GTC recognises its accountability to its stakeholders under the regulatory requirements applicable to our business and we are committed to high standards of integrity and fair dealing in the conduct of our business. We are committed to complying with both the spirit and the letter of the applicable requirements.

The GTC corporate governance framework and process ensures compliance with regulatory requirements and we embrace the achievement of ‘treating customers fairly’.

Our compliance function assists management in undertaking business in compliance with regulatory requirements.

• Website conditions of use
• Privacy policy
• GTC Conflict of interest policies and procedures
• GTC statutory disclosure on introduction
• GTC – BBK – Billike behandeling van kliente (BBK) beleidsdverklaring
• GTC – Beskerming van persoonlike inligting kennisgewing
• GTC – Complaints procedure
• GTC – Protection of personal information notice
• GTC – TCF Policy Statement May 2021
• GTC – Administrator PAIA Manual
• GTC – PAIA Manual

Protection of personal information (POPI) policy
Objective

The objective of this policy is to protect GTC’s Systems and Applications’ information from threats, whether internal or external, deliberate or accidental, to ensure business continuation, minimise business damage and maximize business opportunities.
This policy establishes a general standard on the appropriate protection of personal information within GTC.  It provides principles regarding the right of individuals to privacy and to reasonable safeguards of their personal information.

Scope

This policy applies to the key individuals, representatives, and staff of GTC.

The company and key individuals (or management) are ultimately responsible for ensuring that information security is properly managed.  GTC IT compliance is responsible for:

•  the development and upkeep of this policy.
• ensuring this policy is supported by appropriate documentation, such as procedural instructions.
• ensuring that documentation is relevant and kept up to date
• ensuring this policy and subsequent updates are communicated to relevant managers, representatives, staff and associates, where applicable.
• The company and all key individuals, representatives and staff are responsible for adhering to this policy, and for reporting any security breaches or incidents to the IT Compliance.
• External individuals who are contracted to handle specific IT systems and applications for GTC must adhere to the same information security as that of GTC staff members and will confirm by separate agreement that they have such security measures in place in respect of processing of personal information.

Key principles

The company and each key individual, representative and staff member of GTC is
committed to the following principles:

• To be transparent with regards to the standard operating procedures governing the collection and processing of personal information.
• To comply with all applicable regulatory requirements regarding the collection and processing of personal information.
• To collect personal information only by lawful and fair means and to process personal information in a manner compatible with the purpose for which it was collected.
• Where required by regulatory provisions, to inform individuals when personal information is collected about them.
• To treat sensitive personal information that is collected or processed with the highest of care as prescribed by regulation.
• Where required by regulatory provisions or guidelines, to obtain individuals’ consent to process their personal information.
• To strive to keep personal information accurate, complete and up to date and reliable for their intended use.
• To develop reasonable security safeguards against risks such as loss, unauthorized access, destruction, use, amendment or disclosure of personal information.
• To provide individuals with the opportunity to access the personal information relating to them and, where applicable, to comply with requests to correct, amend or delete personal information.
• To share personal information, such as permitting access, transmission or publication, with third parties only with a reasonable assurance that the recipient has suitable privacy and security protection controls in place regarding personal information.
• To comply with any restriction and/or requirement that applies to the transfer of personal information internationally.

Monitoring

• The management and compliance department of GTC is responsible for administering and overseeing the implementation of this policy and, as applicable, supporting guidelines, standard operating procedures, notices, consents and appropriate related documents and processes.
• The company and key individuals, representatives, and staff of GTC are to be trained according to their functions in regulatory requirements, policies and guidelines that govern the protection of personal information.
• GTC will conduct periodic reviews and audits, where appropriate, to demonstrate compliance with privacy regulation, policy and guidelines.

Operating controls

GTC has established appropriate privacy standard operating controls that are consistent with this policy and regulatory requirements. These include:

• Allocation of information security responsibilities;
• Incident reporting and management;
• User account / email account addition or removal;
• Customer data amendment audit trail;
• Secure online email archives;
• Secure application sign-on;
• Secure document and print functionality;
• Software updates;
• Unique system sign-on;
• Information security training and education;
• Network security controls;
• Domain password policy;
• Virus and Malware protection;
• MDM – Mobile Device Management;
• Data backup.

Implementation

• This policy is implemented by GTC and will be adhered to by the company and all key individuals, representatives and staff who are tasked with collecting and processing of personal information.
• Non-compliance with this policy may result in disciplinary action and possible termination of employment or mandate, where applicable