Collection Notice (POPIA s 18)

1. What we collect and from where. We collect the personal information you give us, including the details you type on an enquiry form, a one-time code that confirms your email address, the identity, passport or registration number of the person who accepts the confidentiality agreement on the enquiry form, and your IP address, the date and time and the version when you accept an agreement or consent online, plus results of identity, credit and sanctions checks we run through our verification provider and public registers. It covers your identity and contact details, entity and beneficial ownership details, financial and business information, payment records and your use of our systems.

2. Who is collecting it. BlackLeaf Group Holdings (Pty) Ltd, registration 2025/879490/07, and the BlackLeaf subsidiary that serves you. The Loft, 439 Diagonal Street, Pringle Bay, 7196. [email protected]. +27 82 843 5788.

3. Why. To verify who you are, assess risk and conflicts, deliver our services, invoice and collect payment, run the portal and meet our legal duties.

4. Voluntary or required. Identity, address and beneficial ownership details are required by law before we can act for you or deliver a shop product. If you do not give them, we cannot onboard you or deliver your order, and we cancel and refund it. Other information is voluntary. If you do not give it, we may not be able to give you some services. A credit bureau enquiry on each director, owner or trustee is also required for a BCRP diagnostic, with that person's separate consent. If it is not given, we cannot begin the diagnostic.

5. Law that requires it. The Financial Intelligence Centre Act 38 of 2001 (verification and record keeping), the Companies Act 71 of 2008 and tax laws (records).

6. Transfers abroad. Some service providers may process information outside South Africa. We transfer it only as section 72 of POPIA allows.

7. Who else receives it and your rights. Other BlackLeaf companies; our service providers (hosting, accounting, verification, payment, email marketing and AI tools); professional partners with your consent; and authorities where the law requires. You may ask for access to your information and to have it corrected or deleted, you may object to processing and withdraw consent, and you may complain to the Information Regulator.

8. Website analytics, advertising measurement and online payments. If you accept analytics on the cookie banner, Google Analytics receives the pages you view, your approximate location and your device details. Google may process this outside South Africa. If you accept advertising measurement on the cookie banner, the Meta (Facebook) pixel on our website sends Meta the page you view, including its address (which may include the name of an advertising campaign in the link you used), that you send an enquiry or other form, that you add an item to the shop basket or start checkout, your IP address, your browser and device type, and an identifier from Meta's cookie. We do not send Meta what you type into a form. Meta handles the information it receives under its own terms and privacy policy, which we do not control. Meta may process this outside South Africa. From 12 November 2026, if you accepted advertising measurement on the cookie banner, Meta may also measure on your own device whether you sent an enquiry or form after seeing an advertisement. Meta may process information about this outside South Africa. If you pay online, PayFast receives your order reference, amount and checkout contact details. You enter card details on its page.

9. Further information. Retention, security and AI use are explained in the Privacy Policy.

Acknowledgement. I have read this notice.

Name: ______________________ Date: ______________________ Signature or tick box: ______________________