Privacy Policy & PAIA Manual

1DEFINITIONS

In this document, unless the context indicates otherwise, the words and expressions set out below shall have the meanings assigned to them and cognate expressions shall have a corresponding meaning. Capitalised terms used but not defined in this document shall have the meanings given to them in the Terms. The defined terms are, namely:

1.1Applicable Laws means all applicable laws, regulations, statutes, codes, standards, directives and legally binding requirements applicable in the RSA, including POPIA, PAIA, the Consumer Protection Act No. 68 of 2008 (“CPA”), the Electronic Communications and Transactions Act No. 25 of 2002 (“ECTA”), the National Environmental Management: Biodiversity Act No. 10 of 2004 and the Threatened or Protected Species Regulations, the Meat Safety Act No. 40 of 2000, the Animal Identification Act No. 6 of 2002 and any regulations relating to livestock movement, animal health and agricultural trade, in each case as amended from time to time;

1.2App means any mobile application, progressive web application, mobile interface or app-based functionality made available by yalla for access to the Platform;

1.3Buyer means a Registered User who purchases or intends to purchase Goods or Services from a Seller through the Platform;

1.4Direct Marketing means to approach a person, either in person or by mail or electronic communication (including SMS, email, WhatsApp, push notification, automated calling machine and telephone call), for the direct or indirect purpose of promoting or offering to supply any goods or services to that person, or requesting a donation, as contemplated in POPIA;

1.5Escrow means the third-party escrow service provided by the Escrow Provider whereby the Purchase Price and Platform Fee paid by a Buyer are held on behalf of the parties to a Transaction until the Buyer accepts delivery, the funds are otherwise released in accordance with the Terms, or a dispute is resolved;

1.6Escrow Provider means TradeSafe, or such other third-party escrow service provider as yalla may designate from time to time, which holds and releases Buyer funds and performs identity and bank account verification of Registered Users;

1.7Farm Assurance means yalla’s buyer-protection product comprising Escrow protection, the Dispute Window and the dispute resolution process described in the Terms;

1.8Field Agent means an independent field agent who, at a Buyer’s election, inspects Goods at the Seller’s location before purchase and files a structured inspection report through the Platform;

1.9Goods means livestock, animals, agricultural goods, farm products, feed, fodder, equipment, machinery, implements and any other items listed for sale on the Platform by a Seller;

1.10Information Officer means the information officer of yalla contemplated in POPIA and PAIA, being the head of yalla as a private body or the person duly authorised by the head, and includes the Deputy Information Officer where the context requires;

1.11Information Regulator means the Information Regulator (South Africa) established in terms of section 39 of POPIA;

1.12Listing means a product, service or land listing created by a Seller or advertiser on the Platform, including all photographs, descriptions, pricing, declarations, documentation and other information provided in it;

1.13Manual means the PAIA manual of yalla contained in Section B of this document;

1.14Operator means a person or entity who Processes Personal Information on behalf of yalla in terms of a contract or mandate, without coming under the direct authority of yalla, as contemplated in POPIA;

1.15PAIA means the Promotion of Access to Information Act No. 2 of 2000 as amended from time to time;

1.16Personal Information shall have the meaning ascribed thereto in terms of section 1 of POPIA, namely: any information relating to an identifiable, living, natural person, and where it is applicable, an identifiable, existing juristic person, including, but not limited to – information relating to the race, gender, sex, pregnancy, marital status, national, ethnic or social origin, colour, sexual orientation, age, physical or mental health, wellbeing, disability, religion, conscience, belief, culture, language and birth of the person; information relating to the education or the medical, financial, criminal or employment history of the person; any identifying number, symbol, e-mail address, telephone number, location information, online identifier or other particular assignment to the person; the biometric information of the person; the personal opinions, views or preferences of the person; correspondence sent by the person that would reveal the contents of the original correspondence; the views or opinions of another individual regarding the person; and the name of the person if it appears with other personal information relating to the person or if the disclosure of the name itself would reveal information about the person;

1.17Platform means the Website, App, customer portal, listing forms, search tools, in-app messaging system, transaction tools, verification tools, Escrow integration, payment tools, dispute resolution tools, ratings system, support channels, communications and related technology made available by yalla;

1.18Platform Services means all services provided by yalla in connection with the Platform, including the marketplace, Listing review and publication, Buyer-Seller messaging, Escrow integration, transaction facilitation, identity verification (through the Escrow Provider), Farm Assurance, Ratings, dispute mediation, access to Field Agent inspections, boosted and promoted Listings, land listings, customer support, notifications and account servicing;

1.19Policy means the privacy policy of yalla contained in Section A of this document, which constitutes the “Privacy Policy” referred to in the Terms;

1.20POPIA means the Protection of Personal Information Act No. 4 of 2013, read with the Regulations Relating to the Protection of Personal Information published under it (as amended), and any codes of conduct, guidance notes and directives issued by the Information Regulator;

1.21Processing shall have the meaning ascribed thereto in terms of section 1 of POPIA, namely: any operation or activity or any set of operations, whether or not by automatic means, concerning Personal Information, including:

1.21.1the collection, receipt, recording, organisation, collation, storage, updating or modification, retrieval, alteration, consultation or use;

1.21.2dissemination by means of transmission, distribution or making available in any other form;

1.21.3merging, linking as well as restriction, degradation, erasure or destruction of information; and

“Process” shall have a similar meaning as the context requires.

1.22Rating means the feedback and rating provided by Buyers and Sellers about each other after each completed Transaction, which forms part of a User’s trading reputation on the Platform;

1.23Registered User means any individual or entity that has completed registration on the Platform, including, for a User who sells or is to be paid through the Platform, providing the identity and bank details required for payouts;

1.24RSA means the Republic of South Africa;

1.25Seller means a Registered User who lists Goods or Services for sale on the Platform;

1.26Services means any agricultural services listed for sale on the Platform by a Seller, as distinct from the Platform Services provided by yalla;

1.27Special Personal Information means Personal Information concerning the religious or philosophical beliefs, race or ethnic origin, trade union membership, political persuasion, health or sex life or biometric information of a data subject, or the criminal behaviour of a data subject, as contemplated in section 26 of POPIA;

1.28Terms means, collectively, yalla’s Terms and Conditions of Use of the Platform and yalla’s Terms of Engagement and Use (comprising the Seller Terms, Buyer Terms and General Platform Terms), each as published on the Platform and amended from time to time;

1.29Transaction means each individual sale and purchase of Goods or Services concluded between a Buyer and a Seller through the Platform, commencing when the Buyer completes checkout and pays the Purchase Price and Platform Fee into Escrow and ending when those funds are released;

1.30User means any person who accesses or uses the Platform, including Buyers, Sellers, browsers, Registered Users, Field Agents, advertisers and service providers, and “Users” shall have a corresponding meaning;

1.31Website means the yalla website at https://yallasa.co.za/ and any related website, landing page, web application, customer portal or online interface used for the Platform Services; and

1.32yalla means yalla Proprietary Limited (registration number: 2026/097649/07), the operator of the Platform and the responsible party in respect of the Processing described in this Policy, and includes its successors in title.

SECTION A – PRIVACY POLICY

2INTRODUCTION AND SCOPE

2.1yalla operates a mobile-first agricultural marketplace through which South African farmers, smallholders, livestock enthusiasts, agricultural suppliers and service providers may list and buy livestock, agricultural goods, farm products, equipment, feed, fodder and Services. Buyers and Sellers contract directly with each other, and every Transaction is settled through Escrow held by the Escrow Provider. yalla is not a party to any Transaction and never receives, holds, routes or refunds a Buyer’s money.

2.2This Policy explains how yalla, as the responsible party, collects, uses, stores, shares, retains, safeguards and otherwise Processes Personal Information in connection with the Website, App, Platform and Platform Services, and sets out the information that yalla is required to give data subjects in terms of section 18 of POPIA.

2.3This Policy must be read together with the Terms and any specific consent, declaration or notice presented to a User during registration, Listing creation or checkout. If there is a conflict between this Policy and the Terms in relation to the Processing of Personal Information, this Policy shall prevail.

2.4This Policy applies to the Personal Information of all Users and of any other person whose Personal Information is Processed through the Platform, including persons identified in Listings, documentation, messages or dispute evidence. As POPIA also protects identifiable, existing juristic persons, this Policy applies to farming companies, trusts, co-operatives, agricultural suppliers and other entities that register as Users.

2.5The Escrow Provider performs identity verification, bank account verification, payment collection, Escrow and settlement functions and Processes the Personal Information required for those functions as an independent responsible party under its own terms and privacy notice. Payment card credentials are tokenised by the Escrow Provider and are never received or held by yalla.

3PERSONAL INFORMATION COLLECTED

3.1yalla may collect and Process the following categories of Personal Information, depending on the User’s role on the Platform (as a browser, Buyer, Seller, Field Agent or advertiser) and the stage of the User’s interaction with the Platform:

3.1.1identity information - full names, South African identity number or passport number, date of birth and, in the case of a juristic person, its registered name, registration number, VAT number and the identity and contact details of its authorised representative;

3.1.2contact information - South African mobile telephone number, email address, WhatsApp number, preferred language and communication preferences;

3.1.3address and location information - residential, business or farm address, delivery or collection address, the province and district in which Goods are located (as displayed in a Listing to district level) and, only where the User has enabled it on the User’s device, precise device location;

3.1.4bank account and payment information - bank name, account holder name, account number and branch code provided when setting up payouts, for verification and settlement through the Escrow Provider, the payment method selected at checkout and payment status information (yalla does not receive or hold payment card details, which are tokenised by the Escrow Provider);

3.1.5verification information - the outcome and status of identity and bank account verification performed by the Escrow Provider when payout details are provided, and records of failed or incomplete verification;

3.1.6Listing information - photographs, descriptions, species, breed, age, weight, count, condition notes, asking price, location, health and disease declarations, the Seller’s warranty of lawful ownership or authority to sell, and any removal certificates, movement permits, brand mark details, health certificates or other documentation uploaded to the Platform, which may contain Personal Information of the Seller or of third parties;

3.1.7Transaction information - enquiries, offers, the agreed Purchase Price, the Platform Fee, checkout records, Escrow status, the Escrow Provider’s confirmation that funds are secured, transport and delivery records, Delivery Confirmation (including deemed confirmation), Dispute Window records, release instructions, refunds and Transaction history;

3.1.8communications information - in-app messages between Buyers and Sellers, messages and support requests sent to yalla, complaints, and records of push notifications, SMS, email and WhatsApp communications sent through or in connection with the Platform;

3.1.9device, usage and technical information - IP address, device identifiers, device model, operating system, App version, browser type, connectivity information, crash and diagnostic logs, session records, search and browsing activity on the Platform, offline drafts and queued uploads, cookies or similar technologies, timestamps, audit trails and security events;

3.1.10dispute information - dispute notices and defect notices, descriptions of alleged discrepancies, delivery photographs, transport documentation, veterinary reports, Field Agent inspection reports, communications relating to the dispute and the outcome of yalla’s mediation;

3.1.11acceptance and consent records - records of the User’s acceptance of the Seller Terms, Buyer Terms and General Platform Terms, consents given or withdrawn under this Policy, user identifiers, IP address information, device information and timestamps evidencing such acceptance or consent;

3.1.12Ratings and reputation information - Ratings given and received after completed Transactions and the resulting trading reputation displayed on the Platform;

3.1.13Field Agent information - in respect of Field Agents, identity and contact details, stated stock knowledge and experience, references, published credentials, professional indemnity details, inspection reports, photographs taken during inspections and fee settlement records;

3.1.14promotions, subscriptions and advertising information - records of boosted or promoted Listings, promoted service adverts, land listing agency subscriptions and private land listing promotions, together with invoicing and payment records for those products;

3.1.15trust and safety information - fraud-monitoring outputs (including pattern detection on new accounts, unusual pricing and repeated dispute behaviour), reports made by other Users, records of prohibited and controlled species screening, suspensions, terminations and Events of Default; and

3.1.16marketing information - Direct Marketing consents, opt-outs and objections, and promotional communication preferences.

3.2yalla shall only collect and Process Personal Information that is adequate, relevant and not excessive given the purpose for which it is Processed, as required by section 10 of POPIA. Where documentation is uploaded to the Platform, yalla does not verify, endorse or confirm it.

3.3yalla will indicate on the Platform which Personal Information is mandatory and which is optional. Registration information, identity details and bank account details are mandatory because the Escrow system requires identified parties on both sides of a Transaction. If a User does not provide mandatory Personal Information, yalla will not be able to register the User, permit the User to list or transact, or provide the relevant Platform Services.

3.4yalla collects Personal Information directly from the User wherever possible. yalla may also collect Personal Information from other sources where permitted by section 12 of POPIA, including from the Escrow Provider (verification outcomes, payment status and settlement confirmations), from other Users (for example, messages, Ratings, reports and dispute evidence), from Field Agents (inspection reports), from public records and from law enforcement or regulatory authorities.

3.5Where a User provides Personal Information about another person (for example, the owner who authorised a sale, a transporter, a farm employee or a person appearing in a photograph or document), the User warrants that the User is lawfully entitled to do so and has informed that person of the Processing described in this Policy.

4PURPOSES AND LEGAL BASIS OF PROCESSING

4.1yalla Processes Personal Information only where a lawful justification exists under section 11 of POPIA, namely where: (a) the data subject consents; (b) Processing is necessary to conclude or perform a contract to which the data subject is party, including the Terms and the checkout and Escrow arrangements for a Transaction; (c) Processing complies with an obligation imposed on yalla by law; (d) Processing protects a legitimate interest of the data subject or (e) Processing is necessary for pursuing the legitimate interests of yalla or of a third party to whom the information is supplied, such as preventing fraud and stock theft, enforcing the Terms and maintaining the integrity of the marketplace.

4.2yalla may Process Personal Information for the following purposes:

4.2.1registering Users, administering accounts and enforcing the eligibility requirements in the Terms, including that Users are at least 18 (eighteen) years of age and resident or conducting business in the RSA;

4.2.2passing the identity details of Sellers, and of other Registered Users who are to be paid, to the Escrow Provider, which may verify them, before a Seller’s Listings are shown to Buyers or a payout is made, which is counterparty verification and not verification of any Goods or Services;

4.2.3verifying bank account details through the Escrow Provider so that the Seller’s share of the Purchase Price can be paid to the correct account on release, and using those details only for payment settlement;

4.2.4reviewing Listings before publication against yalla’s listing standards (completeness, image quality and prohibited and controlled species screening), and publishing Listings with the Seller’s profile, district-level location and Ratings, which review is a publishing standard and not an inspection or verification of ownership, accuracy, quality or documentation;

4.2.5enabling in-app messaging between Buyers and Sellers, withholding contact details until a Transaction is agreed and funds are secured in Escrow, and reviewing messages where reasonably necessary to detect off-Platform circumvention, fraud and other prohibited conduct;

4.2.6facilitating checkout, calculating the Platform Fee, instructing the Escrow Provider to hold, release or refund funds and administering Farm Assurance;

4.2.7recording transport and delivery documentation, Delivery Confirmation by the Seller, the Buyer’s acceptance of delivery (or release by the Escrow Provider where the Buyer neither accepts delivery nor reports a problem), the Dispute Window and the release of funds;

4.2.8recording Users’ acceptance of the Seller Terms, Buyer Terms and General Platform Terms, and any consents and declarations given on the Platform, with audit records of electronic acceptance;

4.2.9receiving, investigating and mediating disputes, considering the Listing, communications, delivery records, veterinary or Field Agent reports and other evidence, determining the allocation of escrowed funds, inviting and publishing Ratings, and arranging optional Field Agent inspections at a Buyer’s request;

4.2.10sending Transaction-related communications, delivery confirmations, payment notifications, dispute notifications, security alerts, support communications and service announcements by push notification, SMS, email or WhatsApp;

4.2.11administering customer support, complaints, CPA refund, return and cooling-off requests, requests by data subjects under POPIA and requests for access to records under PAIA;

4.2.12complying with Applicable Laws, including POPIA, PAIA, the CPA, ECTA, animal identification, livestock movement and protected species legislation, tax and company laws, court orders and lawful requests of regulatory and law enforcement authorities;

4.2.13detecting, preventing, investigating and responding to fraud, stock theft, impersonation, misuse of another person’s identity or bank details, prohibited or protected species listings, Rating manipulation, off-Platform transactions, false dispute claims, unauthorised access, cyber incidents and other Events of Default, including through pattern detection on new accounts, unusual pricing and repeated dispute behaviour;

4.2.14maintaining, securing, testing and improving the Platform (including offline and low-connectivity functionality), administering boosted and promoted Listings, promoted service adverts, and compiling aggregated or de-identified statistics on usage, categories, pricing trends and Listing performance, provided that yalla will only use such insights for any external commercial purpose once de-identified so that no User can be identified; and

4.2.15sending Direct Marketing about yalla’s own products and services, and about sponsors or partners only with the User’s specific consent, in accordance with section 69 of POPIA and subject to the User’s right to opt out at any time free of charge.

5SPECIAL PERSONAL INFORMATION AND CHILDREN

5.1yalla does not use biometric or facial recognition technology and does not intentionally collect Special Personal Information. Users should not include Special Personal Information about any person in Listings, messages, Ratings or uploaded documents unless necessary for a Transaction or dispute. yalla may Process information about the alleged criminal behaviour of a User (such as suspected fraud or stock theft) only as permitted by sections 27 and 33 of POPIA, including to establish, exercise or defend a right in law or to report conduct to the relevant authorities as contemplated in the Terms.

5.2The Platform is intended only for persons who are at least 18 (eighteen) years of age. yalla does not knowingly Process the Personal Information of children, except where it incidentally appears in content uploaded by a User and the Processing complies with sections 34 and 35 of POPIA, and will delete or de-identify such information as soon as reasonably practicable once it becomes aware that it lacks authorisation.

6DISCLOSURE AND SHARING OF PERSONAL INFORMATION

6.1yalla does not sell Personal Information. yalla may share Personal Information only where necessary, lawful and proportionate for the purposes in this Policy. Recipients may include:

6.1.1the Escrow Provider (currently TradeSafe), its banking partner and insurers, for identity and bank verification, Escrow, settlement of the Seller’s share and yalla’s commission, refunds and related compliance;

6.1.2payment service providers supported by the Escrow Provider (such as EFT, instant EFT, card and QR payment providers), and yalla’s own merchant facility provider for boosted Listings, Services listing subscriptions and land listing subscriptions;

6.1.3other Users, to the extent necessary for the Platform to function, including the display of a Seller’s Listings, profile, district-level location and Ratings to Buyers, and the exchange of counterparties’ contact and delivery details only once a Transaction is agreed and funds are secured in Escrow;

6.1.4Field Agents selected by a Buyer, to the extent necessary to conduct an inspection, and transporters where yalla arranges transport at a User’s request;

6.1.5Operators providing technology and support services to yalla, including its platform developer, cloud hosting, data storage, SMS, email, WhatsApp, push notification, analytics, fraud-monitoring, customer support and archiving providers;

6.1.6attorneys, courts, arbitrators and consumer protection bodies, where necessary to resolve a dispute or enforce the Terms;

6.1.7professional advisers, auditors, insurers, investors, funders and any prospective purchaser, successor or assignee of yalla’s business, subject to confidentiality obligations and Applicable Laws;

6.1.8regulatory and law enforcement authorities, including the Information Regulator, the National Consumer Commission, the South African Police Service (including its stock theft units), animal health and agricultural authorities and the South African Revenue Service, where required or permitted by law; and

6.1.9sponsors and partners (such as agricultural input companies, banks and insurers) or any other third party, only where the User has given specific, voluntary and informed consent, or where disclosure is necessary to perform a Transaction, comply with law or protect rights.

7CROSS-BORDER TRANSFERS

yalla and its Operators may store or Process Personal Information outside the RSA, for example where cloud hosting, email, WhatsApp, push notification or analytics providers operate servers abroad. yalla will only transfer Personal Information to a third party in a foreign country where permitted by section 72 of POPIA, including where: (a) the recipient is subject to a law, binding corporate rules or a binding agreement providing an adequate level of protection substantially similar to POPIA, including for onward transfers; (b) the data subject consents; (c) the transfer is necessary to perform a contract with the data subject or (d) the transfer benefits the data subject and consent cannot reasonably be obtained.

8DIRECT MARKETING AND SERVICE COMMUNICATIONS

8.1Service communications are communications necessary to operate a User’s account and the Platform, including those relating to registration, verification, Listings, offers, Escrow, Delivery Confirmation, the Dispute Window, disputes, refunds, Ratings, security alerts, support requests and changes to the Terms or this Policy. They are not Direct Marketing and may be sent by push notification, SMS, email, WhatsApp or in-app message while the User’s account is active.

8.2yalla will only send Direct Marketing by electronic communication (including SMS, email, WhatsApp, push notification and telephone calls) where the User has consented or, for an existing customer whose details were obtained in the context of a Transaction or Platform Services, where the marketing relates to yalla’s own similar products or services and the User was given, and is given with every message, a free opportunity to object. Users may opt out at any time, free of charge, through the opt-out method in each message, the App settings or by contacting yalla.

8.3Every Direct Marketing message will identify yalla and include contact details for opt-out requests. yalla will maintain records of consents, opt-outs and objections and will not share a User’s Personal Information with sponsors or partners for their own marketing without the User’s specific consent.

9OPERATORS AND OTHER DISCLOSURES

9.1yalla does not currently have subsidiaries or affiliates. Personal Information disclosed to Operators is disclosed only for the purpose of providing the Platform Services.

9.2yalla will only appoint Operators under a written contract requiring them to Process Personal Information only with yalla’s authorisation, to treat it as confidential, to maintain the security measures required by section 19 of POPIA and to notify yalla immediately of any security compromise, as required by sections 20 and 21 of POPIA.

9.3yalla may obtain Personal Information about a User from the Escrow Provider, other Users, Field Agents, public records and authorities, as described in clause 2 (Introduction and Scope), for the purposes set out in this Policy.

9.4Where a User obtains another User’s Personal Information through the Platform, the User may use it only for the relevant Transaction and must comply with POPIA, as required by the Terms.

10SECURITY SAFEGUARDS AND INCIDENT NOTIFICATION

10.1yalla will implement appropriate, reasonable technical and organisational measures to prevent loss of, damage to, unauthorised destruction of, unlawful access to or unlawful Processing of Personal Information.

10.2These measures may include role-based access controls, multi-factor authentication for administrative access, encryption in transit and, where appropriate, at rest, tokenisation of payment credentials by the Escrow Provider (so that yalla never holds them), secure handling of offline drafts and queued uploads on Users’ devices, logging and monitoring, backups, Operator due diligence, training, incident response procedures, vulnerability management and regular review of safeguards.

10.3yalla will take reasonable measures to identify reasonably foreseeable internal and external risks to Personal Information, establish and maintain appropriate safeguards, regularly verify that safeguards are effectively implemented and update safeguards in response to new risks or deficiencies.

10.4Where there are reasonable grounds to believe that Personal Information has been accessed or acquired by an unauthorised person, yalla will notify the Information Regulator (using the prescribed form through the Information Regulator’s online portal) and affected data subjects in writing (by email, SMS, in-app notification or publication on the Platform) as soon as reasonably possible, with enough information for them to take protective measures, unless a public body responsible for the prevention, detection or investigation of offences or the Information Regulator determines that notification will impede a criminal investigation. Users must notify yalla immediately of any unauthorised access to their account, as required by the Terms.

11RETENTION AND DESTRUCTION

yalla will retain Personal Information only for as long as necessary to achieve the purpose for which it was collected, unless a longer period is required or authorised by law, reasonably required for yalla’s lawful functions, required by the Terms or consented to, as contemplated in section 14 of POPIA. Indicatively: (a) account, identity and verification records for the life of the account and 5 (five) years after closure; (b) Transaction, Escrow instruction and Platform Fee records for 5 (five) years, or 7 (seven) years where required for accounting records; (c) in-app messages, dispute records and Field Agent reports for 3 (three) years after the Transaction or dispute is concluded; (d) unsold Listings and failed registrations for 12 (twelve) months; (e) Ratings while the account is active, after which they are de-identified; and (f) technical logs for 12 (twelve) months. Information may be kept longer for legal claims, ongoing disputes, investigations or Events of Default. When no longer required, yalla will destroy, delete or de-identify Personal Information in a manner that prevents its reconstruction in an intelligible form.

12DATA SUBJECT RIGHTS

12.1A data subject (including a Buyer, Seller, Field Agent or browser) has the right, subject to POPIA, PAIA and other Applicable Laws, to:

12.1.1ask, free of charge, whether yalla holds Personal Information about the data subject;

12.1.2request access to Personal Information held by yalla, including the identity of third parties who have had access to it, in accordance with PAIA and the Manual;

12.1.3request correction or deletion of Personal Information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or obtained unlawfully, noting that published Ratings may be removed only where they breach the Terms or POPIA;

12.1.4object to the Processing of Personal Information where permitted by POPIA;

12.1.5withdraw consent where Processing is based on consent, without affecting lawful Processing carried out before withdrawal;

12.1.6provide consent for direct marketing and opt out of direct marketing;

12.1.7not be subject to a decision based solely on automated Processing that substantially affects the data subject, except as permitted by section 71 of POPIA (fraud-monitoring alerts are reviewed by a person before an account is suspended, and the release of funds by the Escrow Provider where a Buyer neither accepts delivery nor reports a problem is a contractual mechanism under the Terms);

12.1.8lodge a complaint with yalla; and

12.1.9lodge a complaint with the Information Regulator (enquiries@inforegulator.org.za; complaints.IR@inforegulator.org.za) or institute civil proceedings under section 99 of POPIA.

12.2Requests must be directed to the Information Officer using the details in clause 25 (Details of Information Officer, Deputy Information Officer and Head Office), or through the support function in the App. Objections may be submitted on Form 1 and correction or deletion requests on Form 2 prescribed by the Regulations Relating to the Protection of Personal Information (as amended), free of charge. yalla may require proof of identity before acting on a request and will respond within a reasonable time and any period prescribed by law. Closing an account does not end Processing needed for a Transaction in progress, an ongoing dispute or Farm Assurance rights that survive termination under the Terms.

13INFORMATION OFFICER

13.1yalla’s information officer is Stephani Scheepers (“Information Officer”).

13.2yalla’s deputy information officer is Ryan Scheepers (“Deputy Information Officer”).

13.3The Information Officer and Deputy Information Officer are responsible for encouraging and ensuring yalla’s compliance with POPIA and PAIA, dealing with requests from data subjects and working with the Information Regulator, and will be registered with the Information Regulator before taking up their duties.

13.4The details of the Information Officer and Deputy Information Officer are set out below at clause 25 (Details of Information Officer, Deputy Information Officer and Head Office) of this document.

14INTERNAL PROCEDURES

yalla has implemented, or will implement before the Platform goes live, the following internal measures to protect Personal Information:

14.1the appointment and registration of the Information Officer and Deputy Information Officer;

14.2training its founders, staff and contractors (including those involved in Listing review and dispute mediation) on POPIA and this Policy;

14.3adopting a compliance framework, completing a personal information impact assessment and making internal privacy procedures binding on its staff and contractors, as required by regulation 4 of the Regulations Relating to the Protection of Personal Information; and

14.4concluding written Operator agreements, conducting regular backups and reviewing this Policy and its safeguards at least annually.

SECTION B – PAIA MANUAL

15BACKGROUND AND PURPOSE OF THIS MANUAL

15.1This Manual is prepared in terms of section 51 of PAIA for yalla as a private body. It explains the categories of records held by yalla and the procedure for requesting access to records.

15.2PAIA gives effect to the constitutional right of access to information held by another person where that information is required for the exercise or protection of rights.

15.3This Manual must be made available on the yalla Website and at yalla’s principal place of business for public inspection during normal business hours, to any person upon request and upon payment of the prescribed fee where applicable, and to the Information Regulator upon request.

16RIGHT TO ACCESS RECORDS OF PRIVATE BODY

In terms of PAIA, a person requesting records of a private body must be granted such access if:

16.1the record is required for the exercise or protection of any rights;

16.2the requesting person complies with the procedural requirements of PAIA; and

16.3access is not refused in terms of a ground for refusal contained in PAIA.

17RECORDS HELD IN TERMS OF LEGISLATION

yalla is required to hold records in terms of legislation including, without limitation:

17.1Basic Conditions of Employment Act No. 75 of 1997;

17.2Companies Act No. 71 of 2008;

17.3Compensation for Occupational Injuries and Diseases Act No. 130 of 1993;

17.4Consumer Protection Act No. 68 of 2008;

17.5Debt Collectors Act No. 114 of 1998;

17.6Electronic Communications and Transactions Act No. 25 of 2002;

17.7Employment Equity Act No. 55 of 1998;

17.8Financial Intelligence Centre Act No. 38 of 2001;

17.9Income Tax Act No. 58 of 1962;

17.10Labour Relations Act No. 66 of 1995;

17.11National Credit Act No. 34 of 2005;

17.12Promotion of Access to Information Act No. 2 of 2000;

17.13Protection of Personal Information Act No. 4 of 2013;

17.14Skills Development Act No. 97 of 1998;

17.15Skills Development Levies Act No. 9 of 1999;

17.16Unemployment Insurance Act No. 63 of 2001;

17.17Unemployment Insurance Contributions Act No. 4 of 2002;

17.18Value Added Tax Act No. 89 of 1991; and

17.19any other legislation, directive, code, rule or regulatory requirement applicable to yalla, credit providers, digital platforms, payments, data protection, employment, tax, consumer protection or financial crime compliance.

18SUBJECTS AND CATEGORIES OF RECORDS HELD BY YALLA

18.1The inclusion of a subject or category of records in this clause 18 does not mean that records falling within it will be made available to a requester. Access remains subject to the procedure set out in this Manual and the grounds of refusal in PAIA.

18.2yalla holds the following subjects and categories of records, including records relating to Buyers, Sellers, Field Agents, advertisers, browsers and other Users –

18.2.1Company Records:

18.2.1.1registration certificate;

18.2.1.2memorandum of incorporation;

18.2.1.3securities register and shareholder and director records;

18.2.1.4policies and procedures, including the Privacy Policy, this Manual, yalla’s POPIA compliance framework, personal information impact assessments, listing standards and the published dispute policy;

18.2.1.5directors’ minute book; and

18.2.1.6shareholders’ minute book,

18.2.2Financial Records:

18.2.2.1annual financial statements;

18.2.2.2accounting records;

18.2.2.3asset register;

18.2.2.4yalla’s own bank account and merchant facility records (yalla does not hold Buyer funds, which are held in Escrow by the Escrow Provider);

18.2.2.5audit records;

18.2.2.6records of Platform Fee commission settled to yalla by the Escrow Provider and of income from boosted Listings, promoted service adverts, land listing subscriptions and Field Agent inspection margins; and

18.2.2.7income and expense vouchers,

18.2.3Commercial and Trading Records:

18.2.3.1trade mark and intellectual property records, including in respect of the yalla name, logo, App and Platform;

18.2.3.2licences;

18.2.3.3permits;

18.2.3.4insurance records;

18.2.3.5policies; and

18.2.3.6agreements, including with the Escrow Provider, yalla’s platform developer, Operators, Field Agents, advertisers, land listing agencies and any sponsors or partners,

18.2.4Marketplace and Transaction Records:

18.2.4.1Listings and Listing review records, including completeness, image quality and prohibited and controlled species screening outcomes;

18.2.4.2documentation uploaded by Sellers, such as removal certificates, movement permits, brand mark details and health or disease declarations, which yalla does not verify, endorse or confirm;

18.2.4.3enquiry, offer, agreed Purchase Price, Platform Fee and checkout records;

18.2.4.4Escrow instructions issued by yalla and confirmations received from the Escrow Provider that funds are secured, released or refunded;

18.2.4.5transport and delivery records, Delivery Confirmation and deemed delivery confirmation records, and Dispute Window records;

18.2.4.6Farm Assurance, dispute, Defect Notice, evidence and mediation records, including yalla’s determinations on the allocation of escrowed funds;

18.2.4.7Field Agent inspection requests, bookings and inspection reports;

18.2.4.8Ratings given and received after completed Transactions;

18.2.4.9boosted and promoted Listing, promoted service advert and land listing subscription records; and

18.2.4.10complaints, refund, statutory return and cooling-off requests under the CPA, and correspondence with consumer protection bodies,

18.2.5Registered User and Other User Records:

18.2.5.1registration records and records of acceptance of the Terms, including the Seller Terms, Buyer Terms and General Platform Terms;

18.2.5.2identity, contact and address records of Buyers and Sellers, including the registration details and authorised representatives of juristic persons;

18.2.5.3Field Agent identity, credential, reference and indemnity records;

18.2.5.4bank account details and identity and bank verification outcomes received from the Escrow Provider (the underlying verification data and payment credentials are held by the Escrow Provider and not by yalla);

18.2.5.5limited records of browsers and other Users who have not registered, being device, usage and technical records and any enquiries or support requests they submit;

18.2.5.6in-app messages between Buyers and Sellers;

18.2.5.7consent, Direct Marketing opt-out and objection records;

18.2.5.8records of push notification, SMS, email and WhatsApp communications sent in connection with the Platform;

18.2.5.9customer support and account servicing records; and

18.2.5.10trust and safety records, including fraud-monitoring outputs, User reports, suspensions, terminations, Events of Default and account closure records,

18.2.6Platform, technology and security Records:

18.2.6.1Website, App and Platform logs;

18.2.6.2device, location, session, offline draft and queued upload records;

18.2.6.3cybersecurity records;

18.2.6.4access-control records;

18.2.6.5incident records;

18.2.6.6backup and disaster recovery records; and

18.2.6.7software specifications, source code, development and acceptance records relating to the Platform, and cloud, Operator and infrastructure records,

18.2.7Taxation Records:

18.2.7.1pay-as-you-earn records;

18.2.7.2documents issued to employees for income tax purposes;

18.2.7.3records of payments made to the South African Revenue Service on behalf of employees;

18.2.7.4annual tax return records;

18.2.7.5value-added-tax records, including in respect of the Platform Fee and yalla’s own supplies;

18.2.7.6skills development levies records; and

18.2.7.7unemployment insurance fund records,

18.2.8Personnel and Contractor Records:

18.2.8.1curriculum vitae;

18.2.8.2disciplinary records;

18.2.8.3employment contracts;

18.2.8.4leave records;

18.2.8.5remuneration records and policies;

18.2.8.6training manuals;

18.2.8.7training records;

18.2.8.8compensation for occupational injuries and diseases records;

18.2.8.9medical aid records; and

18.2.8.10pension fund records, in each case where applicable,

18.2.9Legal, Regulatory and Enforcement Records:

18.2.9.1reports made to the South African Police Service, animal health and agricultural authorities and other authorities where required by law;

18.2.9.2correspondence with the Information Regulator, security compromise notifications and registers of POPIA and PAIA requests;

18.2.9.3attorney and legal adviser records;

18.2.9.4records of amounts owing to yalla, including unpaid promotion, advertising and subscription fees;

18.2.9.5court, arbitration and consumer protection body records; and

18.2.9.6legal opinions and privileged records.

18.3The Terms, the Privacy Policy, this Manual, the listing standards, the Platform Fee structure and the published dispute policy are published on the Platform and are automatically available without a request in terms of PAIA.

18.4Records of the Escrow Account, payment card credentials and the underlying identity and bank verification data are held by the Escrow Provider and not by yalla. Requests for access to those records must be directed to the Escrow Provider in accordance with its own PAIA manual.

19REQUEST FOR RECORDS

19.1All requests for records in terms of this Manual must comply with the requirements as set out in PAIA and the PAIA Regulations. The request for records must be in the form prescribed by the PAIA Regulations.

19.2A requester must identify the right that he, she or it is seeking to exercise or protect and provide an explanation of why the requested record is required for the exercise or protection of that right.

19.3A request for records in terms of PAIA must be made formally by way of e-mail or by hand and in the prescribed format.

19.4Requests for records must be directed to the Information Officer who shall consider the request and provide a decision within 30 (thirty) days of having received the request or having received the prescribed particulars in terms of section 53(2) of PAIA.

19.5A request for information may be refused by yalla if it does not comply with PAIA or if yalla believes that there is a valid ground for objection in terms of PAIA.

19.6The person requesting the information must provide yalla with sufficient information for the Information Officer to identify the record and the person requesting the record.

19.7The person requesting information must indicate the type of access required and his/her/its contact details including e-mail address, and postal address.

19.8Should the requesting person prefer a certain means of communication, such means of communication must be included in the request for information.

19.9Should a request for records be made on behalf of a third party, authority to do so must be provided to the Information Officer.

20GRANTING OF REQUEST FOR INFORMATION

20.1Should a request be granted, yalla shall provide the requesting person with the following information:

20.1.1the access fee payable by the requesting person;

20.1.2the type of access which will be granted; and

20.1.3notice that the requesting person may approach a competent court to dispute the access fee or the type of access to be granted.

20.2Once a request has been granted, the records shall be made available to the requesting person once the relevant fee has been paid.

21DENIAL OF REQUEST FOR INFORMATION

21.1A request for access to information may be refused in the following circumstances:

21.1.1protecting Personal Information that yalla holds regarding a third party from unreasonable disclosure;

21.1.2protecting commercial information that yalla holds regarding a third party and may harm the commercial or financial interests of such third party;

21.1.3if the disclosure would result in a breach of a duty of confidence owed to a third party;

21.1.4if the disclosure would result in a breach of legislative duties and obligations imposed on yalla;

21.1.5if the disclosure would jeopardise the safety or life of a natural person;

21.1.6if disclosure would prejudice or impair the security of property or means of transport of a person;

21.1.7if disclosure would prejudice or impair the protection of a person who is subject to a witness protection scheme;

21.1.8if disclosure would prejudice or impair the protection of the safety of the public;

21.1.9the record is privileged from production in legal proceedings unless privilege in relation to such record has been waived;

21.1.10if the record is a computer programme;

21.1.11disclosure of the record will put yalla at a disadvantage in contractual or other negotiations or prejudice yalla in commercial competition;

21.1.12disclosure of the record would harm the commercial or financial interests of yalla; and

21.1.13records containing information about research being carried out or about to be carried out on behalf of a third party or a company which is related to yalla and which have not been made public by yalla.

21.2Should a request be refused, yalla shall provide the requesting person with the following information –

21.2.1adequate reasons for the refusal including the relevant sections of PAIA; and

21.2.2notice that the requesting person may lodge an application with a competent court against the refusal and against the procedure including the period for lodging the application.

22FEES

22.1A non-refundable request fee is payable to yalla upon the submission of the request.

22.2A requesting party who has made a request for access to records and such request has been granted must pay an access fee to yalla for the search and preparation of the records and any time reasonably required which exceeds the prescribed hours for searching and preparation arrangements.

22.3The prescribed forms and fees are available on the website of the Department of Justice and Constitutional Development.

23REQUEST FOR RECORDS CONTAINING THIRD PARTY INFORMATION

23.1Should records be requested that contain information pertaining to a third party, yalla is obliged to attempt to contact the third party to inform it of the request and to provide it with the opportunity to respond to the request by consenting or providing reasons why the access should be refused.

23.2Should the third party provide reasons for the support of or against providing access, the Information Officer will consider such reasons in determining whether access should be granted.

23.3The requesting party may appeal the decision of the Information Officer to a competent court in the Republic of South Africa in accordance with PAIA.

24RECORDS THAT CANNOT BE FOUND OR DO NOT EXIST

24.1Should all reasonable steps be taken by yalla to find a requested record and there are reasonable grounds to believe that the record:

24.1.1is in yalla’s possession but cannot be found; or

24.1.2does not exist,

then the Information Officer shall notify the requesting party that it is not possible to provide the requesting party access to such record.

24.2The communication contemplated in clause 24.1 shall set out the steps taken and correspondence exchanged relating thereto by yalla to find the requested record or to determine whether the record exists.

24.3A notice in terms of clause 24.1 shall constitute a refusal by yalla.

24.4Should the record be found after a notice in terms of clause 24.1 is sent to the requesting party, yalla shall provide the requesting party access to the record, unless refused in terms of a ground for refusal by the Information Officer.

GENERAL

25DETAILS OF INFORMATION OFFICER, DEPUTY INFORMATION OFFICER AND HEAD OFFICE

26AVAILABILITY OF THIS DOCUMENT

This document is available for inspection by the general public at the physical address of yalla, should yalla have received 7 (seven) days prior written notice of the intended inspection.

27DOCUMENT AMENDMENTS

27.1This document shall be reviewed annually by yalla.

27.2Notwithstanding clause 27.1, yalla may amend this document as and when required.

28GUIDE TO PAIA COMPILED BY THE HUMAN RIGHTS COMMISSION

28.1In terms of PAIA, the Human Rights Commission is required to compile a guide to assist persons who wish to exercise any rights in terms of PAIA (“Guide”).

28.2The Guide is available on the following website address: https://www.sahrc.org.za/home/21/files/Section%2010%20guide%202014.pdf.

28.3Alternatively, the Human Rights Commission may be contacted for provision of the Guide at:

Physical address: Sentinel House, Sunnyside Office Park

32 Princess of Wales Terrace

Parktown

Johannesburg

South Africa

2001

Postal address: Private Bag 2700, Houghton, 2041;

Telephone: 011 877 3600

Website: www.sahrc.org.za

E-mail: info@sahrc.org.za

29INTERPRETATION

29.1In this document, unless the context requires otherwise:

29.1.1words importing any one gender shall include the other gender;

29.1.2the singular shall include the plural and vice versa; and

29.1.3a reference to natural persons shall include created entities (corporate or unincorporated) and vice versa.

29.2In this document, the headings have been inserted for convenience only and shall not be used to assist or affect its interpretation.

29.3Any reference in this document to an enactment is to that enactment as amended or re-enacted from time to time.

29.4Where a clause reference is referred to in this document and followed by the heading of the clause so referred, if there is any conflict between the two, the word reference to the heading shall prevail.

29.5Words and/or expressions defined in any clause in the body of this document shall, unless the application of such words and/or expressions is specifically limited to that clause, bear the meaning so assigned to it throughout this document.

29.6The eiusdem generis rule shall not apply and accordingly, whenever a provision is followed by the word “including” followed by specific examples, such examples shall not be construed to limit the ambit of the provision concerned.