POPIA COMPLIANCE NOTICE

1. OUR COMMITMENT

OPULENCE FLOW (PTY) LTD ("Opulence Flow", "we") is committed to processing personal information lawfully, fairly and transparently, in line with the eight conditions for lawful processing in the Protection of Personal Information Act 4 of 2013 ("POPIA"): accountability, processing limitation, purpose specification, further processing limitation, information quality, openness, security safeguards and data subject participation.

This notice should be read together with our Privacy Policy at opulenceflow.com/privacy-policy, which explains in detail what we collect, why, who we share it with and how long we keep it.

2. RESPONSIBLE PARTY AND INFORMATION OFFICER

3. WHEN WE ACT AS AN OPERATOR

When we run advertising and book consultations for dental practices, the dental practice is the responsible party for the personal information of people who enquire through those campaigns. We act as the practice's operator under sections 20 and 21 of POPIA. This means we:

• process that information only with the practice's knowledge and authorisation, and only for the purpose of arranging consultations;
• treat it as confidential and do not use it for our own marketing;
• keep it secure using appropriate technical and organisational measures; and
• notify the practice immediately if we have reasonable grounds to believe the information has been accessed or acquired by an unauthorised person.

4. YOUR RIGHTS AS A DATA SUBJECT

You have the right to:

(a) be told that your personal information is being collected, and by whom;

(b) be told if your personal information has been accessed or acquired by an unauthorised person;

(c) find out whether we hold personal information about you, and request a record or description of it;

(d) request the correction, destruction or deletion of your personal information;

(e) object, on reasonable grounds, to the processing of your personal information;

(f) object at any time to the processing of your personal information for direct marketing, and not receive unsolicited electronic direct marketing;

(g) withdraw your consent at any time; and

(h) lodge a complaint with the Information Regulator.

5. HOW TO MAKE A REQUEST

To exercise any of these rights, email our Information Officer at jose@opulenceflow.com with the subject line "POPIA Request" and include:

• your full name and contact details;
• the right you wish to exercise (for example access, correction, deletion or objection);
• enough detail for us to identify the information concerned; and
• if you are acting for someone else, proof of your authority to do so.

You may also use the prescribed forms under the POPIA Regulations: Form 1 (objection to processing) and Form 2 (request for correction or deletion), available on the Information Regulator's website.

We may ask you to verify your identity before we act on a request, to protect your information from being disclosed to the wrong person.

6. HOW WE RESPOND

We will acknowledge your request and respond within a reasonable time, and in any event within 30 days of receiving a complete request. If we need more time, or cannot comply (for example, because we are legally required to keep certain records), we will tell you why. Requests to correct, delete or object, and requests to stop direct marketing, are free of charge. Requests for access to records may be subject to the procedures and any prescribed fees under the Promotion of Access to Information Act 2 of 2000 (PAIA); we will tell you in advance if any fee applies.

To opt out of marketing messages at any time, reply STOP to any SMS or WhatsApp message, use the unsubscribe link in any email, or email jose@opulenceflow.com.

7. SECURITY BREACHES

If we have reasonable grounds to believe that personal information we hold has been accessed or acquired by an unauthorised person, we will notify the Information Regulator and the affected data subjects as soon as reasonably possible, as required by section 22 of POPIA. Where we act as an operator, we will notify the responsible dental practice immediately.

8. COMPLAINTS

If you have a concern about how we handle your personal information, please contact our Information Officer first so we can try to resolve it. If you are not satisfied with our response, you may lodge a complaint with the Information Regulator (South Africa):

9. UPDATES

We may update this notice from time to time. The latest version will always be available on this page.