POPIA Compliance

The Protection of Personal Information Act (POPIA) is South Africa's data protection legislation. It ensures that all South African institutions conduct themselves in a responsible manner when specific information is collected, processed, stored, and shared. LuxeZA is committed to strict adherence to POPIA's conditions and maintains a "Privacy by Design" approach to our platform development.

In accordance with Section 51 of the Promotion of Access to Information Act (PAIA), LuxeZA maintains a PAIA Manual. This manual details: • Functions and structure of our organization • Contact details of our Information Officer • A guide on how to request access to records • Categories of records we hold You may request a copy of our PAIA Manual by contacting our Information Officer at popia@luxeza.co.za.

LuxeZA adheres to all 8 conditions for lawful processing: 1. **Accountability**: We take responsibility for all personal information in our possession. 2. **Processing Limitation**: We only collect information that is necessary for our stated purposes. 3. **Purpose Specification**: We collect information for specific, explicitly defined, and lawful purposes. 4. **Further Processing Limitation**: We do not reuse information for incompatible purposes. 5. **Information Quality**: We take steps to ensure information is complete and accurate. 6. **Openness**: We are transparent about our data practices. 7. **Security Safeguards**: We implement technical measures to protect data. 8. **Data Subject Participation**: You have the right to access and correct your data.

As a data subject, you may exercise your rights using the forms prescribed by the Information Regulator: **Right to Object (Form 1)**: You may object to the processing of your personal information where such processing is based on legitimate interest or for direct marketing. **Right to Correction/Deletion (Form 2)**: You may request that we correct or delete personal information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or obtained unlawfully. To request these forms or submit a request, please email popia@luxeza.co.za. We will respond as per the timelines stipulated in PAIA (usually 30 days).

We implement robust industry-standard security measures (Encryption, Firewalls, Access Control). **Data Breach Protocol**: In the unlikely event of a data breach where there are reasonable grounds to believe that personal information has been accessed by an unauthorized person: 1. We will notify the **Information Regulator** (using Form 3). 2. We will notify **affected Data Subjects** (via email or website notice) as soon as reasonably possible. 3. We will provide sufficient information to allow you to take protective measures against the potential consequences of the compromise.

We may transfer your data to service providers in other countries (e.g., cloud hosting in EU/US). We rely on: • **Adequacy**: Countries with laws similar to POPIA (e.g., GDPR). • **Contracts**: Standard Contractual Clauses (SCCs) to ensure protection. • **Consent**: Where you have explicitly agreed to the transfer. We do not transfer data to jurisdictions with weak data protection laws without specific safeguards.

Our designated Information Officer is responsible for ensuring POPIA compliance: **Information Officer**: Chief Privacy Officer **Email**: popia@luxeza.co.za **Phone**: +27 11 123 4567 **Address**: 123 Main Street, Sandton, Johannesburg, 2196 **Duties**: • Encouraging compliance with POPIA. • Handling requests for information (PAIA). • Cooperating with the Information Regulator.

If you believe we are processing your information unlawfully, you may lodge a complaint with the Information Regulator (South Africa) using **Form 5**. **Information Regulator Contact**: Website: https://www.justice.gov.za/inforeg/ Email: POPIAComplaints@inforegulator.org.za Address: JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001