Elevate Tech Logo

POPIA Data Subject Rights Policy

Elevate Tech Limited Registration Number: 2025/742289/10 Website: https://store.elevatetech.biz Support Email: support@elevatetech.biz Information Officer: Wade Wareing — wade@elevatetech.biz

Effective Date: 3 June 2026 Version: 1.0

1. Introduction

1.1 This POPIA Data Subject Rights Policy ("Policy") explains the rights that you have as a data subject under the Protection of Personal Information Act 4 of 2013 ("POPIA"), and how you may exercise those rights in respect of personal information processed by Elevate Tech Limited ("Elevate Tech", "we", "us" or "our").

1.2 This Policy supplements, and must be read together with, our Privacy Policy, our PAIA Manual, our Cookie Policy and our Electronic Communications and Consent Policy.

1.3 Elevate Tech is the responsible party for the processing of your personal information. Our Information Officer is Wade Wareing (wade@elevatetech.biz).

2. Definitions

2.1 In this Policy, the terms "personal information", "process", "responsible party", "operator" and "data subject" have the meanings given to them in POPIA and in our Privacy Policy.

3. Your Rights as a Data Subject

3.1 Subject to POPIA, you have the following rights:

(a) Right to be notified (sections 18 and 22). You have the right to be notified that your personal information is being collected, and to be notified where there are reasonable grounds to believe that your personal information has been accessed or acquired by an unauthorised person.

(b) Right of access (section 23). You have the right to request confirmation, free of charge, of whether we hold personal information about you, and to request access to that information. You may also request the identities of all third parties (or categories of third parties) who have, or have had, access to your personal information. A request for access is made through the procedure in our PAIA Manual and may attract a fee for the provision of the information itself.

(c) Right to correction or deletion (section 24). You have the right to request that we correct or delete personal information about you that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or obtained unlawfully, or that we destroy or delete a record of personal information that we are no longer authorised to retain.

(d) Right to object (section 11(3)). You have the right, on reasonable grounds relating to your particular situation, to object to the processing of your personal information where the processing is based on the protection of a legitimate interest, our legitimate interests, or the performance of a public-law duty. If you object, we will stop processing the personal information unless legislation provides otherwise.

(e) Right to object to direct marketing (sections 11(3) and 69). You have the right to object at any time to the processing of your personal information for purposes of direct marketing, and to require that such processing stop. You may withdraw consent to electronic direct marketing at any time.

(f) Right to withdraw consent (section 11(2)). Where processing is based on your consent, you have the right to withdraw that consent at any time, provided that the lawfulness of processing before withdrawal is not affected, and subject to any legal or contractual restrictions and reasonable notice.

(g) Rights in relation to automated decision-making (section 71). You have the right not to be subject to a decision that results in legal consequences for you, or that affects you to a substantial degree, which is based solely on the automated processing of your personal information intended to assess aspects of your personality, except as permitted by POPIA.

(h) Right to submit a complaint (section 74). You have the right to submit a complaint to the Information Regulator regarding an alleged interference with the protection of your personal information, or regarding a determination of an adjudicator.

(i) Right to institute civil proceedings (section 99). You have the right to institute civil proceedings regarding an alleged interference with the protection of your personal information.

4. How to Exercise Your Rights

4.1 To exercise any of your rights, please contact the Information Officer:

4.2 Certain requests must be made on a prescribed form:

(a) Access to personal information — a request for access is made using the prescribed PAIA request form (Form 2), as described in our PAIA Manual. (b) Objection to processing — an objection is made on the prescribed form for objection to the processing of personal information (the POPIA prescribed objection form). (c) Correction or deletion — a request for correction or deletion is made on the prescribed form for the correction or deletion of personal information (the POPIA prescribed correction form).

4.3 The prescribed forms are available from the Information Officer on request and from the Information Regulator's website at https://inforegulator.org.za. Where a right may be exercised without a prescribed form (for example, opting out of marketing via an unsubscribe link), we will give effect to it through the simplest available mechanism.

4.4 To help us respond efficiently, please provide:

(a) your full name and contact details; (b) sufficient information to verify your identity (and, where you act for a juristic person, proof of your authority); (c) a clear description of the personal information and the right you wish to exercise; and (d) any supporting information relevant to your request.

5. Verification of Identity

5.1 To protect your personal information, we will take reasonable steps to verify your identity before acting on a request. We may request additional information for this purpose. We may decline to act on a request where we are unable to verify your identity or authority.

6. Our Response and Timeframes

6.1 We will acknowledge and respond to your request as soon as reasonably possible, and in any event within the timeframes prescribed by PAIA and POPIA. For access requests under PAIA, the standard period is 30 (thirty) days, which may be extended in the circumstances permitted by PAIA, in which case we will notify you of the extension and the reasons for it.

6.2 We will give effect to a valid request for correction, deletion, objection or opt-out without undue delay, and will notify you of the action taken. Where we correct or delete personal information that we have shared with third parties, we will, where reasonably practicable, notify those third parties of the correction or deletion.

6.3 Where we are unable to give effect to a request, we will notify you of the reasons and of any rights you have to lodge a complaint or take further action.

7. Fees

7.1 Confirmation of whether we hold personal information about you is provided free of charge. A fee may be payable for the provision of the personal information itself, in accordance with the fees prescribed under PAIA, as described in our PAIA Manual. We will notify you of any fee before providing the information.

8. Limitations on Your Rights

8.1 Your rights are subject to the limitations and exceptions permitted by POPIA, PAIA and other applicable law. For example:

(a) we may be required by law to retain certain personal information (such as tax and transaction records) and may decline a deletion request to that extent; (b) we may refuse access on the grounds for refusal set out in PAIA (see our PAIA Manual); (c) we may continue processing despite an objection where legislation provides otherwise or where we have an overriding lawful basis; and (d) we may decline manifestly unfounded, excessive or repetitive requests, or charge a reasonable fee, to the extent permitted by law.

9. Complaints to the Information Regulator

9.1 If you are not satisfied with how we have handled your personal information or your request, you have the right to lodge a complaint with the Information Regulator:

9.2 We encourage you to raise any concern with our Information Officer first, so that we may try to resolve it directly.

10. Amendments

10.1 We may amend this Policy from time to time to reflect changes in our practices or in applicable law. The updated version will be published on the Website with a revised "Effective Date" and "Version".

11. Governing Law and Dispute Resolution

11.1 This Policy is governed by the laws of the Republic of South Africa and must be read with POPIA and PAIA.

11.2 Complaints regarding the processing of personal information should be addressed to the Information Officer and may be referred to the Information Regulator. Any other dispute arising from this Policy is subject to the dispute resolution and jurisdiction provisions of our Terms and Conditions of Sale and Website Use.

12. Contact Details

This POPIA Data Subject Rights Policy should be read together with the Privacy Policy, the PAIA Manual, the Cookie Policy and the Electronic Communications and Consent Policy.