Policy

PAIA / POPIA Privacy Policy

Effective date: 3 September 2026

Responsible Party	Exhale AT (Pty) Ltd, trading as Exhale Memorials
Registration Number	2021/765391/07
Registered Address	27 Westgate Street, Port St Johns, Eastern Cape, 5120
Information Officer	Motlatsi Molefe
IR Registration No.	2026-065939 (Information Regulator, registered 3 September 2026)
Contact	motlatsim@exhaleat.com / +27 71 671 9152

1. Purpose of this Policy

Exhale AT (Pty) Ltd, trading as Exhale Memorials ("Exhale", "we", "us"), is committed to protecting the personal information of our customers, suppliers, employees, and other individuals we deal with. This Policy explains what personal information we collect, why we collect it, how we use and protect it, and the rights individuals have over their own information, in accordance with the Protection of Personal Information Act 4 of 2013 (POPIA) and the Promotion of Access to Information Act 2 of 2000 (PAIA).

2. Information Officer

Exhale's Information Officer is Motlatsi Molefe, registered with the Information Regulator of South Africa under registration number 2026-065939. The Information Officer is responsible for ensuring Exhale's compliance with POPIA and for handling requests, queries, or complaints relating to personal information.

3. Personal Information We Collect

Depending on your relationship with Exhale, we may collect:

• Customer information: name, contact details (phone, email, postal/physical address), order and quotation details, engraving text and inscription content, payment and billing information, and delivery/installation details.
• Supplier information: business and contact details, banking details for payment purposes.
• Employee information: name, contact details, identification and tax numbers, banking details, employment records, and health and safety records (including exposure monitoring records relevant to workshop operations).
• Website/enquiry information: name and contact details submitted through enquiry forms, telephone calls, or WhatsApp/social media messages.

4. Purpose of Processing

We process personal information to:

• Prepare quotations, process orders, and manufacture and deliver memorial stones and related products.
• Communicate with customers and suppliers about orders, queries, and account matters.
• Process payments and maintain financial and statutory records.
• Comply with legal obligations, including tax, labour, and occupational health and safety law.
• Manage employees, including payroll, leave, and workplace safety.

5. Legal Basis for Processing

We process personal information on one or more of the following bases: consent given by the data subject; performance of a contract (e.g. fulfilling an order); compliance with a legal obligation (e.g. tax or labour law); and Exhale's legitimate business interests, provided these do not unreasonably override the data subject's own rights.

6. Sharing of Information

We do not sell personal information. We may share personal information with:

• Service providers who assist us in operating the business (e.g. bookkeeping, delivery/logistics, IT and cloud storage providers), under confidentiality obligations.
• Regulatory or government bodies where required by law (e.g. SARS, CIPC, the Department of Employment and Labour).
• Cemeteries, municipalities, or funeral service providers where necessary to complete an installation, and only to the extent required.

7. Data Security

We take reasonable technical and organisational measures to protect personal information against loss, unauthorised access, alteration, or disclosure, including restricting access to personal information to staff who need it to perform their duties, and using secure storage for physical and digital records.

8. Retention

We retain personal information only for as long as necessary to fulfil the purposes described in this Policy, or as required by law (for example, financial records are generally retained for five years in line with SARS and Companies Act requirements). Records are securely deleted or destroyed once no longer required.

9. Data Subject Rights

Subject to POPIA, individuals have the right to:

• Be informed that their personal information is being collected.
• Access the personal information Exhale holds about them.
• Request correction or deletion of inaccurate, irrelevant, or unlawfully processed personal information.
• Object to the processing of their personal information in certain circumstances.
• Withdraw consent, where processing is based on consent, at any time.
• Lodge a complaint with the Information Regulator if they believe their personal information has been processed unlawfully.

Requests can be directed to the Information Officer using the contact details in the table above.

10. Complaints to the Information Regulator

If a data subject is not satisfied with how Exhale has handled their personal information, they may lodge a complaint with the Information Regulator of South Africa:

11. Changes to this Policy

Exhale may update this Policy from time to time to reflect changes in our practices or legal requirements. The current version will always be available on request from the Information Officer.

Exhale AT (Pty) Ltd t/a Exhale Memorials — Reg. 2021/765391/07 — 27 Westgate Street, Port St Johns, Eastern Cape, 5120