PRIVACY POLICY.

Paveer (Pty) Ltd ("Paveer," "we," "us," or "our"), a company registered in the Republic of South Africa, is the responsible party in terms of POPIA for the processing of your personal information. We are committed to protecting your privacy and ensuring that your personal information is processed lawfully, transparently, and in accordance with POPIA.

This Privacy Policy explains how we collect, use, disclose, and safeguard your personal information when you visit our website, use our services, including our dashboard, or create an account with us. This Privacy Policy should be read together with our Terms of Service.

In terms of Section 55 of POPIA, we have appointed an Information Officer who is responsible for ensuring compliance with POPIA and for handling any requests relating to your personal information:

• Information Officer: Legal Department
• Email: legal@paveer.com
• Postal Address: Available upon request

For the purposes of this policy:

• "Personal information" means information relating to an identifiable, living, natural person, and where applicable, an identifiable, existing juristic person, including but not limited to: name, identity number, email address, physical address, telephone number, location information, online identifiers, and any other information defined as personal information under POPIA.
• "Special personal information" means religious or philosophical beliefs, race or ethnic origin, trade union membership, political persuasion, health or sex life, biometric information, or criminal behaviour.
• "Data subject" means the person to whom personal information relates (you).
• "Responsible party" means the entity that determines the purpose and means of processing personal information (Paveer).
• "Operator" means a person who processes personal information on behalf of the responsible party.
• "Processing" means any operation concerning personal information, including collection, storage, use, dissemination, modification, or destruction.

We process your personal information in accordance with the eight conditions for lawful processing under POPIA:

• Accountability: We ensure compliance with POPIA and take responsibility for our processing activities.
• Processing limitation: We process personal information lawfully, minimally, and only with your consent or as otherwise permitted by law.
• Purpose specification: We collect personal information for specific, explicitly defined, and lawful purposes.
• Further processing limitation: We do not process personal information for secondary purposes incompatible with the original purpose.
• Information quality: We take reasonable steps to ensure personal information is complete, accurate, and up to date.
• Openness: We are transparent about our processing activities through this policy and other notices.
• Security safeguards: We implement appropriate technical and organisational measures to protect personal information.
• Data subject participation: We facilitate your rights to access, correct, and delete your personal information.

In terms of Section 13 of POPIA, we collect and process your personal information for the following specific purposes:

• To provide, operate, and maintain our services and platform
• To create and manage your account
• To authenticate users and secure access to our services
• To communicate with you regarding your account, support requests, and service updates
• To process job applications
• To comply with legal obligations under South African law
• To protect our legitimate interests, including fraud prevention and security
• To improve our services based on aggregated, anonymised usage data
• To record the IP address of contact form submissions for security, spam prevention, and fraud detection

Under POPIA, we may process your personal information based on the following justifications (Section 11):

• Consent: You have given us consent to process your personal information for specific purposes.
• Contract: Processing is necessary to enter into or perform a contract with you.
• Legal obligation: Processing is necessary to comply with South African law.
• Legitimate interest: Processing is necessary for our legitimate interests, provided this does not prejudice your rights.
• Protection of a legitimate interest: Processing protects a legitimate interest of the data subject.

Our public website does not use cookies for cross-site tracking or advertising purposes. We may use:

• Essential cookies: Required for core functionality such as session management and security.
• Analytics cookies: Used to collect aggregated, anonymised data about website usage to improve our services.

Where cookies collect personal information, we will obtain your consent in accordance with POPIA before placing such cookies.

We do not sell, rent, or trade your personal information. We may share your personal information with:

• Operators (service providers): Third parties who process personal information on our behalf under written agreements that comply with Section 20-22 of POPIA (e.g., hosting providers, email services, security monitoring).
• Legal authorities: When required by South African law, court order, or to protect our rights, safety, or property.
• Professional advisors: Lawyers, auditors, or other professionals bound by confidentiality obligations.
• Business transfers: In connection with a merger, acquisition, or sale of assets, subject to confidentiality obligations.

All operators processing personal information on our behalf are contractually required to implement appropriate security measures and process personal information only as instructed by us.

In terms of Section 72 of POPIA, we may transfer your personal information to countries outside South Africa only where:

• The recipient country has adequate data protection laws;
• The recipient is bound by a binding corporate rules or agreement providing adequate protection;
• You have consented to the transfer;
• The transfer is necessary for the performance of a contract with you;
• The transfer is for your benefit and it is not reasonably practicable to obtain your consent; or
• The transfer is otherwise permitted under POPIA.

Where we transfer personal information internationally, we implement appropriate safeguards, including binding contractual clauses, to ensure your personal information remains protected.

In terms of Section 19 of POPIA, we implement appropriate, reasonable technical and organisational measures to protect your personal information against:

• Loss, damage, or unauthorised destruction
• Unlawful access or processing

Our security measures include:

• Encryption of data at rest and in transit
• Access controls and authentication mechanisms
• Regular security assessments and audits
• Secure development practices
• Employee training on data protection
• Incident response procedures

While we take reasonable steps to secure your information, no system is completely secure. We cannot guarantee absolute security but are committed to maintaining industry best practices.

In the event of a security compromise affecting your personal information, we will:

• Notify the Information Regulator as required under Section 22 of POPIA;
• Notify you as soon as reasonably possible if the compromise is likely to result in harm or prejudice to you;
• Provide details of the nature of the breach, the personal information affected, and the steps we are taking to address it.

In terms of Section 14 of POPIA, we retain personal information only for as long as necessary to:

• Fulfil the purpose for which it was collected;
• Comply with legal, regulatory, or contractual obligations;
• Resolve disputes and enforce agreements;
• Maintain records required by South African law (e.g., tax records, employment records).

Once personal information is no longer required, we will securely delete or de-identify it in accordance with our data retention schedule.

As a data subject under POPIA, you have the following rights:

• Right to access (Section 23): You may request confirmation of whether we hold personal information about you, and access to that information.
• Right to correction (Section 24): You may request that we correct or delete personal information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading, or obtained unlawfully.
• Right to deletion (Section 24): You may request deletion of your personal information where it is no longer necessary for the purpose for which it was collected.
• Right to object (Section 11(3)): You may object to the processing of your personal information on reasonable grounds relating to your particular situation, unless legislation provides for such processing.
• Right to withdraw consent: Where processing is based on consent, you may withdraw your consent at any time, without affecting the lawfulness of processing prior to withdrawal.
• Right not to be subject to automated decision-making (Section 71): You have the right not to be subject to decisions based solely on automated processing that significantly affects you.
• Right to lodge a complaint: You may lodge a complaint with the Information Regulator if you believe your rights have been violated.

To exercise any of your rights under POPIA, please contact our Information Officer:

• Email: legal@paveer.com
• Subject line: "POPIA Data Subject Request"

We will verify your identity before processing your request and respond within a reasonable time, not exceeding the timeframes prescribed by POPIA. There is no fee for submitting a request, although we may charge a reasonable fee for manifestly unfounded or excessive requests, or refuse to act on such requests.

In terms of Section 69 of POPIA, we will only use your personal information for direct marketing purposes where:

• You have given your consent; or
• You are an existing customer and we are marketing similar products or services, provided you have been given an opportunity to opt out.

You may opt out of direct marketing at any time by contacting us at legal@paveer.com or using the unsubscribe link in our communications.

Our services are not directed at children under the age of 18. We do not knowingly collect personal information from children. In terms of Section 35 of POPIA, if we become aware that we have collected personal information from a child without competent person consent (parent or guardian), we will take steps to delete that information promptly.

If you believe we have collected personal information from a child, please contact us immediately at legal@paveer.com.

Our website and services may contain links to third-party websites, products, or services that we do not control. This Privacy Policy does not apply to third parties. We encourage you to review the privacy policies of any third-party sites before providing your personal information.

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or for other operational reasons. Material changes will be communicated by updating the "Last updated" date at the top of this policy. We encourage you to review this policy periodically.

Your continued use of our services after any changes constitutes your acceptance of the updated policy.

If you are not satisfied with how we have handled your personal information or responded to your request, you have the right to lodge a complaint with the Information Regulator:

• The Information Regulator (South Africa)
• Physical Address: JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001
• Postal Address: P.O. Box 31533, Braamfontein, Johannesburg, 2017
• Email: complaints.IR@justice.gov.za
• Website: https://www.justice.gov.za/inforeg/

This Privacy Policy should be read together with our Terms of Service, which govern your use of our services and products.

This Privacy Policy is governed by and construed in accordance with the laws of the Republic of South Africa, including but not limited to the Protection of Personal Information Act 4 of 2013 (POPIA), the Electronic Communications and Transactions Act 25 of 2002 (ECTA), and the Consumer Protection Act 68 of 2008 (CPA) where applicable.

If you have any questions, comments, or concerns about this Privacy Policy or our processing of your personal information, please contact us:

• Email: legal@paveer.com
• Website: contact@paveer.com