Privacy & Data Protection Policy

PART A: INTRODUCTION & SCOPE

A.1 Overview

Long Haul Technologies ("Company", "we", "us", "our") is committed to protecting the privacy and security of personal information. This Privacy & Data Protection Policy explains how we collect, use, disclose, and safeguard your information when you visit our website, use our services, or interact with us.

We comply with the Protection of Personal Information Act, 2013 (POPIA) and all applicable data protection laws. We are registered as an operator under POPIA and process personal information on behalf of responsible parties (our clients) as well as in our own capacity as a responsible party for our direct interactions with data subjects.

A.2 Scope

This policy applies to:

• Website Visitors: Individuals who visit our website at www.longhaultech.com
• Clients: Organizations and individuals who engage our services
• Client End-Users: Individuals whose information is processed through systems we provide to clients (e.g., LMS users, learners, assessors)
• Prospective Clients: Individuals who contact us for information about our services
• Suppliers and Partners: Individuals associated with our vendors and business partners
• Job Applicants: Individuals applying for positions with us

A.3 Definitions

For purposes of this policy:

• "Personal Information" means any information relating to an identifiable, living, natural person, and where applicable, an identifiable, existing juristic person, including but not limited to information relating to race, gender, sex, pregnancy, marital status, national origin, age, physical or mental health, well-being, disability, religion, belief, language, education, financial history, identifying number, email address, physical address, telephone number, biometric information, and opinions of or about the person.
• "Processing" means any operation or activity concerning personal information, including collection, receipt, recording, organization, collation, storage, updating, modification, retrieval, consultation, use, dissemination, merging, linking, blocking, degradation, erasure, or destruction.
• "Responsible Party" means a public or private body or any other person which, alone or in conjunction with others, determines the purpose of and means for processing personal information.
• "Operator" means a person who processes personal information for a responsible party in terms of a contract or mandate, without coming under the direct authority of that party.
• "Data Subject" means the person to whom personal information relates.

PART B: INFORMATION WE COLLECT

B.1 Information You Provide Directly

We collect information you voluntarily provide to us, including:

B.2 Information Collected Automatically

When you visit our website or use our services, we automatically collect certain information:

B.3 Information from Third Parties

We may receive information about you from third parties, including:

• Clients: When our clients provide us with information about their end-users (learners, employees, etc.) for processing through our systems
• Business Partners: Information from partners who refer you to us or with whom we jointly offer services
• Public Sources: Information from publicly available sources (e.g., LinkedIn, company websites) for business development purposes
• Service Providers: Information from third-party service providers who assist us with fraud prevention, security, or analytics

PART C: HOW WE USE INFORMATION

C.1 Lawful Bases for Processing (POPIA Section 11)

Under POPIA, we process personal information only on lawful grounds, including:

C.2 Specific Purposes

We use personal information for the following specific purposes:

PART D: INFORMATION SHARING AND DISCLOSURE

D.1 When We Share Information

We may share personal information in the following circumstances:

D.2 International Transfers

We may transfer personal information to countries outside South Africa for processing, including to service providers located in countries such as the United States, European Union, and other jurisdictions.

When we transfer personal information across borders, we ensure appropriate safeguards are in place, including:

• Transferring only to countries with adequate data protection laws recognized by South Africa;
• Entering into data transfer agreements based on standard contractual clauses approved by the Information Regulator;
• Obtaining your consent where required by applicable law.

By providing your personal information to us, you acknowledge that we may transfer it to countries that may not have the same level of data protection as South Africa, but we will take steps to protect your information as described in this policy.

D.3 No Sale of Information

We do not sell, rent, or trade your personal information to third parties for their marketing purposes. Any sharing is limited to the purposes described in this policy.

PART E: DATA SECURITY

E.1 Security Measures

We implement appropriate technical and organizational measures to protect personal information against unauthorized access, accidental loss, alteration, disclosure, or destruction, including:

E.2 Security Breach Response

In the event of a security breach affecting personal information, we have procedures to:

1. Identify and contain the breach immediately;
2. Assess the risk to affected data subjects;
3. Notify the Information Regulator as required by POPIA (without unreasonable delay, but within 72 hours where feasible);
4. Notify affected data subjects where the breach poses a real risk of harm;
5. Take steps to mitigate any potential harm;
6. Investigate the cause and implement measures to prevent recurrence.

PART F: COOKIE POLICY

F.1 What Are Cookies

Cookies are small text files placed on your device when you visit a website. They are widely used to make websites work more efficiently and provide information to website owners.

F.2 Types of Cookies We Use

F.3 Cookie Consent

When you first visit our website, we display a cookie banner requesting your consent for non-essential cookies. You can:

• Accept all cookies;
• Reject non-essential cookies (essential cookies will still function);
• Customize your preferences by category;
• Withdraw consent at any time by clearing cookies or adjusting your browser settings.

F.4 Managing Cookies

You can control and manage cookies through your browser settings:

• Chrome: Settings → Privacy and Security → Cookies and other site data
• Firefox: Options → Privacy & Security → Cookies and Site Data
• Safari: Preferences → Privacy → Cookies and website data
• Edge: Settings → Site permissions → Cookies and site data

Please note that blocking essential cookies may affect website functionality.

PART G: DATA RETENTION

G.1 Retention Periods

We retain personal information only for as long as necessary to fulfill the purposes for which it was collected, unless a longer retention period is required or permitted by law.

G.2 Data Deletion

After the retention period expires, we securely delete or anonymize personal information. Methods include:

• Permanent deletion from databases and backups;
• Secure overwriting of electronic files;
• Physical shredding of paper records;
• Anonymization for analytical purposes where appropriate.

PART H: DATA SUBJECT RIGHTS

Under POPIA, you have the following rights regarding your personal information:

H.1 Exercising Your Rights

To exercise any of these rights, please contact us using the details in Part L. We will respond to all legitimate requests within 30 days, unless exceptional circumstances require an extension (which we will communicate to you).

We may need to verify your identity before processing your request. This is a security measure to ensure personal information is not disclosed to unauthorized persons.

There is no charge for exercising your rights, unless requests are manifestly unfounded, excessive, or repetitive, in which case we may charge a reasonable fee.

H.2 Access Request Procedure (POPIA Section 23)

To request access to your personal information, please submit a formal request containing:

1. Your full name and identity number;
2. Contact details for correspondence;
3. Description of the information requested;
4. The form of access required (e.g., electronic copy, printout);
5. Proof of identity.

We will notify you within 30 days of receiving your request and may provide access subject to any lawful grounds for refusal under POPIA Section 27.

PART I: POPIA COMPLIANCE FRAMEWORK

I.1 Conditions for Lawful Processing (POPIA Chapter 3)

We adhere to the eight conditions for lawful processing under POPIA:

I.2 Information Officer

We have appointed an Information Officer as required by POPIA:

Information Officer: [Name]
Email: info.officer@longhaultech.com
Phone: Tumelo
Deputy Information Officer: 062 688 0213

I.3 Operator Agreements

Where we engage operators to process personal information on our behalf, we have written agreements requiring them to:

• Process information only on our documented instructions;
• Implement appropriate security measures;
• Notify us of any security breaches;
• Assist us in complying with data subject requests;
• Return or delete information at the end of the engagement;
• Allow us to audit their compliance.

PART J: CHILDREN'S PRIVACY

Our services may be used by children (persons under 18 years) in educational settings, typically under the supervision of schools, training providers, or parents.

J.1 Processing of Children's Information

When we process personal information of children, we do so:

• On behalf of our clients (schools, training providers) who are the responsible parties and have obtained appropriate consent from parents or guardians;
• With the consent of a competent person (parent or guardian) where we are the responsible party;
• As necessary for the provision of educational services.

J.2 Parental Rights

Parents or legal guardians have the right to:

• Access their child's personal information;
• Request correction or deletion;
• Object to processing;
• Withdraw consent (where processing is based on consent).

If you believe we may have collected information from a child without appropriate consent, please contact us immediately.

PART K: POLICY UPDATES

We may update this Privacy & Data Protection Policy from time to time to reflect changes in our practices, legal requirements, or operational needs.

K.1 Notification of Changes

• Material Changes: We will notify you by email (if we have your contact information) or by prominent notice on our website at least 30 days before changes take effect.
• Non-Material Changes: We will update the "Effective Date" at the top of this policy and post the updated version on our website.

K.2 Continued Use

Your continued use of our website or services after the effective date of any changes constitutes acceptance of the updated policy. If you do not agree to the changes, you must stop using our services and request deletion of your information as described in Part H.

PART L: CONTACT INFORMATION

If you have questions, concerns, or requests regarding this policy or our data practices, please contact us:

L.1 Information Regulator of South Africa

You have the right to lodge a complaint with the Information Regulator if you believe we have violated your privacy rights:

Information Regulator (South Africa)
Website: www.justice.gov.za/inforeg/
Email: inforeg@justice.gov.za
Tel: +27 (0)10 023 5200
Address: 33 Hoofd Street, Forum III, 3rd Floor, Braampark, Johannesburg, 2001

Version 1.0 | Effective 20 February 2026 | Last Reviewed 20 February 2026
Long Haul Technologies is registered as an operator under POPIA. This policy is reviewed annually and updated as needed.