PRIVACY STATEMENT

This Privacy Policy describes how Rhyzotherm (Pty) Ltd processes personal information. Preservation of, and respect for, our customers’, business colleagues and vendors’, and patients’ trust is critical to our continued success. We are committed to ensuring that all your personal information that is collected is kept private and protected.

INFORMATION COLLECTION

We may ask you to submit personal information in order for you to benefit from certain features (such as newsletter subscriptions, or order processing) or to participate in a particular activity (webinars or other promotions). You will be informed what information is required and what information is optional.

We may combine the information you submit with other information we have collected from you, whether on or offline, including, for example, your purchase history. We may also combine it with information we receive about you from other Rhyzotherm affiliates.

If you submit any personal information relating to another individual to us, you represent that you have the authority to do so and to permit us to use the information in accordance with this Privacy Policy.

WHAT IS PERSONAL INFORMATION?

Personal information is information relating to you that we can use to specifically identify you, such as your:

• name
• telephone/cell phone number
• e-mail address
• date of birth
• address
• identity number or other national identifier
• any other information that identifies or could identify you and relates to you

SENSITIVE INFORMATION

Unless we specifically request or invite it, we ask that you not send us, and you not disclose, any sensitive personal information (e.g., ID numbers, information related to racial or ethnic origin, political opinions, religion or philosophical beliefs, health or medical conditions, sexual orientation, criminal background, or trade union membership, or biometric or genetic data) to us.

DATA PROCESSING?

Data processing is any operation or activity or set of operations involving personal information, whether or not by automatic means, including collecting, receiving, recording, organizing, collating, storing, updating or modifying, retrieving, altering, consulting or using; disseminating by means of transmission, distribution or making available in any other form; or merging, linking, as well as restriction, degradation, erasure or destruction of personal information.

Rhyzotherm will always process personal information:

• Confidentiality and fairly
• Appropriately, according to the statements we make
• Lawfully, in accordance with applicable data protection laws, directives, regulations and

Where required by applicable law, we will obtain your consent to our use of your personal information at the point of information collection. We may also use information from or about you as necessary to perform a contract, to comply with a legal obligation (for example, due to our pharmacovigilance obligations), or for our legitimate business interests. We may also rely on other legal bases, specifically for:

Fulfilling your requests.

• to provide you with related customer service;
• to respond to your inquiries and fulfil your requests, such as to send you documents you request or e mail alerts;
• to send you important information regarding our relationship with you, changes to our terms, conditions, and policies and/or other administrative information;
• to manage our contractual relationship with you and comply with a legal

Accomplishing our business purposes.

• for data analysis, for example, to improve the efficiency of our service;
• for audits, to verify that our internal processes function as intended and are compliant with legal, regulatory, or contractual requirements;
• for fraud and security monitoring purposes, for example, to detect and prevent cyberattacks or attempts to commit identity theft;
• for developing new products and services;
• for enhancing, improving or modifying our website or products and services;
• for identifying trends, for example, understanding which parts of our services or products are of most interest to users; and
• for determining the effectiveness of our promotional campaigns, so that we can adapt our campaigns to the needs and interests of our users.

USE OF PERSONAL INFORMATION FOR MARKETING PURPOSES

We may contact you periodically in person, by e-mail, by postal mail, or by telephone to provide information regarding programs, products, services and content that may be of interest to you, unless you advise us that you do not wish to receive marketing or market research communications from us. If applicable law requires that we receive your explicit consent before we send you certain types of marketing communications, we will only send you those types of communications after receiving your explicit consent.

SHARING of PERSONAL INFORMATION WITH THIRD PARTIES

Rhyzotherm will not share your personal information with an unrelated third party without your permission, except as otherwise provided in this Statement of Privacy Principles.

In the ordinary course of business, we will share some personal information with companies that we hire to perform services or functions on our behalf. For example, we may use different vendors or suppliers to ship our products. In these cases, we provide the vendor or supplier with information to process your order such as your name and mailing address. In all cases in which we share your personal information with a third party, we will not authorize them to keep, disclose or use your information with others except for the purpose of providing the services we asked them to provide.

We will not sell, exchange or publish your personal information, except in conjunction with a corporate sale, merger, dissolution, or acquisition.

We may be legally compelled to release your personal information in response to a court order, subpoena, search warrant, law, or regulation. We may cooperate with law enforcement authorities in investigating and prosecuting website visitors who violate our rules or engage in behaviour which is harmful to other visitors (or illegal).

We may disclose your personal information to third parties if we feel that the disclosure is necessary to:

• enforce this Privacy Policy
• protect our rights or property
• protect someone’s health, safety or welfare
• comply with a law or regulation, court order, or other legal process

IN CASE OF CHANGES

If we decide to make a significant change to this Privacy Policy, we will describe any major changes in this section of the Statement. You can always find the most current copy of this policy and its history on the website, or you can contact at:

442 Atterbury road Menlo Park Pretoria 0180

+27 12 001 9346

SECURITY

We seek to use reasonable organizational, technical, and administrative measures designed to protect personal information under our control. Unfortunately, no data transmission over the Internet or data storage system can be guaranteed to be 100% secure. If you have reason to believe that your interaction with us is no longer secure (for example, if you feel that the security of any account you have with us has been compromised), please immediately notify us using the contact information available in the “Contact us” section of the website.

RETENTION PERIOD

We will retain your personal information for as long as needed or permitted in light of the purpose(s) for which it was obtained. The criteria used to determine our retention periods include:

• the length of time we have an ongoing relationship with you and provide the Service to you;
• whether there is a legal obligation to which we are subject; and
• whether retention is advisable in light of our legal position (such as in regard to applicable statutes of limitations, litigation, or regulatory investigations).

THIRD PARTY SITES AND SERVICES

Our website and social media pages may contain links to sites of third parties. This Privacy Policy does not address, and we are not responsible for, the privacy, information, or practices of any third parties, including any third party operating any site or online service (including, without limitation, any application) that is available through our platforms. The availability of, or inclusion of a link

to, any such site or property on our website or social media platforms does not imply endorsement of it by us or by our affiliates.

DATA PROTECTION RIGHTS

You have the right, amongst others:

• to information about your personal details
• to access the information about yourself stored by us and its use
• to correct, destroy, or delete these data
• to refuse direct marketing calls or mail
• to remove your data from a direct marketing list
• to object on reasonable grounds to the processing of your personal information
• to withdraw your consent to the processing of your personal information

CONTACT DETAILS OF INFORMATION OFFICER

Name: Cleo Ndhlovu

Address: 442 Atterbury road, Menlo Park, Pretoria, 0081 Phone Number: 012 001 9346

E-mail: compliance@rhyzotherm.co.za

HOW TO COMPLAIN

If you have any concerns about our use of your personal information, you can make a complaint to us at compliance@rhyzotherm.co.za

Should you believe that Rhyzotherm has utilised your personal information contrary to Applicable Laws, please undertake to first attempt to resolve any concerns with us. If you are not satisfied with such process, you have the right to lodge a complaint with the Information Regulator, using the contact details listed below.

Their contact details are as follows:

The Information Regulator (South Africa)

JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001 Or

P.O Box 31533, Braamfontein, Johannesburg, 2017

POPIA Complaints email: POPIAcomplaints.IR@justice.gov.za PAIA Complaints email: PAIAcomplaints.IR@justice.gov.za