TBO REPORTS - POPIA AGREEMENT 1. PERSONAL INFORMATION of SECURITIES HOLDERS 1.1 The User acknowledges that the Data contains Personal Information of the Securities Holders and that of other persons and that the Processing and use thereof may be subject to or restricted by legislation and other regulatory provisions. 1.2 The User warrants and undertakes to Process the Personal Information within the parameters or limits set out in the Protection of Personal Information Act, any other applicable legislation and other applicable regulatory provisions, and in particular, it will among other things: 1.2.1 only process the Personal Information for the purpose of analysing the shareholders of public companies and not use it for any other unrelated purposes; 1.2.2 process the Personal Information in a lawful and reasonable manner that does not violate the privacy and other rights of the Securities Holders and other persons; 1.2.3 maintain the confidentiality of the Personal Information by among other things restricting access to the Personal Information only to those persons who are authorised or required to have to access to it, and ensure that such persons have committed themselves to maintain the confidentiality; 1.2.4 protect the Personal Information in its control or possession by establishing and maintaining reasonable security arrangements (including, where appropriate, physical, procedural, and technical measures) to prevent unauthorised or accidental access, collection, use, disclosure, copying, modification, or other similar risks; 1.2.5 not transfer the Personal Information to a third party who is situated outside of the Republic of South Africa; 1.2.6 commit to uphold the conditions for the lawful Processing of Personal Information set out in the Protection of Personal Information Act. 1.3 For the purposes of this clause 1: 1.3.1 "Personal Information" means information about an identifiable, living, natural person (and, where it is applicable, an identifiable, existing juristic person). Such Information may include, but not be limited to; (a) information relating to the race, gender, sex, marital status, national, ethnic or social origin, colour, age, language, and birth of the person; (b) information relating to the education, employment history of the person, or information relating to financial transactions in which the person has been involved (c) any identifying number, symbol, e-mail address, physical address, telephone number, location information, online identifier or other particular assigned to the person; (d) the name of the person where it appears with other personal data relating to the person or where the disclosure of the name itself would reveal information about the person. 1.3.2 "Processing" means any operation or activity or any set of operations, whether or not by automatic means, concerning Personal Information, including - (a) the collection, receipt, recording, organisation, collation, storage, updating or modification, retrieval, alteration, consultation or use; (b) dissemination by means of transmission, distribution or making available in any other form; (c) merging, linking, as well as restriction, degradation, erasure or destruction of information. 1.3.3 "Protection of Personal Information Act" means the Protection of Personal Information Act 4 of 2013 (enacted in the Republic of South Africa). 2. PROCESSING CONDITIONS AS REQUIRED BY POPIA You acknowledge and confirm that the following are the eight processing conditions as required by POPIA for the handling, storage, and processing of personal information and you undertake to apply them as appropriate: 2.1 Condition 1: Accountability: responsible party must comply with POPI. 2.2 Condition 2: Processing limitation: only process that which is adequate, relevant and not excessive given the purpose for which it is processed. 2.3 Condition 3: Purpose specification: only collect for specific stated purpose – cannot be used for other purpose and records must not be retained any longer than is necessary for achieving the purpose for which the information was collected. 2.4 Condition 4: Further processing limitation: compatible with initial purpose for collection. 2.5 Condition 5: Information Quality: data must be complete, accurate, up to date. 2.6 Condition 6: Openness: notification to data subject of collection, content of notification prescribed by POPI. 2.7 Condition 7: Security Safeguards: secure integrity or confidentiality of personal information – take reasonable and appropriate technical and organisational measures to prevent technical and organisational measures to prevent loss, damage, unauthorised destruction of personal information; and unlawful access or processing of personal information. 2.8 Condition 8: Data subject participation: has the right to access, right to request correction (including if incorrect, excessive, misleading). 3. SOURCE OF DATA All shareholding data is lawfully purchased under contract from the official share registrars of JSE listed companies. The original raw source data is reformatted in order to provide a more meaningful insight into the data. Copyright © TimBukOne (Pty) Ltd All rights reserved. Any rights not expressly granted herein are reserved. --/--