Protection of Personal Information (POPIA) Policy

1Introduction

Risk ResQ (Pty) Ltd (“Risk ResQ”, “we”, “us” or “our”) is a financial services provider committed to respecting the constitutional right to privacy and protecting the personal information entrusted to us.

We recognise our obligations under the Protection of Personal Information Act 4 of 2013 (“POPIA”) and are committed to processing personal information lawfully, responsibly, securely and transparently.

This Policy sets out Risk ResQ’s approach to the collection, use, storage, sharing, retention and protection of personal information relating to clients, prospective clients, employees, representatives, suppliers, service providers and other stakeholders.

2Purpose of the Policy

The purpose of this Policy is to ensure that Risk ResQ:

• complies with POPIA and other applicable legislation;
• protects personal information against unlawful or unauthorised processing, access, loss or disclosure;
• processes personal information only for legitimate and appropriate purposes;
• maintains appropriate security safeguards;
• respects the rights of data subjects; and
• promotes responsible handling of personal information throughout the organisation.

All directors, employees, representatives and persons processing personal information on behalf of Risk ResQ are required to comply with this Policy.

3The eight conditions for lawful processing

Risk ResQ is committed to complying with the eight conditions for the lawful processing of personal information established by POPIA:

4Personal information we process

Depending on the nature of the relationship or service being provided, Risk ResQ may process information including:

• identification and contact information;
• residential, postal and business addresses;
• employment and occupational information;
• financial and banking information;
• information relating to financial products and services;
• FICA and client-verification information;
• correspondence and communications;
• transactional and payment information; and
• other information required for service delivery, regulatory or compliance purposes.

Where special personal information or information relating to children is required, it will be processed only where permitted by POPIA or other applicable legislation and with appropriate safeguards.

5Purpose of processing

Personal information may be processed for legitimate business, contractual, regulatory and legal purposes, including:

• responding to enquiries and requests;
• providing or facilitating financial products and services;
• establishing and managing client relationships;
• conducting client identification and verification;
• complying with FICA and other regulatory obligations;
• preventing and detecting fraud;
• maintaining required business and client records;
• communicating with clients and stakeholders;
• managing employees, representatives and service providers; and
• complying with lawful requests from regulators, courts and other competent authorities.

Personal information will not be processed for purposes incompatible with the purpose for which it was collected unless permitted by law.

6Disclosure and third-party processing

Risk ResQ does not sell personal information.

Where necessary and lawfully permitted, personal information may be shared with authorised employees and representatives, financial product or service providers, professional advisers, compliance providers, technology and hosting providers, verification or fraud-prevention providers, regulatory authorities and other parties required or permitted by law.

Where third parties process personal information on behalf of Risk ResQ, appropriate measures will be taken to require those parties to maintain the confidentiality and security of the information.

Where personal information is transferred outside South Africa, Risk ResQ will take appropriate steps to ensure that the transfer complies with POPIA.

7Security and data breaches

Risk ResQ will maintain reasonable and appropriate technical and organisational safeguards to protect personal information under its control.

These may include access controls, password protection, secure information systems, physical security, confidentiality requirements and appropriate cybersecurity measures.

Any actual or suspected compromise of personal information must be reported to the Information Officer without unreasonable delay.

Where there are reasonable grounds to believe that personal information has been accessed or acquired by an unauthorised person, Risk ResQ will investigate the incident and comply with the notification and remedial requirements of POPIA, including notification to the Information Regulator and affected data subjects where required.

8Retention and destruction

Personal information will be retained only for as long as necessary for the purpose for which it was collected, unless a longer retention period is required or permitted by legislation, regulation, contract or another lawful basis.

As a financial services provider, Risk ResQ may be required to retain certain client, FICA, transactional, financial and compliance records for prescribed periods.

When personal information is no longer required and there is no lawful basis for retaining it, it will be securely destroyed, deleted or de-identified.

9Direct marketing

Risk ResQ will conduct direct marketing in accordance with POPIA and other applicable legislation.

Where consent is required for electronic direct marketing, the necessary consent will be obtained. Data subjects will also be provided with an appropriate means of opting out of marketing communications.

10Rights of data subjects

Subject to POPIA and other applicable legislation, data subjects have the right to:

• request confirmation of whether Risk ResQ holds their personal information;
• request access to their personal information;
• request correction or deletion of information where permitted;
• object to certain processing of their personal information;
• withdraw consent where processing is based on consent;
• object to direct marketing; and
• lodge a complaint with Risk ResQ or the Information Regulator.

Risk ResQ may require reasonable proof of identity before processing a request relating to personal information.

11Training and ongoing compliance

Risk ResQ will promote awareness of POPIA and responsible information handling throughout the organisation.

Relevant employees and representatives will receive appropriate training regarding their privacy, confidentiality and information-security responsibilities.

Compliance with this Policy will be monitored and the Policy will be reviewed periodically to take account of changes in legislation, regulatory requirements, business operations, technology and information-security risks.

Employees and representatives must promptly report suspected non-compliance, unlawful processing or security incidents to management or the Information Officer.

12Information Officer

Risk ResQ’s Information Officer is responsible for overseeing and facilitating compliance with POPIA, handling privacy-related requests and complaints, promoting awareness and assisting with the management of personal-information security incidents.

13Complaints

Any person who believes that Risk ResQ has processed their personal information unlawfully or contrary to this Policy may submit a complaint to the Information Officer.

Risk ResQ will take reasonable steps to investigate and address such complaints.

A data subject also has the right to lodge a complaint with the Information Regulator (South Africa) in accordance with POPIA.

14Contact details

Risk ResQ (Pty) Ltd · FSP No. 54423

15Policy review

Risk ResQ may amend this Policy from time to time to reflect changes in legislation, regulatory requirements, business practices or the manner in which personal information is processed.

The latest approved version will supersede all previous versions.

Effective Date: 7 October 2026