Privacy and Cookie Policy

Important Information and Who We Are

Purpose of this Privacy Policy

This Privacy Policy aims to give you information on how we collect and process your personal information through any form of your engagement with us. This Privacy Policy complies with, and facilitates the obligations required from, the South African Protection of Personal Information Act, No. 4 of 2013 ("POPI"), as amended.

It is important that you read this Privacy Policy together with any other privacy policy or fair processing notice we may provide on specific occasions when we are collecting or processing personal information about you, so that you are fully aware of how and why we are using your personal information.

Important: We do not process the data of minors nor special categories of personal information. Do not provide us with any such personal data, as it will constitute an immediate and automatic breach of this Privacy Policy and our Terms.

Responsible Party and Operator

EVO is the "Responsible Party" and is responsible for your personal information when we decide its processing operations. In certain instances we may operate as an "Operator" of personal information on behalf of a third party.

Our Contact Details

You have the right to make a complaint at any time to the South African regulator's office (Information Regulator's Office of South Africa). We would, however, appreciate the chance to deal with your concerns before you approach any such regulator, so please contact us in the first instance.

Changes to this Privacy Policy

It is important that the personal information we hold about you is accurate and current. Please keep us informed if your personal information changes during your relationship with us.

This Privacy Policy is subject to change without notice and is updated or amended from time to time and will be effective once we upload the amended version to the Platform. Your continued access or use of our Services constitutes your acceptance of this Privacy Policy, as amended.

Third-Party Links on Platform

The Platform may include links to third-party platforms, plug-ins, and applications. Clicking on those links or enabling those connections may allow third parties to collect or share information about you. We do not control these third-party platforms and are not responsible for their privacy statements or terms. When you leave our Platform, or engage with such third parties, we encourage you to read the distinct privacy policy of every third-party you engage with.

Personal information, or personally identifiable information, means any information about an individual, both natural and juristic entities (i.e., people and companies), from which that entity can be identified. It does not include information where the identity has been removed (anonymous data).

We may collect, use, store, and transfer ("process") different kinds of personal information about you which we have grouped together as follows:

• Identity Data: including full name, or the information about your company such as company name, address and/or company registration details
• Contact Data: including email address, physical/registered addresses, and contact phone numbers
• Profile Data: including all the data and information available in your profile such as reports, advice, statistics, payment history, statements, and subscriptions
• Social Media Data: including all the data available on your publicly available social media profile
• Financial Data: including bank account details
• Transaction Data: including details about payments to and from you, contracts, contractual terms, contract fees, signups, subscriptions, invoices and other details of products and services
• Technical Data: including internet protocol address/es, login data, browser type and version, time zone setting and location, cookies, browser plug-in types and versions, operating system and platform
• Usage Data: including information about how you use our company, Platform, surveys, and Services
• Marketing and Communications Data: including your preferences in receiving notices and marketing from us and our third parties and your communication preferences

Important: We also collect, use, and share Aggregated Data such as statistical or demographic data for any purpose. Your data is not monetised or sold.

We use different methods to collect personal information from and about you, including through:

Direct Interactions

You may give us your personal information by browsing our Platform or by corresponding with us through the Platform, by phone, email or otherwise. This includes personal information you provide when you:

• Use our Services
• Use our Platform
• Contract with us
• Provide any services to us as a service provider or independent contractor
• Request information to be sent to you
• Give us some feedback

Automated Technologies or Interactions

As you interact with our Platform, we may automatically collect Technical Data and Usage Data about your equipment, browsing actions and patterns using cookies, server logs and other similar technologies.

Third Parties

We may receive personal information about you from various third parties such as:

• Analytics providers
• Financial institutions
• Marketing platforms
• Search information providers

How We Use Your Personal Information

We will only use your personal information when the law allows us to and for legitimate reasons, which you hereby expressly understand and consent to. Most commonly, we will use your personal information in the following circumstances:

• Where we have your express consent to do so
• Where we need to consult with you or perform on the Services contract we are about to enter into or have entered into with you
• Where it is necessary for our legitimate business interests (or those of a third party) and your interests and fundamental rights do not override those interests
• Where we need to comply with a legal or regulatory obligation

The Platform may make use of "cookies" to automatically collect information and data through the standard operation of the Internet servers. "Cookies" are small text files a platform can use (and which we may use) to recognise repeat users, facilitate the user's on-going access to and use of a platform and allow a platform to track usage behaviour and compile aggregate data.

The type of information collected by cookies is not used to personally identify you. If you do not want information collected using cookies, there is a simple procedure in most browsers that allows you to deny or accept the cookie feature. Please note that cookies may be necessary to provide you with certain features available on our Platform and thus if you disable the cookies on your browser you may not be able to use those features, and your access to our Platform will therefore be limited.

sigme360 operates an affiliate and referral programme through which approved third parties may refer prospective customers to our Platform.

When you access sigme360 through an affiliate link, referral code, promotional code or similar referral mechanism, we may collect and process information relating to that referral. This may include:

• the affiliate or referral identifier;
• the referring website, application or marketing channel;
• campaign and UTM information;
• date and time of the referral;
• IP address and device or browser information;
• cookie or similar tracking identifiers;
• pages visited and actions taken;
• account registration information;
• subscription or transaction status; and
• information necessary to determine whether a referral qualifies for commission.

We process this information for purposes that include:

• identifying the source of referrals;
• attributing eligible customers to Programme Affiliates;
• measuring Affiliate Programme performance;
• calculating and administering affiliate commission;
• preventing fraudulent referrals or manipulation of the Programme;
• analysing the effectiveness of our marketing activities;
• resolving referral or commission disputes; and
• complying with our legal, accounting, tax and contractual obligations.

Where required by applicable law, affiliate or advertising tracking technologies will be used subject to the appropriate consent or other lawful basis.

Affiliate Tracking Technologies

When you follow an affiliate link, we may place or read a cookie, referral identifier or similar technology on your device to remember the referring Affiliate for a limited attribution period.

Affiliate attribution may remain active for 60 days, unless the applicable identifier expires earlier, is deleted or is otherwise unavailable.

Our affiliate tracking may operate together with analytics technologies, URL parameters, local storage or server-side attribution systems.

Where non-essential cookies or similar technologies require consent under applicable law, they will only be activated in accordance with the applicable consent requirements.

You may manage cookies through your browser and, where available, through our cookie consent tools. Disabling or deleting affiliate tracking technology may prevent a referral from being correctly attributed to the referring Affiliate.

Information About Programme Affiliates

If you apply to or participate in the sigme360 Affiliate Programme, we may collect information including:

• your name;
• business or trading name;
• email address and contact details;
• website and social media information;
• country or location;
• affiliate account and referral identifiers;
• traffic and referral performance;
• commission and transaction records;
• banking or payment information;
• tax, VAT or other regulatory information where required;
• correspondence with sigme360; and
• information reasonably required to prevent fraud and administer the Programme.

We process Affiliate information to assess applications, manage participation in the Programme, provide Affiliate functionality, communicate with Affiliates, calculate and make payments, prevent fraud, maintain accounting and tax records and enforce the Affiliate Programme Terms.

Sharing Affiliate and Referral Information

We may disclose Affiliate Programme information to service providers that assist us with affiliate tracking, analytics, payment processing, accounting, fraud prevention, hosting and other services necessary to operate the Programme.

We may also disclose information where required by law, to professional advisers or regulatory authorities, or where reasonably necessary to establish, exercise or defend legal rights.

We do not provide Programme Affiliates with unrestricted access to the personal information of customers they refer. Affiliate reporting will, wherever reasonably practicable, be limited to attribution, transaction and commission information necessary to operate the Programme.

Where our Affiliate Programme service providers or Affiliates are located outside South Africa, personal information may be processed internationally in accordance with the International Transfers provisions of this Privacy Policy and applicable data protection law.

Affiliate Programme and Referral Data Retention

We retain Affiliate Programme and referral information for as long as reasonably necessary to operate the Programme, administer and verify commissions, prevent fraud, resolve disputes and meet applicable legal, accounting, tax and regulatory requirements.

Where information is no longer required, it will be deleted, anonymised or otherwise handled in accordance with our data retention practices.

We may share and process your personal information outside of South Africa for the purpose of cloud storage or to engage with third parties.

Whenever we may transfer your personal information out of South Africa, we will ensure a similar degree of protection is afforded to it by ensuring at least one of the following safeguards is implemented:

• We will only transfer your personal information to countries that have appropriate data protection legislation in place similar to that of South Africa
• Where we use service providers, we may use specific contracts/clauses which ensure personal information is processed and secured lawfully

Data Security

We have put in place appropriate security measures to prevent your personal information from being accidentally lost, used, or accessed in an unauthorised way, altered, or disclosed by using DDoS Mitigation, VLAN reverse path forwarding protection and Juniper Firewall rules at the network edge and core.

We also limit access to your personal information to those employees, agents, contractors and other third parties who have a legitimate need to know. They will only process your personal information on our instruction and are subject to a duty of confidentiality.

We have automatic backups in place and provide data recoveries of at least seven (7) days before any possible event. If an event is proven to be out of our control, we take no liability or responsibility for any losses.

Data Retention

We will only retain your personal information for as long as necessary to fulfil the purpose we collected it for including any legal, accounting, or reporting requirements.

To determine the appropriate retention period for personal information, we consider the amount, nature, and sensitivity of the personal information, the potential risk of harm from unauthorised use or disclosure of your personal information, the purpose for which we process your personal information, any other South African applicable law requiring us to retain the personal information and whether we can achieve those purposes through other means, and the applicable legal requirements.

You have rights in relation to your personal information where we are the relevant "Responsible Party" over such personal information. Please contact us to find out more about, or manifest, these rights:

• Request access to your personal information
• Request correction of your personal information
• Request erasure of your personal information
• Object to the processing of your personal information
• Request a restriction of processing your personal information
• Request transfer of your personal information
• Right to withdraw consent

European User Rights (GDPR)

If you are located in the EU or Switzerland, you have certain rights with respect to your personal information under the European Commission's General Data Protection Regulation, 2016/679 ("GDPR").

We are the Controller (as defined in GDPR) when you provide us with your personal information through your use of our Services. When we act as a Controller, we determine how your personal information will be used strictly in accordance with this Privacy Policy.

United States (California) User Rights (CCPA)

If you are a California resident, you have certain rights under the California Consumer Privacy Act ("CCPA"). If you are an eligible California user, included in these rights are:

• Right to Know: you have the right to request to know more about the categories and specific pieces of personal information that we have collected about you
• Right to Correction: you have the right to have inaccurate personal information about you corrected
• Right to Deletion: you have the right to request the deletion of personal information that we have collected about you
• Right to Non-Discrimination: there is no penalty for choosing to exercise any of your rights under the CCPA
• Right to Opt-Out: you have the right to opt out of the sale of your personal information