POPIA Compliance Statement

1. Our commitment

As a responsible party under POPIA, we process personal information lawfully, minimally and transparently. This statement summarises how we give effect to POPIA across our business — from enquiry handling and evaluation bookings to supplier and client records.

2. The eight conditions for lawful processing

Our processing of personal information is structured around the eight conditions set out in POPIA:

• Accountability — we remain accountable for the personal information we process
• Processing limitation — we collect only information that is adequate, relevant and not excessive, with your knowledge or consent
• Purpose specification — information is collected and used only for defined, lawful purposes
• Further processing limitation — further processing remains compatible with the original purpose
• Information quality — we keep your information complete, accurate and up to date
• Openness — we are transparent about what we collect and why, as detailed in our Privacy Policy
• Security safeguards — technical and organisational measures protect information against loss, damage and unlawful access
• Data subject participation — you can access, correct or request deletion of your information

3. Roles and responsibilities

ExPeritus (Pty) Ltd is the responsible party for the personal information we hold. Our Information Officer, supported by senior management, oversees POPIA compliance, staff awareness and the handling of data subject requests.

4. Direct marketing

We do not send unsolicited electronic marketing. Where you opt in to updates or newsletters, every message includes an easy way to unsubscribe, in line with sections 45 and 46 of POPIA and the Electronic Communications and Transactions Act (ECTA).

5. Children's information

Our services are directed at industrial and business clients. We do not knowingly collect personal information from children under the age of 18 without the consent of a parent or guardian, as contemplated by section 34 of POPIA.

6. Data breaches

Should a security compromise occur, we will take immediate steps to contain it, assess the risk and — where required by POPIA — notify affected data subjects and the Information Regulator.

7. Contact

To exercise any of your rights, or to ask a question about this statement, contact our Information Officer at contact@experitus.co.za. You also have the right to lodge a complaint with the Information Regulator of South Africa at inforegulator.org.za.