POPIA

POPIA Compliance Statement & Information Officer Notice

Pollinate That is committed to full compliance with the Protection of Personal Information Act 4 of 2013 (POPIA), which came into full effect on 1 July 2021. This document outlines our obligations under POPIA, how we give effect to those obligations, and what recourse is available to you as a data subject.

Who We Are

Pollinate That is an online lifestyle retail store based in Cape Town, South Africa. We are a responsible party as defined under POPIA, meaning we determine the purpose and means of processing your personal information in the course of operating our business.

For all POPIA-related matters, you may contact us at:

Email: hello@pollinatethat.com WhatsApp: +27 60 350 8804 Location: Cape Town, South Africa

Our Information Officer

In terms of Section 55 of POPIA, every responsible party must designate an Information Officer. The Information Officer of Pollinate That is Monica Stephanie Aylward / De Beer. Our Information Officer is responsible for:

• Encouraging compliance with the conditions for lawful processing of personal information
• Dealing with requests made to us in terms of POPIA
• Working with the Information Regulator in relation to investigations
• Ensuring that a POPIA compliance framework is developed, implemented, monitored, and maintained
• Ensuring that a manual is developed, implemented, monitored, and maintained as required under the Promotion of Access to Information Act (PAIA)

What Personal Information We Process

As a responsible party, we process the following categories of personal information:

Customer Information

• Full name and surname
• Email address
• Phone number and WhatsApp contact details
• Physical shipping and billing address
• Order history and transaction records
• Payment information, processed and encrypted via secure third-party payment gateways including PayFast
• IP address, device information, and browsing behaviour collected via cookies and analytics tools
• Communications and correspondence with our team

Special Personal Information We do not intentionally collect special personal information as defined under Section 26 of POPIA, which includes information relating to race, religion, health, sexual orientation, criminal history, or biometric data. Should any such information be shared with us voluntarily, it will be treated with the highest level of confidentiality and will not be processed further unless required by law.

Conditions for Lawful Processing

We process personal information only where at least one of the following lawful grounds exists, in accordance with Chapter 3 of POPIA:

Accountability We take full responsibility for ensuring that all personal information in our possession is processed in accordance with POPIA and that appropriate measures are in place to give effect to the conditions for lawful processing.

Processing Limitation We collect personal information only for the specific, explicitly defined, and lawful purposes related to our business operations. We do not process personal information in a manner that is incompatible with the purpose for which it was collected.

Purpose Specification Personal information is collected for the following lawful purposes:

• Processing and fulfilling customer orders
• Communicating order status, shipping, and delivery updates
• Providing customer support and responding to enquiries
• Sending marketing communications where consent has been given
• Fraud prevention and detection
• Compliance with legal and regulatory obligations
• Improving our products, services, and website

Further Processing Limitation Any further processing of personal information beyond the original purpose will only occur where it is compatible with the original purpose, where we have obtained fresh consent, or where we are required to do so by law.

Information Quality We take reasonable steps to ensure that personal information in our possession is complete, accurate, and up to date. We encourage customers to notify us of any changes to their personal information at hello@pollinatethat.com.

Openness We are transparent about the personal information we collect and the purposes for which we collect it. This document and our Privacy Policy together form our commitment to openness as required under POPIA.

Security Safeguards We implement appropriate, reasonable technical and organisational measures to secure the personal information in our possession against loss, damage, unauthorised access, interference, use, modification, or disclosure. All payment transactions are processed through PCI-compliant, encrypted payment gateways. Access to personal information within our organisation is restricted to those who require it to perform their duties.

In the event of a security compromise or data breach, we will notify the Information Regulator and affected data subjects as required under Section 22 of POPIA, without unreasonable delay.

Data Subject Participation We respect your rights as a data subject and will respond to all requests within the timeframes required by POPIA.

Your Rights as a Data Subject

Under POPIA, you have the following rights, which you may exercise at any time by contacting us at hello@pollinatethat.com:

The Right to Access You have the right to request confirmation of whether we hold personal information about you, and to request a copy of that information. We will respond within 30 days of receiving your request.

The Right to Correction or Deletion You have the right to request that we correct, update, or delete personal information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading, or obtained unlawfully.

The Right to Object You have the right to object to the processing of your personal information on reasonable grounds relating to your particular situation. You also have the right to object at any time to the processing of your personal information for direct marketing purposes, including profiling related to direct marketing.

The Right to Withdraw Consent Where processing is based on your consent, you have the right to withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

The Right to Lodge a Complaint If you believe that we have processed your personal information in a manner that is inconsistent with POPIA, you have the right to lodge a complaint with the Information Regulator of South Africa. The Information Regulator's contact details are as follows:

Information Regulator (South Africa) Website: www.inforegulator.org.za Email: inforeg@justice.gov.za Physical Address: JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001 Postal Address: P.O. Box 31533, Braamfontein, Johannesburg, 2017

Direct Marketing

We may process your personal information for direct marketing purposes only where you have given us your explicit consent to do so, or where you are an existing customer and the marketing relates to our own similar products or services. Every marketing communication we send will include a clear and easy mechanism for you to opt out at any time.

If you wish to opt out of direct marketing communications, you may:

• Click the unsubscribe link in any marketing email
• Reply STOP to any SMS or WhatsApp marketing message
• Contact us directly at hello@pollinatethat.com

We will action all opt-out requests promptly and without charge.

Operators and Third-Party Processors

We may share your personal information with third-party operators who process information on our behalf. These operators are contractually bound to process your information only on our instructions, to implement appropriate security measures, and to comply with POPIA. Our current operators include but are not limited to:

• Shopify — e-commerce platform and website hosting
• PayFast — payment processing
• Shipping and logistics partners — for order fulfilment and delivery
• Email marketing platforms — for customer communications
• Analytics providers — for website performance tracking

We do not authorise any operator to process your personal information for their own purposes or to share it with any other party without our express written consent.

Cross-Border Transfers of Personal Information

As an international shipping store, we may transfer personal information to recipients located outside of South Africa, including shipping partners, logistics providers, and technology platforms. In accordance with Section 72 of POPIA, we will only transfer personal information to foreign countries where:

• The recipient country has adequate data protection laws in place, or
• The recipient has agreed to be bound by data protection terms that are substantially similar to POPIA, or
• You have consented to the transfer, or
• The transfer is necessary for the performance of a contract with you

Retention and Destruction of Records

We retain personal information only for as long as is necessary to fulfil the purpose for which it was collected, or as required by law. In general, we retain customer records for a minimum of 5 years following your last transaction with us, in line with South African tax and commercial law requirements. Once retention periods have expired, personal information is securely deleted, destroyed, or anonymised in a manner that prevents reconstruction.

Promotion of Access to Information Act (PAIA)

In terms of Section 51 of the Promotion of Access to Information Act 2 of 2000 (PAIA), we are required to maintain a manual describing the records we hold and how they may be accessed. Our PAIA manual is available on request by contacting us at hello@pollinatethat.com. Should you wish to submit a formal request for access to records, please use the prescribed Form C as published by the South African Department of Justice.

Updates to This Statement

We review and update this POPIA Compliance Statement periodically to ensure it remains accurate and reflects any changes in legislation, our operations, or our data processing activities. The most current version will always be available on our website. We recommend reviewing this statement periodically.

Contact Us

For all POPIA-related requests, complaints, or enquiries, please contact our Information Officer directly:

Pollinate That Attn: Information Officer hello@pollinatethat.com +27 60 350 8804 Cape Town, South Africa

We are committed to acknowledging all requests within 3 business days and resolving them within 30 days in accordance with POPIA requirements.

Effective Date: April 2026