This privacy statement outlines the processing conducted by Vodacom to provide you with an enhanced mobile communications experience through a specification called Rich Communications Services (‘ RCS’ ). This service is either delivered through a downloaded RCS chat compatible client or through your device manufacturer’s native messaging app.
Last updated: [12 04 2021]
Who we are
RCS chat is provided to you by Vodacom (Pty) Ltd.
We are part of the Vodafone Group.
In this privacy policy:
- “we/us” means Vodacom (Pty) Ltd;
- “third party” means someone who is not you or us; and
- “Vodacom Group” means Vodacom Group Limited and any company or other organisation in which Vodacom Group Limited owns more than 15% of the share capital.
Vodacom (Pty) Ltd is registered in the Republic of South Africa at Corporate Park, 082 Vodacom Boulevard, Vodavalley, Midrand, 1685 under registered number 1993/03367/07 and registered VAT number ..
How to contact us
Your opinion matters to us – if you have any questions about our privacy policy, you can direct your question to the Data Protection Officer at: customerdataquery@vodafone.com. If you would like to mail us by post directly, send it marked the “Privacy Team” to
The Privacy Office – Legal Affairs Vodacom (Pty) Ltd Corporate Park 082 Vodacom Boulevard Vodavalley, Midrand 1685
Personal information we collect about you
Information we collect about you
The types of information we process about you as part of the Rich Communication Service (RCS) Chat Service are:
- To protect you and your device from malicious activity such as spam and viruses, the content of communications will be automatically filtered to try and identify such activity and stop it reaching your device.
- Connectivity information such as the numbers you send RCS messages to.
- Your location via your IP address (or you can choose to share your GPS location with your friends or businesses via the ‘share location’ feature);
- Your device details such as your IMEI number, phone number and device type;
- Information on when the MSISDNs used in your message’s conversations support RCS or not. We won’t link that information with your MSISDN, but just a global list of RCS enabled MSISDNs supporting RCS (built from all RCS users)
- Message and file transfer traffic data such as the numbers of the sender and recipient, the file type, name and length; and
- Content of your messages (such as any files or texts) are stored for up to 30 days in the event that the recipient is unavailable when you first send the message.
We’ll also get information about how you use our products and services, such as:
- The level of service that you receive – for example, network or service faults and other events that may affect our network services or other services;
- We keep an anonymous list of MSISDNs and date when we sent RCS welcome messages, to avoid sending you the same welcome message each time you register to the service. The info anonymize and is automatically deleted in a maximum of 365 days.
- In case of technical issues that may harm your device or the service we may include your MSISDN in an anonymous backlist to prevent the service to be activated for that MSISDN.
When we collect your personal information
We collect your personal information when:
· You send or receive messages or files; or
Vodacom will process your personal data based on:
- The performance of your contract or to enter into the contract and to take action on your requests. For example, we’ll need to process your network traffic data in order for you to send messages and files.
- Vodacom’s legitimate business interests , for example, fraud prevention, maintaining the security of our network and services, direct marketing, and improvement of our services. Whenever we rely on this lawful basis to process your data, we assess our business interests to make sure they do not override your rights. Additionally, in some cases you have the right to object to this processing. For more information, visit the Your Rights section of this policy.
- Compliance with a mandatory legal obligation , including for example accounting and tax requirements, which are subject to strict internal policies (such as retention periods), procedures, and your right to restrict usage of your data, which control the scope of legal assistance to be provided; or
- Consent you provide where Vodacom does not rely on another legal basis. Consent is always presented to you separately and you can withdraw your consent at any time.
- The performance of your contract or to enter into the contract and to take action on your requests. For example, we’ll need to process your network traffic data in order for you to send messages and files.
- Vodacom’s legitimate business interests, for example, fraud prevention, maintaining the security of our network and services, direct marketing, and improvement of our services. Whenever we rely on this lawful basis to process your data, we assess our business interests to make sure they do not override your rights. Additionally, in some cases you have the right to object to this processing. For more information, visit the Your Rights section of this policy.
- Compliance with a mandatory legal obligation, including for example accounting and tax requirements, which are subject to strict internal policies (such as retention periods), procedures, and your right to restrict usage of your data, which control the scope of legal assistance to be provided; or
- Consent you provide where Vodacom does not rely on another legal basis. Consent is always presented to you separately and you can withdraw your consent at any time.
How we use your personal information
Provide you with your service
We use your data in order to provide you with the RCS Chat. For example, the device uses your data to check in the server if you have new messages or to send files and messages.
Marketing & profiling
Vodacom does not use RCS Chat to send you marketing messages without your permission, however given that RCS is a communications platform, third parties to whom you have given your permission may send you such communications. If you wish to opt-out of those, you should contact the third party in question (the sender of the message(s)).
You may also choose to start and/or continue conversations with brands and businesses using RCS Chat. If you do so, then your conversations and interactions may be recorded and analysed by those brands and businesses. For more information please consult the privacy policy of that brand or business.
Analytics
We also conduct real-time traffic analysis for the purposes of routing and detecting any illegitimate Application To Person (‘A2P’) or Person To Application messages – that’s companies sending you messages and/or trying to obtain messages from you. We do not conduct this analysis on a personal level; all your data is aggregated and the analysis is conducted on that aggregate data.
How we share your personal information
Where applicable, we share information about you with:
- Companies in the Vodafone Group;
- Partners, suppliers or agents involved in delivering the RCS product. We may share information with brands such as your MSISDN, when you choose to start a chat conversation with them. Any messages sent to brands using our platform will be subject to the brand’s privacy policy which you can find in the brand’s profile settings;
- Companies who are engaged to perform services for, or on behalf of, Vodacom Limited, or Vodacom Group;
- Credit reference, fraud-prevention or business-scoring agencies, or other credit scoring agencies;
- Debt collection agencies or other debt-recovery organisations;
- Law enforcement agencies, government bodies, regulatory organisations, courts or other public authorities if we have to, or are authorised to by law; or
- A third party or body where such disclosure is required to satisfy any applicable law, or other legal or regulatory requirement.
International data transfers
We predominantly process and store data within the EEA. However, in order to offer some of the RCS discovery features to enable your interaction with brands, data may be transferred to third parties located out of the EEA. In such cases, we will make sure that there is a legal basis for such transfer and that your personal information is adequately protected as required by applicable law, for example, by using standard agreements approved by relevant authorities and by requiring the use of other appropriate technical and organisational measures to protect your personal information.
How long we keep your personal information for
Cessation of service
We retain data for only as long as is necessary for you to receive your service. If you choose to stop using RCS Chat, we will delete your data after 30 days.
Message and File Transfers
Message and File Transfers (FT) are stored for up to 30 days in the Store & Forward database if the recipient of your message was not available. This is subsequently deleted after the 30 days are up.
Keeping your personal information secure
We have specialised security teams who constantly review and improve our measures to protect your personal information from unauthorised access, accidental loss, disclosure or destruction.
Communications over the internet (such as emails) aren’t secure unless they’ve been encrypted. Your communications may go through a number of countries before being delivered, as this is the nature of the internet.
We cannot accept responsibility for any unauthorised access or loss of personal information that is beyond our control.
We’ll never ask for your secure personal or account information by an unsolicited means of communication. You’re responsible for keeping your personal and account information secure and not sharing it with others.
Our website may provide links to third-party websites. We cannot be responsible for the security and content of such third-party websites. So make sure you read that company’s privacy and cookies policies before using or putting your personal information on their site.
The same applies to any third-party websites, RCS conversations or content you connect to using our products and services.
If you choose to initiate and continue conversations with brands or businesses through RCS discovery features (messaging search, messaging gallery, concierge bot, deep linking from websites, social networks or apps, clicking on ads within an RCS conversation, entering a short code or a long number to start a conversation), your conversation and interactions may be recorded and analysed by brands or businesses. For more information, please refer to the brand or business’s privacy policy.
You may choose to disclose your information in certain ways such as social plug-ins (including those offered by Google, Facebook, Twitter and Pinterest) or using third-party services that allow you to post reviews or other information publicly, and a third party could use that information.
Social plug-ins and social applications are operated by the social network themselves and are subject to their own terms of use and privacy and cookies policies. You should make sure you’re familiar with these.
Your rights
At Vodacom, we are committed to processing personal information honestly, ethically, with integrity, and always consistent with applicable laws and our values. Below we set out details on how you can exercise your rights. Please note, under certain circumstances these rights may be limited if we still have lawful grounds to process your personal information. If you have a question or cannot find the answer, please click on this link Customer Services or email us at customercare@vodacom.co.za.
Right to correct personal information
You have the right to have information held about you corrected if it is not accurate. If what we hold on you needs updating, or you think it may be inaccurate or incorrect you can contact our Customer Services team.
Right to access personal information
You have the right to make a request for a copy of the personal information that Vodacom holds about you. To make this request as an individual or an authorised third party, visit our Subject Access Rights of our page privacy portal at https://www.vodacom.co.za/vodacom/privacy-policy/access-to-information-act which gives details on how to do this. Alternatively, you can contact our Customer Services team.
Right to object to use of your personal information
You have the right, in certain circumstances, to object to Vodacom processing your personal information. Please contact our Customer Services team or email us at customerdataquery@vodafone.com
How to lodge a complaint
If you want to contact us about any of your rights or if complain about how we use your personal information you undertake to first attempt to resolve any concerns with Vodacom directly. Kindly contact our representative’s Customer Services team. We will do our best to help but if you are still unhappy, you can contact the Privacy Office at askpopi@vodacom.co.za. If you are not satisfied with such process, you have the right to lodge a complaint with the Information Regulator at:
The Information Regulator (South Africa)
JD House 27 Stiemens Street Braamfontein Johannesburg 2001 Email: inforeg@justice.gov.za Complaints email: complaints.IR@justice.gov.za
Right to restrict use of your personal information
If you feel your personal information we hold on you is inaccurate, or if you believe we shouldn’t be processing your personal information, please contact our Customer Services team to discuss your rights. In certain circumstances you will have the right to ask us to restrict processing.
Right to deletion
Vodacom strives to only process and retain your data for as long as we need to. In certain circumstances you have the right to request that we erase personal data of yours that we hold. If you feel that we are retaining your personal information longer than we need, it is worth first checking that your contract with Vodacom has been terminated, which you can do with Customer Services. If your contract with Vodacom has been terminated, we may still have lawful grounds to process your personal data. For more information on retention periods, see the accordion in this Privacy Policy called ‘How long we keep your personal information for’.