Group Privacy Policy

1. Introduction

This Group Privacy Policy applies to the following three South African companies, each of which is a separate juristic person and a separate responsible party under the Protection of Personal Information Act, 4 of 2013 ("POPIA"):

• Sefeko (Pty) Ltd (Reg. No.: 2003/010592/07) (the holding company);
• Sefeko Monitoring (Pty) Ltd (Reg. No.: 2020/597565/07); and
• Sefeko Solutions (Pty) Ltd (Reg. No.: 2020/597636/07).

In this policy, "Sefeko", "we", "us", or "our" refers to the company in the group that processes your personal information for the purpose in question. Each company is responsible for its own processing under POPIA. Where a service is delivered jointly, the responsible party is the company that contracts with you or holds the customer relationship.

This policy is governed by the laws of the Republic of South Africa. It complies with:

• POPIA;
• the POPIA Regulations, 2018, as amended by the POPIA Amendment Regulations, 2025 (Government Gazette 52523 of 17 April 2025);
• the Promotion of Access to Information Act, 2 of 2000 ("PAIA");
• the Electronic Communications and Transactions Act, 25 of 2002 ("ECTA"); and
• the Cybercrimes Act, 19 of 2020.

By using our website, app, or services, you confirm that you have read and understood this policy.

2. Who we are

The companies covered by this policy are:

Each company shares the general phone line +27 86 173 3356 unless a service-specific number is published.

3. Information Officers

In line with section 55 of POPIA, each company has its own Information Officer registered with the Information Regulator. By default, the Information Officer of each company is its Chief Executive Officer or Managing Director. Deputy Information Officers may be appointed to share the workload.

Information Officer queries for any company in the group: legal@sefeko.co.za. We will route the query to the correct Information Officer.

If you cannot resolve a matter with us, you may lodge a complaint with the Information Regulator (see section 14).

4. Definitions

Key terms used in this policy carry the meaning given in POPIA. The most important are:

• Personal information – any information that identifies you or could be used to identify you (for example, your name, ID number, email, phone number, location, or device information).
• Special personal information – sensitive categories listed in section 26 of POPIA, such as health, biometric data, race, religion, trade union membership, criminal behaviour, or political views.
• Processing – any action with personal information, including collecting, storing, using, sharing, or deleting it.
• Data subject – the person to whom the personal information relates (in most cases, you).
• Responsible party – the company in the Sefeko group that decides why and how your personal information is processed.
• Operator – a third party that processes personal information on behalf of a Sefeko company under a written contract.

5. The eight conditions we follow

Section 4 of POPIA sets out eight conditions for lawful processing. Each Sefeko company applies all of them:

• Accountability – we take ownership of how we handle your personal information.
• Processing limitation – we collect only what we need, for a clear purpose, and only with a lawful basis.
• Purpose specification – we tell you why we are collecting your information.
• Further processing limitation – we do not use your information for new purposes that are not compatible with the original one.
• Information quality – we keep your information accurate, complete, and up to date.
• Openness – we are transparent about what we do, through this policy and our PAIA Manual.
• Security safeguards – we protect your information using reasonable technical and organisational measures.
• Data subject participation – we give you the rights set out in section 13 below.

6. Personal information we collect

Across the group, we collect the following categories of personal information:

• Identity details: full name, ID or passport number, date of birth (where required).
• Contact details: email address, phone number, physical address.
• Account details: username, password (stored in encrypted form), profile information.
• Billing details: VAT number, billing address, and payment reference (we do not store full card details).
• Device and usage data: IP address, browser type, operating system, unique device IDs, pages visited, dates and times of access.
• Location data: where this is needed for the service you have asked for, including monitoring services provided by Sefeko Monitoring (Pty) Ltd.
• Communication records: emails, support tickets, and call logs.

We only collect special personal information where we have a lawful basis under section 27 of POPIA, such as your express consent or a legal obligation.

7. How we collect personal information

• Directly from you when you register, use our services, complete a form, or contact us.
• Automatically through cookies and similar technology when you visit our websites (see section 12).
• From third parties such as social media providers if you choose to log in through them.
• From other companies in the Sefeko group, where you have a relationship with one company that benefits from a service provided by another in the group, and the sharing is lawful and necessary.
• From publicly available sources where this is lawful and for a legitimate business purpose.

8. Why we process your personal information

We process personal information for the following purposes, each supported by a lawful basis under section 11 of POPIA:

• To provide and manage our services and your account.
• To perform a contract with you or take steps before entering one.
• To comply with our legal and regulatory duties.
• To protect your, our, or a third party's legitimate interests.
• To send service messages, security alerts, and updates.
• To prevent fraud, abuse, and security incidents.
• For internal analysis, product improvement, and reporting (using de-identified data where possible).
• For direct marketing, where you have given us consent (see section 11).

9. Special personal information and children

We do not knowingly process special personal information or the personal information of a child (a person under 18) unless:

• the data subject or a competent person has given consent;
• processing is needed to comply with a legal duty; or
• an exemption in sections 27 or 35 of POPIA applies.

If you believe we hold a child's personal information without proper consent, contact us and we will remove it.

10. Sharing your personal information

We may share your personal information with:

• Other companies in the Sefeko group, where this is needed to deliver a service or for shared back-office functions, in line with section 11 of POPIA.
• Operators that process information for us under a written contract, with security duties in line with section 21 of POPIA.
• Business partners, where this is needed to deliver a service you have asked for.
• Professional advisers such as auditors, lawyers, and insurers.
• Authorities, courts, or regulators where the law requires it.
• A buyer or successor in the event of a merger, sale, or restructuring, with notice to you where required.

We do not sell your personal information.

11. Direct marketing

Under section 69 of POPIA, as clarified by the POPIA Amendment Regulations, 2025, we may only send you direct marketing by electronic means (email, SMS, WhatsApp, automated calls, or fax) if:

• you are an existing customer of the relevant Sefeko company and the marketing relates to similar products or services and you were given a clear chance to opt out at the point of collection; or
• you have given prior written consent on Form 4 (or a similar form), provided free of charge and through an accessible channel.

A pre-ticked box or an opt-out option on its own is not valid consent under the 2025 amendments.

You can withdraw consent at any time by emailing legal@sefeko.co.za. We will action this without charge.

12. Cookies and tracking

Our websites use cookies and similar tools, including:

• Strictly necessary cookies for the website to work and for security.
• Functional cookies to remember your settings.
• Analytics cookies to help us understand how the site is used.

You can control cookies through your browser settings. Blocking some cookies may affect how the websites work. Where the law requires, we ask for your consent before placing non-essential cookies.

13. Your rights as a data subject

Under sections 23, 24, and 25 of POPIA, you have the right to:

• be told what personal information we hold about you;
• ask for a copy of your personal information;
• ask us to correct or delete information that is inaccurate, irrelevant, excessive, or out of date;
• object to processing on reasonable grounds, including processing for direct marketing;
• withdraw consent where we rely on consent;
• not be subject to a decision based only on automated processing that has a legal effect on you; and
• lodge a complaint with the Information Regulator.

To exercise any of these rights, email legal@sefeko.co.za and tell us which Sefeko company holds your information, if you know. If not, we will help you find out. We will respond within a reasonable time and at no cost, in line with the POPIA Amendment Regulations, 2025.

14. Lodging a complaint

If you are not happy with how we have handled your personal information, you may lodge a complaint with the Information Regulator (South Africa):

• Address: JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001
• Postal: P.O. Box 31533, Braamfontein, Johannesburg, 2017
• Email: complaints.IR@justice.gov.za
• General: inforeg@justice.gov.za
• Website: https://inforegulator.org.za

15. Cross-border transfers

Some of our service providers are based outside South Africa. Where we transfer personal information across borders, we comply with section 72 of POPIA. Each Sefeko company relies on one of the following grounds for any given transfer:

• the recipient is subject to a law, binding corporate rules, or binding agreement that provides adequate protection;
• you have consented to the transfer;
• the transfer is needed to perform a contract with you;
• the transfer is for a contract concluded in your interest; or
• the transfer is for your benefit and consent is not reasonably possible.

In most cases, we rely on written data processing agreements with our service providers that meet the adequacy standard in section 72(1)(a).

16. How long we keep your information

Each Sefeko company keeps personal information only for as long as needed for the purpose it was collected, or longer if the law requires it. Common retention periods include:

• Tax and accounting records: 5 years (Tax Administration Act, 28 of 2011).
• Contracts and customer records: for the duration of the contract plus 3 years after termination.
• Marketing records: until you withdraw consent.
• Device data and website logs: up to 12 months.

After the retention period, we will delete or de-identify the information.

17. Security of your personal information

In line with section 19 of POPIA, each Sefeko company applies reasonable technical and organisational measures to protect personal information against loss, damage, or unauthorised access. These include access controls, encryption, secure backups, staff training, and contracts with our operators.

No system is 100% secure. While we cannot guarantee absolute security, we work to protect your information and to act quickly if something goes wrong.

18. Security compromises

If we have reasonable grounds to believe that your personal information has been accessed or acquired by an unauthorised person, the relevant Sefeko company will, in line with section 22 of POPIA:

• notify the Information Regulator through its online security compromise reporting platform (mandatory since April 2025); and
• notify you as soon as reasonably possible, unless a public body or law enforcement asks us to delay.

The notice will include enough detail for you to take protective steps.

19. PAIA Manual

The Sefeko group has a single Group PAIA Manual that covers all three companies, prepared in terms of section 51 of the Promotion of Access to Information Act, 2 of 2000. The Manual is available on our website or on request from legal@sefeko.co.za.

20. Changes to this policy

We may update this policy from time to time to reflect changes in law or our practices. The latest version will always be on our website with the effective date shown at the top. Where the change is material, we will let you know by email or a notice on the service.

21. Contact us

End of policy