SKEDX PRIVACY AND DATA PROTECTION AGREEMENT

Last updated: 15 November 2026 · Effective: 16 November 2026

1 ROLE CLARIFICATION

1.1 For Personal Information of Employees that a Customer enters into the SkedX Application:

1.1.1 the Customer fulfils the role of Responsible Party; and

1.1.2 Service Provider fulfils the role of Operator, processing that Personal Information only on the Customer's behalf.

1.2 For Personal Information of Service Provider's own customers, namely the person who registers a Customer, the Customer's directors and Super Users (for registration, verification, billing and support purposes), and Individual Users, Service Provider fulfils the role of Responsible Party.

1.3 Where a Business Partner provides the Services to its End Users, for Personal Information that an End User enters into the SkedX Application:

1.3.1 the End User fulfils the role of Responsible Party;

1.3.2 the Business Partner fulfils the role of Operator; and

1.3.3 Service Provider fulfils the role of sub-operator (sub-processor). It processes that Personal Information only on the Business Partner's instructions, given through the use of the SkedX Application, and on the terms of this Agreement.

1.4 The Business Partner warrants that it has a written agreement with each End User, as required by section 21 of POPI, which allows the Business Partner to use Service Provider as a sub-operator on terms no less protective than this Agreement.

1.5 Employees who wish to exercise their rights regarding Personal Information held by their employer should first contact the Customer or, for End Users, their employer through the Business Partner. Service Provider will assist as set out in clause 3.8.

2 DEFINITIONS

Capitalised terms not defined in this clause 2 have the meanings given to them in clause 2 of the SkedX Online Terms and Conditions of Use ("Terms").

2.1 "Agreement" has the meaning given to it in clause 2.1 of the Terms.

2.2 "Data Subject" means the person to whom Personal Information relates.

2.3 "Information Officer" means Service Provider's information officer named in clause 14.

2.4 "Operator" means a person who processes Personal Information for a Responsible Party in terms of a contract or mandate, without coming under the direct authority of that party.

2.5 "Personal Information Breach" means any situation where there are reasonable grounds to believe that Personal Information has been accessed or acquired by an unauthorised person.

2.6 "Process", "Processed" or "Processing" has the meaning given to "processing" in POPI. It includes collecting, storing, using, updating, disclosing and deleting Personal Information.

2.7 "Responsible Party" means a person who, alone or with others, determines the purpose of and means for Processing Personal Information.

2.8 "Sub-contractor" means a third party that Processes Personal Information on behalf of Service Provider, as listed in clause 6.2.

2.9 "Supervisory Authority" means the Information Regulator of South Africa established under POPI.

3 GENERAL PRIVACY TERMS

3.1 Registration. To register a company Account, the person registering provides his or her name, email address, cell number and password. He or she also provides the Customer's trading and registered names, registration number, VAT, PAYE and UIF references, addresses, and the full names and identity numbers of all directors. To register an individual Account, an Individual User provides his or her name, email address, cell number, password, and identity or passport number. Service Provider does not request or store bank card details.

3.2 Employee information. Depending on what the Customer chooses to capture, the SkedX Application may hold the following information about Employees:

• name, email address, cell number and username;
• identity or passport number, its type and issuing country;
• date of birth, gender and photograph;
• home and postal addresses;
• work permit details and income tax number;
• employee number, job title, worker type, department, branch, job roles, and licences and qualifications;
• pay rates, and minimum and maximum working hours;
• shifts, unavailable times (with a reason of leave, special event or unavailable), and in-app messages.

Passwords are stored only in hashed form, which cannot be reversed. The SkedX Application does not request health information, race or religion.

3.3 Customer support. When a User contacts support@skedx.co.za, Service Provider may need to access the relevant Account and Customer Data to understand, investigate and resolve the request, and to investigate any breach of the Agreement. Service Provider uses this information only for support and never for advertising.

3.4 Cookies and device storage. The SkedX Application does not use advertising, tracking or analytics cookies. It stores the User's login token and chosen country in the User's own browser storage so that the User stays logged in. The User can remove these at any time by logging out or clearing the browser storage.

3.5 Technical information. When a User accesses the SkedX Application, Service Provider's server records the User's internet protocol (IP) address, the time, the page or function requested, and the browser type in its access log. Service Provider also keeps a short-lived record in memory to limit repeated wrong passwords and codes. This information is used only for security and to keep the Services running.

3.6 Communications. Service Provider communicates with Users by email and through notices in the SkedX Application, including:

3.6.1 one-time codes for registration, login by Super Users, password resets and changes of email address or cell number;

3.6.2 service communications, such as welcome messages, shift notifications, notices of changes to an Account, and notices about availability or security of the Services; and

3.6.3 promotional communications, which will only be sent to Users who have opted in and may be stopped at any time.

Users cannot opt out of service communications while they hold an Account, because these are needed to operate and secure it.

3.7 External links. The Website and the SkedX Application may contain links to other websites. Service Provider is not responsible for the privacy practices or content of those websites.

3.8 Rights of Data Subjects. Subject to POPI, a Data Subject may request access to, correction of, or deletion of his or her Personal Information, and may object to its Processing. Individual Users can update their details and delete their Account in the SkedX Application. Other requests may be sent to the Information Officer. Where the request concerns Employee information, Service Provider will refer it to the Customer and help the Customer respond. Service Provider may require proof of identity before acting on a request.

4 PROCESSING OF INFORMATION

4.1 Service Provider Processes Personal Information for the following purposes:

4.1.1 to provide the Services, including logging in, planning shifts and showing Employees their schedules (performance of the Agreement);

4.1.2 to send one-time codes and service communications (performance of the Agreement, and Service Provider's legitimate interest in account security);

4.1.3 to verify new Customers before approval, including cross-checking directors' identity numbers, telephone numbers, addresses and email addresses against other Accounts to detect duplicate or fraudulent registrations (legitimate interest in preventing fraud);

4.1.4 to calculate and issue invoices, including branch counts and login statistics per Customer (performance of the Agreement and legal obligations); and

4.1.5 to secure the Services, keep logs and make backups (legitimate interest and section 19 of POPI).

4.2 Service Provider shall Process Customer Data only to provide the Services and in accordance with the Customer's instructions, which are given through the Customer's use of the SkedX Application. Service Provider shall not use Customer Data for any other purpose.

4.3 Service Provider does not sell Personal Information.

4.4 The Customer warrants that it has a lawful basis to Process its Employees' Personal Information and to provide it to Service Provider, and that it has informed its Employees accordingly.

4.5 Each party remains responsible for complying with its own obligations under POPI.

5 SAFEGUARDING MEASURES

5.1 Service Provider has implemented, and shall maintain while it holds Personal Information, appropriate and reasonable technical and organisational measures against loss, damage, unauthorised destruction and unlawful access to Personal Information, as required by section 19 of POPI. These include:

5.1.1 encryption of all connections to the SkedX Application using HTTPS;

5.1.2 a database that is not reachable from the internet and can only be opened by the SkedX Application on the same server;

5.1.3 hashed passwords; a one-time email code for each Super User login and for changes of email address or cell number; and limits on repeated wrong passwords and codes;

5.1.4 strict separation of Customers, so that no Customer can access another Customer's data, and role-based rights within each Customer, so that, for example, only authorised Users can see pay rates;

5.1.5 daily backups, encrypted before they leave the server, which can only be decrypted with a key kept off the server;

5.1.6 a server that is locked down, accessible only to Service Provider's authorised personnel by cryptographic key, and kept up to date with security updates; and

5.1.7 access by Service Provider's personnel to Customer Data only where needed to provide, support, bill or secure the Services, under a duty of confidentiality.

6 SUB-CONTRACTORS

6.1 Service Provider shall ensure that each Sub-contractor is bound in writing to:

6.1.1 Process Personal Information only as needed to provide its services to Service Provider;

6.1.2 keep Personal Information confidential; and

6.1.3 maintain appropriate technical and organisational security measures.

Service Provider remains responsible to the Customer for its Sub-contractors.

6.2 Service Provider's current Sub-contractors are:

6.2.1 Google Cloud (Google LLC and its affiliates), which hosts the SkedX Application, database and encrypted backups in its Johannesburg, South Africa region;

6.2.2 Zoho Corporation, which sends emails from the SkedX Application through its data centres in the United States of America; and

6.2.3 Netlify, Inc., which hosts the Website. The Website does not collect Personal Information other than standard visitor logs.

6.3 Service Provider will notify Customers by email of any new Sub-contractor that will Process Customer Data, at least 24 (twenty-four) hours before it does so.

7 RIGHTS TO AUDIT

7.1 In the event of suspected fraud, theft or a Personal Information Breach, the Customer may, on at least 21 (twenty-one) Business Days' written notice, request reasonable information and records to verify Service Provider's compliance with this Agreement.

7.2 Any audit shall be limited to records relating to the Customer, shall not give access to other Customers' data, and shall be at the Customer's cost.

8 BREACHES AND NOTIFICATIONS

8.1 Service Provider shall notify the Customer as soon as reasonably possible after becoming aware of a Personal Information Breach affecting Customer Data. It shall provide the information in its possession that the Customer needs to meet its own obligations under section 22 of POPI.

8.2 Where Service Provider is the Responsible Party, it shall notify the Supervisory Authority and the affected Data Subjects as required by section 22 of POPI.

8.3 Information may be provided in stages as it becomes available. Notification is not an admission of fault or liability.

8.4 Where the affected Customer Data belongs to a Business Partner's End User, Service Provider shall notify the Business Partner, which shall notify the End User without undue delay. Service Provider may also notify the End User directly where the Business Partner cannot be reached or the law requires it.

9 RETENTION AND DELETION OF DATA

9.1 Service Provider keeps Personal Information only for as long as needed for the purposes in clause 4, or as required by law.

9.2 When the Customer removes an Employee, the Employee can no longer log in to the Customer's Account or be booked, and his or her upcoming shifts are cancelled. The Employee's record and past shifts are kept, marked as removed, for as long as the Customer's Account is active, so that the Customer's reports, analytics and payroll history remain complete. They are deleted with the rest of the Customer Data in terms of clause 9.4.

9.3 On termination of a Customer's Account, the Customer may, within 30 (thirty) days of termination and free of charge, export its data using the reports available in the SkedX Application, or request a copy from Service Provider.

9.4 After that period, Service Provider shall permanently delete the Customer Data from the live system. Encrypted backups containing it expire automatically within 30 (thirty) days. A safety copy made at the time of deletion is also deleted after 30 (thirty) days. Deleted data cannot be recovered.

9.5 When an Individual User deletes his or her Account, it is deleted from the live system immediately, and from backups as they expire.

9.6 Invoice records are kept for 5 (five) years or as required by tax law. Server access logs are overwritten automatically as they fill. One-time codes are kept, in hashed form, for no more than 10 (ten) minutes.

9.7 Until deletion is complete, the safeguards in clause 5 continue to apply, and Service Provider shall not use the data for any other purpose.

10 LAW ENFORCEMENT REQUESTS AND DISCLOSURES

10.1 If Service Provider receives a demand by law to disclose Customer Data, it shall promptly notify the Customer in writing, unless the law prohibits this. Service Provider shall disclose only what it is legally required to disclose.

11 CROSS-BORDER TRANSFERS

11.1 The SkedX database and its backups are stored in the Republic of South Africa.

11.2 Limited Personal Information, namely email addresses, names and email content, passes through servers of the Sub-contractors listed in clauses 6.2.2 and 6.2.3 outside South Africa, including Zoho's data centres in the United States of America. Service Provider will only allow this where section 72 of POPI permits it, including where the recipient is subject to a law, binding corporate rules or a binding agreement providing an adequate level of protection, or where the transfer is necessary to perform the Agreement.

12 TERM

12.1 This Agreement commences on the date the Account is registered and continues until the Agreement terminates in accordance with the Terms. Clauses 5, 8, 9 and 10 continue to apply for as long as Service Provider holds any Customer Data.

13 COOPERATION WITH SUPERVISORY AUTHORITY

13.1 Service Provider and the Customer shall each cooperate, on request, with the Supervisory Authority in the performance of its functions.

14 INFORMATION OFFICER

14.1 Service Provider's Information Officer is Roche Cameron, who may be contacted at info@skedx.co.za.

14.2 Questions, requests or complaints about this Agreement or the Processing of Personal Information may be sent to info@skedx.co.za.

14.3 A Data Subject may also lodge a complaint with the Information Regulator of South Africa (https://inforegulator.org.za).

SkedX – Plan, Schedule, Prosper