SA STUDENT MARKET PLACE: POPIA PRIVACY POLICY

1. Introduction

1.1. SA Student Marketplace respects your privacy and is committed to processing your Personal Information lawfully and in accordance with the Applicable Law .

1.2. This Privacy Policy explains how we collect, use, store, disclose and otherwise process your Personal Information when you access or use the SA Student Marketplace website, mobile applications and related services.

1.3. This Privacy Policy must be read together with our Terms and any other notices or policies made available on the Platform from time to time.

1.4. By accessing or using the Platform, you acknowledge that you have read this Privacy Policy.

2. Definitions and Interpretation

In this Privacy Policy, unless the context indicates otherwise:

2.1. Account: the account created by the User on the Platform.

2.2. Applicable Law: the laws of the Republic of South Africa applicable to the processing of Personal Information, including the Protection of Personal Information Act No. 4 of 2013.

2.3. Information Officer: the person described in clause 1 6.1 of this Privacy Policy.

2.4. Information Regulator: the information regulator as defined in Section 39 of POPIA.

2.5. Listing: any advertisement, offer, request or post placed by the User on the Platform.

2.6. Personal Information: personal information as defined in Section 1 of POPIA.

2.7. Platform: the SA Student Marketplace website, mobile applications, software and related services and features made available by us from time to time.

2.8. POPIA: the Protection of Personal Information Act No. 4 of 2013.

2.9. this Privacy Policy: this POPIA Privacy Policy, as amended from time to time.

2.10. Terms: our Terms and Conditions , together with any policies incorporated by reference, as amended from time to time.

2.11. User: any person who accesses or uses the Platform , also referred to as "you".

2.12. We, us or our: Tengora (Pty) Ltd, a private company duly incorporated and registered in accordance with the company laws of the Republic of South Africa, with registration number 2026/291523/07 , being the owner and operator of the Platform and the responsible party for the purposes of POPIA.

2.13. In this Privacy Policy:

• 2.13.1. words importing the singular include the plural and vice versa;
• 2.13.2. references to any gender include the others;
• 2.13.3. references to a person include natural and juristic persons;
• 2.13.4. headings are for convenience only and do not affect interpretation; and
• 2.13.5. the words "including" and "include" mean "including without limitation".

3. Personal Information We Collect

3.1. We may collect and process Personal Information including:

• 3.1.1. account and registration information;
• 3.1.2. profile information;
• 3.1.3. listing, transaction and communication -related information;
• 3.1.4. technical, device and usage information;
• 3.1.5. location -related information that you choose to provide; and
• 3.1.6. any other information you voluntarily provide or that is reasonably necessary for the operation, security and improvement of the Platform.

3.2. We may collect Personal Information directly from you, automatically through your use of the Platform, and from lawful third -party sources where necessary.

4. How we use Personal Information

4.1. We may use Personal Information for purposes including :

• 4.1.1. creating and administering Accounts;
• 4.1.2. operating, maintaining and improving the Platform;
• 4.1.3. enabling Listings, communications and platform functionality;
• 4.1.4. monitoring compliance and enforcing our Terms;
• 4.1.5. preventing, detecting and investigating fraud, abuse and security incidents;
• 4.1.6. responding to queries, complaints and disputes;
• 4.1.7. communicating with you regarding the Platform, including service notices and updates; and
• 4.1.8. complying with legal and regulatory obligations.

5. Grounds for Processing

5.1. We process Personal Information only where permitted by Applicable Law.

5.2. Depending on the circumstances, processing may be necessary:

• 5.2.1. to conclude or perform a contract with you;
• 5.2.2. to comply with a legal obligation ;
• 5.2.3. for a legitimate interest; or
• 5.2.4. on the basis of your consent.

5.3. Where processing is based on consent, you may withdraw that consent at any time, but such withdrawal will not affect prior lawful processing.

6. Disclosure of Personal Information

6.1. We may disclose Personal Information:

• 6.1.1. to other Users, where necessary for the operation of the Platform;
• 6.1.2. to service providers, operators, contractors and professional advisers who assist us to operate the Platform;
• 6.1.3. where required or permitted by law or lawful process;
• 6.1.4. where reasonably necessary to protect rights, safety, property or the integrity of the Platform;
• 6.1.5. in connection with a merger, acquisition, restructuring or disposal of assets; or
• 6.1.6. where you otherwise consent.

6.2. We do not sell your Personal Information to third parties for their own direct marketing purposes.

7. Cross -Border Transfers

7.1. Personal Information may be stored or processed outside South Africa.

7.2. Where Personal Information is transferred outside South Africa, we will do so only in accordance with Applicable Law.

8. Security

8.1. We take reasonable technical and organisational measures to protect the integrity and confidentiality of Personal Information in our possession or under our control.

8.2. No method of transmission, storage or processing is completely secure, and we cannot guarantee absolute security.

8.3. You must keep your Account credentials secure and notify us promptly if you suspect unauthorised access or misuse.

9. Retention

9.1. We retain Personal Information for as long as reasonably necessary for the purposes for which it was collected or processed, including operational, evidential, fraud -prevention, legal and regulatory purposes.

9.2. We may retain certain information after an Account is closed where retention is required or permitted by law or reasonably necessary to protect legitimate interests.

9.3. When Personal Information is no longer required, we will delete, destroy, de -identify or anonymise it where reasonably practicable and lawful.

10. Your Rights

10.1. Subject to Applicable Law, you may have the right:

• 10.1.1. to request access to Personal Information held about you;
• 10.1.2. to request correction or deletion of Personal Information;
• 10.1.3. to object to certain processing;
• 10.1.4. to withdraw consent where processing is based on consent; and
• 10.1.5. to lodge a complaint with the Information Regulator.

10.2. We may require proof of identity before acting on any request.

11. Direct Marketing

11.1. We may send you service -related communications necessary for the operation of the Platform.

11.2. We will send direct marketing communications only where permitted by Applicable Law.

11.3. You may opt out of direct marketing at any time.

12. Cookies and Similar Technologies

12.1. The Platform may use cookies, local storage and similar technologies for functionality, security, analytics and performance.

12.2. You may be able to control certain of these technologies through your browser, device or app settings, although doing so may affect functionality.

13. Children

13.1. The Platform is not intended for persons under 18 years of age.

13.2. If we become aware that Personal Information has been provided by or in relation to a child contrary to our platform rules or Applicable Law, we may take appropriate steps, including deleting the information or restricting the relevant Account.

14. Third-Party Services

14.1. The Platform may contain links to, or make use of, third -party websites, software, infrastructure or services.

14.2. We are not responsible for the privacy practices of third parties not under our control.

15. Changes to this Privacy Policy

15.1. We may amend this Privacy Policy from time to time.

15.2. Any amended version becomes effective when published on the Platform or otherwise brought to your attention.

16. Contact Details

16.1. Any questions, requests or complaints regarding this Privacy Policy or our processing of Personal Information may be sent to:

16.2. In the event that you have any queries or concerns that cannot be addressed by the Information Officer, you have the right to contact the Information Regulator. The Information Regulator's details are as follows: