PRIVACY POLICY

1. Introduction

Value Capital ("we", "us", "our") is committed to protecting the privacy and security of the personal information you provide to us. This Privacy Policy describes how we collect, use, store, share and protect your personal information when you visit our website, register a member account, make investments, or otherwise interact with our services (collectively, the "Platform").

This Policy should be read together with our Terms and Conditions, Risk Disclosure and Cookie Policy. Where there is any conflict between this Policy and applicable data protection law, the law prevails.

By using the Platform, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with it, please do not use the Platform.

2. Who We Are (Responsible Party)

For the purposes of the Protection of Personal Information Act, 2013 (POPIA), Value Capital is the responsible party (data controller) in respect of the personal information processed through the Platform.

Our registered details and Information Officer are available on request and will be updated on the Platform from time to time. You may contact our Information Officer using the details in Section 17 for any matter relating to this Policy or your personal information.

3. Information We Collect

We may collect the following categories of personal information:

• Identity information — full name, date of birth, nationality, identity or passport number, and identity document images;
• Contact information — email address, mobile number, physical address and postal address;
• Account information — username, password (stored in encrypted form), account preferences and security settings;
• Financial information — bank account details, payment method details, transaction history, investment activity, deposits and withdrawals;
• Verification information — proof of address, proof of income or source of funds, and other KYC documentation required by law;
• Technical information — IP address, device type, browser type, operating system, session data and general location data;
• Usage information — pages viewed, features used, actions taken on the Platform and interactions with our support team;
• Communications — records of emails, chat messages, support tickets and any other correspondence with us.

We do not intentionally collect more information than is reasonably necessary for the purposes described in this Policy.

4. How We Collect Your Information

We collect personal information in the following ways:

• Directly from you — when you register an account, complete forms, submit verification documents, contact support or communicate with us;
• Automatically — through your use of the Platform, including through cookies, log files and similar technologies (see Section 8);
• From third parties — such as identity verification providers, payment service providers, banks, credit reference agencies and fraud prevention services, where permitted by law;
• From publicly available sources — where necessary for verification, fraud prevention or compliance purposes.

5. Why We Use Your Information

We use your personal information for the following purposes:

• To create, manage, verify and secure your Account;
• To process deposits, withdrawals, investments and related transactions;
• To comply with legal obligations, including anti-money laundering (AML), counter-terrorist financing (CTF), KYC and tax reporting requirements;
• To detect, prevent and investigate fraud, abuse and unlawful activity;
• To provide customer support and respond to enquiries;
• To administer incentives, referral rewards and promotions (see the Terms and Conditions);
• To improve, personalise and develop the Platform and its features;
• To send service-related communications, security alerts and, where you have opted in, marketing communications;
• To enforce our Terms and Conditions and protect our legal rights;
• To comply with requests from regulators, courts or law enforcement where legally required.

Where we wish to use your information for a new purpose not covered by this Policy, we will inform you and, where required, obtain your consent.

6. Legal Basis for Processing

We process your personal information on one or more of the following legal bases:

• Performance of a contract — where processing is necessary to provide the Platform and services you have requested;
• Legal obligation — where processing is required to comply with applicable laws such as AML, CTF and tax laws;
• Legitimate interests — where processing is necessary for our legitimate business interests, such as fraud prevention, security and platform improvement, provided your rights are not overridden;
• Consent — where you have given us clear consent, for example to receive marketing communications or to process certain special categories of information;
• Vital interests — where processing is necessary to protect your vital interests or those of another person.

7. Sharing Your Information

We do not sell your personal information. We may share it, on a need-to-know basis, with:

• Service providers — such as payment processors, banking partners, identity verification providers, cloud hosting providers, IT support and communication platforms, all under written agreements requiring them to protect your information;
• Professional advisers — such as auditors, legal advisers and insurers where necessary;
• Regulators and authorities — such as the Financial Sector Conduct Authority, the Information Regulator, tax authorities, courts and law enforcement, where legally required;
• Fraud prevention and credit reference agencies — where necessary to protect the integrity of the Platform and comply with applicable law;
• Affiliates and successors — in the event of a merger, acquisition, restructuring or sale of assets, in which case we will take reasonable steps to ensure your information continues to be protected.

Where we share information with third parties, we take reasonable steps to ensure they apply appropriate safeguards and process your information only for the purposes for which it was shared.

8. Cookies & Similar Technologies

We use cookies and similar technologies to operate the Platform, remember your preferences, keep you logged in securely, analyse usage and improve your experience. The types of cookies we may use include:

You can manage or disable non-essential cookies through your browser settings. Disabling strictly necessary cookies may prevent parts of the Platform from working correctly. For further detail, please refer to our Cookie Policy.

9. Data Retention

We retain personal information only for as long as is necessary to fulfil the purposes for which it was collected, to comply with legal, regulatory, tax and accounting requirements, and to resolve disputes.

• Account and transaction records — typically retained for at least five (5) years after the end of the relationship or as required by applicable law;
• KYC and verification records — retained for as long as required by AML and CTF legislation;
• Marketing preferences — retained until you withdraw consent or unsubscribe;
• Technical and log data — retained for a limited period for security and analytical purposes.

When information is no longer needed, we will securely delete, anonymise or archive it in accordance with applicable law.

10. Data Security

We take the security of your personal information seriously and implement appropriate technical and organisational measures to protect it against unauthorised access, loss, misuse, alteration or destruction. These measures include:

• Encryption of data in transit using industry-standard protocols (HTTPS/TLS);
• Encryption of sensitive data at rest where appropriate;
• Access controls, authentication and role-based permissions for staff;
• Ongoing monitoring, logging and regular security reviews;
• Staff training on data protection and confidentiality;
• Written agreements with service providers requiring appropriate safeguards.

11. Your Rights

Subject to applicable law, you have the following rights in relation to your personal information:

To exercise any of these rights, please contact us using the details in Section 17. We may need to verify your identity before acting on your request. We will respond within the timeframe required by applicable law, and where a request cannot be fulfilled we will explain why.

12. Children's Privacy

The Platform is not intended for use by anyone under the age of 18. We do not knowingly collect personal information from children. If you believe that a child has provided personal information to us, please contact us so that we can take appropriate steps to delete it.

13. Cross-Border Transfers

Some of our service providers, including cloud hosting and payment partners, may store or process your personal information outside the Republic of South Africa. Where we transfer personal information across borders, we will do so only where:

• The recipient is subject to laws or binding agreements that provide an adequate level of protection comparable to POPIA;
• You have consented to the transfer; or
• The transfer is otherwise permitted by applicable law.

14. Third-Party Links & Services

The Platform may contain links to third-party websites or services that are not owned or controlled by us. This Privacy Policy does not apply to those third parties. We encourage you to review the privacy policies of any third-party service you access. We are not responsible for the privacy practices or content of external sites.

15. Data Breaches

We have procedures in place to detect, investigate and respond to personal data breaches. Where a breach poses a risk to your rights or interests, we will notify you and the relevant regulator, including the Information Regulator of South Africa, as required by applicable law, and take reasonable steps to mitigate the impact.

16. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal or regulatory requirements. Where we make material changes, we will provide reasonable notice by posting the updated Policy on the Platform and, where appropriate, by additional notification.

The updated Policy takes effect from the date stated at the top of the page. We encourage you to review this Policy periodically to stay informed about how we protect your information.