POPIA Compliance

01 What is POPIA?

The Protection of Personal Information Act (POPIA) is South Africa's primary data protection law. It regulates how organisations collect, store, use, share, and destroy personal information. POPIA applies to any person or organisation that processes personal information of South African residents.

POPIA gives every person the right to privacy, including the right to have their personal information protected against unlawful collection, retention, dissemination, and use.

02 Our Commitment

Mokoena Fortified Holdings (Pty) Ltd is committed to:

• Processing personal information lawfully, fairly, and in a transparent manner
• Collecting information only for specific, explicitly defined, and legitimate purposes
• Ensuring information is adequate, relevant, and not excessive
• Keeping information accurate and up to date
• Retaining information only for as long as necessary
• Protecting information from loss, damage, or unauthorised access
• Respecting the rights of all data subjects

03 The 8 Conditions for Lawful Processing

POPIA prescribes eight conditions for lawful processing of personal information. MFH adheres to all eight:

• 1. Accountability — We take full responsibility for ensuring compliance with POPIA across our organisation.
• 2. Processing Limitation — We only collect information with your consent or where legally permitted, and for the minimum necessary purposes.
• 3. Purpose Specification — Information is collected for specific, lawful purposes and not processed in a way incompatible with those purposes.
• 4. Further Processing Limitation — We do not use your information for purposes beyond what was originally communicated to you.
• 5. Information Quality — We take reasonable steps to ensure your information is complete, accurate, and kept up to date.
• 6. Openness — We are transparent about what information we hold, why we hold it, and how we use it.
• 7. Security Safeguards — We implement appropriate technical and organisational security measures to protect your personal information.
• 8. Data Subject Participation — We honour your rights to access, correct, and delete your personal information upon request.

04 Information Officer

In terms of POPIA, MFH has designated an Information Officer responsible for overseeing POPIA compliance within our organisation. The Information Officer has been registered with the Information Regulator of South Africa.

05 How We Collect Personal Information

We collect personal information through the following channels:

• Our website contact and enquiry forms
• WhatsApp and telephone conversations
• Email correspondence
• Documents submitted for company registration and compliance services
• Invoicing and payment processing
• Automatically via cookies and website analytics (see our Cookie Policy)

We will always inform you at the point of collection what information we are collecting and why.

06 Special Categories of Information

Certain categories of personal information receive heightened protection under POPIA, including ID numbers, financial information, and information about children. Where MFH collects such information (e.g. ID numbers for CIPC registration), we:

• Collect only what is strictly necessary
• Store it securely with restricted access
• Delete it once the purpose has been fulfilled and legal retention periods have passed
• Never share it with unauthorised third parties

07 Data Subject Rights

As a data subject, you have the following rights under POPIA:

• Right to be notified — You must be informed when we collect your personal information
• Right of access — You may request a copy of the personal information we hold about you
• Right to correction or deletion — You may request correction of inaccurate data or deletion of data we no longer have grounds to retain
• Right to object — You may object to the processing of your personal information on reasonable grounds
• Right to opt out of direct marketing — You can unsubscribe from marketing communications at any time
• Right to complain — You may lodge a complaint with the Information Regulator

To exercise any right, contact our Information Officer at info@mokoenafortified.co.za. We will respond within 30 days.

08 Security Safeguards

MFH implements the following measures to protect your personal information:

• Encrypted communication (HTTPS/TLS) on all digital platforms
• Password-protected and access-controlled document storage
• Limited staff access to personal information on a need-to-know basis
• Regular review of data access permissions
• Secure deletion of physical documents containing personal information
• Staff training on POPIA obligations and data handling

09 Breach Notification

In the event of a security compromise or breach of personal information, MFH will:

• Investigate the breach promptly and take corrective action
• Notify the Information Regulator within 72 hours of becoming aware of the breach (where required)
• Notify affected data subjects as soon as reasonably practicable
• Document the breach, its scope, and all remedial steps taken

10 Third-Party Operators

Where MFH uses third-party service providers who process personal information on our behalf ("Operators"), we ensure that:

• Operators are bound by written agreements requiring POPIA-compliant processing
• Operators only process information for the purposes we specify
• Operators implement appropriate security measures
• We remain accountable for the processing conducted by our Operators

Our primary Operators include payment processors, email service providers, and website hosting providers.

11 How to Lodge a Complaint

If you believe MFH has violated your POPIA rights, you may:

• First contact our Information Officer to resolve the matter directly
• If unresolved, lodge a complaint with the Information Regulator of South Africa