APPENDIX A DATA PROTECTION

1. The following terms shall have meanings assigned to them hereunder, namely:

a. “Personal Information” is defined in the Protection of Personal Information Act (Act no, 4 of 2013) (“POPIA”) as follows: Information relating to an identifiable, living natural person, and where it is applicable, an identifiable, existing juristic person, including but not limited to:

i. information relating to the race, gender, sex, pregnancy, marital status, national, ethnic or social origin, colour, sexual orientation, age, physical or mental health, wellbeing, disability, religion, conscience, belief, culture, language and birth of the person;

ii. information relating to the education or the medical, financial, criminal, or the employment history of the person;

iii. any identifying number, symbol, e-mail address, physical address, telephone number, location information, online identifier or other particular assignment to the person;

iv. the biometric information of the person;

v. the personal opinions, views or preferences of the person;

vi. correspondence sent by the person, that is implicitly or explicitly of a private or confidential nature or further correspondence that would reveal the contents of the original correspondence;

vii. the views or opinions of another individual about the person; and

viii. the name of the person if it appears with other personal information relating to the person or if the disclosure of the name itself would reveal information about the person.

b. “Processing” is defined in POPIA as follows: Any operation or activity or any set of operations, whether or not by automatic means, concerning personal information, including

i. the collection, receipt, recording, organisation, collation, storage, updating or modification, retrieval, alteration, consultation or use;

ii. dissemination by means of transmission, distribution or making available in any form; or

iii. merging, linking, as well as restriction, degradation, erasure or destruction of information;

c. Suburban Control Centre Proprietary Limited t/a SCP Security is a Responsible Party in respect of Personal Information you (Data Subject) provide to us. Suburban Control Centre Proprietary Limited t/a SCP Security processes the following types of Personal Information from you (if applicable per individual/legal entity):

i. Identification document;

ii. Proof of residential/business operating address;

iii. Contact numbers;

iv. E-mail addresses;

v. Banking details;

d. By agreeing to the terms and conditions, and by extension your existing relationship, you acknowledge that Suburban Control Centre Proprietary Limited t/a SCP Security requires your personal information, as defined in the Protection of Personal Information Act of 2013 ('POPIA') and consent that Suburban Control Centre Proprietary Limited t/a SCP Security collect, retain, use, disclose, or otherwise process your personal information in order to provide the services

requested.

2. Your personal information may be shared with our employees, agents, sub-contractors and other entities within the Suburban Control Centre Proprietary Limited t/a SCP Security group in order to fulfil their duties.

3. Any personal information will not be given or sold to any third parties.

4. Suburban Control Centre Proprietary Limited t/a SCP Security will disclose or report personal information if and when required to do so by law or any regulatory authority, and to its employees (if relevant), or agents who require such information to carry out their duties.

5. Suburban Control Centre Proprietary Limited t/a SCP Security abides by all applicable laws.

APPENDIX B PRIVACY NOTICE The Privacy Notice (Appendix B) contains additional information

regarding personal information and the processing thereof.

This privacy notice applies to Suburban Control Centre Proprietary Limited t/a SCP Security.

1) Why does Suburban Control Centre Proprietary Limited t/a SCP Security require your Personal

Information?

a) The Personal Information forms part of Suburban Control Centre Proprietary Limited t/a SCP

Security’s requirements when obtaining a mandate from you or opening an account to facilitate the

relevant business activities.

b) Suburban Control Centre Proprietary Limited t/a SCP Security needs your Personal Information to

provide you with the following services:

i) To establish a legal relationship with you;

ii) To populate the client account information required to open your account;

iii) To perform the services you requested us to perform, which includes but are not limited to

payroll, tax, accounting, advisory, compilations, independent reviews and audit work; and

iv) To generate statements and capture contact information related to your account;

2) How is your Personal Information Processed?

a) Your Personal Information is processed at our offices in JHB.

b) Storage of your Personal Information takes place at our offices in JHB.

c) Back-ups of all client data is securely stored in the cloud.

d) No third-party providers have direct access to your Personal Information unless specifically required by law and to satisfy client due diligence principles.

3) How long does Suburban Control Centre Proprietary Limited t/a SCP Security keep your Personal

Information?

Under South African law, Suburban Control Centre Proprietary Limited t/a SCP Security is required to keep your Personal Information for a five (5) year period following the date of termination of the business relationship with Suburban Control Centre Proprietary Limited t/a SCP Security. After this period, your Personal Information is irreversibly destroyed.

4) What are your rights?

You have the right to be notified regarding the correction or deletion of your Personal Information or

restriction of Processing. Suburban Control Centre Proprietary Limited t/a SCP Security shall communicate any correction or deletion of your Personal information or restriction of Processing.

a) You can withdraw your consent to the Processing of your Personal Information.

b) Should you believe that any of your Personal Information held by Suburban Control Centre

Proprietary Limited t/a SCP Security is incorrect or incomplete, you have the right to request to view

this this information, rectify it or have it deleted. Please contact Suburban Control Centre Proprietary

Limited t/a SCP Security Information Officer on clive@scpsecurity.co.za should this be required.

c) In addition, if you wish to complain about how Suburban Control Centre Proprietary Limited t/a SCP Security has handled your Personal Information, please contact the Information Officer on

clive@scpsecurity.co.za. Suburban Control Centre Proprietary Limited t/a SCP Security will investigate your complaint and contact you to resolve the matter.

d) If your query relating to your Personal Information is not, in your opinion, adequately dealt with, you an contact the Information Regulator on 012 406 4818 or inforeg@justice.gov.za to file an official

complaint.