both individual and juristic persons
in order to carry out its business and organisational functions. The manner in which thisinformation is Processed and the purpose for which it is Processed is determined by theCompany. The Company is at times both an Operator and a Responsible Party in terms ofits contractual obligations. The Company is accordingly a Responsible Party for thepurposes of POPIA and will ensure that the Personal Information of a Data Subject:
i.

ii.
iii.

is processed lawfully, fairly and transparently. This includes the provision ofappropriate information to Data Subjects when their data is collected by the Company,in the form of privacy or data collection notices. RGA must also have a legal basis (forexample, consent) to process Personal Information;is processed only for the purposes for which it was collected;
will not be processed for a secondary purpose unless that processing is compatible
3

iv.
v.
vi.
vii.

viii.

with the original purpose.
is adequate, relevant and not excessive for the purposes for which it was collected;
is accurate and kept up to date;
will not be kept for longer than necessary;is processed in accordance with integrity and confidentiality principles; this includes
physical and organisational measures to ensure that Personal Information, in both
physical and electronic form, are subject to an appropriate level of security whenstored, used and communicated by the Company, in order to protect against accessand acquisition by unauthorised persons and accidental loss, destruction or damage;is processed in accordance with the rights of Data Subjects, where applicable. Data
Subjects have the right to:(a)be notified that their Personal Information is being collected by the Company.
The Data Subject also has the right to be notified in the event of a data
security incident;(b)know whether the Company holds Personal Information about them, and toaccess that information. Any request for information must be handled inaccordance with the provisions of this Manual;(c)request the correction or deletion of inaccurate, irrelevant, excessive, out ofdate, incomplete, misleading or unlawfully obtained personal information;(d)object to the Company’s use of their Personal Information and request thedeletion of such Personal Information (deletion would be subject to theCompany’s record retention requirements);(e)object to the processing of Personal Information for purposes of direct
marketing by means of unsolicited electronic communications; and(f)complain to the Information Regulator regarding an alleged infringement of
any of the rights protected under POPIA and to institute civil proceedings
regarding the alleged non-compliance with the protection of his, her or its
Personal Information.

4.3 Purpose of the Processing of Personal Information by the Company
As outlined above, Personal Information may only be Processed for a specific purpose. The
purposes for which the Company Processes or will Process Personal Information include, but
is not limited to, the following:
Purpose of the processing
Administer our business:

Provide reinsurance services to our clients:

Promote our products and services:













Research and market analysis:Manage our recruitment process:Manage equity, investments and shares
Manage mergers and acquisitions
Calculate and allocate financial resources
Calculate and set-aside financial reserves
Fulfil legal and regulatory requirements
Audit our business
Manage our clients and treaties
Assess and re-assess risks to be insured
Assess claims
Check for potential fraud, sanctions, credit andanti-money laundering
Price our products and services
Share information about our products andservices
Invite to attend our events and facilitate
participation
Manage communications
Price our products and services
Develop new and improve existing services andproducts
Communicate with candidates4Manage our employees:


Ensure security of our assets:

Assess candidate's professional experience,skills and abilities
Verify candidate’s right to work
Provide an employment offer
Inform candidates of future job opportunities
Carry out administrative procedures required for
identification verification, record keeping andfulfilment of an employment contract
Manage leave entitlements, sick leave,compensation, and payroll
Provide benefits
Assess performance, conduct salary reviews andadminister promotions
Provide training
Investigate and resolve any disputes, misconduct
or disciplinary matters
Manage our health and safety policies andcomply with our obligationsFoster diversity in the workplace
Facilitate social interaction among employees
and collaborative working environment
Provide access to our premises, equipment andsystems
Maintain the security of our premises, systems,
facilities and data

4.4Categories of Data Subjects and Personal Information/Special Personal Information relating thereto
As per section 1 of POPIA, a Data Subject may either be a natural or a juristic person. The Table below
includes but is not limited to the various categories of Data Subjects that the Company Processes
Personal Information on and the types of Personal Information relating thereto.
Categories of data subjects
Corporate

Product/Services related

Group companies
Shareholders
Board members
Trustees
Directors
Investors
Other organisations and their employees (e.g.
public bodies, banking institutions, suppliers andservice providers)Current and potential clients (ceding companies)
Advisors
Brokers
Policyholders and beneficiaries
Witnesses

Employment related

Candidates
Employees
Consultants
Visitors to premises

Type/classes of information processed5

Personal details: name, age, gender, date of birth, photographs, marital status, nationality,height and weight, employee number.
Identification information: government-issued ID and other certificates (for example,marriage certificates), driving license, taxpayer identification number, national ID number,passport ID number.
Corporate details: company name, identification number.
Contact information: address, telephone number and email address.
Information about family: marital status, number of children and their name, age, gender,
date of birth, address.
Employment information: employment history, employer, job role, employment contract, startand leave dates, working pattern.
Financial information: details pertaining to a bank account, annual income andcompensation.
Insurance policy and claims related information: policy number, previous insurance
records and claims histories, insurance policy amount, terms and issue dates,
recommendations and decisions regarding your policy underwriting and claims, including riskratings.
Education information: educational background, professional licenses and qualifications,skills.
Communication information: communication preferences, opt-in/opt-out preferences,enquiries, complaints, requests.
Benefits related information: available benefits, payments claimed.
Pay related information: salary, payroll information, tax information, retirement and/orpension information, details of any leave, expenses claimed.
Personality test information
Investigations related information: grievance and dignity at work matters, disciplinary
records, warnings or penalties issued, whistleblowing concerns.
Security monitoring related information: information derived from monitoring IT acceptable
use standards and access to premises, including employee user ID, IT systems access logs,
access card logs, CCTV records.
Performance and training information: performance at work, promotions, training history,development needs.
Types / classes of special personal information processed
Racial or ethnic origin

Religious or other beliefs

Trade union membership
Offences and alleged offences

Physical or mental health details
Criminal proceedings, outcomes andsentences

6

RGA Reinsurance Company of South Africa Limited

4.5 Recipients of Personal Information
The table below includes but is not limited to the categories of recipients to whom theCompany may provide a Data Subject’s Personal Information subject to the Company’s
compliance with POPIA:
Recipients of Personal Information Family, associates and representatives of the person whose personal information we areprocessing
 Employment and recruitment agencies
 Financial organisations
 Credit reference agencies
 Healthcare, social and welfare organisations
 Healthcare professionals
 Central government Police forces and courts, where necessary Clients
 Business associates and other professional advisers
 Retrocessionaires
 Claimants, beneficiaries, assignees and payees Press and the media
 Persons making an enquiry or complaint Private investigators
 Current, past and prospective employers
 Educators and examining bodies
 Claims investigators
 Suppliers and service providers
 Industry bodies
 Ombudsman and regulatory authorities Survey and research organizations
 Debt collection and tracing agencies
 Other companies in the RGA Group Auditors
 Pension fund administrators
 Trade unions
 Security organizations
4.6 Cross-Border Flows of Personal Information
Section 72 of POPIA provides that Personal Information may only be transferred out of theRepublic of South Africa if the:i. recipient country can offer such data an “adequate level” of protection. This means that its data
privacy laws must be substantially similar to the Conditions for Lawful Processing as contained inPOPIA; orii. Data Subject consents to the transfer of their Personal Information; oriii. transfer is necessary for the performance of a contractual obligation between the Data Subject
and the Responsible Party; oriv. transfer is necessary for the performance of a contractual obligation between the Responsible
Party and a third party, in the interests of the Data Subject; orv. the transfer is for the benefit of the Data Subject, and it is not reasonably practicable to obtain theconsent of the Data Subject, and if it were, the Data Subject, would in all likelihood provide suchconsent.
Personal Information may be transmitted transborder to other persons in other countries,and Personal Information may be stored in data servers hosted outside South Africa, which
may not have adequate data protection laws. The Company will endeavour to ensure that
all recipients of Personal Information in other countries will make all reasonable efforts tosecure said data and Personal Information.
Below includes the cross-border transfers of Personal Information to the following:
7

RGA Reinsurance Company of South Africa Limited
4.7Other RGA group companies in other countries
Retrocessionaires in other countries
Suppliers and service providers in other countries.
Description of information security measures to be implemented by the Company
Security measures such as anti-malware detection, firewall, encryption, back-up and disasterrecovery, systems access controls and other are implemented by the Company in order toensure that Personal Information is protected.
The Company performs assessments of the suitability and effectiveness of information
security measures in order to ensure that the Personal Information that is processed by theCompany is safeguarded and Processed in accordance with the Conditions for Lawful
Processing.

5. Updating and availability of this ManualThis Manual will be reviewed, if necessary, on an annual basis and is available on RGA's website at:https://www.rgare.com/global-directory/emea/south-africa).
Reviewed and updated on 12 October 2021.

8