SUMITOMO CORPORATION AFRICA PROPRIETARY LIMITED ("SCAF") PRIVACYPOLICY
THIS PRIVACY POLICY ("PRIVACY POLICY") APPLIES TO HOW WE COLLECT, USE AND
PROCESS YOUR PERSONAL INFORMATION. PLEASE READ THIS PRIVACY POLICYCAREFULLY.
All of the provisions of this Privacy Policy are important, but please pay special attention
to the parts that are in bold writing. These parts contain information about provisions thathave special consequences for you. These parts are only intended to bring suchprovisions to your attention, and, where necessary, to explain their fact, nature and effect.
Where explanations are given, they may be contained in a box. Such boxed explanations
are aids to understanding only and are not provisions themselves. They do not limit themeaning or application of the provisions, and do not apply only to the situations andexamples described in the boxes or only to similar situations or examples.
1.

SCOPE OF THIS PRIVACY POLICY

1.1

Introduction and scope

1.1.1

Sumitomo Corporation Africa Proprietary Limited ("SCAF" or "we" or "us" or"our") ") is part of a group of companies that operates globally in a wide range
of industries including in South Africa.

1.1.2

SCAF strives to ensure that our use of your Personal Information of a data
subjects (a person to whom Personal Information relates) is lawful, reasonable,
and relevant to our business activities, with the ultimate goal of improving ourofferings and your experience.

1.1.3

We have appointed an Information Officer who is responsible for overseeing
questions in relation to the Privacy Policy. You may contact our Information
Officer at popiaqueries.jhb@sumitomocorp.com to discuss this Privacy Policyor your rights under data protection laws that are applicable to you.

1.1.4

This Privacy Policy describes how we will treat your Personal Information
whether provided by you to us, or collected by us through other means in yourordinary use of our products and/or services, which includes access to our
website (“the Website").

1.1.5

This Privacy Policy must be read together with any Website terms andconditions and any other documents or agreements that describe the mannerPage 2in which we, in specific circumstances, collect or process Personal information
about you. This will enable you to understand the manner in which SCAF willprocess your Personal Information. This Privacy Policy supplements such otherdocuments and agreements but does not supersede them and in the event of
any conflict, ambiguity or inconsistency between this Privacy Policy and suchother documents and agreements, the terms of the particular document oragreement will prevail.
2.
2.1

THE PERSONAL INFORMATION THAT WE COLLECT ABOUT YOU?
SCAF may collect, acquire, receive, record, organise, collate, store, update, change,
retrieve, read, process, analyse, use and share your Personal Information in themanner as set out in this Privacy Policy. When we perform one or more of theseactions, we are "Processing" your Personal Information.

2.2"Personal Information" refers to private information about an identifiable natural or
juristic person. Personal Information does not include information that does not
identify a person (including in instances where that information has been
anonymised). The Personal Information that we collect about you may differ on thebasis of the products and services that you receive from SCAF.

2.3
2.3.1

We may process various types of Personal Information as follows:
Identity Information, which includes information concerning your name,username or similar identifier, date of birth, gender, race and legal status;

2.3.2

Contact Information, which includes your billing addresses, delivery
addresses, e-mail addresses and telephone numbers, as well as company
secretarial information that has been disclosed in relation to you;

2.3.3

Financial Information, which includes bank account and payment card details,
insurance information, financial statements and VAT registration numbers andcredit ratings;

2.3.4

Usage Information, which includes information as to your access to and useof the Website, products and services;

2.3.5

MarketingandCommunications

Information,

which

includesyourpreferences in respect of receiving marketing information from us and our third
parties, and your communication preferences.

Page 3
2.4

SCAF may also process, collect, store and/or use aggregated data, which may include
historical or statistical data ("Aggregated Data") for any purpose. Aggregated Data
may be derived from your Personal Information but is not considered Personal
Information, as this data does not directly or indirectly reveal your identity. However,
if we combine or connect Aggregated Data with your Personal Information in a mannerthat has the result that it can directly or indirectly identify you, we will treat the
combined data as Personal Information, which will be managed in accordance withthis Privacy Policy.

3.

HOW WE COLLECT YOUR PERSONAL INFORMATION

3.1

We collect your Personal Information in three ways, namely:

3.1.1

through direct or active interactions with you;

3.1.2

through automated or passive interactions with you; and3.1.3

from third parties, including third party service providers.

3.2

Direct or active collection from you

3.2.1

We may require that you submit certain information to enable you to accessportion of the Website, to make use of our services, to purchase our goods orservices, to facilitate the conclusion of an agreement with us, or that isnecessary for our fulfilment of our statutory or regulatory obligations. We alsocollect Personal Information directly from you when you communicate directlywith us, for example via e-mail, telephone calls, feedback forms, site comments
or forums.

3.2.2

If you contact us, we reserve the right to retain a record of that correspondence,
which may include Personal Information.

3.2.3

The Personal Information that we actively collect from you may include any of
the Personal Information listed in clause 2 of this Privacy Policy.

3.3

Passive collection from your Access Device

3.3.1

We may passively collect certain of your Personal Information from the Access
Device that you use to access and navigate the Website (each an "Access
Device"), by way of various technological applications, for instance, using
server logs to collect and maintain log information.

Page 43.3.2

We also use cookies and anonymous identifiers which enable our computer
system to recognise you when you next visit the Website to distinguish you fromother users and to improve our service to you, and which can be used toenhance the content of the Website and make it more user-friendly, as well as
to give you a more personalised experience.

3.3.3

A cookie is a small piece of data (an alphanumeric identifier) which our computer
system transfers to your Access Device through your web browser when you
visit the Website, and which is stored in your web browser. When you visit theWebsite again, the cookie allows the site to recognise your browser. Cookies
may store user preferences and other information.

3.3.4

You may disable the use of cookies by configuring your browser to refuse all
cookies or to indicate when a cookie is being sent. However, if you do so, you
may not be able to enjoy all of the features and functionality of the Website.

3.3.5

The Personal Information that we passively collect from your Access Device
may include your Identity Information, your Contact Information, your Technical
Information, your Profile Information, your Usage Information, your Location
Information and your Marketing and Communications Information, or any other
Personal Information which you permit us, from time to time, to passively collectfrom your Access Device.

3.4

Personal Information collected from third parties
SCAF receives Personal Information about you from various third parties andpublic sources, including:

3.4.1

third party service providers, such as credit vetting agencies;

3.4.2

third parties who provide Personal Information to data controllers, and who inturn provide this Personal Information to SCAF; and3.4.3

our information technology suppliers.

4.

HOW WE USE YOUR PERSONAL INFORMATION

4.1

We use the Personal Information we collect from you to maintain and improve theWebsite and to improve the experience of our users, to facilitate the sale of our
products and the provision of our services and to fulfil our statutory and regulatory
obligations.

Page 5
4.2

We may also use your Personal Information to:

4.2.1

retain and make information available to you on the Website;

4.2.2

create your user account and allow use of the Website;

4.2.3

maintain and update our customer, or potential customer, databases;

4.2.4

establish and verify your identity on the Website;

4.2.5

operate, administer, secure and develop the Website and the performance andfunctionality of the Website;

4.2.6

detect, prevent or manage actual or alleged fraud, security breaches or theabuse, misuse or unauthorised use of the Website and contraventions of thisPrivacy Policy or any of the terms and conditions that apply to your use of theWebsite;4.2.7

inform you about any changes to the Website, this Privacy Policy or otherchanges that are relevant to you;

4.2.8

create user profiles and to analyse and compare how you and other users makeuse of the Website, including your browsing habits, click-patterns, preferences,frequency and times of use, trends and demographic information;

4.2.9

provide you with marketing material that is relevant to you;

4.2.10diagnose and deal with technical issues and customer support queries andother user queries;

4.2.11protect our rights in any litigation that may involve you;

4.2.12for security, administrative and legal purposes;

4.2.13comply with our statutory obligations, including submissions to the Companies
and Intellectual Property Commission ("CIPC"), as well as engaging withregulatory authorities;

4.2.14

facilitate publication on the Stock Exchange News Services ("SENS") and toenable users to access SENS announcements;

4.2.15for customer relations purposes;

Page 64.2.16

conduct SCAF's recruitment and hiring processes, which includes the
conducting of criminal record and credit checks, referrals, the capturing of job
applicant's details and the providing of status updates to job applicants;

4.2.17

to fulfil any contractual obligations that we may have to you or any third party;

4.2.18communicate with you and retain a record of our communications with you andyour communications with us;

4.2.19analyse and compare the types of Access Devices that you and other users
make use of and your physical location; and4.2.20for other lawful purposes that are relevant to our business activities or regulatory
functions.

4.3

SCAF will restrict its processing of your Personal Information to the original purpose
for which it was collected, unless SCAF reasonably considers that it is necessary toprocess it for another purpose that is compatible with the original purpose.

4.4

SCAF may, where permitted or required to do so by applicable legislation, process
your Personal Information without your knowledge or consent, and will do so inaccordance with the further provisions of this Privacy Policy.

5.

COMPULSORY PERSONAL INFORMATION AND CONSEQUENCES OF NOTSHARING WITH US
Where SCAF is required to process certain Personal Information by law, or in termsof a contract that we have with you, and you fail to provide such Personal Information
when requested to do so, SCAF may be unable to perform in terms of the contract wehave in place or are trying to enter into with you. In this case, SCAF may be required
to terminate the contract and/or relationship, upon notification to you, which
termination will be done in accordance with the terms of the contract and all applicablelegislation.
In the clause above, you agree and accept that there is certain compulsory
Personal Information you must provide us with if you want to enjoy all of thefeatures and functionality on the Website. If you decide not to provide us withsuch compulsory Personal Information, you agree that we may limit certain
features and functionality on the Website.

Page 7
6.

SHARING OF YOUR PERSONAL INFORMATION

6.1

We will not intentionally disclose your Personal Information, whether for commercial
gain or otherwise, other than with your permission, as permitted by applicable law orin the manner as set out in this Privacy Policy.

6.2
6.2.1

SCAF may share your Personal Information under the following circumstances:with our agents, advisers, service providers and suppliers that have agreed to
be bound by this Privacy Policy or similar terms, which offer the same level asprotection as this Privacy Policy;

6.2.2

with our employees, suppliers, service providers, contractors and agents if andto the extent that they require such Personal Information in the provision ofservices for or to us, which include hosting, development and administration,technical support and other support services relating to the Website or theoperation of SCAF's business. We will authorise any Personal Information
processing done by a third party on our behalf, amongst other things by entering
into written agreements with those third parties governing our relationship withthem and containing confidentiality and non-disclosure provisions;

6.2.3

to enable us to enforce or apply any other contract between you and us;

6.2.4

to protect our rights, property or safety or that of our customers, employees,
contractors, suppliers, service providers, agents and any other third party;

6.2.5

to mitigate any actual or reasonably perceived risk to us, our customers,
employees, contractors, agents or any other third party;

6.2.6

with governmental agencies and other regulatory or self-regulatory bodies, if
required to do so by law or we reasonably believe that such action is necessary
to:6.2.6.1

comply with the law or with any legal process;6.2.6.2

protect and defend the rights, property or safety of SCAF, or ourcustomers, employees, contractors, suppliers, service providers, agentsor any third party;

6.2.6.3

detect, prevent or manage actual or alleged fraud, security breaches,
technical issues, or the abuse, misuse or unauthorised use of the Website
and contraventions of this Privacy Policy; andPage 86.2.6.4

protect the rights, property or safety of members of the public (if you
provide false or deceptive information or misrepresent yourself, we may
proactively disclose such information to the appropriate regulatory bodies
and/or commercial entities).

7.

STORAGE AND TRANSFER OF YOUR PERSONAL INFORMATION

7.1

We store your Personal Information on our servers or those of our service providers
and in hard copy format at our offices and at the storage facilities of our third-party
record storage and management providers.

7.2

We reserve the right to transfer to and/or store your Personal Information on servers
in a jurisdiction other than where it was collected, or outside of South Africa in ajurisdiction that may not have comparable data protection legislation.

7.3

If the location to which Personal Information is transferred and/or is stored does nothave substantially similar laws to those of South Africa, which provide for theprotection of Personal Information, we will take reasonably practicable steps,
including the imposition of appropriate contractual terms to ensure that your Personal
Information is adequately protected in that jurisdiction.

7.4

Please contact us if you require further information as to the specific mechanisms
used by us when transferring your Personal Information outside of South Africa or toa jurisdiction that is different to the one in which we collected your Personal
Information.

8.

SECURITY

8.1

We take reasonable technical and organisational measures to secure the integrity ofretained information and protect it from misuse, loss, alteration and destruction though
the use of accepted technological standards that prevent unauthorised access to or
disclosure of your Personal Information.

8.2

We also create a back-up of your information for operational and safety purposes.

8.3

We review our information collection, storage and processing practices, including
physical security measures periodically, to ensure that we keep abreast of goodpractice.

8.4

Despite the above measures being taken when Processing Personal Information, we
do not guarantee that your Personal Information is 100% secure.

Page 98.5

SCAF has implemented procedures to address actual and suspected data breaches
and undertakes to notify you and the relevant regulatory authorities of breaches ininstances in which SCAF is legally required to do so and within the period in whichsuch notification is necessary.
In this clause, you acknowledge that you know, and you accept that technology
is not absolutely secure and there is a risk that your Personal Information will
not be secure when processed by means of technology. We do not promise that
we can keep your Personal Information completely secure. You will not be able
to take action against us if you suffer losses or damages in thesecircumstances.

9.

RETENTION OF YOUR PERSONAL INFORMATION AND SPECIAL PERSONALINFORMATION

9.1

We may retain and Process some or all of your Personal Information if and for as long
as:

9.1.1

we are required or permitted by law, a code of conduct or a contract with you to
do so;

9.1.2

we reasonably need it for lawful purposes related to the performance of ourfunctions and activities;

9.1.3

we reasonably require it for evidentiary purposes; or

9.1.4

you agree to us retaining it for a specified further period.

9.2

To determine the appropriate retention period for Personal Information, SCAF willconsider, among other things, the nature and sensitivity of the Personal Information,
the potential risks or harm that may result from its unauthorised use or disclosure, thepurposes for which we process it and whether those purposes may be achieved
through other means. SCAF will always comply with applicable legal, regulatory, tax,
accounting or other requirements as they pertain to the retention of Personal
Information.

10.

MAINTENANCE OF YOUR PERSONAL INFORMATION AND SPECIAL PERSONALINFORMATION

10.1

In accordance with applicable legislation and the rules of SCAF, SCAF will take allnecessary steps to ensure that the persons responsible for the maintenance of your

Page 10
Personal Information do so in a manner that ensures that it is accurate, complete, notmisleading and is up to date.
10.2

It is your responsibility to advise SCAF or the persons responsible for the maintenanceof your Personal Information should any of Personal Information we have about you
be incorrect, incomplete, misleading or out of date, by notifying us at the contact
details set out in clause 18.1 below.

11.

YOUR RIGHTS

11.1

Data protection laws confer certain rights on you in respect of your Personal
Information, which include the right to:

11.1.1

Block all cookies, by setting your browser to do so, including cookies
associated with our products and services or to indicate when a cookie is being
sent by us.

11.1.2

Request access to your Personal Information (commonly known as a “datasubject access request”), thereby enabling you to receive a copy of the Personal
Information retained about you.

11.1.3

Request the correction of your Personal Information, in order to ensure that
any incomplete or inaccurate Personal Information is corrected.

11.1.4

Request erasure of your Personal Information, where there is no lawful basis
for the retention or continued processing of it.

11.1.5

Object to the processing of your Personal Information for legitimate interest(or those of a third-party) and there is something about your particular situation
which makes you want to object to processing on this ground as you feel it
impacts on your fundamental rights and freedoms.

11.1.6

Request restriction of processing of your Personal Information. This
enables you to ask SCAF to suspend the processing of your Personal
Information in limited circumstances, which may differ by jurisdiction.

11.1.7

Withdraw consent previously given in respect of the processing of your
Personal Information at any time which withdrawal of consent will not affectthe lawfulness of any processing carried out prior to your notice of withdrawal.
Withdrawal of consent may limit the ability of SCAF or a third-party to provide

Page 11certain products or services to you but will not affect the continued processingof your Personal Information in instances in which your consent is not required.
11.2

As far as the law allows, we may charge a fee for attending to any of the above
requests and may also refuse to carry out any of your requests in whole or in part.

12.

CHANGES TO THIS PRIVACY POLICYThis Privacy Policy may be amended from time to time and we will take reasonably
practicable steps to inform you when changes are made. Without limiting the mannerin which we may inform you, it could be that such notification may be by way of e-mail(if you provide your e-mail address when you register to use the Website), a "pop-up"
notification on the Website, or a notification when you access the Website.

13.

CHILDREN
The Website and SCAF's products and services are not targeted at children (a natural
person under the age of 18 years). We will not knowingly collect Personal Informationin respect of children without express permission to do so from a competent person(any person who is legally competent to consent to any action or decision being taken
in respect of any matter concerning a child).

14.

DIRECT MARKETING

14.1

When you register to use the Website, you may be required to provide your consent
to agree to receive marketing communication from us.

14.2

You may refuse to accept, require us to discontinue, or pre-emptively block any
approach or communication from us if that approach or communication is primarily forthe purpose of direct marketing (“direct marketing communications”).

14.3

You may opt out of receiving direct marketing communication from us at any time byrequesting us (in the manner set out in the communication or by contacting us at thecontact details set out in clause 18) to stop providing any direct marketing
communication to you.

14.4

If you have chosen to opt out, we may send you written confirmation of receipt of youropt out request (which may be in electronic form) and will thereafter not send any
further direct marketing communication to you. Please note that you may continue toreceive communication from SCAF that is not marketing related.

Page 1215.

THIRD PARTY SITES

15.1

This Privacy Policy does not apply to the websites of any other parties, or theapplications, products or services, such websites advertise, and which may be linked
to this Website, or websites that link to or advertise this Website. SCAF is not
responsible for the privacy practices of such third-party websites.

15.2

We advise you to read the privacy policy of each third-party website and decide
whether you agree to their privacy practices and policies, as these third-party websites
may also be collecting or sharing your Personal Information.
We are not liable if you suffer losses or damages when visiting third-party
websites by following a link to that website from this Website. You accept that
there may be risks when you use such third-party websites, and you do so at
your own risk.

16.

CONSUMER PROTECTION ACT, PROTECTION OF PERSONAL INFORMATIONACT AND OTHER LAWS

16.1

If this Privacy Policy or any provision in this Privacy Policy is regulated by or subject
to the Consumer Protection Act, the Protection of Personal Information Act, 2013("POPIA") or other laws, it is not intended that any provision of this Privacy Policy
contravenes any provision of the Consumer Protection Act, POPIA or such other laws.
Therefore, all provisions of this Privacy Policy must be treated as being qualified, tothe extent necessary, to ensure that the provisions of the Consumer Protection Act,
POPIA and such other laws are complied with.

16.2
16.2.1

No provision of this Privacy Policy:
does or purports to limit or exempt us from any liability (including, without
limitation, for any loss directly or indirectly attributable to our gross negligenceor wilful default or that of any other person acting for or controlled by us) to theextent that the law does not allow such a limitation or exemption;

16.2.2requires you to assume risk or liability for the kind of liability or loss, to the extent
that the law does not allow such an assumption of risk or liability; or

16.2.3limits or excludes any warranties or obligations which are implied into thisPrivacy Policy by the Consumer Protection Act (to the extent applicable), POPIA(to the extent applicable), or other applicable laws or which we give under theConsumer Protection Act (to the extent applicable), POPIA (to the extent

Page 13applicable), or other applicable laws, to the extent that the law does not allow
them to be limited or excluded.
17.

GENERAL

17.1

You agree that this Privacy Policy our relationship and any dispute of whatsoever
nature relating to or arising out of this Privacy Policy whether directly or indirectly isgoverned by South African law, without giving effect to any principle of conflict of laws.

17.2

Our failure to exercise or enforce any right or provision of this Privacy Policy shall notconstitute a waiver of such right or provision.

17.3

Each provision of this Privacy Policy, and each part of any provision, is removableand detachable from the others. As far as the law allows, if any provision (or part of aprovision) of this Privacy Policy is found by a court or authority of competentjurisdiction to be illegal, invalid or unenforceable (including without limitation, because
it is not consistent with the law of another jurisdiction), it must be treated as if it was
not included in this Privacy Policy and the rest of this Privacy Policy will still be valid
and enforceable.

18.

QUERIES AND CONTACT DETAILS OF THE INFORMATION REGULATOR

18.1

Should you feel that your rights in respect of your Personal Information have been
infringed, please address your concerns to the SCAF Information Officer or the SCAF
Legal Department.

18.2

Postal Address:

P.O. Box 522795, Saxonwold, 2132

E-mail address:

popiaqueries.jhb@sumitomocorp.com

Fax number:+27-(0)11-784-9122/9123

If you feel that the attempts by SCAF to resolve the matter have been inadequate,
you may lodge a complaint with the South African Information Regulator by accessing
their website at https://inforegulator.org.za/.