At G CAP NPC, we are committed to protecting the privacy and personal information of our customers, employees, and visitors in accordance with the Protection of Personal Information Act 4 of 2013 (POPIA) in South Africa. This Privacy Policy outlines how we collect, process, store, and protect your personal information, as well as your rights as a data subject.

This policy applies to G CAP NPC, located at Southfield, Cape Town, South Africa, and covers all personal information processed by us, whether collected through our website (https://staging.gcap.org.za), mobile applications, or other means.

Definitions

• Personal Information: Information relating to an identifiable, living, natural person, or an identifiable, existing juristic person, as defined under POPIA.
• Data Subject: The person or entity to whom the personal information relates.
• Responsible Party: G CAP NPC, the entity that determines the purpose and means of processing personal information.
• Operator: Any third party that processes personal information on behalf of G CAP NPC.

Information We Collect

We may collect the following types of personal information, depending on the nature of our interaction with you:

• Identity Information: Name, ID number, date of birth, or company registration details.
• Contact Information: Email address, phone number, physical address, or postal address.
• Financial Information: Bank account details or payment information (only where necessary for transactions).
• Usage Information: Information about how you interact with our website or services, including IP addresses, browser types, and device information.
• Special Personal Information: Information such as race, health, or biometric data (only collected with explicit consent or where legally required).
• Children’s Information: Information about individuals under 18 (only collected with the consent of a competent person, such as a parent or guardian).

We collect this information directly from you when you provide it (e.g., through forms, emails, or account creation) or indirectly through automated means, such as cookies and tracking technologies on our website.

How We Use Your Information

We process personal information for the following purposes:

• To provide and improve our products and services.
• To process transactions and fulfill orders.
• To communicate with you, including responding to inquiries or sending marketing communications (unless you have opted out).
• To comply with legal obligations, such as tax or regulatory requirements.
• To protect our legitimate interests, such as preventing fraud or ensuring the security of our systems.
• To analyse website usage and improve user experience (e.g., through analytics).

Legal Basis for Processing

We process personal information based on the following lawful grounds under POPIA:

• Consent: Where you have given voluntary, specific, and informed consent.
• Contract: Where processing is necessary to fulfil a contract with you.
• Legal Obligation: Where processing is required to comply with South African law.
• Legitimate Interests: Where processing is necessary for our legitimate interests, provided it does not infringe on your rights.
• Protection of Vital Interests: Where processing is necessary to protect your or another person’s vital interests.

Cookies and Tracking Technologies

Our website uses cookies and similar technologies to enhance your experience, analyse usage, and deliver personalized content. Cookies may collect personal information, such as your IP address or browsing behaviour.

• We use essential cookies to enable core website functionality.
• We use non-essential cookies (e.g., analytics or advertising cookies) only with your explicit consent.
• You can manage your cookie preferences through our cookie consent banner or by adjusting your browser settings. You may also withdraw consent at any time by contacting us or updating your preferences.

Sharing Your Information

We may share your personal information with:

• Operators: Third-party service providers (e.g., payment processors, IT service providers, managing agents) who process data on our behalf. These operators are bound by contracts to protect your information in accordance with POPIA.
• Legal Authorities: Where required by law or to protect our rights, we may disclose information to government authorities or law enforcement.
• Business Transfers: In the event of a merger, acquisition, or sale, your information may be transferred to a new entity, subject to POPIA compliance.

We do not share your personal information with third parties for their own marketing purposes without your explicit consent.

Cross-Border Data Transfers

We may transfer your personal information outside of South Africa for the sole purpose of fulfilling our services to you, however we will ensure that:

• The recipient is subject to a law, binding corporate rules, or agreement that provides an adequate level of protection in line with POPIA.
• The transfer is necessary for the performance of a contract or for your benefit.

Data Security

We implement appropriate technical and organisational measures to protect your personal information from unauthorised access, loss, or misuse. These measures include:

• Encryption of sensitive data.
• Access controls and authentication protocols.
• Regular security assessments and updates.

In the event of a data breach, we will notify you and the Information Regulator as required under POPIA.

Your Rights as a Data Subject

Under POPIA, you have the following rights regarding your personal information:

• Right to be Informed: To know what personal information we collect and how it is processed.
• Right to Access: To request a copy of the personal information we hold about you.
• Right to Correction: To request correction of inaccurate or incomplete information.
• Right to Deletion: To request deletion of your personal information, where applicable.
• Right to Object: To object to the processing of your personal information for certain purposes, such as direct marketing.
• Right to Restrict Processing: To request that we restrict the processing of your information in certain circumstances.
• Right to Withdraw Consent: To withdraw consent for processing at any time, where consent is the legal basis.
• Right to Complain: To lodge a complaint with the Information Regulator if you believe your rights have been violated.

To exercise these rights, please contact our Information Officer. We may require proof of identity to process your request. Certain requests may be subject to a reasonable fee, as permitted by POPIA.

Retention of Personal Information

We retain your personal information only for as long as necessary to achieve the purposes outlined in this policy or as required by law. Once no longer needed, we securely delete or anonymize your information.

Direct Marketing

We will only send you direct marketing communications (e.g., emails or SMS) if:

• You have given explicit consent (opt-in) by supplying your data to us for that purpose; or
• You are an existing customer, and we are marketing similar products or services, with a clear option to opt out.

You may opt out of marketing communications at any time by clicking the unsubscribe link in our emails or contacting us directly.

Information Officer

We have appointed an Information Officer responsible for overseeing POPIA compliance. You can contact our Information Officer at:

• Name: D. Daniels
• Contact: Please use this form.

Updates to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. The updated policy will be posted on our website, and we will notify you of significant changes where required.

Contact Us

If you have any questions, concerns, or complaints about this Privacy Policy or our data practices, please contact us using this form.

You may also lodge a complaint with the Information Regulator at:

• Website: www.inforegulator.org.za
• Email: POPIAComplaints@inforegulator.org.za
• Address: P.O. Box 31533, Braamfontein, Johannesburg, 2017, South Africa

Effective Date

This Privacy Policy is effective as of 4 June 2025 and is reviewed as part of a regular schedule under G CAP NPC’s governance rules.