1. Introduction

1.1. Welcome to our Privacy policy. This is our plan of action when it comes to processing your personal information and protecting your privacy. We respect your privacy and take the protection of your personal information very seriously. The purpose of this policy is to describe the way that we process data that can be associated with you or another specific natural or juristic person and can be used to identify you or that person (“personal information”

1.2. This policy may form part of our Terms and Conditions and shall be governed by and construed in accordance with the laws of South Africa. This Notice explains how we obtain, use and disclose your personal information, as is required by the Protection of Personal Information Act, 2013 (POPIA). We are committed to protecting your privacy and to ensuring that your personal information is collected and used properly, lawfully and openly.

1.3. We recommend that you read this policy so that you fully understand our approach towards the use of your personal information.

1.4. In this policy, the following words and phrases which have the corresponding meaning:

1.4. In this policy, the following words and phrases which have the corresponding meaning:

• 1.4.1. "consent", means the consent which you give to us to process your personal information. This consent must be voluntary, specific and informed. Following this, once we have explained to you why we need your personal information and what we will be doing with it, you are then, in relation to certain uses of the information, required to give us your permission to use it, which permission or consent can be express or implied; implied meaning that consent may be demonstrated by way of your actions;
• 1.4.2. "data subject", means you, the person who owns and who will provide us with your personal information for processing, which reference is found under POPIA;
• 1.4.3. “information”, means any data or information, whether such information is deemed to be personal information or not;
• 1.4.4. "operator" means any person who processes your personal information on our behalf as a sub-contractor, in terms of a contract or mandate, without coming under our direct authority. These persons for illustration purposes may include Privacy Policy : Carrol Boyes (Pty) Ltd verification agencies, advertising and public relations agencies, call centres, service providers, auditors, legal practitioners, organs of state, government, provincial and municipal bodies;
• 1.4.5. "personal information", means personal information relating to any identifiable, living, natural person, and an identifiable, existing juristic person, including, but not limited to: your name, address, contact details, date of birth, place of birth, identity number, passport number, bank details, details about your employment, tax number and financial information; vehicle registration, dietary preferences, financial history, information about your next of kin and or dependents, information relating to your education or employment history;
• 1.4.6. “special personal information” means information of a very personal nature and information includes race, gender, pregnancy, nationality, ethnic or social origin, colour, physical or mental health, disability, criminal history, including offenses committed or alleged to have been committed, membership of a trade union and biometric information, such as images, fingerprints and voice-prints, blood typing, DNA analysis, retinal scanning and voice recognition;
• 1.4.7. "processing" or “process” or processed”, means in relation to personal information, the collection, receipt, recording, organisation, collation, storage, updating or modification, retrieval, alteration, consultation or use; dissemination by means of transmission, distribution or making available in any other form; merging, linking, as well as restriction, degradation, erasure or destruction of information; or sharing with, transfer and further processing, including physical, manual and automatic means. This is a wide definition and therefore includes all types of usage of your personal information by us, including the initial processing when we first collect your personal information and any further and ongoing processing;
• 1.4.8. “purpose” means the reason your personal information needs to be processed by us;
• 1.4.9. "responsible party, means us, the person/entity who is processing your personal information;
• 1.4.10. “you” means you, the data subject under POPIA, who will be providing us, the responsible party with your personal information, for processing.

1.5. In terms of POPIA, where a person processes another’s personal information, such processing must be done in a lawful, legitimate and responsible manner and in accordance with the provisions, principles and conditions set out under POPIA.

1.6. In order to comply with POPIA, a person processing another’s personal information must: Privacy Policy : Carrol Boyes (Pty) Ltd

• 1.6.1. provide the data subject or owner of the personal information with a number of details pertaining to the processing of the personal information, before such information is processed; and
• 1.6.2. get permission or consent, explicitly or implied, from the owner / data subject, to process the personal information, unless such processing:
• 1.6.2.1. is necessary to carry out actions for the conclusion or performance of a contract to which the owner / data subject of the personal information is a party;
• 1.6.2.2. is required in order to comply with an obligation imposed by law; or
• 1.6.2.3. is for a legitimate purpose or is necessary to protect the legitimate interest (s) or for pursuing the legitimate interests of i) the owner / data subject of the personal information; ii) the person processing the personal information; or iii) that of a third party to whom the personal information is supplied; or
• 1.6.2.4. is necessary for the proper performance of a public law duty by a public body or on behalf of a public body.

1.7. In accordance with the requirements of POPIA, and because your privacy and trust are important to us, we set out below how we collect, use, and share your personal information and the reasons why we need to use and process your personal information.

2.WHO WE ARE AND WHAT WE DO

Our details are: Carrol Boyes (Pty) Ltd Registration Number : 2007/008786 Island Centre, Industry Street Paarden Eiland Cape Town Western Cape 7405 Our main business is : manufacturing and sale of functional art ("our products" or "our services") We operate a website which can be found at : Privacy Policy : Carrol Boyes (Pty) Ltd

3. APPLICABILITY OF THIS PRIVACY POLICY

3.1. All personal information will be processed to enable us to do and further our main business. This policy will apply to you if you interact with us in any form as part of our main business. The manner in which we collect personal information from you, what personal information we process and how that personal information is used will depend on the way you interact with us relating to our main business. If you interact with us in any of the following ways, this policy will be applicable to you:

• 3.1.1. Users of our sites: persons who use any of our websites, applications, mobile applications, or social media portals or platforms whether in order to find out more about us, to make enquiries about us, or our products or services or where people want to do business with us, be it providing or selling to us or receiving or buying from us, certain goods and services, etc.
• 3.1.2. Applicants: persons who wish to apply for an employment position or learnership with us, or a bursary, funding, or a sponsorship from us.
• 3.1.3. Employees and Directors: persons who are employed by us or who have been appointed as directors or committee members.
• 3.1.4. Customers and Clients: persons who are desirous of, or who use or purchase our products or services, who receive marketing communications or who communicate with us physically or via email or via our websites, applications, mobile applications, or social media portals or platforms, or who come onto any of our sites, facilities or who enter our offices.
• 3.1.5. Customers and Clients: persons who are desirous of, or who use or purchase our products or services, who receive marketing communications or who communicate with us physically or via email or via our websites, applications, mobile applications, or social media portals or platforms, or who come onto any of our sites, facilities or who enter our offices.
• 3.1.6. Contractors, Vendors and Service Providers: persons who are desirous of, or who do provide us with goods, and services, or who we provide goods and services to, including consultancy and infrastructure related services and who we interact and communicate with, either physically or via email or via our websites, applications, mobile applications, or social media portals or platforms, and/or who come onto any of our sites, facilities and/or who enter our offices.
• 3.1.7. Visitors: people who come onto any of our premises and sites, including reception and waiting rooms, offices, operational areas and facilities, manufacturing areas, storage areas, warehouses and parking areas. Privacy Policy : Carrol Boyes (Pty) Ltd
• 3.1.8. Regulators and Public Bodies: persons who we engage with in order to discharge legal and public duty obligations, including SARS, National Treasury, Department of Labour, the Financial Sector Conduct Authority.
• 3.1.9. Business partners: whether in their capacity as operators or not, who provide services, goods and other benefits to us, our employees or to our customers, clients and service providers, such as medical aids, pensions or provident funds, administrators, financial service providers, advertising, marketing or PR agencies, wellness or health and medical providers.

4. HOW DO WE COLLECT PERSONAL INFORMATION FROM YOU?

The way you interact with us will dictate how we collect information from you. In general, we have three ways of collecting information from you:

4.1. Submitted Information: This is information you specifically provide to us and includes providing information:

• 4.1.1. When you interact with any forms on our websites, applications or social platforms;
• 4.1.2. When you use any of our websites, social media platforms or services
• 4.1.3. When you subscribe to any of our newsletters;
• 4.1.4. When entering any of our competitions or promotions;
• 4.1.5. When participating in a survey offered on our websites, applications or social platforms;
• 4.1.6. When posting a comment, a review, a reply or a recommendation on any of our websites, applications or social media platforms;
• 4.1.7. When you apply to become a customer or client;
• 4.1.8. When you apply to become one of our employees or directors;
• 4.1.9. When you enter into a any form of contract with us;
• 4.1.10. When ordering or subscribing to any of our services;
• 4.1.11. When you place orders for our products or services advertised on our website;
• 4.1.12. When you consult or meet with us in person or electronically;
• 4.1.13. When you send us electronic messages via email or any social applications or platforms;
• 4.1.14. When you book for any of our events or services;
• 4.1.15. When you sign in to any of our premises for security purposes. Privacy Policy : Carrol Boyes (Pty) Ltd

4.2. Anonymous Information: This is Information that may be collected from you anonymously. With each visit to our website, we may automatically and anonymously collect and store certain technical information about you. Some of this information may be personal information and includes, but is not limited to the following:-

• 4.2.1. Your Internet Protocol (IP) address which is used to connect your computer to the Internet;
• 4.2.2. Your operating system, browser type and platform for system administration;
• 4.2.3. Information about your use of our website including details of your visits such as pages viewed and the resources that you accessed;
• 4.2.4. Your location data and other communication data;
• 4.2.5. Third Party Tracking Tools – refer to paragraph 7;
• 4.2.6. Cookies – refer to paragraph 8.

4.3. Third-party Information: We may collect personal information about you from third parties, such as:

• 4.3.1. Your organization and others with whom you have a relationship with that provide or publish personal information related to you, such as from our customers or from others when they create, post, or submit user content that may include your personal information.
• 4.3.2. Regulators, professional or industry organizations and certification / license agencies that provide or publish personal information related to you.
• 4.3.3. Third parties and affiliates who deal with or interact with us or you.
• 4.3.4. Service providers and business partners who work with us and that we may utilize to deliver certain content, products, or services or to enhance your experience.
• 4.3.5. Marketing, sales generation, and recruiting business partners.
• 4.3.6. SAP, Home Affairs, Credit bureaus and other similar agencies.
• 4.3.7. Government agencies, regulators and others who release or publish public records.
• 4.3.8. Other publicly or generally available sources, such as social media sites, public and online websites, open databases, and data in the public domain.

5. WHAT INFORMATIONA DO WE COLLECT FROM YOU?

We strive to collect only that personal information which relates to our main business and is necessary for the intended purpose of the collection. The type of Privacy Policy : Carrol Boyes (Pty) Ltd information we collect from you and process, depends on the manner in which you interact with us and may include, but is not limited to:

5.1. You or your employer’s contact information, such as names, surname, alias, address, identity- or registration number, passport number, date of birth, security number, phone number, cell phone number, vehicle make and registration number, social media user ID, email address, and similar contact data.

5.2. Account Information, including banking details, security-related information (including user names and passwords, authentication methods, and roles), service-related information (including purchase history and account profiles), billing-related information (including payment, shipping, and billing information), and similar data, all which are required to perform contractual matters and / or in order to provide you with access to our Products or Services.

5.3. User content, such as content of communications, suggestions, questions, comments, feedback, and other information you send to us, that you provide to us when you contact us, or that you post on our websites, applications, mobile applications, or social media portals or platforms including information in alerts, folders, notes, and shares of content), and similar data which are required to perform contractual matters and / or in order to provide you access to services or attend to queries.

5.4. Device & browser information, such as network and connection information (including Internet Service Provider (ISP) and Internet Protocol (IP) addresses), device and browser identifiers and information (including device, application, or browser type, version, plug-in type and version, operating system, user agent, language and time zone settings, and other technical information), advertising identifiers, cookie identifiers and information, and similar data, which are required to perform contractual matters and / or in order to provide you access to services or attend to queries or to ensure that security safeguards are in place.

5.5. Usage Information and browsing history, such as usage metrics (including usage rates, occurrences of technical errors, diagnostic reports, settings preferences, backup information, API calls, and other logs), content interactions (including searches, views, downloads, prints, shares, streams, and display or playback details), and user journey history (including click-streams and page navigation, URLs, timestamps, content viewed or searched for, page response times, page interaction information (such as scrolling, clicks, and mouse-overs), and download errors), advertising interactions (including when and how you interact with marketing and advertising materials, click rates, purchases or next steps you may make after seeing an advertisement, and marketing preferences), and similar data which are required to perform contractual matters or in order to provide you access to services or attend to queries or to ensure that security safeguards are in place. Privacy Policy : Carrol Boyes (Pty) Ltd

5.6. Location Data, such as the location of your device, your household, and similar location data, which are required to perform contractual matters or in order to provide you access to services or attend to queries or to ensure that security safeguards are in place.

5.7. Demographic Information, such as country, preferred language, age and date of birth, marriage status, gender, physical characteristics, personal or household/familial financial status and metrics, military status, and similar data, which are required to perform contractual matters and / or in order to provide you access to services or attend to queries or to ensure that security safeguards are in place.

5.8. Your image and any biometric Information, such as still pictures, video, voice, fingerprints and other similar data, which are required to perform contractual matters or in order to provide you access to our premises, services or products or to attend to queries or to ensure that security safeguards are in place.

5.9. Public issued Identity Information, such as government-issued identification information, tax identifiers, social security numbers, other government-issued identifiers, and similar data, which are required to comply with laws and public duties as well for other lawful reasons about your employment with the organization.

5.10. Financial Information, such as billing address, credit card information, billing contact details, and similar data., tax numbers and VAT numbers, which are required to perform contractual matters and / or in order to provide you access to services or attend to queries or to ensure that security safeguards are in place or which are required to comply with laws and public duties.

5.11. Social media and online content, such as information placed or posted in social media and online profiles, online posts, and similar data, which are required to perform contractual matters and / or in order to provide you access to services or attend to queries and generally for the purposes of advertising, marketing and related communications.

5.12. Security Information like serial numbers of equipment, details regarding the possession of dangerous weapons, and other contact information including details of your previous employers, memberships or affiliations, including professional bodies and trade unions, and similar data, which are required for various legitimate interest, contractual or lawful reasons pertaining to your application for employment or actual employment with the organization. If you are a job applicant, employee or director, we may also collect the following Information from you: Privacy Policy : Carrol Boyes (Pty) Ltd

5.13. Career, education, and employment related information, such as job preferences or interests, work performance and history, salary history, status as a veteran, nationality and immigration status, demographic data, disability-related information, application information, professional license information and related compliance activities, accreditations and other accolades, education history (including schools attended, academic degrees or areas of study, academic performance, and rankings), and similar data, which are required for contractual or employment-related matters or which are required to comply with laws and public duties.

5.14. Specific identifiers, or special personal information, which are required in order to protect legitimate interests, comply with legal obligations or public legal duties, or in order to accommodate you in our workplaces, such as your race (BBBEE related), religion (correct and fair treatment related), sexual and medical history including any medical conditions (to comply with laws and related to correct and fair treatment issues), trade union matters (to comply with laws and related to correct and fair treatment issues), and financial, credit, deviant and criminal history (to protect our legitimate interests and to perform risk assessments), as well as children’s details(benefits related).

5.15. Health records such as medical status and history, examinations, blood type, medical aid history, disability-related information, biometrics, medicals, psychometrics and similar data, which are required for contractual or employment-related matters or which are required to comply with laws and public duties.

7. THIRD PARTY TRACKING TOOLS

7.1. We may use tools on our websites, applications or social media platforms provided by third party service providers to track your visits to and activity on our website (“third party tracking tools”), which we may use mainly to obtain Privacy Policy : Carrol Boyes (Pty) Ltd statistics of how users like you use our website, to improve our website’s performance and ranking and to improve the features and user experience of our website.

7.2. The information collected by third party tracking tools is collected automatically and anonymously – no personal information is collected.

7.3. The collection of information by these third-party tracking tools is done and managed by parties over whom we have no control. We will therefore not be responsible or held accountable in any way for the manner in which this information is collected, processed, stored or shared by such third parties.

8.COOKIES

8.1. Our websites may use cookies, which are small text files sent by a web server to store on a web browser. They may be used to ensure that our websites function properly, store user preferences when needed and collect anonymous statistics on website usage.

8.2. We may use two types of cookies –

• 8.2.1. First party cookies, also called session cookies. This type of cookie contains a randomly generated number and allows the browser to remember your selections. It expires when you close the browser and contains no personally identifiable information.
• 8.2.2. Third party cookies. These cookies are mainly used to collect anonymous website statistics such as the number of visitors in a month, average duration of visits and popular pages viewed. This data is used to review and improve the site. It can also be used and placed by applicable social networks if you share pages via social networks. This is done in accordance with their respective privacy policies.

8.3. You may refuse to accept cookies by activating the setting on your browser which allows you to refuse the setting of cookies. However, if you select this setting you may be unable to access certain parts of the website. Unless you have adjusted your browser setting so that it will refuse cookies, our system will issue cookies when you log on to the website. If you accept a “cookie” or fail to deny the use of “cookies”, you agree that we may use your personal information collected using “cookies” (subject to the provisions of this policy). Where you either reject or decline cookies, you are informed that you may not be able to experience the interactive features of the website fully.

9. HOW DO WE USE YOUR PERSONAL INFORMATION?

Privacy Policy : Carrol Boyes (Pty) Ltd We will only collect, use, disclose or otherwise process your personal information in accordance with this policy. How we use your personal information will depend on the nature of your interaction with us and we undertake only to use your personal information in line with our main business for purposes that are generally accepted and necessary for the reason you interact with us. This includes but is not limited to:

9.1. Due diligence purposes: To carry out a due diligence before we decide to engage or interact with you or to do business with you, including, where appropriate, obtaining and verifying your credentials, including your business details, medical status, health history and related records, education and employment history and qualifications, credit and financial status and history, tax status, B-BBEE status, and or any performance or vendor related history.

9.2. Contract purposes: To investigate whether we are able or willing to conclude a contract with you based on the findings of any due diligence detailed above, and if the assessment is in order, to conclude a contract with you.

9.3. To process transactions and render or provide or receive goods and services: To perform under any contract which has been concluded with you, including carrying out all contractual obligations, exercising all contractual rights, assessing or communicating requirements, manufacturing, packaging, ordering, delivering, and/or responding to, or submitting queries, complaints, returns or engaging in general feedback, or acting in such a manner as to personalize any goods or services, and to make recommendations related to us or our or your operations.

9.4. Attending to financial matters about any transaction: To administer accounts or profiles related to you or your organization including registrations, subscriptions, purchases, billing events, fees, costs and charges calculations, quoting, invoicing, receipt of payments or payment of refunds, reconciliations and financial management in general.

9.5. Communications: To make contact with you and to communicate with you generally or in respect of our or your requirements, or instructions or our product or services.

9.6. Risk assessment and anti- bribery and corruption matters: To carry out vendor, organizational and enterprise wide risk assessments, in order to detect and prevent bribery, corruption, fraud and abuse, to comply with all applicable laws, as well as to identify and authenticate your access to and to provide you with access to our goods, services or premises and generally to ensure the security and protection of all persons including employees, and persons when entering or leaving our sites and operations or facilities and/or to exercise our rights and to protect our and others rights and property, including to take Privacy Policy : Carrol Boyes (Pty) Ltd action against those that seek to violate or abuse our systems, services, customers or employees or other third parties where applicable.

9.7. Legal obligation and public duties: To comply with the law and our legal obligations, including to register with Regulators, obtain and hold permits and certificates, register for VAT, Tax, PAYE, SDL, COIDA and UIF etc. and to submit reports or provide various notices or returns, to litigate and collect any money due to us, to respond to a request or order from a SAP official, investigator or court official, regulator, or public authority.

9.8. Security purposes: to permit you access to our offices, facilities, manufacturing or parking areas, as well as to controlled areas, for the purposes of monitoring via CCTV, your interaction and access in and from our facilities described above, and for general risk management, security and emergency incident control purposes as well as for data and cybersecurity purposes

9.9. Internal research and development purposes: To conduct internal research and development for new content, products, and services, and to improve, test, and enhance the features and functions of our current goods and services.

9.10. Sale, merger, acquisition, or other disposition of our business (including regarding any bankruptcy or similar proceedings): To proceed with any proposed or actual sale, merger, acquisition, or other disposition of our business (including concerning any bankruptcy or similar proceedings).

9.11. Marketing and electronic communications related to it: To provide you with communications regarding us, our goods and services and or other notifications, programs, events, or updates that you may have registered or asked for, and to send you offers, advertising, and marketing materials, including providing personalized advertising to you, save where you have opted out of this activity.

9.12. Events, advertising and public relations materials and publications: For the purposes of making contact with you and or attending to your enquiries and requests in relation to our advertising and public relations materials and publications and or events and functions and for providing you from time to time with information pertaining to public relations materials and publications, and or events and functions and to invite you to attend functions and events or our request for your appearance in advertising and public relations materials and publications. If you are a job applicant, employee or director, we may also use your personal information for:

9.13. Employment: To conduct and communicate with you regarding recruiting and human resource administration, to manage recruitment including legal eligibility for work and vetting. Privacy Policy : Carrol Boyes (Pty) Ltd

9.14. Employment due diligence purposes: To carry out ongoing due diligence exercises including obtaining and verifying your details or credentials, such as receiving and verifying your identity, education, qualifications and employment history, medical and health history and related records, financial, credit and tax status and history, and or any employee performance-related history.

9.15. To conclude an employment contract with you, to manage hires, promotion and succession planning; and to conduct and communicate with you regarding your employment and to perform human resources administration, financial administration, comply with labour, Tax and B-BEEE laws, management and organizational administration, training, and skills development, including performance assessments and disciplinary matters.

9.16. Employment benefits: To manage your benefits, including administering remuneration, relocation, insurance, payroll, pensions and other employee benefits and tax, including disclosure to others such as payroll providers, accountants, occupational health providers, insurers, pensions administrators, hosting service providers and legal advisers;

9.17. Operational issues: To communicate, enforce and ensure you comply with policies, including in relation to claims, disciplinary actions or legal requirements and conducting investigations and incident response, including reviewing your communications in these situations in accordance with relevant internal policies and applicable law;

9.18. Occupational health: For compliance with any applicable laws and to manage occupational health and absence and fitness for work and notifying family members in emergencies. 9.19. Travel: To facilitate business travel, travel-related support including conference attendance, bookings, and emergency support services.

9.20. B-BBEE: For compliance with any applicable laws and to monitor equal employment opportunities, in respect of diversity categories including but not limited to age, gender, ethnicity, nationality, religion, disability, sexual orientation, and marital or family status.

9.21. IR and Labour relations: For compliance with any applicable laws and to manage membership to trade unions and collective agreements for administering collective employee arrangements where these are in place.

10. HOW DO WE SHARE YOUR PERSONAL INFORMATION?

10.1. We may share personal information if it relates to our main business and for the purposes set out in this policy as follows: Privacy Policy : Carrol Boyes (Pty) Ltd

• 10.1.1. Our employees and our affiliates. We may share your personal information amongst our employees, affiliates and for business and operational purposes.
• 10.1.2. Your Organization and Contacts. We may share your personal information with your organization and others with whom you have a relationship in order to fulfill or perform a contract or other legal obligation, including with third parties that arrange or provide you with access to our goods or services and who pay us regarding such access. We may also share your personal information with your contacts if you are in the same organization or to facilitate the exchange of information between you and the contact(s).
• 10.1.3. Business Partners. We may share your personal information with our business partners to jointly offer, provide, deliver, analyze, administer, improve, and personalize products or services or to host events and functions. We may also pass certain requests from you or your organization to these business providers.
• 10.1.4. Third Party Content Providers. We may share your personal information with our third-party content providers to perform tasks on our behalf and to assist us in providing, delivering, analyzing, administering, improving, and personalizing content related to our relationship with you, including financial, benefits, health and medical, and wellness benefits and may to this end pass certain requests from you or your organization to these providers.
• 10.1.5. Third Party Service Providers. We may share your personal information with our third-party service providers to perform tasks on our behalf and which are related to our relationship with you, including financial, benefits, health and medical, and wellness benefits and to assist us in offering, providing, delivering, analyzing, administering, improving, and personalizing such services or products.
• 10.1.6. Cyber Third-Party Service Providers. We may share your personal information with our third-party cyber service providers to perform tasks on our behalf and which are related to our relationship with you, including those who provide technical and/or customer support on our behalf, who provide application or software development and quality assurance, who provide tracking and reporting functions, research on user demographics, interests, and behavior, and other products or services. These third-party service providers may also collect personal information about or from you in performing their services and functions on our Services. We may also pass certain requests from you or your organization to these third-party service providers.
• 10.1.7. Advertisers. We may share your personal information with advertisers, advertising exchanges, and marketing agencies that we engage for advertising services, to deliver advertising, and to assist us in advertising our brand and products and services. Those advertising services may also target advertisements on third party websites based on cookies or other information indicating previous interaction with us and/or ourselves. Privacy Policy : Carrol Boyes (Pty) Ltd networks, marketing surveys, business websites, and other sources made available to us to create listings and profiles that are placed into user listings and directories. Additionally, if you choose to include your personal information in any reviews, comments, or other posts that you create, then that personal information may be displayed other users as part of your posting.
• 10.1.9. In the Event of Merger, Sale, or Change of Control. We may transfer your personal information to a third-party entity that acquires or is merged with us as part of a merger, acquisition, sale, or other change of control (such as the result of a bankruptcy proceeding).
• 10.1.10. Regulators and law enforcement agencies. We may disclose your personal information to regulators and other bodies in order to comply with any applicable law or regulation, to comply with or respond to a legal process or law enforcement or governmental request.
• 10.1.11. Other Disclosures. We may disclose your personal information to relevant third parties if we reasonably believe that disclosure of such information is helpful or reasonably necessary to do or further our main business or to enforce our terms and conditions or other rights (including investigations of potential violations of our rights), to detect, prevent, or address fraud or security issues, to obtain payment of monies that may be legally due to us or to protect against harm to the rights, property, or safety of our employees, any users, or the public.

10.2. When we share your personal information with our third-party service providers, partners or advertisers, we:

• 10.2.1. We require that our third-party service providers take appropriate, reasonable, technical and organisational measures to keep your personal information secure;
• 10.2.2. Our service providers may not use or disclose personal information for any purpose other than providing the services on our behalf.

10.3. In some cases, we may de-identify your personal information (which means that we delete any information that can be used to identify you) (“de-identified Information”). You agree that once your personal information has been deidentified, we may share such de-identified Information with our agents, advisers, service providers and suppliers.

10.4. We will never sell or otherwise make your personal information available to any other party that is not related to our main business, unless we obtain your prior permission to do so.

11. DIRECT MARKETING Privacy Policy : Carrol Boyes (Pty) Ltd

11.1. We may use your personal information to market our products directly or services or any related products or services to you. Such marketing will be done by way of electronic communication and may take the form of : Emails, ext Messages / SMS, Social media networks, such as Facebook, Instagram or Twitter

11.2. By using our website, products or services and providing us with the relevant personal information, you consent to us processing your personal information for direct marketing to you, using electronic communications. Such direct marketing electronic communication may include, but is not limited to:

• Communication from us regarding new products and services;
• Communication from businesses that may be advertising on our websites
• Communication from businesses that are affiliated to us.

11.3. You may object, free-of-charge and without formality, to the use of your details for direct marketing purposes, by contacting us as per the details in paragraph 16. You also have the right to opt out of receiving further marketing communications from us should you wish to do so.

12. CROSS-BORDER TRANSFER OF PERSONAL INFORMATION

12.1. There is a possibility that the personal information that we collect from you may have to be transferred to, and stored at, a destination outside of the Republic of South Africa for purposes of our main business. The reasons for such crossborder transfers, includes but is not limited to:

• 12.1.1. Our website may be hosted by a third-party hosting service provider, outside South Africa;
• 12.1.2. We may have to back up our electronic information to servers that are outside South Africa;
• 12.1.3. If your personal information is processed outside of South Africa, we will take reasonable measures to ensure that your personal information is processed by such third-party service providers for the purposes for which it has been provided to us and that the required levels of protection have been implemented by such third-party service providers to safeguard your personal information. Other than these steps, we have no control over how your personal information is used by such third-party providers. We will therefore not be responsible or held accountable in any way for the manner in which this information is processed by such third-parties. Privacy Policy : Carrol Boyes (Pty) Ltd

13. HOW DO WE SAFEGUARD YOUR PERSONAL INFORMATION?

13.1. The security of your personal information is important to us. Taking into account the nature, scope, context, and purposes of processing personal information, as well as the risks to individuals of varying likelihood and severity, we have implemented technical, organizational and contractual measures designed to protect the security of personal information. In this regard we will conduct regular audits regarding the safety and the security of your Personal Information.

13.2. Your personal information will be stored electronically which information, for operational reasons, will be accessible to persons employed or contracted by us on a need-to-know basis, save that where appropriate, some of your personal information may be retained in hard copy.

13.3. While we cannot guarantee the security of any personal information you provide us, we will continue, on an ongoing basis, to review our security controls and related processes to ensure that your personal information remains secure.

14. HOW LONG DO WE RETAIN YOUR INFORMATION?

14.1. Once your personal information is no longer required because the purpose for which the personal information was held has come to an end, such personal information will be retained in accordance with our applicable retention schedules. The retention period will vary depending on the type of processing, the purpose for such processing, the business function, record classes, and record types.

14.2. We will not retain your personal information for longer than is necessary to achieve the purpose for which we collected it, unless

• 14.2.1. It is required by law to keep a record of this information for a longer period of time; or
• 14.2.2. We need to keep the record of this information for another lawful purpose; or
• 14.2.3. There is a contractual obligation to keep this information for a longer period, or
• 14.2.4. You have consented to their information being kept for a longer period.

14.3. We may retain de-identified information for as long as we deem necessary for historical, statistical, or research purposes

15. YOUR RIGHTS

You as a data subject have certain rights, which are detailed below:

15.1. The right of access. You may ask us free of charge to confirm that we hold your personal information, or ask us to provide you with details, at a fee, how we have processed your personal information. Privacy Policy : Carrol Boyes (Pty) Ltd

15.2. The right to rectification. You have the right to ask us to update or rectify any inaccurate personal information.

15.3. The right to erasure (the ‘right to be forgotten’). Where any overriding legal basis or legitimate reason to process your personal information no longer exists, and the legal retention period has expired, you may request that we delete the personal information.

15.4. The right to object to and restrict further processing. Where we do not need your consent to process your personal information, but you are not in agreement with such processing, you object to us processing such personal information.

15.5. The right to withdraw consent. Where you have provided us with consent to process your personal information, you have the right to withdraw your consent subsequently.

15.6. The right to data portability. You may want your personal information to be transferred to another party, which can be done under certain circumstances. Any such request can be addressed to us using the contact information below.

16. Contact Us

If you believe we are in breach of the POPI Act, kindly reach out to us here for assistance.

16.1. Any comments, questions or suggestions about this policy or our handling of your Personal Information should be emailed to: popi@carrolboyes.com

16.2. Alternatively, you can contact us at the following address or telephone number: Information Officer: Matt McDonald Island Centre, Industry Street Paarden Eiland Cape Town Western Cape 7405 South Africa Phone: 021 424 8263 17. CHANGES TO THIS POLICY As our company changes over time, this policy may change as well. We reserve the right to amend this policy at any time, for any reason, and without notice to you other than the posting of the updated Privacy Policy on our website and in Privacy Policy : Carrol Boyes (Pty) Ltd this regard encourage you to visit our website frequently in order to keep abreast with any changes.

17. CHANGES TO THIS POLICY

As our company changes over time, this policy may change as well. We reserve the right to amend this policy at any time, for any reason, and without notice to you other than the posting of the updated Privacy Policy on our website and in Privacy Policy : Carrol Boyes (Pty) Ltd this regard encourage you to visit our website frequently in order to keep abreast with any changes.

18. COMPLAINTS

18.1. Should you wish to discuss a complaint, please feel free to contact us using the details provided above. All complaints will be treated in a confidential manner.

18.2. Should you feel unsatisfied with our handling of your personal information, or about any complaint that you have made to us, you are entitled to escalate your complaint to the South African, Information Regulator who can be contacted at https://www.justice.gov.za/inforeg/ 19.

19. ACCEPTANCE AND CONSENT

If you believe we are in breach of the POPI Act, kindly reach out to us here for assistance.

19.1. By providing us with the personal information which we require from you as listed under this policy:

• 19.1.1. You acknowledge that you understand why your personal information needs to be processed;
• 19.1.2. You accept the terms which will apply to such processing, including the terms applicable to the transfer of such personal information cross border;

19.2. Where consent is required for any processing as reflected in this policy, you agree that we may process this particular personal information.

19.3. You confirm that you have shared this policy with employees, contractors and subcontractors and have received from them the required consent to provide us with their respective personal information for processing as provided for and described under this policy, and where consent is required for any processing as reflected in this policy, such people have agreed that we may process this particular personal information.

19.4. Furthermore, should any of the personal information concern or pertain to a legal entity whom you represent, you confirm that you have the necessary authority to act on behalf of such a legal entity and that you have the right to provide the personal information or the required permissions in respect of the processing of that organization or entity's personal information. This policy was last updated on 09/19/2023 Privacy Policy : Carrol Boyes (Pty) Ltd