DATA PRIVACY POLICY

We at the Ignition Group take your privacy seriously and are committed to protecting your

Personal Information. We place a high premium on the privacy of every person or organisation

with whom we interact and therefore acknowledge the need for Personal Information to be

handled with a reasonable standard of care.

This Data Protection and Privacy Policy (‘’Policy’’) relates to our Processing of your Personal

Information when you interact with us, access our Platforms and/ or use our Offerings. It explains

how we undertake to Process Personal Information in a manner which promotes the constitutional

right to privacy, while retaining accountability and managing Data Subject participation.

With our headquarters in Durban, South Africa, we are a global customer acquisition business,

operating in the telecommunications, home services and ﬁnancial services sectors.

We are committed to complying with the Applicable Laws in the multiple jurisdictions in which we,

and you, operate. We have therefore drafted this Policy in accordance with the provisions of

POPIA, which governs Data protection in South Africa, and in consideration of the following

international Applicable Laws:

1. General Data Protection Regulation (European Union) 2016/679, which governs Data

protection in respect of the European Union;

2. Federal Data Protection Act, updated as of 1 September 2023, which governs Data protection

in respect of Switzerland;

3. Data Protection Act 2018 which governs Data protection in respect of the United Kingdom;

and

4. California Consumer Privacy Act of 2018, as amended and expanded by the California Privacy

Rights Act of 2020, which may be employed for Data protection within the United States of

America.

5. Consumer Data Protection Act, effective 1 January 2023, which governs data protection and

privacy in respect of Virginia within the United States of America.

(collectively referred to as “International Data Protection Laws”).

By engaging with us, electronically or physically, you Consent to the Processing and transfer of

your Personal Information as set out in this Policy.

If you have any questions or concerns about our Processing of your Personal Information, please

1.1.

1.2.

1.3.

1.4.

DEFINITIONS

“Afﬁliate/s” means any entity which is associated with the Ignition Group through

common ownership, as per Annexure A2 below;

"Anonymisation" means the process of turning Personal Information into anonymous

information so that a Data Subject is not (or is no longer) identiﬁable;

“Annexure/s” means any annexure attached to this Policy, as amended from time to time;

“Applicable Law/s" means any laws applicable to the protection and Processing of

Personal Information, with particular emphasis on POPIA and the International Data

DATA PRIVACY POLICY

our purposes for Processing your Personal Information;

our retention periods in terms of Applicable Laws;

your access rights; and

our internal procedure for queries and/ or complaints.

PAIA MANUAL

PAIA is the statutory law in South Africa governing access to information and enables

people to gain access to information held by both public and private bodies.

If you would like to review, amend or obtain a copy of your Personal Information held by us,

please review our PAIA manual on how to submit a request. Our PAIA manual is located

on our Website.

YOUR RIGHTS

While you have rights concerning your Personal Information, it is important to note that

there may be various considerations in determining how to address any requests you may

have.

Your rights include:

Right of Access – you can ask us for a copy of the Personal Information we hold.

Right to Know – you can ask us what Personal Information is or was shared with any of

our Afﬁliates or Service Providers.

Right to Change – you can ask us to update your Personal Information or delete any

Personal Information that is no longer accurate or relevant.

Right to Object – you can object to our Processing of your Personal Information.

Right to Report – you can lodge a complaint with the relevant authorities should you feel

aggrieved by the manner in which we have Processed your Personal Information. The

information regarding the applicable relevant Data Protection Authority is set out in

Clause 16 below.

You can contact our Information Ofﬁcer on DataPrivacy@ignitiongroup.co.za with any

requests you may have.

when you instruct us or our Afﬁliates to do so;

with your Consent in circumstances where such Consent is required;

to provide features, add value, or improve the quality and customise our Offerings and

Platforms;

improve the quality of our Offerings and Platforms;

where the Personal Information has been de-identiﬁed, including through aggregation

or Anonymisation;

to provide assistance with marketing, billing, processing credit card payments, data

analysis, fraud prevention, network and information security, technical support and

customer service;

when it is necessary for the fulﬁlment of our Offerings to you or prospective customers;

to comply with Applicable Laws or to respond to lawful requests and legal process;

to protect any Data Subject’s vital interests, but only where we believe it is necessary; and

in connection with or during negotiation of any business transfer, merger, ﬁnancing,

acquisition, or dissolution transaction or proceeding involving the sale, transfer,

divestiture or disclosure of all or a portion of our business or assets to another company.

From time to time, we may engage in joint sales or product promotions with certain third

parties and/or our Afﬁliates.

If you have speciﬁcally expressed an interest in, or purchased, a jointly offered product,

promotion or service, we may share relevant Personal Information with those third parties

or Afﬁliates. Where you have given Consent to do so, these third parties or Afﬁliates may

send you marketing communications about their own products and services.

Please be aware that we do not control third parties or Afﬁliates who are not

contracted to Process Personal Information for and on our behalf. These third parties

and Afﬁliates are responsible for managing their own use of the Personal Information

collected in these circumstances. We recommend that you carefully consider any

applicable privacy policies of the relevant third parties, Service Provider or Afﬁliate to

ﬁnd out more about their handling of your Personal Information.

CHILDREN’S PRIVACY

Our Offerings are not intended for use by Children.

We do not knowingly collect personally identiﬁable information from Children.

If you become aware that a Child has provided us with Personal Information, please

If we become aware that we have collected Personal Information from Children without

parental Consent, we will take immediate steps to remove/ delete such Personal

Information.

INTERNATIONAL DATA PROTECTION LAWS: ANNEXURES B AND C

For Data Subjects residing outside of the Republic of South Africa, Annexures B and C will

apply to you and our Processing of your Personal Information, speciﬁcally:

Annexure B: resident of the European Economic Area, United Kingdom and

Switzerland; and

Annexure C: Californian residents.

These Annexures provide you with details on:

purpose for which the information was collected or subsequently processed;

any legal obligations we have in terms of Applicable Laws;

the nature of any contracts we have in place with you; or

the existence of your Consent.

It is speciﬁcally recorded that you have the right to object to the Processing of your Data at

any time during the Processing. However, we would be required to retain and store your

Data for the purposes of swiftly dealing with such an objection or enquiry.

We will use Pseudonymisation to retain your Usage Data for internal analysis purposes. We

generally retain your Usage Data for a shorter period, except when it is used to strengthen

the security or to improve the functionality of our Offerings, or we are legally obligated to

retain it for longer time periods.

TRANSFER OF YOUR DATA

Your Data may be transferred to, Processed and maintained outside of your city province,

country or other governmental jurisdiction where the Applicable Laws may differ from

those of your jurisdiction.

If you are located outside the Republic of South Africa and choose to provide information to

us, please note that we may transfer your Data to the Republic of South Africa and Process it

there.

Your Consent to this Policy followed by your submission of such Data represents your

Consent to such transfer.

We will take reasonably necessary steps to ensure the secure treatment of your Data in

accordance with this Policy. Your Data will not be transferred to an organization or country

unless adequate data protection laws or controls are in place to safeguard your Data.

In addition, we will purge, anonymise or delete your Personal Information in accordance

with Applicable Laws, and other regulatory and compliance requirements.

PROVISION OF PERSONAL INFORMATION TO SERVICE PROVIDERS

We may disclose your Personal Information to our Service Providers, where necessary, to

achieve the purpose(s) for which your Personal Information was originally collected and

Processed.

We will, however, enter into written agreements with such Service Providers, where we

deem appropriate, to ensure that they comply with Applicable Laws pursuant to the

Processing of your Personal Information.

AFFILIATE AND AFFLIATE PROCESSING

Our Afﬁliates may transfer your Personal Information among themselves to fulﬁl operational

requirements and to assist us in complying with our obligations to you.

All our Afﬁliates adopt and apply the principles set forth in this Policy in order to

standardise, justify and ensure that any transfers of Personal Information between them

adhere to the lawful Processing requirements set forth in Applicable Laws. This also

guarantees compliance by ensuring that any potential additional handling of your Personal

Information stays in line with the original reason it was collected by a speciﬁc Afﬁliate.

Afﬁliates only transfer Personal Information in the following circumstances:

you. Once you have opted out, it can take up to 6 (six) weeks for the opt-out request to be

actioned within Ignition Group.

You may opt out of receiving promotional Electronic Communications from us by following

the instructions in those communications. If you opt-out, we may still send you

non-promotional Electronic Communications relating to the Offerings you have taken up.

Our Platforms use Cookies to keep track of your visits and activity on the Platform.

For information related to the use of Cookies, please see our Cookie Policy on our Website.

USAGE DATA

We may also Process Usage Data that your browser sends whenever you visit or engage

with our Platforms or when you access our Offerings by or through any device.

This Usage Data may include information such as your device Internet Protocol (‘’IP’’)

address, browser type, browser version, the Websites that you visit, the pages of other

websites and the uniform resource locator (“URL”) of such pages, the time and date of your

visit to those pages, the time spent on those pages, unique device identiﬁers, URL data for

market segmentation purposes and other diagnostic data. It may also include information

in terms of the type of device you use, your device unique ID and your device operating

system.

LOCATION DATA

With your permission, by enabling your location services, we may Process your Location

Data in order to provide features, add value or improve or customise our Offerings.

You can enable or disable your location services when you use any of our Platforms, at any

time, by way of your device settings.

SECURITY OF YOUR PERSONAL INFORMATION

We take all reasonable and appropriate steps to protect your Personal Information against

loss, misuse, unauthorised access, disclosure, alteration and/or destruction.

We use appropriate technical and organisational measures to protect your Personal

Information. These measures include, but are not limited to, physical access controls and

strict conﬁdentiality measures, encryption, internet ﬁrewalls, intrusion detection and

network monitoring depending on the nature of the information and the scope of

Processing.

While we strive to use commercially acceptable means to protect your Personal

Information, we cannot guarantee its absolute security. Please remember that no method of

transmission over our Platforms or electronic storage is absolutely secure.

HOW LONG WE RETAIN YOUR DATA

We retain your Data for no longer than necessary.

The retention time will depend on:

to establish your needs, wants and preferences in relation to the Offerings provided by

us and our Afﬁliates;

to help us identify you when you engage with us for the ﬁrst time or after an extended

period of time from the last interaction;

to allocate Unique Identiﬁers to you for the purpose of securely storing, retaining and

recalling your Personal Information from time to time;

to facilitate your access to our premises;

to maintain your Records as an existing customer;

for employment purposes;

for general administration purposes;

for legal and/or contractual purposes;

to provide features, add value, or improve the quality and customise our Offerings and

Platforms;

improve the quality of our Offerings and Platforms;

to communicate with you for marketing and non-marketing purposes;

to transfer Personal Information within the Ignition Group and our Afﬁliates so as to enable

us to market our Offerings to you or other Data Subjects;

to transfer or share Personal Information with select Service Providers on a need-to-know

basis so as to enable us to deliver services to you, including credit bureaus to assess and

verify the proﬁle of you as a potential customer for purposes of receiving our Offerings;

to analyse the Personal Information collected for research and statistical purposes;

to transfer Personal Information from South Africa to other jurisdictions if it is required as

stipulated in Clause 9 herein;

to carry out analysis and customer proﬁling in order to identify other products and services

which might be of interest to you, as well as to inform you of such products and/or services; or

for fraud prevention and detection, and to protect and defend the rights and property of

Ignition Group, our employees, our Afﬁliates and business associates.

We will not Process your Personal Information for any purpose other than for the purposes

set forth in Clause 2.9 or in any speciﬁc privacy notices of any Subsidiary or Afﬁliate unless

we are permitted or required to do so in terms of Applicable Laws.

We will Process Personal Information in compliance with the conditions as set out in

Applicable Laws, to ensure that your privacy is protected.

We may from time-to-time Process Personal Information by making use of automated

means (without deploying any human intervention in the decision-making process) to make

decisions about you or your application. In this instance it is speciﬁcally recorded that you

may object to or query the outcomes of such a decision. Requests to contest decisions

based solely on automated processing will be authenticated prior to processing the

request.

PERSONAL INFORMATION FOR DIRECT MARKETING PURPOSES

We acknowledge that we may only Process your Personal Information to contact you for

purposes of direct marketing when it is generally permissible to do so in terms of Applicable

Laws and where we have complied with the provisions of those Applicable Laws.

Where this is lawfully permitted, we will ensure that a reasonable opportunity is given to

you to object (opt-out) to the use of your Personal Information for our marketing purposes

at the point of collection and on the occasion of each direct marketing communication to

uniquely identiﬁes that Data Subject in relation to the Responsible Party;

“Usage Data’’ is data collected automatically, either generated by the use of an Offering,

or our Platforms (for example, the duration of a Website page visit), as more fully described

at clause 5 below;

“Website/s’’ means our main Website at www.ignitiongroup.co.za and any of our

Subsidiary and/or Afﬁliate company websites.

INFORMATION WE MAY COLLECT FROM YOU

When you engage with us, whether physically, electronically, or through the use of our

Offerings, facilities or Platforms, you may be required to provide your Personal Information.

In some instances, especially when you interact with our Platforms or Websites, we may

automatically collect your Location Data, Usage Data and Cookies. We will, in effect, be

Processing your Data and will do so in terms of this Policy.

There may be instances where we have collected your Personal Information from other

sources such as our Service Providers, social media networks and blogs (where the posting

of your Personal Information may make it public information) and business associates, and

in such instances, we will inform you by virtue of the updates in this Policy.

When you provide us with the Personal Information of any other person, we will Process the

Personal Information of such person in accordance with this Policy, as well as any terms and

conditions or other relevant policies to which this Policy relates.

We may Process the following types of Personal Information from time to time, including

but not limited to:

full names;

identity numbers;

registration numbers;

Financial Details;

statutory information;

physical and postal address particulars;

telephone numbers; and/or

email addresses.

When collecting Personal Information from you, we will comply with the notiﬁcation

requirements as set out in Applicable Laws, including the requirements set forth in Section

18 of POPIA.

When you provide us with such Personal Information, we may also be required to conﬁrm

that you are a competent person and that you have authority to give the requisite Consent

to enable us to Process such Personal Information.

You may not always be required to provide the Personal Information that we have

requested. However, if you choose not to provide certain information, you may not be able

to take advantage of some of our Offerings and fully utilize our Platforms.

We Process Personal Information primarily to optimise the delivery of our Offerings and

Platforms, administer our business operations, ensure a legally compliant workplace

environment and safeguard your Personal Information in our custody.

We may Process the Personal Information collected from you for other legitimate, justiﬁable

business purposes including, but not limited to, the following:

to provide or manage any information as requested by or received from you, in general;

“Personal Information’’ means information relating to an identiﬁable, living, natural

person, and where it is applicable, an identiﬁable, existing juristic person, including, but not

limited to:

information relating to the race, gender, sex, pregnancy, marital status, national, ethnic

or social origin, colour, sexual orientation, age, physical or mental health, well-being,

disability, religion, conscience, belief, culture, language and birth of the person;

information relating to the education or the medical, ﬁnancial, criminal or employment

history of the person;

any identifying number, symbol, e-mail address, physical address, telephone number,

Location Data, online identiﬁer or other particular assignment to the person;

the Biometric information of the person;

the personal opinions, views or preferences of the person; correspondence sent by the

person that is implicitly or explicitly of a private or conﬁdential nature or further

correspondence that would reveal the contents of the original correspondence;

the views or opinions of another individual about the person; and

the name of the person if it appears with other Personal Information relating to the

person or if the disclosure of the name itself would reveal information about the person.

“Platform/s” collectively means our Website and any other websites, mobile applications

or other digital interfaces operated or managed by us;

"POPIA" means the Protection of Personal Information Act, No.4 of 2013 and the

regulations thereto, as amended or replaced from time to time;

‘’Processing’’ means any operation or activity or any set of operations, whether or not by

automatic means, concerning Personal Information, including:

the collection, receipt, recording, organisation, collation, storage, updating or

modiﬁcation, retrieval, alteration, consultation or use;

dissemination by means of transmission, distribution or making available in any other

form by electronic communications or other means; or

merging, linking, blocking, degradation, erasure or destruction.

For the purposes of this deﬁnition, "Process" has a corresponding meaning.

“Pseudonymisation’’ means the Processing of Personal Information in such a manner that

the Personal Information can no longer be attributed to a speciﬁc person without the use of

additional information.

“Record/s” means any recorded information which the Responsible Party possesses or

controls, regardless of its form or the material on which it is contained, including computer

hardware or software. A Record can be electronic or paper- based, but it must form part of

a ﬁling system to be included.

“Responsible Party” means a public or private body or any other person which alone or in

conjunction with others, determines the purpose of and means for processing personal

information. For purposes of this Policy, we are the responsible party as deﬁned in Section

1 of POPIA;

“Service Provider/s” means any independent juristic or natural person contracted by the

Ignition Group to facilitate our Offerings, improve a Platform, add value to an existing

Offering or provide additional Offerings to you;

“Subsidiary/ies” means any entity which is wholly owned by Ignition Telecoms

Investments Proprietary Limited, as per Annexure A1 below;

"Unique Identiﬁer" means any identiﬁer that is assigned to a Data Subject and is used by

the Responsible Party for the purposes of the operations of that Responsible Party and that

Protection Laws. Applicable Laws includes any statute, regulation, notice, policy, directive,

ruling or subordinate legislation, the common law, any binding court order, judgment or

ruling, any applicable industry code, policy or standard enforceable by law, or any

applicable direction, policy or order that is given by any regulator, competent authority or

organ of state or statutory industry body;

“Biometric” is a technique of personal identiﬁcation based on physical, physiological, or

behavioural characterisation.

“Biometric Information” is information derived from techniques to identify individuals

based on physical, physiological, or behavioural characterisation, including blood typing,

ﬁngerprinting, DNA analysis, retinal scanning and voice recognition.

“Child” means a natural person under the age of 18 (eighteen) (including the plural

“Children”);

“Consent” means any voluntary, speciﬁc and informed expression of will, in terms of which

permission is given for the Processing of Personal Information as contemplated in

Applicable Laws;

“Cookies’’ are a small amount of Data generated by a website and saved by your web

browser. Its purpose is to remember information about you. If Data Subjects elect not to

receive Cookies, they may be able to view some, but not all, of the content on our

Platforms;

“Data’’ means Personal Information, Usage Data, Cookies and/or Location Data;

“Data Protection Authority” means the relevant regulatory authoritative bodies in the

respective jurisdictions established in terms of Applicable Laws;

‘’Data Subject’’ means our customer(s), user(s) or any natural person in respect of whom

we Process Personal Information (also referred to as “you” or “your”);“ECTA” means the

Electronic Communications and Transactions Act, No. 25 of 2002;

“Electronic Communication” shall have the same meaning as ascribed to the term in

terms of POPIA;

‘’Financial Details’’ means information provided by your bank such as:

account information, including bank name, account name, account type, account holder,

branch number;

information about an account balance, including current and available balance;

identiﬁers and information about the account holder(s), including name, email address,

phone number, date of birth, gender, and address information;

information about account transactions, including amount, date, type, price, and a

description of the transaction; and

deductions from your bank account where necessary for the fulﬁllment of Offerings

provided by the Ignition Group.

“Location Data” means the information about the physical location of a Data Subject’s

device. Depending on the Data Subject’s location, the Personal Information or Personal

Data will be processed in accordance with Applicable Laws;

"Ignition Group" means Ignition Telecoms Investments Proprietary Limited and any of its

subsidiaries, as incorporated from time to time, the particulars of which are recorded in

Annexure A1 to this Policy (also referred to as ‘’we’’, ‘’us’’ or ‘’our’’). For purposes of this

Policy, we are the responsible party as deﬁned in Section 1 of POPIA;

“Offering/s” refer to the products or services provided by the Ignition Group including

those provided by any of our Afﬁliates;

“PAIA” means the Promotion of Access to Information Act 2 of 2000;

1.5.

1.6.

1.7.

1.8.

1.9.

1.10.

1.11.

1.12.

1.13.

1.14.

1.14.1.

1.14.2.

1.14.3.

1.14.4.

1.14.5.

1.15.

1.16.

1.17.

1.18.