Data Privacy Notice

Effective date: 01 August 2025
Last update: 02 March 2026
Version: 3

SAVA Technologies (Pty) Ltd (“SAVA”, “we”, “us”, or “our”) is committed to protecting your personal information in accordance with the Protection of Personal Information Act 4 of 2013 (POPIA) and other applicable South African laws.

SAVA acts as a Responsible Party when we determine the purpose and means of processing your personal information.

What this Privacy Notice explains

• What personal information we collect
• Why we collect it
• How we use and protect it
• When we may share it
• Your rights in relation to your personal information

This notice applies to all clients, prospective clients, website users, business partners, employees and related persons whose personal information we process.

We may block users in certain countries from using our website.

Personally identifiable information

Personally identifiable information refers to any information that identifies you and can distinguish/locate your identity as an individual, either alone or when combined with other available information. Personally identifiable information that we may process under this policy includes:

• Your name and surname
• Identifying number (e.g. an account number, identity number or passport number); and
• Email address; physical address (e.g. residential address, work address or physical location); telephone number.

A juristic person (a company, trust or association for example) may also have personal information protected in law and may be processed in terms of this policy.

We may process personal information relating to the juristic person’s directors, officers, employees, shareholders, members, representatives, guarantors, sureties, spouses of sureties, other security providers and other persons (“Related Persons”).

If you provide personal information about a related person, you warrant that the related person is aware that you are sharing their personal information with us and has consented to it.

We will process the personal information of related persons as stated in this policy; thus, references to you in this policy will include related persons with the necessary amendments.

Why we collect personal information

The purpose for which personal information is being collected:

We collect personal information to:

• Assess and process your applications to use our services;
• Facilitate account creation and the logon process;
• Manage and maintain your user account;
• Verify your identity where required;
• Communicate with you and carry out instructions and requests;
• Respond to enquiries and complaints;
• Enforce any agreement if you are in breach of the agreement;
• Comply with our record-keeping obligations;
• Conduct market and behavioural research;
• Run customer satisfaction surveys, promotional and other competitions;
• Any other business related purposes.

You acknowledge that if you do not provide us with certain information (which may include personal information) that we require to comply with our legal obligations, we cannot provide any services to you.

Legal basis for processing

We process your personal information for:

• Our legitimate business interests
• To verify your identity
• In order to allow you to enter and use our website, app and/or services
• To enter into a contract with you relating to our services
• To comply with FICA and anti-money laundering obligations
• To improve our services

Sources of information

We collect personal information from the following sources:

• Directly from you;
• From public sources (such as company registers, online search engines, deed registries, public posts on social media); and
• From third parties that we interact with to conduct our business (such as partners, online partners, credit bureaux, regulators and government departments or service providers).

Retention

We keep your personal information for as long as:

• The law requires us to keep it;
• A contract between us requires us to keep it;
• You have consented to us keeping it;
• We are required to keep it to achieve the purposes listed in this policy;
• We require it for statistical or research purposes; and
• We require it for lawful business purposes.

We may keep your personal information even if you no longer have a relationship with us despite your request for us to delete or destroy your personal information, provided the law permits or requires us to keep this information.

Marketing

We will use your personal information to market other services to you. You can at any stage, request us to stop sending marketing communications to you.

Automated decision-making

In accordance with the Protection of Personal Information Act 4 of 2013, SAVA does not make decisions that produce legal or similarly significant effects on clients solely on the basis of automated processing, including profiling.

How we store your personal information

We take all reasonable and appropriate measures to ensure that your personal information is safeguarded and secure. We have reasonable standards of technology and operational security in place to attempt to prevent loss or misuse of any personal information.

Any of our authorised employees who are responsible for the maintenance of any special personal information submitted by you are requested to maintain the confidentiality of such information unless you have consented to disclosure.

Whenever we employ third parties to assist us, we will bind them to our privacy policies as far as they may be required to have access to your personal information to perform such services.

Our website may contain links to or from other sites. We try to link to sites that share our high standards and respect for privacy. We are, however, not responsible for the content or the security or privacy practices employed by other sites.

How your information is used and disclosed

We may use the information (including personal information) we hold about you in these ways:

• To ensure that our website and App is presented in the most effective manner for you and for your device
• In aggregate and de-identified form, for internal business purposes such as generating statistics and developing our strategic and marketing plans
• To determine how you interact with our services, the website and the App and based on this information to market our services to you
• To allow you to participate in interactive features of our App or website when you choose to do so
• To notify you about changes to our services

We may share with third-party service providers certain information, such as your browser capabilities or operating system, that we have collected to understand better which advertisements and services may interest you.

We will not disclose personal information to anyone outside our company or our third parties service providers without your permission, unless:

• We are compelled to do so by law or in terms of a court order;
• It is in the public interest to do so;
• It is necessary to protect our rights.

Your legal rights

You have rights in relation to your personal data where we are the relevant “Responsible Party” over such personal data.

You have the right to:

• Request access to your personal information
• Request correction of inaccurate information
• Request deletion (where legally permissible)
• Object to processing
• Restrict processing
• Withdraw consent
• Lodge a complaint with the Information Regulator

We may require identity verification before processing your request and may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive.

Right to access and rectify personal information

It is your responsibility to ensure all information provided to us is accurate and correct and you may make changes to or correct inaccurate personal information that you provide us using our support services (info@sava.africa).

Any requests for changes or corrections will be actioned as soon as reasonably possible.

Right to objection

You may object on reasonable grounds to the processing of your personal information where the processing is in your legitimate interest, our legitimate interest or in the legitimate interest of another party. You must inform us of your objection in the prescribed manner after using our support services.

We will not be able to give effect to your objection if:

• The processing of your personal information was and is permitted or required by law;
• You provided consent to the processing, and our processing was conducted in line with your consent; or
• the processing is necessary to conclude or perform under a contract with you.

Right to withdraw consent / Right to be forgotten

Where you have provided your consent for processing your personal information, including any consent in respect of Related Persons, you may withdraw your consent and request your personal information to be deleted. We will action your request as soon as reasonably possible and to the extent permitted by law.

Data breach notification

In the event of a security compromise where your personal information has been accessed or acquired by an unauthorised person, SAVA will notify you and the Information Regulator in accordance with applicable law, including section 22 of the Protection of Personal Information Act, 2013 (“POPIA”).

Where notification to you is required, such notification will be made as soon as reasonably possible and will include sufficient information to allow you to take protective measures.

This notification may include:

• A description of the nature of the security compromise
• The possible consequences of the compromise
• The measures taken or proposed to be taken by SAVA to address the breach
• Recommendations on steps you can take to mitigate potential adverse effects
• The contact details of SAVA where you can obtain further information

SAVA maintains internal incident response and breach management procedures to ensure that all security compromises are identified, contained, investigated and reported in a timely and compliant manner.

Right to complain

You have the right to file a complaint with the Information Regulator about an alleged infringement of the protection of your personal information. The contact details of the Information Regulator (South Africa) are provided below:

Woodmead North Office Park
54 Maxwell Drive
Woodmead
Johannesburg
2191
Tel no.: +27 (0)10 023 5200
Email address: enquiries@inforegulator.org.za
Website: https://inforegulator.org.za

Data privacy policy changes

This policy is reviewed regularly and any changes will be posted clearly on our website. We reserve the right to change, modify, add or remove portions of these terms at any time.

Information officer

Our appointed Information officer, Kolawole Olajide can be contacted at hello@sava.africa.

SAVA encourages you to review this Privacy Policy periodically to stay informed about how we protect your Personal Information.