Platform Privacy Policy

This Privacy Policy applies to all Clients, Suppliers, and visitors who access or use the Entegri Connect Platform. It explains what personal information we collect, why we collect it, who we share it with, where it is stored, and what rights you have.

If you do not agree with this Policy you should not register on or use the Platform.

1. WHO WE ARE AND HOW TO CONTACT US

Responsible Party (Controller): Entegri Connect (Pty) Ltd, registration number 2026/674044/07, incorporated in the Republic of South Africa on 24 August 2026, of 477 Jan Bantjies Road, Sinoville, Pretoria, Gauteng, 0129, South Africa.

Information Officer: Rayno Loubser, rayno@entegri.net. Registered with the Information Regulator of South Africa on 2 September 2026, registration number 2026-065740.

General and privacy contact: info@entegri.net

EU Representative (Article 27 GDPR): Christiaan Josua Opperman, Casa Alfazema, Estrada do Cerro da Maio, Loulé, Portugal, 8100-326; christo@punchlinep.com

UK Representative (Article 27 UK GDPR): The Platform is not currently offered to Clients located in the United Kingdom. If this changes, Entegri Connect will appoint a UK representative where required and update this Policy before accepting UK registrations.

Except where this Policy or the Mutual Non-Disclosure and POPIA Agreement expressly states otherwise, we are the responsible party under the Protection of Personal Information Act 4 of 2013 (“POPIA”) for personal information processed in operating the Platform. Where we act as an operator for Workspace Documents, or where another Platform user acts as an independent responsible party, the allocation of roles is described in this Policy and the Mutual Non-Disclosure and POPIA Agreement. Where we process the personal information of individuals located in the European Economic Area or the United Kingdom, we are also the controller or processor, as applicable, for the purposes of the EU General Data Protection Regulation and the UK GDPR (together, “GDPR”), as explained in clause 11.

2. WHO THIS POLICY COVERS

This Policy covers:

2.1 Suppliers, being professional services providers registered on the Platform, and the individuals who represent them.

2.2 Clients, being organisations and, where permitted, individuals who post Service Requirements on the Platform, and the individuals who represent them. Clients may be located in South Africa or in other countries.

2.3 Visitors to the Platform who have not registered.

2.4 Third-party individuals whose personal information a Client or Supplier discloses to us or through the Platform, such as directors, employees, and beneficial owners.

This Policy does not cover personal information that a Supplier collects and processes in its own right in the course of performing an Engagement for a Client. In that context the Supplier is an independent responsible party and its own privacy policy applies. The allocation of roles is set out in clause 8 of the Mutual Non-Disclosure and POPIA Agreement.

3. WHAT PERSONAL INFORMATION WE COLLECT

3.1 Information you give us

From Suppliers: full name or company name, registration or identity number, physical and postal address, email address and telephone number, professional registrations and membership numbers, credential and qualification documents, tax compliance status and SARS details including TCS PIN, banking details, professional indemnity insurance details, service descriptions, experience, bid proposals, and Platform communications.

From Clients: full name or company name, registration or identity number, physical and postal address, email address and telephone number, VAT number, service requirements, payment information, and Platform communications.

From both: documents uploaded to a workspace in the course of an Engagement, which may contain financial records, working papers, and personal information relating to third parties.

3.2 Information we collect automatically

Platform access logs, IP address, device and browser information, cookies and similar technologies (see the Cookie Policy), and records of your activity on the Platform.

3.3 Information we obtain from others

Verification data obtained from professional bodies, regulators, and public registers for the purpose of confirming the credentials and standing that a Supplier has claimed. We do not currently use a bank account verification service. If one is introduced, this Policy and Annexure A will be updated before use, and we may then obtain confirmation from that service that account details supplied match the relevant identity details.

3.4 Special personal information and children

3.4.1 We do not seek to collect special personal information as defined in section 26 of POPIA (information about religious or philosophical beliefs, race or ethnic origin, trade union membership, political persuasion, health or sex life, or biometric information), or special category data under the GDPR. Where a criminal record disclosure or similar information is necessary for credential verification, we will collect and process it only with your express consent or on another lawful basis under section 27 of POPIA, and we will tell you before we do so.

3.4.2 The Platform is not intended for children. You must be at least 18 years old to register. We do not knowingly collect the personal information of a child as defined in POPIA. If we become aware that we hold such information without the lawful basis required by section 34 of POPIA, we will delete it.

3.4.3 You must not upload to a workspace any special personal information or information relating to a child unless you have a lawful basis to disclose it and have told us in advance.

4. HOW WE USE YOUR PERSONAL INFORMATION AND OUR LAWFUL BASIS

We process personal information only where we have a lawful basis. The table below sets out each purpose and the basis we rely on.

Withdrawing consent. Where we rely on your consent, you may withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal. Withdrawing consent for an optional feature, such as non-essential cookies, does not affect your Platform access. We cannot continue to provide the Platform to you if you withdraw from the processing that is necessary to perform our contract with you, in which case you may close your account under clause 12.3.

Registration is not blanket consent. Ticking the acceptance box confirms that you have read and understood this Policy. It is not, and is not relied on as, consent to every processing activity described in it. Consent is sought separately, and only where consent is the basis relied on.

5. THE MARKETPLACE MODEL: WHO CAN SEE WHAT

5.1 When a Client posts a Service Requirement, it is visible to registered Suppliers eligible for the relevant discipline, and to Entegri Connect.

5.2 A Supplier’s Profile is visible to Clients browsing the Platform. Supplier direct contact details are withheld from Client view until a Bid has been accepted. This restriction is enforced at the data layer, not only in the user interface.

5.3 Bids are visible to the Client who posted the Service Requirement, and to Entegri Connect. Bids are not visible to other Suppliers.

5.4 Following Bid acceptance, both parties receive each other’s contact details. From that point each party holds the other’s contact details as an operator on our instructions, under Part B of the Mutual Non-Disclosure and POPIA Agreement.

5.5 Documents uploaded to an Engagement workspace are visible to the parties to that Engagement and to authorised Entegri Connect personnel who require access to operate and support the Platform.

6. AI-ASSISTED FEATURES

6.1 The Platform offers optional AI-assisted drafting features, which help you generate or improve text such as a Service Requirement description, a Supplier profile summary, or a note accompanying a quote.

6.2 These features are provided using a third-party AI service. Where you use them, the text you submit and the text generated in response are transmitted to and processed by that provider outside South Africa. The provider is named in Annexure A.

6.3 We use these features on a paid commercial service tier under which the provider is contractually prohibited from using your content to train or improve its models, and under which the provider’s personnel do not review submitted content for product-improvement purposes. We do not use free or consumer tiers of any AI service for Platform data.

6.4 AI-assisted features are optional. They operate only when you choose to invoke them. They are not applied automatically to your content, and they are not used to evaluate you, to score you, or to make any decision about you.

6.5 Do not submit personal information about third parties, client-confidential financial information, or working papers to an AI-assisted feature. The features are intended for descriptive and marketing text only.

6.6 Text generated by an AI-assisted feature is a draft. You remain responsible for its accuracy and for everything you publish on the Platform, as set out in the Website Terms of Use.

6.7 We may discontinue or change AI-assisted features at any time. Where we change the provider, we will update Annexure A and notify you in accordance with clause 17.

7. AUTOMATED DECISION-MAKING

7.1 The Platform operates an eligibility engine that determines automatically which disciplines a Supplier may bid on, based on the credentials the Supplier has uploaded, the verification status of those credentials, and the requirements applicable to the relevant discipline and, where applicable, the Public Interest Score band.

7.2 This is automated processing. It can result in a Supplier being unable to bid on a particular Service Requirement.

7.3 Under section 71 of POPIA and Article 22 of the GDPR you have the right not to be subject to a decision based solely on automated processing that has legal consequences for you or affects you to a substantial degree. Accordingly:

7.3.1 the eligibility engine applies published, objective rules derived from the requirements of professional bodies and applicable legislation;

7.3.2 you may request in writing an explanation of why a particular eligibility outcome was reached;

7.3.3 you may request human review of any eligibility outcome by writing to info@entegri.net, and a person, not the system, will reconsider it;

7.3.4 you may make representations and submit further credentials in support of that review; and

7.3.5 the outcome of the review is a Platform Dispute under the Platform Dispute Resolution Policy if you remain dissatisfied.

7.4 We do not use automated processing to profile you for marketing purposes, and we do not sell or license any profile derived from your Platform activity.

8. DIRECT MARKETING

8.1 We will send you electronic direct marketing only where you have consented, or where section 69(3) of POPIA permits it because you are an existing customer, the marketing relates to similar products or services, and you were given an opportunity to object when we collected your details.

8.2 Every marketing communication contains a clear and free means of opting out. Opting out of marketing does not affect service messages about your account, which we must send to operate the Platform.

8.3 Where we send marketing to a recipient in the European Economic Area or the United Kingdom, we do so only on the basis permitted by the applicable ePrivacy rules, which for most recipients means prior consent.

8.4 Where we send marketing to a recipient in the United States, each message will identify itself as a commercial communication, include our valid physical postal address, and honour an opt-out request within ten business days, as required by the CAN-SPAM Act.

8.5 We do not sell, rent, or licence your personal information to any third party for that party’s own marketing.

9. WHO WE SHARE YOUR PERSONAL INFORMATION WITH

9.1 We do not sell your personal information.

9.2 We share personal information only:

9.2.1 with other Platform users, including Entegri Enterprises (Pty) Ltd where it participates as a Supplier, as described in clauses 5 and 16;

9.2.2 with the service providers listed in Annexure A, each of which processes personal information on our documented instructions as an operator under section 20 and 21 of POPIA, and as a processor under Article 28 of the GDPR where applicable, under a written agreement imposing confidentiality and security obligations;

9.2.3 with professional bodies, regulators, and public registers, for the purpose of verifying credentials and standing that you have claimed;

9.2.4 with our professional advisers, auditors, and insurers, where they are bound by professional obligations of confidentiality;

9.2.5 with a purchaser or successor in title, in connection with a sale, merger, or reorganisation of our business, subject to that party accepting obligations no less protective than this Policy, and subject to notice to you; and

9.2.6 where required by law, court order, or a lawful request from a regulator or revenue authority. Where we are lawfully permitted to do so, we will notify you before responding to such a request.

9.3 A current list of our operators and sub-processors, the purpose each serves, and the country in which each processes personal information, is set out in Annexure A. We will update Annexure A whenever a provider changes, and will notify registered users of a material change at least thirty days in advance where practicable, so that you may object.

10. WHERE WE STORE AND PROCESS PERSONAL INFORMATION

10.1 We do not host the Platform in South Africa. No major managed hosting, managed database, or object storage provider we have assessed offers a South African region on the service tiers the Platform uses. We state this plainly rather than implying local storage.

10.2 Personal information collected through the Platform is stored and processed in the following locations:

10.3 Backups are held in the same region as the primary system unless stated otherwise in Annexure A.

10.4 Our hosting region policy. We have selected a European Union hosting region for the Platform’s core infrastructure. We did so deliberately. The European Union is widely recognised as providing a level of protection for personal information comparable to that required by POPIA, which satisfies section 72(1)(a), and it means that personal information originating with Clients established in the European Economic Area or the United Kingdom does not leave that protection when it is stored.

10.4.1 Two things follow from this and are dealt with in clause 11. First, moving personal information from South Africa to the European Union is a cross-border transfer under POPIA, made lawfully on the grounds in clause 11.1. Second, our own access to the Platform from South Africa is, for personal information originating in the EEA or the UK, an export out of the European Union, dealt with in clause 11.4.

10.4.2 The Cloudflare R2 bucket used for uploaded documents has its location set to Western Europe (WEUR). This storage location is disclosed separately from the Frankfurt locations used for the application and database so that users can see the provider-specific storage arrangement.

10.4.3 A development database previously existed in AWS us-east-1 (Northern Virginia, United States), separate from the Frankfurt production database. It has been deleted. All Platform database records now sit in Frankfurt, Germany.

10.5 Entegri Connect personnel access the Platform from South Africa. Access is role-based, logged, and subject to the controls described in our Information Security Statement.

11. CROSS-BORDER TRANSFERS OF PERSONAL INFORMATION

11.1 The Platform is hosted in the European Union, so personal information you provide is transferred across South Africa’s borders. Section 72 of POPIA permits such a transfer only on one of the grounds set out in that section. We rely on the following:

11.1.1 Section 72(1)(a): the recipient is subject to a law, binding corporate rules, or a binding agreement that provides an adequate level of protection, upholds principles for the lawful processing of personal information substantially similar to POPIA’s conditions, and includes provisions substantially similar to section 72 for onward transfers. The core Platform infrastructure is hosted in the European Union and is therefore subject to the GDPR, which meets this standard. Each provider in Annexure A is additionally engaged under a written data processing agreement imposing these obligations.

11.1.2 Certain ancillary services listed in Annexure A may process limited personal information outside the European Union. Google services used for optional AI-assisted drafting and Google Sign-In may process information in the United States and other Google regions. Scanii processes uploaded files for malware scanning in its Ireland (EU) processing region. Each provider is engaged under a written data processing agreement imposing appropriate confidentiality, security, and transfer safeguards, and receives only the categories of information described in Annexure A rather than the Platform’s records as a whole.

11.1.3 Section 72(1)(b): where the transfer is necessary for the performance of a contract between you and us. Hosting your account, your Service Requirements or Bids, and your workspace documents is necessary to provide the Platform to you.

11.1.4 Section 72(1)(c) and (d): where the transfer is necessary for the conclusion or performance of a contract concluded in your interest between us and a third party.

11.2 We do not rely on your consent alone as the basis for cross-border transfer of the personal information necessary to operate the Platform, because consent under section 72(1)(e) must be specific and freely given and cannot properly be bundled into a registration tick box. Optional features, such as AI-assisted drafting, involve a transfer only when you choose to use them, and you can decline them without losing access to the Platform.

11.3 Where personal information is transferred from the European Economic Area or the United Kingdom to a country or recipient for which applicable data-protection law requires additional safeguards, we will put an appropriate lawful transfer mechanism in place before the transfer occurs. Depending on the circumstances, this may include the European Commission’s Standard Contractual Clauses, the UK International Data Transfer Agreement or Addendum, or another legally recognised safeguard, together with any required transfer-risk assessment. Copies of any applicable terms are available on request from the Information Officer.

11.4 Where you or your Client is located outside South Africa, personal information you upload may also be accessed by us in South Africa. South Africa has comprehensive data protection legislation in POPIA and an independent supervisory authority in the Information Regulator, but it has not been the subject of a European Commission adequacy decision. Where a transfer from the European Economic Area or the United Kingdom to Entegri Connect in South Africa requires an additional transfer safeguard, Entegri Connect will ensure the appropriate mechanism described in clause 11.3 is in place before the relevant transfer occurs.

12. HOW LONG WE KEEP PERSONAL INFORMATION

12.1 We keep personal information only for as long as we have a lawful purpose for holding it. Our retention periods are:

12.2 Workspace documents. We will give the parties to an Engagement at least thirty days’ notice before deleting workspace documents at the end of the twelve-month tail, and will provide an export facility so that you can retain your own copy. Deletion means deletion of the underlying object in our storage, and purging of that object from backups in the ordinary backup rotation cycle, in accordance with section 14(5) of POPIA. Signed engagement letters are never automatically deleted.

12.3 Account closure. You may close your account at any time by writing to info@entegri.net. On closure we will: deactivate your account within five business days; delete or de-identify personal information for which we no longer have a lawful purpose; and retain the remainder for the periods in the table above. We will confirm in writing what has been deleted and what has been retained, and why.

12.4 Where a legal hold applies because of actual or anticipated litigation, a regulatory investigation, or a lawful request, retention is extended for the duration of that hold, and we will tell you that this has happened where we are lawfully permitted to do so.

12.5 Where we retain information because a retention period has not expired, we restrict access to it so that it is used only for the purpose that justifies its retention.

13. SECURITY

13.1 We implement appropriate, reasonable technical and organisational measures as required by section 19 of POPIA and Article 32 of the GDPR. These include encryption of data in transit using TLS 1.2 or higher, encryption at rest, role-based access control, multi-factor authentication on administrative accounts, file type and size restrictions, separation of production from development environments, audit logging, and personnel confidentiality and security-awareness requirements. Uploaded files are scanned for malware through Scanii before being made available to other users.

13.1A Documents you upload are stored in a private object store on ISO/IEC 27001-certified infrastructure, encrypted at rest, and are accessible only through short-lived signed links issued to the parties to the relevant Engagement. Our use of certified infrastructure does not mean that Entegri Connect is itself ISO/IEC 27001 certified. It is not, and clause 13.3 says so.

13.2 A fuller description of our controls is set out in our Information Security Statement, which is available on request to Clients, Suppliers, and prospective counterparties conducting due diligence.

13.3 We do not currently hold ISO/IEC 27001, SOC 2, or equivalent third-party certification. Our infrastructure providers hold their own certifications, but our use of certified infrastructure does not make Entegri Connect certified, and we do not claim that it does.

13.4 No system is completely secure. You are responsible for keeping your login credentials confidential and for notifying us immediately at info@entegri.net of any unauthorised use of your account.

14. IF SOMETHING GOES WRONG: SECURITY COMPROMISE NOTIFICATION

14.1 Where there are reasonable grounds to believe that your personal information has been accessed or acquired by an unauthorised person, we will notify the Information Regulator of South Africa and the affected data subjects as soon as reasonably possible after discovering the compromise, as required by section 22 of POPIA, unless a public body or the Regulator directs us to delay in order to protect a criminal investigation.

14.2 Where the compromise affects personal information subject to the GDPR, we will notify the competent supervisory authority without undue delay and, where feasible, within seventy-two hours of becoming aware of it, and will notify affected individuals without undue delay where the breach is likely to result in a high risk to their rights and freedoms.

14.3 Our notification will describe, to the extent then known, the nature of the compromise, the categories and approximate number of individuals and records affected, the likely consequences, the measures taken or proposed, and the contact point for further information.

14.4 To report a suspected security breach or privacy concern, contact info@entegri.net, marked for the attention of the Information Officer. We will acknowledge receipt within twenty-four hours.

15. YOUR RIGHTS

15.1 Rights available to everyone under POPIA

Access. To be told whether we hold personal information about you, and to request a copy. A request under section 23 of POPIA is made using Form 2 – Request for Access to Record, prescribed under regulation 7 of the PAIA Regulations, 2021, as described in our PAIA Manual. A prescribed fee may apply to the copy, but not to confirmation of whether we hold personal information about you.

Correction. To require us to correct or delete personal information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading, or obtained unlawfully, under section 24.

Deletion. To request deletion of personal information we are no longer authorised to retain, subject to the retention obligations in clause 12.

Objection. To object, on reasonable grounds, to processing we carry out on the basis of legitimate interests, under section 11(3).

Withdrawal of consent. Where consent is the basis we rely on, to withdraw it at any time.

Not to be subject to a solely automated decision. As described in clause 7.

Complaint. To lodge a complaint with the Information Regulator, as described in clause 18.

15.2 Additional rights where the GDPR applies to you

If you are located in the European Economic Area or the United Kingdom, you additionally have the right to:

Restrict processing in the circumstances set out in Article 18, for example while the accuracy of your information is being verified;

Data portability, being the right to receive the personal information you provided to us in a structured, commonly used, machine-readable format, and to have it transmitted to another controller where technically feasible, under Article 20;

Object to processing carried out on the basis of legitimate interests, and to object at any time and without needing to give reasons to processing for direct marketing purposes, under Article 21; and

Lodge a complaint with your local supervisory authority, in addition to any complaint to the Information Regulator of South Africa.

15.3 How to exercise your rights

15.3.1 Write to our Information Officer at rayno@entegri.net. Tell us which right you wish to exercise and give us enough information to identify you and locate the records.

15.3.2 We may ask you to verify your identity before we act. We will not use the information you give us for verification for any other purpose.

15.3.3 We will respond within thirty days of receiving your request, or within one month where the GDPR applies, and will tell you if we need to extend that period and why.

15.3.4 We do not charge for responding to a request, except for the prescribed PAIA fee for copies of records, and except where a request is manifestly unfounded or excessive, in which case we will tell you before charging anything.

15.3.5 If we decline a request, we will tell you why, and tell you how to complain.

16. CONFLICT OF INTEREST DISCLOSURE

16.1 Entegri Connect (Pty) Ltd operates the Platform and does not provide professional services. Entegri Enterprises (Pty) Ltd, registration number 2013/137202/07, is a separate company that practises as a professional services firm. The two companies are related, share a director, and in some cases share personnel.

16.2 Entegri Enterprises may register on the Platform as a Supplier and bid on Service Requirements on the same terms as any other Supplier. The Client decides which Bid, if any, to accept. The safeguards that apply are set out in the Related Company Terms.

16.3 Entegri Enterprises receives personal information through the Platform only in the way any Supplier does: it can see Service Requirements open to its eligible disciplines, and it receives a Client’s contact details only if that Client accepts its Bid. We do not give Entegri Enterprises other Suppliers’ Bids, pricing or Profile content, and we do not use Client Service Requirements, Supplier Bids or Supplier Profile content as commercial intelligence for Entegri Enterprises.

16.4 Where an individual who works for both companies performs Platform operations, support or administration, they do so for Entegri Connect under a written operator agreement between the two companies, as listed in Annexure A, and may not use Platform information for Entegri Enterprises’ own purposes. Personal information that Entegri Enterprises obtains in its own professional work outside the Platform is not used for Platform purposes.

17. CHANGES TO THIS POLICY

17.1 We may update this Policy to reflect changes in our processing, our providers, our legal obligations, or Platform functionality.

17.2 We will notify registered users of material changes by email and by a notice on the Platform at least thirty days before the changes take effect. A change of operator or sub-processor in Annexure A is a material change.

17.3 The version number and effective date at the top of this Policy indicate the current version. Superseded versions are retained and are available on request.

17.4 Your continued use of the Platform after the effective date constitutes acceptance of the updated Policy. If you do not accept it, you must stop using the Platform and may close your account under clause 12.3. Where a change requires your consent, we will ask for it separately rather than treating continued use as consent.

18. COMPLAINTS

18.1 Please raise any concern with us first, at rayno@entegri.net, marked for the attention of the Information Officer. We will acknowledge within two business days and respond substantively within fifteen business days.

18.2 You may lodge a complaint with the Information Regulator of South Africa at any time:

Email: POPIAComplaints@inforegulator.org.za Address: Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191. Website: inforegulator.org.za

18.3 If you are in the European Economic Area or the United Kingdom, you may also complain to your local data protection supervisory authority. In the United Kingdom this is the Information Commissioner’s Office, ico.org.uk.

19. RELATED DOCUMENTS

This Policy should be read with the Cookie Policy, the Website Terms of Use, the Mutual Non-Disclosure and POPIA Agreement, the applicable Platform Participation Agreement, the Platform Dispute Resolution Policy, the Related Company Terms, and our PAIA Manual, all available on the Platform.

ANNEXURE A: OPERATORS AND SUB-PROCESSORS

Current as at 1 October 2026. We will update this Annexure whenever a provider changes and will notify registered users in accordance with clause 17.2.