Our privacy policy

1. Definitions

The following words and expressions bear the meanings assigned to them and cognate
expressions bear corresponding meanings:
1.1 Applicable Laws; means all applicable laws, rules, codes, regulations, and formal regulatory guidelines and

standards, made by a Regulator, legislature or other public authority with binding effect in force from time to time (construed having regard to related guidance and codes of practice issued or approved by a regulator or other public body);
1.2 Iron Monkey, means Iron Monkey (Proprietary) Limited, a company registered in terms of South African law with registration number: 2021/710766/07
1.3 Responsible Party and & Operator; have the meanings given to those terms in the Data Protection Laws, and where an equivalent term is used in Data Protection Laws (such as; Responsible Party and Operator, respectively) Controller and Processor are read to refer to those equivalent terms;
1.4 Data Breach; means any actual or suspected breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Personal Information transmitted, stored or otherwise Processed;
1.5 Data Protection Laws means any Applicable Laws which regulate the Processing of Personal Information that is received by Iron Monkey;
1.6 Data Subject means each identified or identifiable (whether directly or indirectly) legal or natural person to whom any Personal Information relates;
1.7 Personal Information Personal Information means information relating to any natural or legal person, the Processing of which is regulated by Data Protection Laws including : (i) information relating to the race, gender, sex, marital status, national, ethnic or social origin, colour, age, disability, language and birth of the person; (ii) information
relating to the education or the medical, financial, criminal or employment history of the person; (iii) information relating to the financial affairs of the person; (iv) credit card details and transactional data; (v) any identifying number, symbol, e-mail address, physical address, telephone number or other particular assignment to the person;
(vi) correspondence sent by the person that is implicitly or explicitly of a private or

C2 General confidential nature or further correspondence that would reveal the contents of the original correspondence; (vii) the views or opinions of another individual about the person; (viii) the name of the person if it appears with other personal information relating to the person or if the disclosure of the name itself would reveal information about the person;  and (ix) any other information the Processing of which may be treated or defined
as personal information& in terms of any Applicable Laws, including Data Protection
Laws;
1.8 Policy means this Privacy Policy;
1.9 Process means to collect, receive, record, organise, collate, store, develop, update, modify, retrieve, alter, consult, use, disseminate or perform any other act or action, including any other act or action which may be treated or defined as “process” or “processing” (or any equivalent term for a similarly-regulated activity) in terms of any Data Protection Laws, and “Processed” and “Processing” shall have a corresponding meaning; and
1.10 Regulator shall mean any court or public body having regulatory or supervisory authority over all Personal Information.

2. Purpose of the Policy
2.1. The purpose of this Policy is to inform Data Subjects about how Iron Monkey Processes their Personal Information.
2.2. Iron Monkey, in its capacity as Responsible Party (and/or Operator, where applicable), shall strive to observe, and comply with its obligations under Data Privacy Laws as well as accepted information protection principles, practices and guidelines when it Processes Personal Information from or in respect of a Data Subject.
2.3. This Policy applies to Personal Information collected by Iron Monkey in connection with the products and services which Iron Monkey provides. This includes information collected directly from you as a Data Subject, as well as information we collect indirectly though our service providers who collect your information on our behalf.
2.4. This Privacy Policy does not apply to the information practices of third party companies that Iron Monkey may engage with in relation to its business operations (including, without limitation, their websites, platforms and/or applications) which we do not own or control; or individuals that Iron Monkey does not manage or employ. These third party sites may have their own privacy policies and terms and conditions that people will have to comply with.

C2 General

3. Process of Collecting Personal Information
3.1. Iron Monkey collects Personal Information directly from Data Subjects as and when required for a defined purpose, unless an exception is applicable (such as, for example, where the Data Subject has made the Personal Information public or the Personal Information is contained in or derived from a public record).
3.2. Iron Monkey will always collect Personal Information in a fair, lawful and reasonable manner to ensure that it protects the Data Subject privacy and will Process the Personal Information based on legitimate grounds in a manner that does not adversely affect the Data Subject in question.
3.3. Iron Monkey often collects Personal Information directly from the Data Subject and/or in some cases, from third parties. Where Iron Monkey obtains Personal Information from third parties, Iron Monkey will ensure that it obtains the consent of the Data Subject to do so or will only Process the Personal Information without the Data Subject consent where Iron Monkey is permitted to do so in terms of clause 3.1 above or the Data Protection Laws.
3.4. An example of such third parties includes: (i) agencies; (ii) other companies providing services to Iron Monkey; and (iii) where Iron Monkey makes use of publicly available sources of information.
4. Lawful Processing of Personal Information
4.1. Where Iron Monkey is the Responsible Party, it will only Process a Data Subject Personal Information (other than for Special Personal Information) where:
4.1.1. consent of the Data Subject (or a competent person, where the Data Subject is a Child) is obtained;
4.1.2. Processing is necessary to carry out the actions for conclusion of a contract to which a Data Subject is party;
4.1.3. Processing complies with an obligation imposed by Data Protection Laws on Iron Monkey;
4.1.4. Processing protects a legitimate interest of the Data Subject; and/or
4.1.5. Processing is necessary for pursuing the legitimate interests of Iron Monkey or of a third party to whom the information is supplied.

C2 General

4.2. Iron Monkey will only Process Personal Information where one of the legal bases referred to in paragraph 4.1 above are present.
4.3. Iron Monkey will make the manner and reason for which the Personal Information will be Processed clear to the Data Subject.
4.4. Where Iron Monkey is relying on a Data Subject consent as the legal basis for Processing Personal Information, the Data Subject may withdraw his/her/its consent or may object to Iron Monkey Processing of the Personal Information at any time. However, this will not affect the lawfulness of any Processing carried out prior to the withdrawal of consent or any Processing justified by any other legal ground provided under Data Privacy Laws.
4.5. If the consent is withdrawn or if there is otherwise a justified objection against the use or the
Processing of such Personal Information, Iron Monkey will ensure that the Personal Information is no longer Processed.
5. Special Personal Information and Personal Information of Children
5.1. Special Personal Information is sensitive Personal Information of a Data Subject and Iron Monkey acknowledges that it will generally not Process Special Personal Information unless:
5.1.1. Processing is carried out in accordance with the Data Subject consent;
5.1.2. Processing is necessary for the establishment, exercise or defence of a right or obligation in law;
5.1.3. Processing is for historical, statistical or research purposes, subject to stipulated safeguards;
5.1.4. information has deliberately been made public by the Data Subject; or
5.1.5. specific authorisation applies in terms of Data Privacy Laws.
5.2. Iron Monkey acknowledges that it may not Process any Personal Information concerning a child and will only do so where it has obtained the consent of the parent or guardian of that child or where it is permitted to do so in accordance with applicable laws.
6. Purpose for Processing Personal Information
6.1. Iron Monkey understands its obligation to make Data Subjects aware of the fact that it is Processing their Personal Information and inform them of the purpose for which Iron Monkey Processes such Personal Information.

C2 General

6.2. Iron Monkey will only Process a Data Subject Personal Information for a specific, lawful and clear purpose (or for specific, lawful and clear purposes) and will ensure that it makes the Data Subject aware of such purpose(s) as far as possible.
6.3. It will ensure that there is a legal basis for the Processing of any Personal Information. Further, Iron Monkey will ensure that Processing will relate only to the purpose for and of which the Data Subject has been made aware (and where relevant, consented to) and will not Process any Personal Information for any other purpose(s).
6.4. Iron Monkey will generally use Personal Information for purposes required to operate and
manage its normal operations and these purposes include one or more of the following non- exhaustive purposes:
6.4.1. for the purposes of providing or services to clients;
6.4.2. for purposes of onboarding suppliers or service providers as approved suppliers/service providers of Iron Monkey. For this purpose, Iron Monkey will also Process a service provider/supplier Personal Information for purposes of performing the necessary due diligence checks;

6.4.3. generally for procurement and supply purposes;
6.4.4. for purposes of monitoring the use of Iron Monkey electronic systems and online platforms by Data Subjects. Iron Monkey will, from time to time, engage third party
service providers (who will Process the Data Subject Personal Information on
behalf of Iron Monkey) to facilitate this;
6.4.5. for purposes of preventing, discovering and investigating violations of this Policy,
the applicable law and other Iron Monkey policies;
6.4.6. in connection with the execution of payment processing functions, including
payment of Iron Monkey suppliers'/service providers' invoices;
6.4.7. for employment-related purposes such as recruiting staff, administering payroll,
background checks, etc.;
6.4.8. in connection with internal audit purposes (i.e. ensuring that the appropriate
internal controls are in place in order to mitigate the relevant risks, as well as to
carry out any investigations where this is required);

C2 General

6.4.9. in connection with external audit purposes. For this purpose, Iron Monkey engages
external service providers and, in so doing, shares Personal Information of the
Data Subjects with third parties;
6.4.10. for company secretarial related purposes. For this purpose, Iron Monkey will, from
time to time, collect information relating to Data Subjects from third parties;
6.4.11. for such other purposes to which the Data Subject may consent from time to time;
6.4.12. for such other purposes as authorised in terms of Data Protection Laws; and
6.4.13. to comply with any Data Protection Laws or any query from a Regulator.
7. Keeping Personal Information Accurate
7.1. Iron Monkey will take reasonable steps to ensure that all Personal Information is kept as
accurate, complete and up to date as reasonably possible depending on the purpose for
which Personal Information is collected or further Processed.
7.2. Iron Monkey may not always expressly request the Data Subject to verify and update
his/her/its Personal Information unless this process is specifically necessary.
7.3. Iron Monkey, however, expects that the Data Subject will notify Iron Monkey from time to
time in writing of any updates required in respect of his/her/its Personal Information.
8. Storage And Processing of Personal Information
8.1. Iron Monkey may store the Data Subject’s Personal Information in hardcopy format and/or in
electronic format using Iron Monkey own secure on-site servers or other internally hosted
technology. The Data Subject’s Personal Information may also be stored by third parties, via
cloud services or other technology, with whom Iron Monkey has contracted with, to support
Iron Monkey operations.
8.2. Iron Monkey third party service providers, including data storage and processing providers,
may from time to time also have access to a Data Subject Personal Information in
connection with purposes for which the Personal Information was initially collected to be
Processed.
8.3. Iron Monkey will ensure that such third party service providers will Process the Personal
Information in accordance with the provisions of this Policy, all other relevant internal
policies and procedures and Data Privacy Laws.

C2 General

8.4. These Third Parties do not use or have access to the Data Subject’s Personal Information
other than for purposes specified by Iron Monkey, and Iron Monkey requires such parties to
employ at least the same level of security that Iron Monkey uses to protect the Data
Subject’s Personal Information.
8.5. The Data Subject’s Personal Information may be Processed in South Africa or another
country where Iron Monkey, its affiliates and their third party service providers maintain
servers and facilities and Iron Monkey will take steps, including by way of contracts, to
ensure that it continues to be protected, regardless of its location, in a manner consistent
with the standards of protection required under applicable law, including Data Privacy Laws.
9. Personal Information for Direct Marketing Purposes
9.1. To the extent that Iron Monkey acts in its capacity as a direct marketer, it shall strive to
observe, and comply with its obligations under Data Privacy Laws when implementing
principles and practices in relation to direct marketing.
9.2. Iron Monkey acknowledges that it may only use Personal Information to contact the Data
Subject for purposes of direct marketing from time to time where it is permissible to do so.
9.3. Iron Monkey may use Personal Information to contact any Data Subject and/or market Iron
Monkey services directly to the Data Subject(s) if the Data Subject is one of Iron Monkey's
existing clients, the Data Subject has requested to receive marketing material from Iron
Monkey or Iron Monkey has the Data Subject consent to market its services directly to the
Data Subject.
9.4. If the Data Subject is an existing client, Iron Monkey will only use his/her/its Personal
Information if it has obtained the Personal Information through the provision of a service to
the Data Subject and only in relation to similar services to the ones Iron Monkey previously
provided to the Data Subject.
9.5. Iron Monkey will ensure that a reasonable opportunity is given to the Data Subject to object
to the use of their Personal Information for Iron Monkey marketing purposes when
collecting the Personal Information and on the occasion of each communication to the Data
Subject for purposes of direct marketing.
9.6. Iron Monkey will not use your Personal Information to send you marketing materials if you
have requested not to receive them. If you request that we stop Processing the Data
Subject’s Personal Information for marketing purposes, Iron Monkey shall do so.
10. Retention of Personal Information

C2 General

10.1. Iron Monkey may keep records of the Personal Information, correspondence, or comments it
has collected in an electronic or hardcopy file format.
10.2. In terms of Data Privacy Laws, Iron Monkey may not retain Personal Information for a period
longer than is necessary to achieve the purpose for which it was collected or processed and
is required to delete, destroy (in such a way that it cannot be reconstructed) or de-identify
the information as soon as is reasonably practicable once the purpose has been achieved.
This prohibition will not apply in the following circumstances:
10.2.1. where the retention of the record is required or authorised by Applicable Laws or
by any Regulator;
10.2.2. Iron Monkey requires the record to fulfil its lawful functions or activities;
10.2.3. retention of the record is required by a contract between the parties thereto;
10.2.4. the Data Subject (or competent person, where the Data Subject is a Child) has
consented to such longer retention; or
10.2.5. the record is retained for historical, research, archival or statistical purposes
provided safeguards are put in place to prevent use for any other purpose.
Accordingly, Iron Monkey will, subject to the exceptions noted in this Policy, retain
Personal Information for as long as necessary to fulfil the purposes for which that
Personal Information was collected and/or as permitted or required by Data
Protection Laws.

10.3. Where Iron Monkey retains Personal Information for longer periods for statistical, historical,
archival or research purposes, Iron Monkey will ensure that appropriate safeguards have
been put in place to ensure that all recorded Personal Information will continue to be
Processed in accordance with this Policy and Data Protection Laws.
10.4. Once the purpose for which the Personal Information was initially collected and Processed
no longer applies or becomes obsolete, Iron Monkey will ensure that the Personal
Information is deleted, destroyed or de-identified sufficiently so that a person cannot re-
identify such Personal Information. In instances where we de-identify the Personal
Information, Iron Monkey may use such de-identified information indefinitely.
11. Failure to Provide Personal Information
Should Iron Monkey need to collect Personal Information by Applicable Laws or under its
obligations as a service provider, and the Data Subject fails to provide the Personal Information

C2 General

when requested, Iron Monkey may be unable to perform its duties as a service provider in terms
of the Data Protection Laws.
12. Safe-Keeping of Personal Information
12.1. Iron Monkey shall preserve the security of Personal Information and, in particular, prevent its
alteration, loss and damage, or access by non-authorised third parties.
12.2. Iron Monkey will ensure the security and integrity of Personal Information in its possession
or under its control with appropriate, reasonable technical and organisational measures to
prevent loss, unlawful access and unauthorised destruction of Personal Information.
12.3. Iron Monkey has implemented physical, organisational, contractual and technological
security measures (having regard to generally accepted information security practices or
industry specific requirements or professional rules) to keep all Personal Information secure,
including measures protecting any Personal Information from loss or theft, and unauthorised
access, disclosure, copying, use or modification. Further, Iron Monkey maintains and
regularly verifies that the security measures are effective and regularly updates same in
response to new risks.
13. Breaches of Personal Information
13.1. Iron Monkey will address any Data Breach in accordance with the terms of Data Privacy
Laws.
13.2. Iron Monkey will notify the Regulator and the affected Data Subject (unless the applicable
law or a government authority requires that we delay notification to the Data Subject) in
writing in the event of a Data Breach (or a reasonable belief of a Data Breach) in respect of
that Data Subject Personal Information.
13.3. Iron Monkey will provide such notification as soon as reasonably possible after it has
become aware of any Data Breach in respect of such Data Subject Personal Information.
13.4. Where Iron Monkey acts as an 'Operator' for purposes of Data Privacy Laws and should any
Data Breach affect the data of Data Subjects whose information Iron Monkey Processes as
an Operator, Iron Monkey shall (in terms of Data Privacy Laws) notify the relevant
Responsible Party immediately where there are reasonable grounds to believe that the
Personal Information of relevant Data Subjects has been accessed or acquired by any
unauthorised person.
14. Provision of Personal Information to Third Party Service Providers

C2 General

14.1. Iron Monkey may disclose Personal Information to third parties and will enter into written
agreements with such third parties to ensure that they Process any Personal Information in
accordance with the provisions of this Policy, and Data Privacy Laws.
14.2. Iron Monkey notes that such Third Parties may assist Iron Monkey with the purposes
including but not limited to:
14.2.1. data storage;
14.2.2. assisting Iron Monkey with auditing processes (external auditors);
14.2.3. for providing outsourced services to Iron Monkey, including in respect of its (i)
legal, (ii) data storage requirements and (iii) upskilling of its employees; and/or
14.2.4. to notify the Data Subjects of any pertinent information concerning Iron Monkey.
14.3. Iron Monkey will disclose Personal Information with the consent of the Data Subject or if Iron
Monkey is permitted to do so without such consent in accordance with Data Protection
Laws.
14.4. Further, Iron Monkey may also send Personal Information to a foreign jurisdiction outside of
the Republic of South Africa, including for Processing and storage by third parties.
14.5. When Personal Information is transferred to a jurisdiction outside of the Republic of South
Africa including to any cloud, data centre or server located outside of the South Africa, Iron
Monkey will obtain the necessary consent to transfer the Personal Information to such
foreign jurisdiction or may transfer the Personal Information where Iron Monkey is permitted
to do so in accordance with the provisions applicable to cross-border flows of Personal
Information under Data Privacy Laws.
14.6. The Data Subject should also take note that the Processing of Personal Information in a
foreign jurisdiction, if and to the extent such Processing does occur, may be subject to the
laws of the country in which the Personal Information is held, and may be subject to
disclosure to the governments, courts of law, enforcement or regulatory agencies of such
other country, pursuant to the laws of such country.
15. Responses
Iron Monkey will respond to each written request of a Data Subject not later than 30 (thirty) days
after receipt of such requests. Under certain circumstances, Iron Monkey may, however, extend
the original period of 30 days once for a further period of not more than 30 (thirty) days.