PRIVACY POLICY

Last Updated: January ****

*. Purpose of this Privacy Policy

1.1. We are a direct marketing and lead provision company and processing of personal information is central to the nature of our business. 1.2. This privacy policy explains our approach to any personal information that we might have on our databases (“customer database”), collect from you or which we have obtained about you from a third party and/ or from the BLT Group and the purposes for which we process your personal information as required by the Protection of Personal Information Act 4 of 2013 (POPIA). This Privacy Policy also sets out your rights in respect of our processing of your personal information. 1.3. This Privacy Policy is intended to assist you in making informed decisions when you interact with us. Please take a moment to read and understand it. Please note that it should be read in together with our Website Terms of Use(Terms) because both will apply to our interactions with you.

2. Who are we and what do we do

2.1. Blue Label Data Solutions (Pty) Limited (Registration Number 2008/011699/07) [“BLDS”/

“we”/ ”our”/ ”us”], is a private company registered in the Republic of South Africa, which, through its various divisions and brands* provides direct marketing services and all functions related thereto. (“Marketing Services”). 2.2. The Marketing Services are conducted via a number of websites (“Websites”) and also by means of telephone, SMS, automated voice messages (“AVM”), electronic mail, television advertising, landing pages, and other means of lead generation

(“Communication Platforms”) (together referred to as the “Sites”) to users (“you”) to enable you to contract with third party service providers (“Service Providers”) in various industries by marketing and advertising products and services, the latest deals, specials and promotions offered by these Service Providers ("Offers"). 2.3. The Service Providers on whose behalf we conduct Marketing Services typically operate in the following industries: insurance, financial services, motor industry, asset providers, betting and gambling, general maintenance, cellular services, retail and contact centers. Please click on the industry description to find out who the relevant Service Providers are. These Services Providers and industries may change from time to time in which case references to them will change in this privacy policy. 3. The BLT Group

3.1. BLDS is a wholly owned subsidiary of Blue Label Telecoms Limited, Registration No 2006/022679/06 (“BLT”).

3.2. BLT has established a central data processing structure for all entities forming part of the BLT Group* of companies (BLT Group) and personal information processed by us as a member of the Group will be designated as BLT Group data. 3.3. Therefore, your personal information will form part of BLT Group Data and may be used by the BLT Group for the purposes contained in this privacy policy. This Privacy Policy will apply to such processing.

3.4. As such, “BLDS” / “we”/ ”our”/ ”us”, includes each business unit, branch and/or representative office of any business of BLDS; any holding companies or subsidiaries of BLDS or subsidiaries of such holding companies or companies connected to BLDS; and any of BLDS’s associates, cessionaries, delegates or successors in title or appointed third parties such as its authorised agents, advisors, partners and contractors. It also includes the companies making up the BLT Group from time to time, in particular, BluNova (Pty) Limited, which is the central processor for the BLT Group. 4. Scope

4.1. This Privacy Policy has been published to help you understand our privacy practices by describing how we collect and use your personal information, why we collect it, with whom we share it, and your choices and rights in relation to your personal information. 4.2. Our Privacy Policy has been developed to provide a framework for the appropriate level of privacy protection and represents our commitment to compliance with South African data protection legislation and any other applicable worldwide data protection laws, to try and achieve the highest standards in protecting your personal information. 5. Application

5.1. This Privacy Policy applies to personal information that we collect from you during your interactions with us, including through any of the Sites or personal information that we may collect offline or receive from third parties as explained below. 5.2. This Privacy Policy will apply to personal information that we process regardless of the Site through which it is collected and/ or provided. 5.3. By submitting your details to us or visiting or using the Sites you accept the application of this Privacy Policy and updates thereto and expressly consent to the processing of your personal information in the way described herein. 5.4. This Privacy Policy will apply to your personal information we already hold as at the date hereof, as an existing customer on our database (“customer database”). As an existing customer on our customer database this Privacy Policy will apply unless and until you request to be removed from the customer database or opt-out, which you are always entitled to do.

5.5. We review our privacy policies regularly and occasionally may need to change or update them. The most current version of this Privacy Policy will always be posted under the Privacy Policy tab of the Website and will be effective from the date of posting. 5.6. You agree that you will check the Privacy Policy from time to time. By not asking to be removed from our customer database and/ or continuing to use the Marketing Services and/or continuing to access and/or use the Sites after we make changes to this Privacy Policy, you agree to be bound by the revised Privacy Policy. 5.7. Where we use third parties to process personal information on our behalf, this Privacy Policy will apply to such third parties will in the processing of your personal information. 5.8. This Privacy Policy applies to BLT Group to the extent that it processes your personal information as BLT Group data.

6. What is Personal Information

6.1. Personal information is defined in POPIA as information relating to an identifiable, living, natural person, and where it is applicable, an identifiable, existing juristic person, and includes any information that identifies or relates specifically to you, including, for example, your name, age and identity number or other national identifier, your contact address, your location, your banking details, and contact numbers. In short, any information that we can use to specifically identify you will be personal information. 6.2. Some types of personal information are considered special personal information. These include personal information revealing or related to a person’s health, racial or ethnic origin, religious or philosophical beliefs, sex life, political affiliation, or trade union membership; criminal behaviour and proceedings related thereto. 7. Processing

7.1. Processing is defined in POPIA as any operation or activity or set of operations involving personal information, whether or not by automatic means, including collecting, receiving, recording, organising, collating, storing, updating, modifying, retrieving, altering, consulting or using; disseminating by means of transmission, distribution or making available in any other form; or merging, linking, as well as restriction, degradation, erasure or destruction of personal information. In short anything that is done with personal information from collection to destruction.

7.2. When processing, we may combine your Personal Information and use the combined Personal Information for any of the purposes stated in this Privacy Policy. 7.3. Sometimes you may provide us with specific consent to process your Personal Information in a particular manner and/ or for a particular purpose. Read the specific consents given carefully.

7.4. If BLDS processes Personal Information for another party like a Service Provider under a contract or a mandate, the Service Providers privacy policy may apply to the processing.

8. When will we process your Personal Information

8.1. We will only process Personal Information for lawful purposes relating to our business if the following applies:

8.1.1. Where you are an existing customer on our customer database and you have not opted out of Marketing Services;

8.1.2. Where you interact with us on the Sites;

8.1.3. Where your personal information is held by another member in the BLT Group and you have agreed to the processing thereof by the BLT Group; 8.1.4. if, where required, you have consented thereto; 8.1.5. if a person legally authorised by you, the law or a court, has consented thereto; 8.1.6. if it is necessary to conclude or perform under a contract, 8.1.7. if the law requires or permits it; and/or

8.1.8. if it is required to protect or pursue your, our or a third party’s legitimate interest. 9. When will we process your Special Personal Information 9.1. We may process your special Personal Information in the following circumstances: 9.1.1. if you have consented to such processing;

9.1.2. if the processing is needed to create, use or protect a right or obligation in law; 9.1.3. if the processing is for statistical or research purposes; 9.1.4. if the special Personal Information was made public by you; 9.1.5. if the processing is required by law;

9.1.6. if racial information is processed, and the processing is required to identify you; and / or

9.1.7. if health information is processed, and the processing is to determine your insurance risk, or to comply with an insurance policy or to enforce an insurance right or obligation.

10. What Categories of Personal Information We Collect 10.1. We collect a variety of types of Personal Information. Examples include: 10.1.1. Identifiers and contact information, such as your identification number, name, address, phone number/s, or email address;

10.1.2. Purchase or other commercial information, such as the items you purchase, shipping or delivery address, and contact information; 10.1.3. Payment information, such as your payment method and payment information

(such as debit or credit card number and information), and billing address; 10.1.4. Preference information, such as your contact and marketing preferences, and brand and merchandise interests;

10.1.5. Profile and account information, which may include contact, purchase, and preference information as well as information about items you have purchased or Offers you have shown an interest in, product review information, account; 10.1.6. Communications and interactions, which may include email messages, chat sessions, text messages, and phone calls that we exchange with you; 10.1.7. Demographic information, which may include age or birthdate, gender, postal code, your status as a consumer, and other information about you; 10.1.8. Call recordings, including information about your call and what you share when you call us or we call you on the phone;

10.1.9. Location or geolocation information of your device that you use, if your device settings allow us to collect location information; 10.1.10. Device and browsing information and other Internet activity information, including information about your phone, tablet, computer, or device, and online browsing activity (collectively, "automatically collected information"). Automatically collected information may include IP addresses, unique device identifiers, cookie identifiers, device and browser settings and information, and Internet service provider information. Automatically collected information also may include information about when and how you access and use our Sites or how you interact with us on our Sites, such as the date and time of your visit or use, the websites you visit before coming and after leaving our Sites, how you navigate and what you search for using our Sites, the website pages and items you view using our Website and Communication Channels, and the items you purchase or Offers you show an interest in; and

10.1.11. Inferences about any of the information above that may relate to your preferences, or other matters.

10.1.12. When we collect information that does not personally identify you, including, information that has been anonymised or aggregated, if we link this information with your personal information, we will treat such linked information as personal information.

10.2. You can choose not to provide personal information to us when requested. However, if this is necessary to provide you with our Marketing Services and Offers, access to our Sites, or to perform administrative functions, we may be unable to do these things.

11. Where we obtain Personal Information about you 11.1. We collect Personal Information about you from various different sources, including the following:

11.1.1. From you directly.

11.1.2. From and based on your use of our, Marketing Services or Sites and Offers. 11.1.3. From and based on how you engage or interact with us such as on social media, emails, letters, telephone calls, surveys, competitions and promotions. 11.1.4. From public domain sources (like CIPC).

11.1.5. Third parties we interact with for the purposes of conducting our business (like partners, reward partners, list providers, our customer loyalty rewards programmes’ retail and online partners or our Service Providers).Third parties from whom we may collect Personal Information include members of the BLT Group any connected companies, subsidiary companies, its associates, cessionaries, delegates, assigns, affiliates or successors in title and / or appointed third parties

(like its authorised agents, partners, contractors and suppliers), spouses, dependents, partners, employer, joint applicant or account holder and other similar sources (If the law requires us to do so, we will ask for your consent before collecting Personal Information about you from third parties). 11.1.6. persons you have authorised to share Personal Information. 11.1.7. Parties who you choose to engage with directly as a result of marketing material and /or offers you have received from us as part of marketing services which we conduct on their behalf.

11.1.8. attorneys, tracing agents, debt collectors and other persons that assist with the enforcement of agreements.

11.1.9. payment processing services providers, merchants, banks and other persons that assist with the processing of your payment instructions, like card scheme providers (like VISA or MasterCard).

11.1.10. law enforcement and fraud prevention agencies and other persons tasked with the prevention and prosecution of crime.

11.1.11. From regulatory authorities, industry ombudsman, governmental departments, local and international tax authorities. 11.1.12. credit bureaux and similar verification agencies. 11.1.13. trustees, Executors or Curators appointed by a court of law; 11.1.14. our service providers, agents and sub-contractors like couriers and other persons we use to offer and provide products and services to consumers; 11.1.15. participating partners, whether retail or online, in customer loyalty reward programmes operated by the BLT Group or our Service Providers; 11.1.16. when we respond to your inquiries and requests, obtain feedback from you

11.1.17. when you contact us for information, including for customer support or complaints. We want to provide you with the best possible service, so calls to BLDS will be recorded and/or monitored for quality checks and staff training. Recordings may also be used to help us combat fraud;

11.1.18. when you send information to us by posting to a forum or blog or in an advertisement, is stored on our servers. We do not specifically use that information except to allow it to be read, but you will see in our User Terms that we reserve a right to use it in any way we decide.

11.1.19. From our joint venture partners; and / or 11.1.20. other marketing list providers.

11.2. We collect the following information when you visit and use our Sites and Services: 11.2.1. Location information - depending on the services and products that you use, and your settings or device permissions, we may collect your precise or approximate location information as determined through data such as GPS, IP address and WIFI. 11.2.2. Transaction information - We collect transaction details relating to your use of the Sites and services, products purchased, (including the type of products and services you requested, date and time of the service, and number of products). 11.2.3. Usage and preference information - We collect information about how you interact with the Sites, preferences expressed, and settings chosen. In some cases, we do this through the use of cookies, pixel tags, and similar technologies that create and maintain unique identifiers. For more information please see below. 11.2.4. Device information - We may collect information about the devices you use to access and use the Sites.

11.2.5. Log information – information about your interaction with and access to the Sites. 11.2.6. Information from referring websites/applications. 11.2.7. Information about how you use our or a third party’s services and products, such as the types of content you view or engage with, the type of product you buy, or the frequency and duration of your activities.

11.2.8. We collect Personal Information from other sources including our trusted partnerships with third-parties and where we operate accounts on third-party platforms: For example, when you use the “like” functionality on Facebook or the +1 functionality on Google+.

11.2.9. We may track the products you buy when you click on one of our display adverts and go on to purchase products.

11.2.10. We may also collect technical information to help us identify your device for fraud prevention and diagnostic purposes.

11.2.11. When you send a message, we collect the data you have given to us in that message in order to obtain confirmation that you are entitled to receive the information and to provide to you the information you need. We record your request and our reply in order to increase the efficiency of our business / organisation. 11.3. We may also collect personal information from third parties, including public databases, social media sites, business partners with whom we offer co-branded services or engage in joint marketing activities and third parties that provide list enhancement or similar services.

12. What purpose do we use Personal Information for 12.1. We use Personal Information for the following reasons: 12.1.1. sending marketing communications (SMS, E-mail, AVM, Telephonic Calls) with the latest Offers of Service Providers;

12.1.2. to market products, goods and services of Service Providers to you; 12.1.3. to respond to your enquiries and complaints; 12.1.4. providing information about goods and/or services you may have requested and notifying you about important changes or developments to these goods and/or services;

12.1.5. to update your personal information on our customer database to ensure that it is and remains accurate as required by POPIA;

12.1.6. to follow up as part of our customer care procedures; 12.1.7. updating our records;

12.1.8. internal record keeping;

12.1.9. administering and recording Offers and engagement with Service Providers; 12.1.10. to improve our products and services and give feedback to Service Providers;

12.1.11. To personalise your access to our Sites, for example, by telling you about new features that may be of interest to you.

12.1.12. For analytical purposes and to research, develop and improve programs, products, services and content.

12.1.13. To authenticate the identity of individuals contacting us by telephone, electronic means or otherwise.

12.1.14. To enforce this Privacy Policy and other rules about your use of our Site. 12.1.15. To the extent that data is aggregated and anonymised for business purpose, such as analysing usage trends and seeking compatible advertisers and partners.

12.1.16. If you have asked to receive emails or SMS communications from us, to track whether you open, read or click on the content to see what you are interested in so that we can give you more content that we think you are more likely to enjoy. We use this data to profile your likes and dislikes. 12.1.17. Based on profile information, to give you advertising that we think you will like and want to see as you view content from us or from our network of publishers that we advertise with. We may use your current location to serve advertising to you that is to do with promotions or events that are happening nearby that we think you might be interested in.

12.1.18. In respect of information we collect about your computer, which may at times be able to identify you, for any lawful business purpose, including without limitation to help diagnose problems with our servers, to gather broad demographic information and to otherwise administer our Sites. 12.1.19. In respect of information which does not identify any individual may be used in a general way by us or third parties, to provide class information, for example relating to demographics or usage of a particular page or service. 12.1.20. to comply with legislative, regulatory, risk and compliance requirements

(including directives, sanctions and rules), voluntary and involuntary codes of conduct and industry agreements or to fulfill reporting requirements and information requests;

12.1.21. crime detection prevention and prosecution; 12.1.22. competitions and other promotions;

12.1.23. evaluating the effectiveness of our Marketing Services and for research, training and statistical analysis with the aim of improving our Marketing Services; 12.1.24. making our Marketing Services or those of our Service Providers easier for you to use and providing you with access to related Marketing Services and Offers;

12.1.25. to contact you for market research purposes; 12.1.26. to detect, prevent and report theft, fraud, money laundering and other crimes. This may include the processing of Special Personal Information, like alleged criminal behaviour or like the supply of false, misleading or dishonest information or avoiding liability by way of deception; 12.1.27. to enforce and collect on any agreement when you are in default or breach of the agreement terms and conditions, or to institute legal proceedings against you;

12.1.28. to conduct market and behavioural research, including scoring and analysis to determine if you qualify for Offers or to determine your credit or insurance risk;

12.1.29. for historical, statistical and research purposes, like market segmentation; 12.1.30. to record and/or assist Service Providers and / or the BLT Group to process instructions payment instructions (like a debit order or EFT); 12.1.31. to disclose and obtain Personal Information from credit bureaux regarding your credit history to conduct affordability assessments, credit assessments and credit scoring to make you Offers; 12.1.32. to develop credit models and credit tools for the BLT Group and to enhance Offers and Marketing Services;

12.1.33. to manage and maintain your relationship with us, our Service providers and/ or the BLT Group;

12.1.34. to enable us to deliver goods, documents or notices to you; 12.1.35. for security, identity verification and to check the accuracy of your Personal Information;

12.1.36. to communicate with you and carry out your instructions and requests; 12.1.37. for customer satisfaction surveys;

12.1.38. to enable you to take part in loyalty reward programmes, to determine your qualification for participation, earning of reward points, determining your rewards level, monitoring your buying behaviour with our rewards partners to allocate the correct points or inform you of appropriate products, goods and services you may be interested in or to inform our reward partners about your purchasing behaviour;

12.1.39. to enable you to take part in and make use of value-added products and services offered by our Service providers and the BLT Group; and / or 12.1.40. for any other related purposes.

12.2. We may do these things either for BLDS, any entity in the BLT Group or on behalf of our Service Providers or business partners. 12.3. At the time you provide us with any information in response to a request from us, such information will be used in terms of this Privacy Policy or any specific details provided.

12.4. We may contact you by e-mail, telephone, SMS, fax or mail in relation to the purposes set out in this section and by providing such information you are deemed to have agreed to us contacting you by these methods of communication. We will continue to contact you by way of such methods until you advise us you no longer wish to be contacted by certain methods.

13. Use of Personal Information for marketing

13.1. We provide Marketing Services.

13.2. We may provide you from time to time with information about new Offers and other information.

13.3. We will use Personal Information to market Offers to you from Service Providers. 13.4. We will do this by using the Sites.

13.5. If you are not our customer on our existing customer database, a customer of the BLT Group or in any other instances where the law requires, we will only market to you by electronic communications with your consent. If you have consented, this Privacy Policy will apply to the marketing services we provide to you. 13.6. You may opt-out of direct marketing campaigns at any time, at which point we will not send you any direct marketing related to a specific service, Offer or associated campaign. Should you decide to opt out of all or any direct marketing received from us, you can either click on the following - https://www.nationaloptout.org/ or register on the do not contact list of the Direct Marketing Association of South Africa which can be found on www.dmasa.org.

13.7. In all cases you can request us to stop sending marketing communications to you at any time.

13.8. If we, the BLT Group or a Service Provider is providing you with products and/ or services, you will also be subject to the specific terms and conditions relating to the product or services you are being provided with and these terms will include additional information as to how we or any of our customers or business partners may contact you.

13.9. If the reason you have given us personal information is to receive Marketing Services from us, we will continue to provide this information to you unless you ask us not to do so.

14. When will we use Personal Information to make automated decisions 14.1. An automated decision is made when Personal Information is analysed to make a decision without human intervention in that decision-making process. 14.2. We may use your Personal Information to make an automated decision as allowed by the law.

14.3. You have a right to query any such decisions made and we will provide reasons for the decisions as far as reasonably possible.

15. Sharing Personal Information

15.1. In general, we will only share your Personal Information if any one or more of the following apply:

15.1.1. If the law allows it;

15.1.2. in terms of this Privacy Policy which you have agreed to; 15.1.3. if, where necessary, you have otherwise, including by agreeing to this Privacy Policy, consented to this;

15.1.4. if it is necessary to conclude or perform under a contract, we have with you; 15.1.5. if the law requires it; and / or

15.1.6. if it’s necessary to protect or pursue your, our or a third party’s legitimate interest.

15.2. In line with the aforesaid, in terms of this Privacy Policy, we may share your Personal Information with the following persons. These persons have an obligation to keep your Personal Information secure and confidential: 15.2.1. other members of the BLT Group;

15.2.2. Service Providers, including, without limitation, insurance companies, credit provision companies, retailers, cell phone companies, car sales companies, gambling and betting companies;

15.2.3. our subsidiaries, provided that BLDS is the party responsible for the management of jointly used personal information;

15.2.4. business partners with whom we offer co-branded services or engage in joint marketing activities;

15.2.5. third parties/clients who contract with us for lead generation and marketing services

15.2.6. our employees as required by their employment conditions; 15.2.7. attorneys, tracing agents, debt collectors and other persons that assist with the enforcement of agreements;

15.2.8. payment processing services providers, merchants, banks and other persons that assist with the processing of your payment instructions, like card scheme providers (like VISA or MasterCard);

15.2.9. Service Providers and third parties who advise us that you have consented to such sharing;

15.2.10. law enforcement and fraud prevention agencies and other persons tasked with the prevention and prosecution of crime;

15.2.11. regulatory authorities, industry ombuds, governmental departments, local and international tax authorities and other persons the law requires us to share your Personal Information with;

15.2.12. credit bureau and similar verification agencies; 15.2.13. our, agents and sub-contractors like couriers and other persons we use to offer and provide products and services to you

15.2.14. persons to whom we have ceded our rights or delegated our obligations to under agreements, like where a business is sold; 15.2.15. the general public where you submit content to our social media sites like our Facebook page;

15.2.16. trustees, Executors or Curators appointed by a court of law; 15.2.17. participating partners in our customer loyalty reward programmes, those of our Service Providers or the BLT Group, where you purchase goods, products and service or spend

Contact this candidate