Super Group Dealerships – Employee Privacy Policy

Introduction

This policy outlines the Dealership Division of Super Group Trading Pty Ltd.'s ("Super Group") privacy policy that applies when Super Group obtains and uses information of applicants, employees or contract workers, or any person associated with these people such as their children, spouses or other third parties (collectively referred to as "Data Subjects") and received as a result of the relationship with this person. It has been prepared with reference to internal business practices and applicable laws such as the Protection of Personal Information Act 4 of 2013 (“POPI”). It applies uniformly to all dealerships and head office functions relating to recruitment and employment.

General POPI principles applying to applicant and employee information

 Personal Information. In this policy "Personal Information" or “information” means information about a data subject as defined in POPI and includes, amongst others, name, identifying numbers, address, contact information, banking information, biometrics, payroll and disciplinary action.

 Collecting Personal Information. As far as possible, we collect Personal Information directly from the Data Subject, but may also collect from the following sources:

 Government organisations and public bodies;

 The internet and media, including online and social media platforms and public resources

 Family or friends and References

 Business partners with whom we have trusted relationships, including to verify details or perform checks such as credit or criminal checks

 Other third parties if the law allows it.

 Responsibility. Super Group shall assume all the responsibilities of a "Responsible Party" in terms of POPI (this is the party that determines the purpose of and means for processing Personal Information).

 Processing. Personal Information will be collected and processed lawfully and in accordance with all laws that apply to Super Group, including but not limited to POPI, PAIA, and applicable employment and tax laws.

 Minimality. Only Personal Information that is necessary, related to or relevant to the reason for which Super Group intends to use it will be required.

 Purposes for processing Personal Information. Super Group will process Personal Information in terms of this policy for the following purposes in compliance with applicable laws:

 Recruitment, including but not limited to credit and criminal checks and psychometric testing

 All aspects relating to the employment relationship, including payroll, pay slips, leave, employee benefits, medical aid, pension and insurance and other wellness products

 Staff deductions, loans, garnishee orders, staff purchases and tax

 Employee wellness, staff functions and general staff initiatives

 Training

 Biometric information for access control

 Performance, reviews and disciplinary action

 Internal audit and statutory compliance

 Internal reporting and reporting to authorities

 Sharing information with third parties for purposes set out in this policy

 Any other legitimate human resource activity

 Disclosure and sharing of Personal Information. Super Group will only disclose or share Personal Information to third parties for purpose set out in this policy, unless further consent is obtained or to the extent that legislation permits or requires. Super Group will disclose Personal Information to regulatory authorities, professional advisors like lawyers and accountants. Where a third party provides services to us, we will share the required information with these third parties to enable them to provide services to us. Super Group will also transfer information to third parties if it sells any portion of its business or assets. Your information will also be shared with medical aid, provident fund and employee wellness intermediaries for the processing of benefits and administration of the respective funds or benefits. Where Super Group makes use of third party service providers or sub-contractors for performing its services, information may be transferred to these third parties and we enter into written agreements with these third parties which require them to only use the information in terms of our written instructions and comply with confidentiality and security requirements. In the event of a transfer of Personal Information to any third party, details of the transfer will be retained in terms of our retention policies.

 Consent. Where you have provided consent for Super Group to process your Personal Information, you may also withdraw your consent where our processing is based on your consent. However, we may continue to process your Personal Information if another legal justification exists for the processing. If you refuse consent, we may not be able to maintain the relationship with you, unless we can rely on another justification ground to lawfully process your Personal Information. You expressly consent to the processing of your children’s personal information and any special personal information for any of the purposes set out in this policy. Special personal information includes health, trade union membership, race, biometrics and criminal information.

 Retention periods. Super Group takes reasonable steps to only process Personal Information for the minimum period necessary and retains information in accordance with the retention periods required by

law and as described in this policy. Information that is no longer required for the purposes for which it was collected will be destroyed.

 Security. All reasonable measures will be taken to ensure the security, integrity and confidentiality of Personal Information that we hold by taking appropriate, reasonable, technical and organisational security measures to protect Personal Information and prevent accidental or unlawful destruction, loss, alteration, disclosure, access and other unlawful or unauthorised forms of processing. Super Group cannot be held liable for any losses or damages that may occur as a result of security breaches unless directly attributed to the gross negligence or misconduct on the part of Super Group or any of its employees, contractors or service providers.

 Quality of Personal Information. We want to ensure that your Personal Information is accurate and up to date. You may ask us to correct or remove any Personal Information that you think is inaccurate, by sending us an email on mercia.harmse@supergrp.com. It is your responsibility to update us if any of your Personal Information changes.

 Access to Personal Information. If you would like us to provide you with the Personal Information that we hold about you, you may send in a request in the prescribed format (link) and email it to nicole.delaney@supergrp.com. This request may be subject to you verifying your identity and the rights that you are wishing to exercise and to an administration fee in terms of applicable laws. We will provide you with the requested information, or if in terms of the law we are not required to share the information with you, we will inform you accordingly as soon as is reasonably possible in the circumstances but no later than 30 days after request has been received.

 Cross border transfer. Super Group may use cloud storage services which will result in your information being transferred cross border. We will only transfer Personal Information to third parties in countries with adequate data protection laws or do so in terms of a written agreement with the recipient which imposes data protection requirements on that party as required by POPI.

Breach, objection and complaints  Security breach. In the event of a security breach of any Personal Information, Super Group will notify all affected Data Subjects and the applicable regulatory authorities of the breach. If you want to report any concerns about our privacy practices or if you suspect any breach regarding your Personal Information, kindly notify us by sending an email to nicole.delaney@supergrp.com.

 Objection to processing. You may, on reasonable grounds, object to Super Group using your Personal Information for certain purposes, including any automated processing. If you object, we will stop using your Personal Information and delete it, except if applicable laws allow its use or retention. To exercise this right or to discuss it with us, please contact us on nicole.delaney@supergrp.com.

 Complaints. If you want to raise any objection or have any queries about our privacy practices, you can contact our data protection officer on natalie.matticks@supergrp.com. In the event that you believe that Super Group or any of its divisions or dealerships have infringed on any of your rights or have contravened the provisions of POPI in any manner that has prejudiced you, you have the right to raise your complaint