Data Privacy & Protection Policy

Global Manufacturing Africa (Pty) Ltd ("GMA", "we", "our", "us") is committed to protecting the privacy and personal data of all individuals with whom we interact. This Policy is designed to comply with the Protection of Personal Information Act 4 of 2013 ("POPIA") — Republic of South Africa; the General Data Protection Regulation (EU) 2016/679 ("GDPR") — European Union; and the UK General Data Protection Regulation ("UK GDPR") and Data Protection Act 2018 — United Kingdom.

Part A — South Africa: POPIA Compliance

A1. Responsible Party Details

• Responsible Party: Global Manufacturing Africa (Pty) Ltd
• Registration No: K2025753377
• Address: SARU House, Tyger Valley, Cape Town, South Africa
• Information Officer: Timothy Manners-Wood
• Contact: [email protected]

A2. Personal Information We Collect

We collect: full name; ID or registration number; contact details (email, phone, address); banking details (for payment only); purchase and order history; CRM and communication records; website usage data (IP address, device info).

We do not intentionally collect special personal information (race, health, religion, political views) unless specifically required and consented to.

A3. Lawful Grounds for Processing

We process personal information on the following grounds:

• (a) Performance of a contract — to fulfil sales, warranties, and partner agreements;
• (b) Legal obligation — tax, regulatory, and compliance requirements;
• (c) Legitimate interest — fraud prevention, business operations, security;
• (d) Consent — marketing communications (opt-in only, withdrawable at any time).

A4. Purpose Limitation

Personal information is collected only for the specific purposes listed and will not be used for any incompatible secondary purpose without fresh consent or another lawful basis.

A5. Data Sharing

We share personal information only with: payment processors and banks; logistics and freight providers; authorised cloud and CRM service providers (subject to processing agreements); regulatory and law enforcement authorities (where legally required).

We do not sell personal information to any third party.

A6. Cross-Border Transfers

Where personal information is transferred outside South Africa, we ensure the recipient country or organisation provides an adequate level of protection equivalent to POPIA, or we put appropriate contractual safeguards in place.

A7. Data Subject Rights (POPIA)

You have the right to:

• (a) Access your personal information (POPIA s23)
• (b) Request correction of inaccurate information (s24)
• (c) Object to processing (s11(3))
• (d) Request deletion where no longer necessary
• (e) Lodge a complaint with the Information Regulator

Information Regulator: www.justice.gov.za/inforeg | [email protected]

A8. Retention

Personal information is retained for as long as necessary to fulfil the purpose for which it was collected, or as required by law (minimum 5 years for financial records). After the retention period, data is securely destroyed or anonymised.

A9. Security

GMA implements appropriate technical and organisational measures including: encryption in transit and at rest; role-based access controls; audit logging; regular security assessments; incident response protocols.

A10. Data Breach Notification

In the event of a data breach that poses a risk of harm to data subjects, GMA will notify the Information Regulator and affected data subjects as required by POPIA s22, within the prescribed timeframe.

Part B — European Union: GDPR Compliance

B1. Scope

This Part applies where GMA processes personal data of individuals located in the European Union (EU), regardless of where GMA is located, in connection with offering goods or services to EU data subjects, or monitoring their behaviour.

B2. Data Controller Details

• Data Controller: Global Manufacturing Africa (Pty) Ltd
• EU Representative (Art. 27): To be appointed
• Contact: [email protected]

B3. Lawful Bases Under GDPR (Art. 6)

• (a) Contract — processing necessary for performance of a contract with the data subject;
• (b) Legal obligation — compliance with applicable law;
• (c) Legitimate interests — where GMA's interests are not overridden by data subject rights;
• (d) Consent — freely given, specific, informed, and unambiguous consent for marketing.

B4. Data Subject Rights (GDPR)

EU data subjects have the right to: access (Art. 15); rectification (Art. 16); erasure / "right to be forgotten" (Art. 17); restriction of processing (Art. 18); data portability (Art. 20); object to processing (Art. 21); withdraw consent at any time.

Requests must be responded to within 30 days. Contact: [email protected]

B5. International Data Transfers (GDPR)

Transfers of personal data from the EU to GMA in South Africa are subject to the adequacy decision framework or, where not available, are governed by Standard Contractual Clauses (SCCs) approved by the European Commission.

B6. Data Protection Officer (DPO)

GMA will assess whether appointment of a DPO is required under GDPR Art. 37. Where required, DPO contact details will be published on the GMA website and notified to the relevant supervisory authority.

B7. Supervisory Authority

EU data subjects have the right to lodge a complaint with their national supervisory authority. A list of EU supervisory authorities is available at: edpb.europa.eu

Part C — United Kingdom: UK GDPR Compliance

C1. Scope

This Part applies where GMA processes personal data of individuals located in the United Kingdom, in connection with offering goods or services to UK data subjects.

C2. UK Representative

UK Representative (s27 UK GDPR): To be appointed if GMA has ongoing processing of UK data subjects. Contact: [email protected]

C3. UK Data Subject Rights

UK data subjects have the same rights as EU data subjects under Part B above, exercisable under the UK GDPR and Data Protection Act 2018.

UK supervisory authority: Information Commissioner's Office (ICO) | ico.org.uk | 0303 123 1113

C4. UK International Transfers

Transfers of UK personal data to GMA in South Africa will be governed by the UK's International Data Transfer Agreement (IDTA) or other mechanisms approved by the ICO.

Part D — Cookies and Website

D1. Cookies

GMA's website uses essential cookies for functionality only. We do not use advertising or tracking cookies without explicit consent. Users may manage cookie preferences through their browser settings. A cookie consent banner is displayed on first visit.

D2. Third Party Links

Our website may contain links to third-party websites. We are not responsible for the privacy practices of third-party sites and encourage users to read their privacy policies.

Part E — General Provisions

E1. Policy Updates

This Policy will be reviewed at least annually and updated as required by changes in law or GMA's operations. The current version is always available at globalmanufacturing.africa and upon request.

E2. How to Exercise Your Rights

To exercise any right under this Policy, contact: [email protected]
We will respond within 30 days (GDPR/UK GDPR) or as required by POPIA.