Privacy Policy

1.1 Finance 7 Seven (Pty) Ltd, trading as Appiawave ("Appiawave", "we", "us", "our"), is committed to protecting your privacy and handling your Personal Information responsibly, in accordance with the Protection of Personal Information Act 4 of 2013 ("POPIA") and other applicable law.

1.2 This Privacy Policy explains what Personal Information we collect through www.appiawave.co.za (the "Website") and in connection with the Appiawave Products, why we collect it, how we use and protect it, who we share it with, and what rights you have in respect of it.

1.3 This Policy applies to visitors to the Website, prospective and existing Merchants and customers, and individuals whose information is submitted to us in connection with an application for any Appiawave Product (AppiaStaff, AppiaSpend, AppiaReward, AppiaCloud, AppiaPro, Merchant Acquiring, Payment Gateway, DebiCheck & EFT Collections, PayBeta, PayMaster, AppLend, AppiaPay, and Appiawave Nexus).

1.4 Please read this Policy together with our Terms of Use, available at www.appiawave.co.za/terms-of-use.

2.1 In accordance with POPIA, Appiawave has appointed an Information Officer responsible for ensuring compliance with this Policy and applicable data protection law.

• Information Officer: Fanney Msimuko
• Email: fanney@mklegal.co.za
• Postal Address: 3 Viceroy Link, Route 21 Business Park, Centurion

3.1 The Personal Information we collect depends on how you interact with us — for example, whether you are simply browsing the Website, requesting a quote, or applying for an Appiawave Product. We collect the following categories of Personal Information:

3.2 Where you submit Personal Information about another individual (for example, a co-director or an employee for staff payout products), you confirm that you have that individual's permission to share their information with us for the purposes described in this Policy.

4.1 We collect Personal Information:

• directly from you, when you complete a form on the Website, request a quote, apply for an Appiawave Product, or contact us by phone, email, or WhatsApp;
• automatically, through cookies and similar technologies when you use the Website (see clause 12);
• from third parties, including credit bureaus, identity verification service providers, our banking and card network partners, and, where legally permitted, publicly available sources, for the purposes of KYC, FICA, and credit assessment.

5.1 We process your Personal Information for the following purposes:

• to assess and respond to enquiries and quote requests submitted through the Website;
• to onboard you or your business as a Merchant or customer, including conducting KYC and FICA verification;
• to assess creditworthiness and affordability in respect of lending and Buy Now Pay Later products (AppLend and PayBeta);
• to provide, operate, and support the Appiawave Products you use;
• to process payments, collections, and settlements;
• to detect, investigate, and prevent fraud, money laundering, and other financial crime;
• to comply with our obligations under applicable law, including FICA, the National Credit Act 34 of 2005, and requirements imposed by PASA, the SARB, the NCR, and card networks;
• to communicate with you about your application, account, or our products;
• with your consent, to send you direct marketing communications about Appiawave Products (see clause 13);
• to maintain the security of the Website and the Appiawave Products;
• to improve the Website and develop new products and features.

6.1 We rely on one or more of the following lawful grounds under POPIA to process your Personal Information:

• your consent, for example, where you opt in to marketing communications;
• the processing is necessary to perform a contract to which you are party, or to take steps at your request before entering into a contract, for example, assessing your application for an Appiawave Product;
• the processing is necessary to comply with a legal obligation, for example, our obligations under FICA;
• the processing is necessary to pursue our legitimate interests or those of a third party, for example, fraud prevention, provided this is balanced against your rights and interests.

7.1 We may share your Personal Information with:

• card networks (Visa and Mastercard) and our sponsoring or settlement banking partners, to the extent necessary to process transactions;
• registered credit bureaus, in respect of Appiawave Products regulated under the National Credit Act (AppLend and PayBeta), as required or permitted by that Act;
• the Financial Intelligence Centre and other relevant authorities, where required under FICA or other applicable law;
• Regulators, including PASA, the SARB, and the NCR, where required for regulatory reporting or upon lawful request;
• service providers who process information on our behalf, such as cloud hosting providers, identity verification providers, and communication platforms (for example, our WhatsApp Business messaging provider), under contracts that require them to protect your information;
• professional advisers, including our auditors, lawyers, and consultants, where necessary;
• a successor entity, in the event of a merger, acquisition, or sale of all or part of our business, subject to equivalent protection of your Personal Information.

7.2 We do not sell your Personal Information to third parties for their own marketing purposes.

8.1 Appiawave operates in South Africa and, through Appiawave Technology Ltd, in Nigeria. Where your Personal Information is transferred to, stored in, or accessed from outside South Africa — including in connection with our Nigerian operations or where a service provider we use stores data outside South Africa — we will only do so in accordance with POPIA, including where the recipient is subject to a law, binding corporate rules, or an agreement that provides an adequate level of protection substantially similar to POPIA, or where another basis recognised under POPIA applies (such as your consent, or the transfer being necessary for the performance of a contract with you).

9.1 We retain your Personal Information for as long as necessary to fulfil the purposes described in this Policy, including to satisfy legal, accounting, or reporting requirements.

9.2 In particular, FICA requires us to retain certain KYC and transaction records for a minimum of five years following the termination of a business relationship. Records relating to credit agreements are retained for the periods required under the National Credit Act, currently five years.

10.1 We maintain administrative, technical, and physical safeguards designed to protect your Personal Information against unauthorised access, loss, misuse, or alteration, including measures aligned with our PCI-DSS compliance and ISO 27001 certification.

10.2 No method of transmission over the internet or electronic storage is completely secure. While we strive to protect your Personal Information, we cannot guarantee its absolute security.

10.3 In the event of a security compromise affecting your Personal Information, we will notify the Information Regulator and affected individuals as required under POPIA.

11.1 Subject to applicable law, you have the right to:

• be notified that we are collecting your Personal Information and for what purpose;
• access the Personal Information we hold about you;
• request correction or updating of inaccurate, incomplete, or outdated Personal Information;
• request the deletion or destruction of Personal Information that we are no longer authorised to retain;
• object, on reasonable grounds, to the processing of your Personal Information;
• object to processing of your Personal Information for purposes of direct marketing;
• not be subject solely to automated decision-making (including credit scoring) that materially affects you, without the opportunity to make representations, except in circumstances permitted by law;
• withdraw any consent you have given, at any time, without affecting the lawfulness of processing before withdrawal;
• lodge a complaint with the Information Regulator.

11.2 To exercise any of these rights, contact our Information Officer using the details in clause 2. We may need to verify your identity before giving effect to your request.

12.1 The Website uses cookies and similar technologies to operate correctly, remember your preferences, and understand how visitors use the Website.

12.2 You can control or disable cookies through your browser settings. Disabling certain cookies may affect the functionality of the Website.

13.1 We will only send you direct marketing communications by email, SMS, or WhatsApp with your consent, or as otherwise permitted under section 69 of POPIA (for example, where you are an existing customer and the marketing relates to similar Appiawave Products, and you were given a reasonable opportunity to opt out at the time your details were collected).

13.2 You may opt out of direct marketing at any time by using the unsubscribe mechanism provided in the communication, or by contacting us at onboarding@appiawave.co.za.

14.1 Where you apply for or are granted an Appiawave Product regulated under the National Credit Act (including AppLend and PayBeta), we may submit information about your application and your account performance (including payment history) to registered credit bureaus, as required or permitted under the National Credit Act. This information may affect your credit profile and your ability to obtain credit from other providers.

15.1 The Website and the Appiawave Products are directed at businesses and individuals who are at least 18 years old. We do not knowingly collect Personal Information from children. If you believe a child has provided us with Personal Information, please contact us so that we can address it.

16.1 We may update this Policy from time to time to reflect changes in our practices or legal requirements. The "Last Updated" date at the top of this Policy indicates when it was last revised. Material changes will be communicated in accordance with applicable law.

17.1 If you have questions about this Policy or wish to exercise any of your rights, contact our Information Officer:

• Email: onboarding@appiawave.co.za
• Phone: +27 12 335 9020
• WhatsApp: +27 74 756 2775

17.2 If you are not satisfied with our response, you have the right to lodge a complaint with the Information Regulator of South Africa:

• Physical address: JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001
• Email: complaints.IR@justice.gov.za
• Website: www.justice.gov.za/inforeg