Email 1 Title: POPIA 1 - LICENTIA GROUP - POPIA PRIVACY NOTICE Please add the following Details in the Header: Previous Version Date: 29 August 2024 Effective Date: 01 May 2026 Version Number: POPIA/LFSA/002 (Digital Dropdown Governance Structure) HEADER (Always Visible – Not Collapsible) LICENTIA GROUP PRIVACY NOTICE In terms of the Protection of Personal Information Act 4 of 2013 (“POPIA”) Primary Responsible Party: Licentia Franchise SA (Pty) Ltd Registration Number: 2015/172514/07 Joint Responsible Parties (Provincial Entities): Licentia Mpu Malanga (Pty) Ltd – 2022/218545/07 Licentia KwaZulu Natal (Pty) Ltd – 2020/054282/07 Licentia Gau Teng (Pty) Ltd – 2021/493538/07 Licentia Free State (Pty) Ltd – 2021/619945/07 Licentia Limpopo (Pty) Ltd – 2022/836315/07 Licentia North West (Pty) Ltd – 2023/574703/07 Last Updated: [Auto-Generated System Date] Version: [System Version Number] The Sections shall be completed and emailed to you each separately. DROPDOWN STRUCTURE (INDEX ONLY – No Text Yet) Each of the below will be collapsible in the digital system. SECTION 1 – WHO WE ARE SECTION 2 – INFORMATION OFFICERS SECTION 3 – SERVICES COVERED BY THIS NOTICE SECTION 4 – INFORMATION WE COLLECT SECTION 5 – PURPOSE OF PROCESSING SECTION 6 – FRANCHISE DATA SHARING & GOVERNANCE SECTION 7 – DIRECT MARKETING & COMMUNICATION SECTION 8 – DATA HOSTING & CROSS-BORDER TRANSFERS SECTION 9 – SECURITY SAFEGUARDS SECTION 10 – RETENTION OF INFORMATION SECTION 11 – YOUR RIGHTS UNDER POPIA SECTION 12 – DATA BREACH PROCEDURE SECTION 13 – AMENDMENTS TO THIS NOTICE DEVELOPER IMPLEMENTATION INSTRUCTIONS (THIS IS CRITICAL) Developers must implement the following, if possible. Please let me know what is possible and what is not. 1️⃣ DIGITAL STRUCTURE REQUIREMENTS Header must always remain visible. Each Section must be collapsible (accordion dropdown). Users must be able to expand one section at a time. “Expand All” option should be available. 2️⃣ CONSENT LOGGING SYSTEM (MANDATORY) When a client ticks the consent checkbox, the system must log: Full name entered Province selected IP address Device type Date & time stamp Version number of Privacy Notice Checkbox text version Unique consent ID number Consent logs must: Be exportable in CSV/PDF Be searchable by name or ID Be non-editable once stored Be audit-log protected 3️⃣ VERSION CONTROL System must: Automatically update “Last Updated” date Store previous versions of Privacy Notice Link consent records to the version number accepted Prevent deletion of historic versions 4️⃣ DATA ACCESS CONTROL (FRANCHISE MODEL) Provincial users may only access their territorial data. Head Office must have master access. Access rights must be role-based: Admin Provincial Manager Compliance Officer Legal Department Developer (restricted technical) Audit trail must log: Who accessed what file When accessed What was modified Download activity Email 2-14 Title: This is just the POPIA act as each section as an email