POPIA Compliance Statement

Weavix is committed to the responsible processing of personal information in compliance with the Protection of Personal Information Act 4 of 2013 (POPIA). This statement describes how we implement the eight conditions for lawful processing established under POPIA, and how we protect the rights of data subjects in connection with our pipeline intelligence services.

POPIA applies to all personal information processed by Weavix, whether collected directly from data subjects, obtained through third-party sources, or generated through our intelligence pipeline operations.

Weavix processes personal information in accordance with all eight conditions prescribed by POPIA:

A core component of the Weavix service involves the identification and scoring of commercial opportunity signals. This process may involve the processing of information about business entities and individuals in a commercial capacity. Weavix applies the following controls to this pipeline:

• —Data is sourced from publicly available commercial activity signals, verified third-party databases, and consented data sources only.
• —Individual personal information is processed only where it is directly relevant to a commercial activity signal and is handled with the minimum necessary scope.
• —All intelligence profiles delivered to clients are reviewed for POPIA compliance before delivery.
• —Clients are contractually prohibited from using delivered intelligence in a manner that would constitute unlawful processing under POPIA.
• —A SHA-256 hashed audit trail is maintained for all data processing events within the intelligence pipeline.

Where Weavix processes personal information on the basis of consent, that consent is obtained explicitly, voluntarily, and with full disclosure of the processing purpose. Consent may be withdrawn at any time by contacting our Information Officer.

Where processing is conducted on the basis of legitimate interest (as permitted under POPIA), we conduct a balancing test to ensure that the data subject's rights and interests are not overridden. We document the outcome of this test and make it available upon request.

Under POPIA, data subjects have the following rights, which Weavix is committed to upholding:

• —The right to be notified that personal information is being collected.
• —The right to access personal information held about them.
• —The right to request correction or deletion of personal information.
• —The right to object to the processing of personal information.
• —The right to submit a complaint to the Information Regulator.
• —The right not to be subject to decisions based solely on automated processing.

To exercise any of these rights, submit a written request to our Information Officer at [email protected]. We will acknowledge your request within 3 business days and respond within 30 days.

Weavix has appointed an Information Officer as required under POPIA. The Information Officer is responsible for:

• —Ensuring compliance with POPIA across all data processing activities.
• —Handling data subject access requests and complaints.
• —Maintaining the PAIA Manual and this compliance statement.
• —Liaising with the Information Regulator on compliance matters.

Data subjects who are not satisfied with Weavix's response to a complaint or access request may lodge a complaint with the Information Regulator of South Africa: