LOKALE PRIVACY POLICY

At LOKALE, we are committed to protecting your privacy and handling your personal information with transparency, integrity, and care. This Privacy Policy explains how we collect, use, store, share, and protect your personal information when you use the LOKALE mobile application, website, and related services. It also outlines your rights and choices regarding your personal information in accordance with applicable South African data protection laws, including the Protection of Personal Information Act (POPIA).

1. Definitions

1.1 Personal information: means a person's name and personal details, including but not limited to their contact information, identity or registration number, date of birth, location information, financial information, online identifiers, photographs, videos, purchase and transaction history, communications, opinions, preferences, and any other information that relates to an identifiable, living natural person or, where applicable, an identifiable existing juristic person, whether such person can be identified directly or indirectly.

1.2 Processing: means any activity concerning personal information, including the collection, receipt, recording, organisation, storage, use, dissemination, transmission, distribution, merging, linking, restriction, erasure, or destruction of such information.

1.3 Data subject: means the person to whom the personal information relates, including shoppers, vendors, creators, and any other users of the platform.

1.4 Responsible party: means Lokale, being the entity that determines the purpose of and means for processing personal information collected through the Platform.

1.5 Operator: means any third party that processes personal information on Lokale's behalf and under our instruction, such as payment processors, delivery partners, hosting providers, or analytics providers.

1.6 Consent: means any voluntary, specific, and informed expression of will by which a data subject agrees to the processing of their personal information.

1.7 Vendor: means a registered local brand or business selling products through Lokale.

1.8 Creator: means a user who produces short-form video content promoting products on the Platform.

2. Information We Collect

We collect personal information that you provide directly to us, information generated through your use of the Platform, and information obtained from third parties.

This information may include:

• Account and Identity Information: Your full name, email address, mobile number, date of birth, profile photograph, username, password, and other account registration details when you create an account as a shopper, vendor, or creator.
• Vendor and Business Information: Where you register as a vendor, we collect information relating to your business, including your business name, registration details, business address, tax information, banking details for payouts, and identity verification documents where required.
• Transaction and Payment Information: Information relating to your purchases and sales, including your order history, products purchased or sold, delivery and billing addresses, payment method, and transaction records. Payment card information is processed by our secure third-party payment service providers and is not stored in full on our servers.
• Content Information: Any content that you create or share through the Platform, including videos, photographs, captions, comments, reviews, ratings, messages, and other user-generated content.
• Technical and Usage Information: Information collected automatically when you access or use the Platform, including your device type, operating system, IP address, browser type, mobile network information, app usage patterns, pages viewed, time spent on the Platform, cookies, software development kit (SDK) data, crash reports, and diagnostic information.
• Location Information: Approximate or precise location information where you have enabled location services on your device, to support features such as product discovery, delivery services, and other location-based functionality.
• Communications: Information contained in your communications with us, including customer support requests, enquiries, complaints, feedback, and other correspondence.

We do not knowingly collect or process special personal information except where permitted or required by law. We also do not knowingly collect personal information from children under the age of 18 without the consent of a competent person. Where we become aware that personal information has been collected from a child without the required consent, we will take reasonable steps to delete the information or deactivate the relevant account, as appropriate, in accordance with applicable law, including the Protection of Personal Information Act, 2013 (POPIA).

3. Purpose of Collection and Lawful Basis for Processing

We collect and process your personal information only for specific, explicit, and lawful purposes relating to the operation of the Platform. We will only process personal information where such processing is adequate, relevant, and not excessive for the purpose for which it is collected, in accordance with the conditions for lawful processing set out in the Protection of Personal Information Act, 2013 (POPIA).

We process your personal information for the following purposes:

• to create, verify, and manage your user account;
• to verify your identity and prevent fraud, unauthorised access, and other unlawful activities;
• to facilitate the listing, marketing, purchase, and sale of products and services through the Platform;
• to process payments, refunds, and vendor payouts through authorised payment service providers;
• to coordinate deliveries, order fulfilment, and related logistics;
• to enable you to upload, host, publish, and share videos, images, reviews, comments, and other user-generated content;
• to facilitate communication between shoppers, vendors, creators, and our customer support team;
• to provide customer support, investigate complaints, and resolve disputes;
• to send transactional and service-related communications, including order confirmations, payment notifications, delivery updates, and account notices;
• to send promotional and marketing communications where you have consented to receive them or where otherwise permitted by law;
• to personalise your experience by recommending products, content, and features based on your interactions with the Platform;
• to analyse user activity, improve our products and services, develop new features, and maintain the performance and security of the Platform;
• to comply with applicable legal, regulatory, tax, and accounting obligations; and
• to protect the rights, property, security, and integrity of LOKALE, its users, and the Platform.

We will only process your personal information where one or more of the following lawful grounds apply:

• you have given your consent to the processing;
• the processing is necessary to conclude or perform a contract to which you are a party, including our Terms of Service;
• the processing is necessary to comply with a legal or regulatory obligation imposed on us;
• the processing is necessary to protect your legitimate interests; or
• the processing is necessary to pursue our legitimate interests as the responsible party or those of a third party, provided that such interests are not overridden by your constitutional rights or your right to privacy.

4. Information We Share

We do not sell your personal information to third parties.

We may share your personal information with the following categories of recipients where reasonably necessary to operate, maintain, and improve the Platform:

• Vendors and Creators: We share information with vendors and creators where necessary to facilitate purchases, fulfil orders, provide customer support, or otherwise enable the services you request. This may include your name, delivery address, contact number, and order details.
• Payment Service Providers and Financial Institutions: We share information with authorised third-party payment processors and financial institutions to process payments, refunds, and vendor payouts. Payment card information is processed securely by these providers and is not stored in full on our systems.
• Delivery and Logistics Partners: We share information required to coordinate the collection, shipment, and delivery of orders, including your name, delivery address, contact details, and order information.
• Service Providers and Operators: We share information with trusted third-party service providers, including cloud hosting providers, data storage providers, information technology service providers, security providers, customer support providers, and other operators who process personal information solely on our behalf and under written agreements requiring them to implement security safeguards consistent with the Protection of Personal Information Act, 2013 (POPIA).
• Analytics and Marketing Providers: We may share limited information with analytics, advertising, and marketing service providers to measure Platform performance, understand user behaviour, improve our services, and deliver relevant communications where permitted by law.
• Regulatory Authorities and Law Enforcement: We may disclose personal information where required to do so by law, court order, subpoena, or other lawful process, or where reasonably necessary to protect our rights, property, users, or the security and integrity of the Platform.
• Corporate Transactions: We may disclose personal information as part of a merger, acquisition, investment, restructuring, financing, or sale of all or part of our business or assets, provided that the receiving party agrees to protect your personal information in a manner consistent with this Privacy Policy.

Where we transfer personal information to a third party located outside the Republic of South Africa, including cloud service providers, we will only do so where the recipient is subject to laws, binding corporate rules, or a binding agreement that provides an adequate level of protection substantially similar to that required under POPIA, or where another lawful basis for cross-border transfers exists in accordance with section 72 of POPIA.

5. Security Safeguards

We are committed to protecting the integrity, confidentiality, and security of the personal information in our possession or under our control. We implement appropriate, reasonable technical and organisational measures to prevent the loss of, damage to, unauthorised destruction of, unlawful access to, or unlawful processing of personal information, in accordance with the Protection of Personal Information Act, 2013 (POPIA).

Our security measures include, where appropriate:

• encryption of personal information in transit and at rest;
• secure password storage and authentication measures;
• access controls that restrict access to personal information to authorised personnel on a need-to-know basis;
• regular monitoring, testing, and review of our security practices and systems;
• secure cloud hosting and data storage solutions; and
• written agreements with operators and service providers requiring them to implement security safeguards that are substantially similar to those required under POPIA.

While we take reasonable steps to safeguard your personal information, no method of transmitting or storing information electronically is completely secure. Accordingly, we cannot guarantee the absolute security of your personal information.

If we have reasonable grounds to believe that your personal information has been accessed or acquired by an unauthorised person, we will notify you and the Information Regulator as soon as reasonably possible, where required by applicable law. We will also take appropriate steps to investigate the incident, mitigate any potential harm, and prevent similar incidents from occurring in the future.

6. Data Retention

We retain your personal information only for as long as is reasonably necessary to fulfil the purposes for which it was collected, including providing the Platform and our services, complying with our legal, regulatory, tax, accounting, and reporting obligations, resolving disputes, enforcing our agreements, and protecting our legitimate business interests.

If you close your LOKALE account or request the deletion of your personal information, we will, subject to our legal and regulatory obligations, take reasonable steps to delete, destroy, or de-identify your personal information in a manner that prevents its reconstruction in an intelligible form.

We may retain certain personal information where retention is required or permitted by applicable law, or where it is necessary for legitimate business purposes, including maintaining financial and transaction records, complying with tax and audit requirements, detecting and preventing fraud, resolving disputes, enforcing our legal rights, or complying with court orders or requests from competent authorities.

7. Your Rights as a Data Subject

In terms of the Protection of Personal Information Act, 2013 (POPIA), you have certain rights regarding the personal information we collect and process. LOKALE is committed to respecting and facilitating the exercise of these rights.

Subject to applicable law, you have the right to:

• be notified that your personal information is being collected and informed of the purpose for which it is collected;
• request confirmation as to whether we hold personal information about you;
• request access to the personal information we hold about you;
• request the correction, updating, deletion, destruction, or de-identification of your personal information where it is inaccurate, irrelevant, excessive, out of date, incomplete, misleading, or unlawfully obtained;
• object, on reasonable grounds, to the processing of your personal information where permitted by POPIA;
• object at any time to the processing of your personal information for direct marketing purposes;
• withdraw your consent to the processing of your personal information where processing is based on your consent, provided that such withdrawal will not affect the lawfulness of any processing carried out before your consent was withdrawn;
• request that we review any decision that has been made solely through automated processing where that decision has legal consequences for you or significantly affects you;
• lodge a complaint with the Information Regulator if you believe that your personal information has been processed unlawfully; and
• institute civil proceedings where you believe your rights under POPIA have been infringed.

To exercise any of these rights, you may contact us using the contact details provided in this Privacy Policy. We may request reasonable information to verify your identity before processing your request. We will respond to your request within a reasonable time and in accordance with the requirements of POPIA.

8. Cookies and Tracking Technologies

The Platform uses cookies, software development kits, pixels, and similar tracking technologies to recognise you, remember your preferences, analyse Platform usage, and deliver relevant content and advertising. You may control or disable cookies through your device or browser settings, although doing so may affect the functionality of certain features of the Platform.

9. Direct Marketing

We will only send you direct marketing communications, including by SMS, email, or push notification, where you have given your consent, or where you are an existing customer and we are marketing our own similar products or services to you. Every marketing communication we send will identify Lokale as the sender and will provide you with a simple, free mechanism to opt out of receiving further such communications at any time.

10. Information Officer and Contact Details

Lokale has designated an Information Officer responsible for ensuring compliance with this Privacy Policy and POPIA. If you have any questions, concerns, or requests relating to this Privacy Policy or the processing of your personal information, please contact us at info@lokaleapp.co.za.

11. Lodging a Complaint with the Information Regulator

If you are not satisfied with how we have handled your personal information or responded to a request relating to your rights under POPIA, you have the right to lodge a complaint with the Information Regulator of South Africa. The Information Regulator can be contacted at:

Email: complaints.IR@justice.gov.za
Website: www.justice.gov.za/inforeg
Physical Address: JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001.

12. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, our services, or legal requirements. Where we make material changes, we will take reasonable steps to notify you, including by posting a notice on the Platform or sending you a notification. Your continued use of the Platform after any such update constitutes your acceptance of the revised Privacy Policy.

13. Acceptance of Terms

By accessing, downloading, registering for, or continuing to use the Lokale Platform, you confirm that you have read and understood this Privacy Policy, and you consent to the collection, use, and processing of your personal information in the manner described herein, in accordance with the Protection of Personal Information Act 4 of 2013.