POPIA Policy

1. Introduction

The right to privacy is recognised and protected in South Africa under the Constitution and POPIA. POPIA promotes the lawful, fair and responsible processing of personal information. It requires responsible parties to collect, use, store, share and destroy personal information in a manner that protects the rights of data subjects. Nova collects and processes personal information as part of its insurance advisory, intermediary, policy servicing, claims support and related business activities. Nova is committed to managing personal information responsibly, lawfully and transparently.

2. Definitions

For purposes of this policy: Consent means any voluntary, specific and informed expression of permission by a data subject for the processing of personal information. Data Subject means the person or entity to whom personal information relates, including a client, prospective client, policyholder, company, supplier, employee, representative or other stakeholder. Information Officer means the person responsible for encouraging compliance with POPIA and dealing with requests made under POPIA. Operator means a person or entity that processes personal information for Nova under a contract or mandate, without coming under Nova’s direct authority.

Personal Information means information relating to an identifiable natural person or, where applicable, an identifiable juristic person. This includes personal, financial, contact, policy, claims, underwriting, risk, employment or other identifying information. Processing means any operation concerning personal information, including collecting, receiving, recording, storing, updating, using, sharing, transferring, restricting, deleting or destroying information. Responsible Party means the person or entity that determines the purpose and means of processing personal information. Special Personal Information includes information relating to religious or philosophical beliefs, race or ethnic origin, trade union membership, political persuasion, health, biometric information or criminal behaviour.

3. Policy Purpose

The purpose of this policy is to confirm Nova’s commitment to protecting personal information and complying with POPIA. This policy aims to:

• promote lawful and responsible processing of personal information;

• protect the privacy rights of clients, prospective clients and other data subjects;

• support compliance with POPIA and related legislation;

• guide Nova team members, representatives and service providers in handling personal information;

• create reasonable internal controls for managing personal information;

• support transparent communication with clients and data subjects;

• ensure that personal information is processed only for legitimate business, insurance, compliance or legal purposes.

4. Policy Application

This policy applies to:

• Nova’s directors;

• Nova’s representatives;

• Nova’s employees;

• outsourced service providers;

• back-office support providers;

• compliance support providers;

• any person or entity processing personal information on behalf of Nova.

This policy applies to all personal information processed by Nova, whether in physical, electronic, verbal or recorded form.

This policy must be read together with Nova’s Privacy Policy, PAIA Manual, Complaints Management Policy and any related compliance documents.

5. Rights of Data Subjects

Nova recognises the rights of data subjects under POPIA. Where applicable, data subjects have the right to:

5.1 Access Personal Information

A data subject may request confirmation of whether Nova holds personal information about them and may request access to that information.

5.2 Correct or Update Personal Information

A data subject may request that inaccurate, incomplete, excessive, outdated or misleading personal information be corrected or updated.

5.3 Request Deletion of Personal Information

A data subject may request deletion of personal information where Nova is no longer legally authorised or required to retain it. This right may be limited by legal, regulatory, contractual or recordkeeping requirements.

5.4 Object to Processing

A data subject may object to the processing of personal information where permitted under POPIA. Nova will consider such objections in line with its legal, regulatory and contractual obligations.

5.5 Lodge a Complaint

A data subject may lodge a complaint with Nova regarding the processing of personal information. A data subject may also lodge a complaint with the Information Regulator of South Africa.

5.6 Be Informed

A data subject has the right to be informed when personal information is collected and, where required by law, where there has been unauthorised access to or acquisition of personal information.

6. General Guiding Principles

Nova will apply the following POPIA principles when processing personal information.

6.1 Accountability

Nova will take reasonable steps to ensure that personal information is processed lawfully and in accordance with POPIA. Nova will assign responsibility for privacy and information protection controls to appropriate persons within the business.

6.2 Processing Limitation

Nova will process personal information lawfully, fairly and only where necessary for legitimate business, insurance, compliance or legal purposes. Nova will not collect excessive personal information.

6.3 Purpose Specification

Nova will collect personal information for specific, defined and lawful purposes relating to its business and services. These purposes may include:

• insurance advice;

• risk assessment;

• quotations;

• policy placement;

• endorsements;

• renewals;

• claims support;

• client servicing;

• compliance recordkeeping;

• complaint handling;

• legal and regulatory obligations.

6.4 Further Processing Limitation

Nova will only process personal information further where such processing is compatible with the original purpose for which the information was collected, or where otherwise permitted by law.

6.5 Information Quality

Nova will take reasonable steps to ensure that personal information is accurate, complete, updated where necessary and not misleading.

Clients and data subjects are responsible for providing accurate information and notifying Nova of changes.

6.6 Openness and Transparency

Nova will take reasonable steps to ensure that clients and data subjects understand why their personal information is collected and how it will be used. Nova will make relevant privacy information available through its website and client documentation.

6.7 Security Safeguards

Nova will take reasonable technical, organisational and administrative measures to protect personal information against loss, damage, unauthorised access, disclosure, alteration or destruction. These safeguards may include:

• controlled access to records and systems;

• secure storage of documents;

• user permission controls;

• secure communication practices;

• password protection;

• access limitations;

• document retention and disposal controls;

• monitoring and response processes for security incidents.

6.8 Data Subject Participation

Nova will provide a reasonable process for data subjects to request access to, correction of, or deletion of their personal information, subject to applicable legal and regulatory limitations.

7. Information Officer

Nova has appointed an Information Officer responsible for overseeing POPIA compliance within the business. The Information Officer’s responsibilities may include:

• encouraging compliance with POPIA;

• dealing with POPIA-related requests and complaints;

• supporting personal information access requests;

• assisting with privacy and data protection controls;

• liaising with the Information Regulator where required;

• supporting awareness and responsible handling of personal information;

• reviewing this policy when required.

Information Officer details:

Name: Brad Rimmer Designation: Operations and Systems Email: info@novainsurance.co.za Direct Email: brad@novainsurance.co.za Website: www.novainsurance.co.za POPIA-related requests should be sent to: info@novainsurance.co.za Where required, Brad Rimmer may be contacted directly at: brad@novainsurance.co.za

8. Duties and Responsibilities

8.1 Directors and Management

Nova’s directors and management are responsible for ensuring that Nova takes reasonable steps to comply with POPIA and protect personal information. This includes ensuring that:

• personal information is processed lawfully;

• staff and service providers understand their responsibilities;

• appropriate controls are implemented;

• records are kept properly;

• data protection risks are reviewed;

• privacy-related complaints and incidents are handled appropriately.

8.2 Employees, Representatives and Service Providers

Any person processing personal information for or on behalf of Nova must:

• process personal information only for authorised purposes;

• maintain confidentiality;

• follow Nova’s policies and instructions;

• avoid unnecessary disclosure of personal information;

• report privacy incidents or suspected breaches promptly;

• use approved systems and storage locations;

• comply with applicable laws and contractual obligations.

8.3 Operators and Third Parties

Where Nova uses operators or third-party service providers, Nova will take reasonable steps to ensure that they process personal information lawfully and securely.

This may include contractual confidentiality, data protection and security obligations.

9. POPIA Review

Nova will review its POPIA compliance controls periodically or when there are material changes to the business, systems, legal requirements or service providers. A POPIA review may include:

• identifying what personal information Nova collects;

• confirming why the information is processed;

• reviewing where information is stored;

• reviewing who has access to information;

• assessing information security controls;

• reviewing document retention and disposal practices;

• confirming whether client notices and consent wording are appropriate;

• reviewing privacy-related complaints or incidents.

10. Request to Access Personal Information Procedure

A data subject may request access to personal information held by Nova. Requests should be sent to: info@novainsurance.co.za Nova may require the data subject to complete a personal information request form and provide proof of identity before processing the request. Nova will consider requests in accordance with POPIA, PAIA and any applicable legal, regulatory, contractual or recordkeeping requirements. Nova will respond within a reasonable period.

11. POPIA Complaints Procedure

A data subject may complain to Nova if they believe their personal information has been processed unlawfully or contrary to POPIA. Complaints should be submitted in writing to: info@novainsurance.co.za

Where a POPIA complaint is received by another person in Nova, it must be escalated to the appropriate internal owner or Information Officer as soon as reasonably possible. Nova will:

• acknowledge receipt of the complaint;

• consider the complaint fairly;

• investigate where required;

• request additional information if needed;

• provide a response within a reasonable period;

• take corrective action where appropriate.

Where the complaint relates to a suspected data breach, Nova will assess whether any notification to affected data subjects or the Information Regulator is required.

12. Complaints to the Information Regulator

If a data subject is not satisfied with Nova’s response, they may lodge a complaint with the Information Regulator of South Africa. Information Regulator South Africa Telephone: 010 023 5200 POPIA Complaints: POPIAComplaints@inforegulator.org.za PAIA Complaints: PAIAComplaints@inforegulator.org.za Website: www.inforegulator.org.za

13. Disciplinary and Corrective Action

Where a person acting for or on behalf of Nova fails to comply with this policy, POPIA or applicable confidentiality obligations, Nova may take appropriate corrective, contractual, administrative, disciplinary or legal action. This may include:

• further training;

• restriction of access;

• review of responsibilities;

• disciplinary action;

• termination of a service provider relationship;

• legal action where appropriate.

14. Changes to This Policy

Nova may update this POPIA Policy from time to time to reflect changes in law, business operations, systems, service providers or regulatory requirements. The latest version will be made available on the Nova website or on request.