BTMEDU (PTY) LTD

BTMEDU (PTY) LTD (“BTMEDU”, “the Company”, “we”, “us” or “our”) is committed to protecting personal information and respecting the privacy rights of customers, prospective customers, employees, suppliers, delivery recipients and other individuals whose personal information it processes. This policy establishes the Company's framework for collecting, receiving, recording, storing, using, sharing, retaining and disposing of personal information in accordance with the Protection of Personal Information Act 4 of 2013 (“POPIA”), its applicable regulations and other relevant South African legislation. The purpose of this policy is to ensure that personal information is processed lawfully, fairly, securely and only for legitimate business purposes.

This policy is intended to operate in accordance with:

• The Protection of Personal Information Act 4 of 2013 (POPIA).
• The Promotion of Access to Information Act 2 of 2000 (PAIA), where applicable.
• The Consumer Protection Act 68 of 2008, where applicable.
• The Electronic Communications and Transactions Act 25 of 2002, where applicable.
• Other applicable South African laws governing commercial transactions, employment, taxation, accounting and recordkeeping.

Where legislation imposes a specific requirement that differs from this policy, the applicable legal requirement will prevail.

This policy applies to all personal information processed by or on behalf of BTMEDU, including information collected through:

• The Company's website and Progressive Web App (PWA).
• Online customer registrations and accounts.
• Product enquiries and customer support.
• Orders for stationery, textbooks, religious books, art and craft products, educational toys and corporate gifts.
• School-specific stationery and textbook lists.
• Shopping carts, checkout and payment processing.
• Delivery and collection arrangements.
• Stationery Stokvel enrolment and related transactions, where offered.
• Email, telephone, messaging platforms and other communication channels.
• Supplier, employee and business administration processes.

This policy applies to employees, contractors and other authorised persons who process personal information under the Company's authority.

• Personal information: Information relating to an identifiable living natural person and, where applicable, an identifiable existing juristic person, as defined by POPIA.
• Data subject: The person or entity to whom personal information relates.
• Responsible party: The person or organisation that determines the purpose of and means for processing personal information. BTMEDU will act as the responsible party where it determines those purposes and means.
• Operator: A third party that processes personal information for BTMEDU under a contract or mandate, without coming under the direct authority of the Company in doing so.
• Processing: Any operation involving personal information, including collection, storage, use, disclosure, alteration, retrieval or destruction.
• Special personal information: Information falling within the special categories protected by POPIA, including certain information relating to religious beliefs, health, biometrics and other protected characteristics.

BTMEDU may collect and process the following categories of information where reasonably necessary for its business activities.

BTMEDU will process personal information only where a lawful justification exists under POPIA. Purposes may include:

• Creating and maintaining customer accounts.
• Processing orders and payments.
• Delivering products or arranging collection.
• Providing customer service and responding to enquiries.
• Managing returns, refunds, complaints and disputes.
• Administering school lists and customer-selected stationery requirements.
• Administering approved Stationery Stokvel services.
• Preventing fraud and protecting the Company's systems.
• Meeting applicable legal, tax, accounting and recordkeeping obligations.
• Sending service-related communications.
• Sending direct marketing where permitted by law.
• Improving website functionality, usability and security.
• Establishing, exercising or defending legal rights.

Depending on the circumstances, processing may be necessary for contractual performance, compliance with a legal obligation, protection of legitimate interests, consent or another lawful justification recognised by POPIA. BTMEDU will not rely on consent where it is not the appropriate lawful basis, and will not use personal information for unrelated purposes without a lawful justification.

BTMEDU will take reasonable steps to ensure that individuals are informed, where required, about:

• The identity and contact details of the Company.
• The categories of information being collected.
• The purposes for which the information will be used.
• Whether the information is required or optional.
• The consequences of not providing information that is necessary for a transaction.
• The recipients or categories of recipients to whom information may be disclosed.
• Any relevant cross-border processing.
• The rights available to data subjects under POPIA.
• The process for lodging complaints with the Information Regulator.

Personal information should, where reasonably practicable, be collected directly from the data subject. Information obtained from another source must be handled in accordance with applicable legal requirements. BTMEDU will not require customers to provide information that is unnecessary for the relevant transaction or service.

BTMEDU recognises that school stationery and textbook purchases may involve children. The Company will take reasonable steps to minimise the collection of children's personal information. School lists and grade selections should generally be managed without identifying individual learners. Where BTMEDU processes personal information relating to a child, it will comply with the special requirements in POPIA governing children's information, including obtaining authorisation from a competent person where required, unless a lawful exception applies. BTMEDU will not assume that a parent's purchase of school supplies automatically authorises every possible use of a child's personal information.

BTMEDU does not intend to collect special personal information unless it is necessary for a legitimate, defined purpose and the processing is permitted under POPIA. If customers purchase religious books, the Company will ordinarily process only the information necessary to fulfil the order. A purchase must not automatically be used to infer, profile or record a customer's religious beliefs. Any processing of special personal information must be assessed separately and authorised only where a lawful basis exists.

BTMEDU may use third-party payment service providers, including PayFast, where configured and supported. The Company will:

• Use secure payment integrations and appropriate server-side verification.
• Process payment references, amounts and payment statuses as necessary.
• Avoid storing full payment card details or security codes on its own systems.
• Restrict access to financial transaction records.
• Use payment information only for legitimate transaction, reconciliation, fraud prevention, support and legal purposes.
• Ensure that payment providers are subject to appropriate contractual and security requirements.

A payment notification or redirect to the website will not, by itself, be treated as conclusive proof that a payment succeeded.

BTMEDU may disclose personal information to appropriate third parties where necessary and lawful, including:

• Payment service providers.
• Delivery companies and courier services.
• Website hosting, cloud infrastructure and software providers.
• Customer communication and support providers.
• Accounting, legal, audit and professional advisers.
• Regulators, law enforcement authorities or courts where legally required.
• Other service providers necessary to fulfil a customer request or operate the business lawfully.

BTMEDU will limit disclosures to information reasonably necessary for the relevant purpose. Where an operator processes personal information on behalf of BTMEDU, the Company will take reasonable steps to ensure that an appropriate written agreement governs confidentiality and security obligations, as required by POPIA. Third parties receiving information for their own independent purposes must be assessed according to the nature of the disclosure and their applicable legal responsibilities.

Where BTMEDU uses hosting, cloud, analytics, communications or other services that involve personal information being transferred outside South Africa, the Company will assess whether the transfer complies with section 72 of POPIA. Personal information will not be transferred across borders unless the applicable statutory requirements are met, including any required protections, agreements, authorisation or other lawful basis. The Company will take reasonable steps to understand where its service providers store and process personal information.

BTMEDU will implement appropriate, reasonable technical and organisational safeguards to protect personal information against loss, unauthorised access, unlawful processing, alteration, disclosure or destruction. Depending on the systems and risks involved, safeguards may include:

• Access controls and role-based permissions.
• Strong authentication for privileged accounts.
• Encryption in transit and appropriate encryption at rest.
• Secure password storage and management.
• Security updates and vulnerability management.
• Firewalls and monitoring of relevant security events.
• Backups and recovery procedures.
• Restrictions on exporting customer records.
• Staff confidentiality obligations and training.
• Secure disposal of paper and electronic records.
• Periodic reviews of risks and the effectiveness of security measures.

Access to personal information must be limited to persons who need it for authorised duties. All personnel must report suspected unauthorised access, loss, disclosure or misuse of personal information promptly through the Company's designated incident-reporting process.

If BTMEDU has reasonable grounds to believe that personal information has been accessed or acquired by an unauthorised person, it will follow the incident response process required by POPIA. The Company will:

• Contain and investigate the incident.
• Preserve relevant evidence and assess the nature and scope of the compromise.
• Take reasonable steps to prevent further unauthorised access.
• Notify the Information Regulator and affected data subjects as required by section 22 of POPIA, as soon as reasonably possible, subject to applicable legal provisions.
• Provide information required for affected persons to take protective measures.
• Document the incident and corrective actions.
• Review and improve security measures where necessary.

An operator processing information for BTMEDU must notify the Company immediately if it has reasonable grounds to believe that personal information has been accessed or acquired by an unauthorised person.

BTMEDU will retain personal information only for as long as necessary for the purpose for which it was collected or subsequently processed, unless longer retention is required or permitted by law. Retention periods may depend on:

• The completion of an order or customer relationship.
• Tax, accounting and statutory recordkeeping obligations.
• The management of refunds, warranties, complaints or disputes.
• Fraud prevention and security requirements.
• The establishment, exercise or defence of legal claims.
• Other applicable legal requirements.

When personal information is no longer required, BTMEDU will take reasonable steps to delete, destroy or de-identify it securely, subject to any applicable retention obligation or lawful basis for continued retention. The Company will maintain a retention schedule specifying the applicable periods for key categories of records.

BTMEDU may send communications necessary to confirm orders, verify transactions, provide delivery updates, respond to enquiries or administer customer accounts. Promotional emails, SMS messages and other direct marketing communications will be handled in accordance with POPIA and other applicable laws. Where consent or another statutory condition is required, BTMEDU will obtain and record it before sending the relevant marketing communication. The Company will provide an appropriate method for customers to opt out of marketing communications and will honour valid opt-out requests. A customer's purchase or registration will not automatically be treated as unrestricted permission to send promotional communications through every channel.

The BTMEDU website and PWA may use cookies, local storage and similar technologies for purposes such as:

• Maintaining sessions and authentication.
• Supporting cart functionality.
• Improving security.
• Remembering appropriate user preferences.
• Measuring website performance, where configured.

Non-essential analytics or advertising technologies will be assessed for applicable privacy and consent requirements. BTMEDU will not store sensitive payment information or confidential customer records in insecure browser storage. Information stored locally must be limited to what is appropriate for the functionality and protected against foreseeable risks.

Subject to applicable legal conditions and limitations, data subjects may have the right to:

• Be notified that their personal information is being collected or has been accessed by an unauthorised person.
• Request access to their personal information.
• Request correction or deletion of inaccurate, irrelevant, excessive, outdated, incomplete, misleading or unlawfully obtained information.
• Object to certain processing on reasonable grounds relating to their particular situation.
• Object to direct marketing where the law provides that right.
• Withdraw consent where processing is based on consent.
• Request that certain decisions based solely on automated processing be addressed in accordance with POPIA.
• Lodge a complaint with the Information Regulator.
• Seek remedies available under applicable law.

Requests will be assessed and handled within the applicable legal timeframes. BTMEDU may take reasonable steps to verify the identity and authority of a person making a request. A request for deletion may be limited where the Company is legally required or otherwise lawfully entitled to retain the information.

BTMEDU will ensure that its Information Officer and any Deputy Information Officers are appointed and registered with the Information Regulator where required. The Information Officer is responsible for overseeing the Company's POPIA compliance framework, including relevant policies, training, internal procedures, cooperation with the Information Regulator and the handling of privacy-related requests and complaints.

• Information Officer: Tshegofatso Phaloane
• Designation: Director
• Email: info@btmedu.co.za
• Telephone: 061 081 4598
• Business address: Shop 16 North Park Mall, 256 Burger Street, Pretoria North

Privacy-related requests and complaints may be directed to the Information Officer at info@btmedu.co.za or on 061 081 4598.

A person who has concerns about BTMEDU's handling of personal information may first contact the Company's Information Officer using the verified details published on the website. The Company will record, assess and respond to complaints in accordance with applicable requirements. Data subjects may also approach the Information Regulator of South Africa through its official channels:

Website: https://inforegulator.org.za/

This policy does not limit any statutory rights or remedies available to a data subject.

Employees, contractors and authorised service providers must:

• Access personal information only for authorised purposes.
• Keep information confidential.
• Follow approved security and data-handling procedures.
• Avoid sharing customer information through unauthorised channels.
• Report suspected incidents immediately.
• Complete relevant privacy and information-security training.
• Return or securely dispose of information when their authorised access ends, subject to lawful recordkeeping requirements.

Unauthorised access, disclosure or misuse may result in disciplinary action, termination of access or contractual remedies, and may be referred to the appropriate authorities where warranted.

BTMEDU will take reasonable steps to maintain an ongoing privacy compliance programme, which may include:

• Maintaining a record of processing activities.
• Assessing privacy risks associated with new systems and services.
• Reviewing operator and service-provider agreements.
• Reviewing access permissions and security controls.
• Training relevant personnel.
• Maintaining incident and request registers.
• Reviewing retention periods.
• Assessing cross-border data transfers.
• Reviewing this policy at least annually and when material changes occur.

This policy must be read together with the Company's applicable privacy notice, information security procedures, retention schedule, operator agreements and PAIA manual.

BTMEDU may amend this policy when required by changes in legislation, business operations, technology, service providers or identified risks. Material changes will be communicated through appropriate channels where required by law. The current version will be made available through the Company's website or another appropriate publication channel.

This policy is adopted by BTMEDU (PTY) LTD.

Directors