Privacy and Cookie Policy

Important Information and Who We Are

Purpose of this Privacy Policy

This Privacy Policy aims to give you information on how we collect and process your personal information through any form of your engagement with us. This Privacy Policy complies with, and facilitates the obligations required from, the South African Protection of Personal Information Act, No. 4 of 2013 ("POPI"), as amended.

It is important that you read this Privacy Policy together with any other privacy policy or fair processing notice we may provide on specific occasions when we are collecting or processing personal information about you, so that you are fully aware of how and why we are using your personal information.

Important: We do not process the data of minors nor special categories of personal information. Do not provide us with any such personal data, as it will constitute an immediate and automatic breach of this Privacy Policy and our Terms.

Responsible Party and Operator

EVO is the "Responsible Party" and is responsible for your personal information when we decide its processing operations. In certain instances we may operate as an "Operator" of personal information on behalf of a third party.

Our Contact Details

You have the right to make a complaint at any time to the South African regulator's office (Information Regulator's Office of South Africa). We would, however, appreciate the chance to deal with your concerns before you approach any such regulator, so please contact us in the first instance.

Changes to this Privacy Policy

It is important that the personal information we hold about you is accurate and current. Please keep us informed if your personal information changes during your relationship with us.

This Privacy Policy is subject to change without notice and is updated or amended from time to time and will be effective once we upload the amended version to the Platform. Your continued access or use of our Services constitutes your acceptance of this Privacy Policy, as amended.

Third-Party Links on Platform

The Platform may include links to third-party platforms, plug-ins, and applications. Clicking on those links or enabling those connections may allow third parties to collect or share information about you. We do not control these third-party platforms and are not responsible for their privacy statements or terms. When you leave our Platform, or engage with such third parties, we encourage you to read the distinct privacy policy of every third-party you engage with.

Personal information, or personally identifiable information, means any information about an individual, both natural and juristic entities (i.e., people and companies), from which that entity can be identified. It does not include information where the identity has been removed (anonymous data).

We may collect, use, store, and transfer ("process") different kinds of personal information about you which we have grouped together as follows:

• Identity Data: including full name, or the information about your company such as company name, address and/or company registration details
• Contact Data: including email address, physical/registered addresses, and contact phone numbers
• Profile Data: including all the data and information available in your profile such as reports, advice, statistics, payment history, statements, and subscriptions
• Social Media Data: including all the data available on your publicly available social media profile
• Financial Data: including bank account details
• Transaction Data: including details about payments to and from you, contracts, contractual terms, contract fees, signups, subscriptions, invoices and other details of products and services
• Technical Data: including internet protocol address/es, login data, browser type and version, time zone setting and location, cookies, browser plug-in types and versions, operating system and platform
• Usage Data: including information about how you use our company, Platform, surveys, and Services
• Marketing and Communications Data: including your preferences in receiving notices and marketing from us and our third parties and your communication preferences

Important: We also collect, use, and share Aggregated Data such as statistical or demographic data for any purpose. Your data is not monetised or sold.

We use different methods to collect personal information from and about you, including through:

Direct Interactions

You may give us your personal information by browsing our Platform or by corresponding with us through the Platform, by phone, email or otherwise. This includes personal information you provide when you:

• Use our Services
• Use our Platform
• Contract with us
• Provide any services to us as a service provider or independent contractor
• Request information to be sent to you
• Give us some feedback

Automated Technologies or Interactions

As you interact with our Platform, we may automatically collect Technical Data and Usage Data about your equipment, browsing actions and patterns using cookies, server logs and other similar technologies.

Third Parties

We may receive personal information about you from various third parties such as:

• Analytics providers
• Financial institutions
• Marketing platforms
• Search information providers

How We Use Your Personal Information

We will only use your personal information when the law allows us to and for legitimate reasons, which you hereby expressly understand and consent to. Most commonly, we will use your personal information in the following circumstances:

• Where we have your express consent to do so
• Where we need to consult with you or perform on the Services contract we are about to enter into or have entered into with you
• Where it is necessary for our legitimate business interests (or those of a third party) and your interests and fundamental rights do not override those interests
• Where we need to comply with a legal or regulatory obligation

The Platform may make use of "cookies" to automatically collect information and data through the standard operation of the Internet servers. "Cookies" are small text files a platform can use (and which we may use) to recognise repeat users, facilitate the user's on-going access to and use of a platform and allow a platform to track usage behaviour and compile aggregate data.

The type of information collected by cookies is not used to personally identify you. If you do not want information collected using cookies, there is a simple procedure in most browsers that allows you to deny or accept the cookie feature. Please note that cookies may be necessary to provide you with certain features available on our Platform and thus if you disable the cookies on your browser you may not be able to use those features, and your access to our Platform will therefore be limited.

We may share and process your personal information outside of South Africa for the purpose of cloud storage or to engage with third parties.

Whenever we may transfer your personal information out of South Africa, we will ensure a similar degree of protection is afforded to it by ensuring at least one of the following safeguards is implemented:

• We will only transfer your personal information to countries that have appropriate data protection legislation in place similar to that of South Africa
• Where we use service providers, we may use specific contracts/clauses which ensure personal information is processed and secured lawfully

Data Security

We have put in place appropriate security measures to prevent your personal information from being accidentally lost, used, or accessed in an unauthorised way, altered, or disclosed by using DDoS Mitigation, VLAN reverse path forwarding protection and Juniper Firewall rules at the network edge and core.

We also limit access to your personal information to those employees, agents, contractors and other third parties who have a legitimate need to know. They will only process your personal information on our instruction and are subject to a duty of confidentiality.

We have automatic backups in place and provide data recoveries of at least seven (7) days before any possible event. If an event is proven to be out of our control, we take no liability or responsibility for any losses.

Data Retention

We will only retain your personal information for as long as necessary to fulfil the purpose we collected it for including any legal, accounting, or reporting requirements.

To determine the appropriate retention period for personal information, we consider the amount, nature, and sensitivity of the personal information, the potential risk of harm from unauthorised use or disclosure of your personal information, the purpose for which we process your personal information, any other South African applicable law requiring us to retain the personal information and whether we can achieve those purposes through other means, and the applicable legal requirements.

You have rights in relation to your personal information where we are the relevant "Responsible Party" over such personal information. Please contact us to find out more about, or manifest, these rights:

• Request access to your personal information
• Request correction of your personal information
• Request erasure of your personal information
• Object to the processing of your personal information
• Request a restriction of processing your personal information
• Request transfer of your personal information
• Right to withdraw consent

European User Rights (GDPR)

If you are located in the EU or Switzerland, you have certain rights with respect to your personal information under the European Commission's General Data Protection Regulation, 2016/679 ("GDPR").

We are the Controller (as defined in GDPR) when you provide us with your personal information through your use of our Services. When we act as a Controller, we determine how your personal information will be used strictly in accordance with this Privacy Policy.

United States (California) User Rights (CCPA)

If you are a California resident, you have certain rights under the California Consumer Privacy Act ("CCPA"). If you are an eligible California user, included in these rights are:

• Right to Know: you have the right to request to know more about the categories and specific pieces of personal information that we have collected about you
• Right to Correction: you have the right to have inaccurate personal information about you corrected
• Right to Deletion: you have the right to request the deletion of personal information that we have collected about you
• Right to Non-Discrimination: there is no penalty for choosing to exercise any of your rights under the CCPA
• Right to Opt-Out: you have the right to opt out of the sale of your personal information