POPIA Statement

1. ABOUT

1.1. This Statement sets out how your Personal Information will be used by Rohatyn Management South Africa Proprietary Limited and applies to any information, including Personal and Special Personal Information, you give to Rohatyn Management South Africa Proprietary Limited or which Rohatyn Management South Africa Proprietary Limited may collect from thirdparties.

1.2. Rohatyn Management South Africa Proprietary Limited is a company, registered according to the laws of the Republic of South Africa; with its primary place of business at 35 Fricker Road, Illovo, Johannesburg 2196 of Rohatyn Management South Africa Proprietary Limited.

1.3. It is important that you read this Statement carefully before submitting any Personal Information to Rohatyn Management South Africa Proprietary Limited.2.

DEFINITIONS

2.1. For purposes of this Statement:

2.1.1. "Applicable Laws" means all laws, regulations that Rohatyn Management South Africa Proprietary Limited is required to comply with;

2.1.2. “Rohatyn Management South Africa Proprietary Limited”, “Us” or “We” means Rohatyn Management South Africa Proprietary Limited;

2.1.3. “Client” or "you" means any prospective, new or existing client of Rohatyn Management South Africa Proprietary Limited and its subsidiaries.

2.1.4. “IO” means the Information Officer of Rohatyn Management South Africa Proprietary Limited

2.1.5. “Notice” or “Privacy Notice” means this Internal Privacy Notice;

2.1.6. “Personal Information” means information relating to an identifiable, living, natural person, and (where applicable) an identifiable, existing juristic person, including the name, race, gender, marital status, address and identifying number of a person, symbol, e-mail address, physical address, telephone number, location information, online identifier or other particular assignment to the person;

2.1.7. “POPIA” means the Protection of Personal Information, 2013 and any regulations or codes of conduct promulgated thereunder;32.1.8. “Processing” or “Process” means any activity that involves the use of Personal Information. It includes any operation or activity or any set of operations, whether or not by automatic means, concerning Personal Information, including:

2.1.8.1. the collection, receipt, recording, organisation, collation, storage, updating or modification, retrieval, alteration, consultation or use;

2.1.8.2. dissemination by means of transmission, distribution or making available in any other form; or

2.1.8.3. merging, linking, as well as restriction, degradation, erasure or destruction of information;

2.1.9. “Special Personal Information” means Personal Information concerning the religious or philosophical beliefs, race or ethnic origin, trade union membership, political persuasion, health or sex life or biometric information of a data subject; or the criminal behaviour of a data subject to the extent that such information relates to the alleged commission by a data subject of any offence; or any proceedings in respect of any offence allegedly committed by a data subject or the disposal of such proceedings; and

2.1.10. “Statement” or “Privacy Statement” means this External Privacy Statement;

2.1.11. “Website” means Rohatyn Management South Africa Proprietary Limited website with address rohatyngroup.com.3.

SCOPE AND APPLICATION

3.1. By submitting any Personal Information to Rohatyn Management South Africa Proprietary Limited you provide consent to the Processing of your Personal Information as set out in this Statement.

1.1. The provisions of this Statement are subject to mandatory, unalterable provisions of Applicable Laws.

1.2. Please do not submit any Personal Information to Rohatyn Management South Africa Proprietary Limited if you do not agree to any of the provisions of this Statement. If you do not consent to the provisions of this Statement, or parts of the Statement, Rohatyn Management South Africa Proprietary Limited may not be able to provide its products and services to you.

1.3. You have the right to withdraw your consent for a specific Processing activity at any time. To withdraw your consent, please contact Mark Parsons. Once we have received notification that you have withdrawn your consent, we will no longer Process your information for the purpose or purposes you originally agreed to, unless we have another legitimate basis for doing so in law.

4. HOW TO CONTACT US

If you have any comments or questions about this Statement or how we handle your Personal Information, please contact the Information Officer.

IO Name: Mark Parsons

E-mail address: [email protected]

5. AMENDMENT OF THIS STATEMENT

5.1. We may amend this Statement from time to time for any of the following reasons:

5.1.1. to provide for the introduction of new systems, methods of operation, services, products or facilities;

5.1.2. to comply with changes to any legal or regulatory requirement;

5.1.3. to ensure that our Statement is clearer and more favourable to you;

5.1.4. to rectify any mistake that may be discovered from time to time; and/or

5.1.5. for any other reason which Rohatyn Management South Africa Proprietary Limited, in its sole discretion, may deem reasonable or necessary.

5.2. Any such amendment will come into effect and become part of any agreement you have with Rohatyn Management South Africa Proprietary Limited when notice is given to you of the change by publication on our Website. It is your responsibility to check the Website often.

6. PRIVACY AND INDEMNITY

6.1. Rohatyn Management South Africa Proprietary Limited takes your privacy and the protection of your Personal Information very seriously, and we will only use your Personal Information in accordance with this Statement and applicable data protection legislation. It is important that you take all necessary and appropriate steps to protect your Personal Information yourself (forexample, by ensuring that all passwords and access codes are kept secure).

6.2. We have implemented reasonable technical and operational measures to keep your Personal Information secure.

6.3. You hereby indemnify and hold Rohatyn Management South Africa Proprietary Limited harmless from any loss, damages or injury that you may incur as a result of any unintentional disclosures of your Personal Information to unauthorised persons or the provision of incorrect or incomplete Personal Information to Rohatyn Management South Africa Proprietary Limited.

7. INFORMATION WHICH WE MAY COLLECT ABOUT YOU

7.1. We may collect the following information about you:

7.1.1. your name, address, contact details, date of birth, place of birth, identity number,
passport number, bank details, details about your employment, tax number and financial information;

7.1.2. records of correspondence or enquiries from you or anyone acting on your behalf;

7.1.3. details of transactions you carry out with us;

7.1.4. details of contracts, sales or leases you carry out with us; and

7.1.5. sensitive or Special Personal Information, including biometric information, suchas images, fingerprints and voiceprints.

7.2. In most circumstances, providing your Personal Information to us is voluntary. Sometimes, itmay be mandatory to provide your Personal Information to us. If you fail to provide certaininformation when requested, we may not be able to perform the services you requested fromus or we may be prevented from complying with our legal obligations.

7.3. Where you provide us with the Personal Information of third parties you should take steps toinform the third party that you need to disclose their details to us, identifying us. We willProcess their Personal Information in accordance with this Statement.

8. HOW WE COLLECT INFORMATION

8.1. You may provide Personal Information to us either directly or indirectly (through an agent acting on your behalf, or an introducer), by completing an application for our products and services or requesting further information about our products and services, whether in writing, through our website, over the telephone or any other means.

8.2. We may also collect your Personal Information from your appointed agent, any regulator, or other third party that may hold such information.

9. USE OF INFORMATION COLLECTED

9.1. We may use, transfer and disclose your Personal Information for the purposes of:

9.1.1. providing you with the services, products or offerings you have requested, and notifying you about important changes to these services, products or offerings;

9.1.2. managing your account or relationship and complying with your instructions orrequests;

9.1.3. detecting and preventing fraud and money laundering and/or in the interest of security and crime prevention;

9.1.4. assessing and dealing with complaints and requests;

9.1.5. operational, marketing, auditing, legal and record keeping requirements;

9.1.6. verifying your identity or the identify of your beneficial owner;

9.1.7. transferring or Processing your Personal Information outside of the Republic of South Africa to such countries that may not offer the same level of data protection as the Republic of South Africa, including for cloud storage purposes and the use of any of our websites;

9.1.8. complying with Applicable Laws, including lawful requests for information received from local or foreign law enforcement, government and tax collectionagencies;

9.1.9. recording and/or monitoring your telephone calls and electronic communications to/with Rohatyn Management South Africa Proprietary Limited in order to accurately carry out your instructions and requests, to use as evidence and in the interests of crime prevention;

9.1.10. conducting market research and providing you with information about our products or services from time to time via email, telephone or other means (for example, events);

9.1.11. where you have unsubscribed from certain direct marketing communications, ensuring that we do not sent such direct marketing to you again;

9.1.12. disclosing your Personal Information to third parties for reasons set out in this Statement or where it is not unlawful to do so;

9.1.13. monitoring, keeping record of and having access to all forms of correspondence or communications received by or sent from Rohatyn Management South Africa Proprietary Limited or any of its employees, agents or contractors, including monitoring, recording and using as evidence all telephone communications between you and Rohatyn Management South Africa Proprietary Limited; and

9.1.14. improving or evaluating the effectiveness of our business or products, services or offerings.

9.2. We may from time to time contact you about services, products and offerings available from Rohatyn Management South Africa Proprietary Limited or specific subsidiaries which we believe may be of interest to you, by email, phone, text or other electronic means, unless you have unsubscribed from receiving such communications. You can unsubscribe from receiving such communications by sending an email to10.

DISCLOSURE OF YOUR INFORMATION

10.1. Your Personal Information may be shared with our subsidiaries, our agents and subcontractors, and selected third parties who Process the information on our behalf.

10.2. We may also disclose your Personal Information to third parties in the following circumstances:

10.2.1. to our subsidiaries who are contracted to provide products or services to you;

10.2.2. to assess and monitor any of your applications for our products or services;

10.2.3. to determine which products and services may be of interest to you and/or to send you information about such products and services, unless you object or choose not to receive such communications;

10.2.4. to have a better understanding of the your circumstances and needs to provide and improve our products and services;

10.2.5. to any relevant person and/or entity for purposes of prevention, detection and reporting of fraud and criminal activities, the identification of the proceeds of unlawful activities and the combatting of crime;

10.2.6. to any regulator or supervisory authority, including those in foreign jurisdictions, if Rohatyn Management South Africa Proprietary Limited is required to do so in terms of Applicable Laws;

10.2.7. to a prospective buyer or seller of any of our businesses or assets;

10.2.8. to any person if we are under a duty to disclose or share your Personal Information in order to comply with any Applicable Laws, or to protect the rights, property or safety of Rohatyn Management South Africa Proprietary Limited, Clients or other third parties; and/or

10.2.9. to your agent or any other person acting on your behalf, an or an introducer.

10.3. We may transfer your information to another of the Rohatyn Management South Africa Proprietary Limited entities, an agent, sub-contractor or third party who carries on business in another country, including one which may not have data privacy laws similar to those of South Africa. If this happens, we will ensure that anyone to whom we pass your information agrees to treat your information with the same level of protection as if we were dealing with it.

10.4. If you do not wish us to disclose this information to third parties, please contact us at the contact details set out above in clause 4. We may, however, not be able to provide products or services to you if such disclosure is necessary.

11. RETENTION OF YOUR INFORMATION

We may retain your Personal Information indefinitely, unless you object, in which case we will only retain it if we are permitted or required to do so in terms of Applicable Laws. However, as a general rule, we will retain your information in accordance with retention periods set out in Applicable Laws, unless we need to retain it for longer for a lawful purpose. (For example, for the purposes of complaints handling, legal processes and proceedings.)

12. ACCESS TO, CORRECTION AND DELETION OF YOUR PERSONAL INFORMATION

12.1. You may request details of Personal Information which we hold about you under the Promotion of Access to Information Act, 2000 (“PAIA”). Fees to obtain a copy or a description of Personal Information held about you are prescribed in terms of PAIA. Confirmation of whether or not we hold Personal Information about you may be requested free of charge. If you would like to obtain a copy of your Personal Information held by Rohatyn Management South Africa Proprietary Limited, please review our PAIA Manual located at rohatyngroup.com/popia

12.2. You may request the correction of Personal Information Rohatyn Management South Africa Proprietary Limited holds about you. Please ensure that the information we hold about you is complete, accurate and up to date. If you fail to keep your information updated, or if your information is incorrect, Rohatyn Management South Africa Proprietary Limited may limit the products and services offered to you or elect not to open the account.

12.3. You have a right in certain circumstances to request the destruction or deletion of and, where applicable, to obtain restriction on the Processing of Personal Information held about you. If you wish to exercise this right, please contact us using the contact details set out above in clause 4.

12.4. You have a right to object on reasonable grounds to the Processing of your Personal Information where the Processing is carried out in order to protect our legitimate interests or your legitimate interests, unless the law provides for such Processing.

13. COMPLAINTS 13.1. Should you believe that Rohatyn Management South Africa Proprietary Limited has utilised your Personal Information contrary to Applicable Laws, you undertake to first attempt to resolve any concerns with us.13.2. If you are not satisfied with such process, you may have the right to lodge a complaint with the Information Regulator, using the contact details listed below:

E-mail address: [email protected]

Physical address JD House27 Stiemens, StreetBraamfontein, Johannesburg, 2001