Privacy Policy (South Africa)

1. Introduction & Scope

This Privacy Policy (the "Policy") sets out the principles and procedures adopted by Puma Energy South Africa (Pty) Limited ("Puma Energy", "we", "our", or "us") regarding the collection, use, processing, retention, disclosure and protection of personal information when you engage with the Puma PRIS loyalty programme and its related mobile application (the "PRIS App").

This Policy applies to:

• Individuals registering for, or making use of, the PRIS App or PRIS loyalty programme;
• Individuals transacting through the PRIS App and cards; and
• Any person who otherwise communicates with Puma Energy in relation to the PRIS programme.

Puma Energy International, whose corporate offices are at 1, rue de Jargonnant, CH-1207, Geneva, Switzerland, together with Puma Energy South Africa (Pty) Limited, whose registered office is located at 129 Rivonia Road, The Marc Tower 2, 8th Floor, Sandton, Gauteng, 2196, are the controllers of your personal information for the purposes of applicable data protection laws, including POPIA, in respect of personal information processed in connection with the PRIS loyalty programme. Puma Energy International may process personal information in a supporting capacity as part of the Puma Energy Group.

By using the PRIS App, you acknowledge that you have read and understood this Policy and consent to the processing of your personal information as described herein.

2. Categories of Personal Data Collected

For the purposes of providing, maintaining and improving the PRIS programme, Puma Energy may collect and process the following categories of information:

• Identity and Contact Information: including but not limited to your full name, government-issued identification number, mobile number, postal and/or email address;
• Loyalty Account and Transactional Information: including your PRIS wallet ID, accumulated balance, top-up history, redemptions, station identifiers, location and time of transactions, rewards earned and redeemed, and promotional campaigns opted into;
• Device and Technical Information: including your device type, device unique identifiers and operating system, the version of the PRIS App in use, limited diagnostic or error reporting, IP address, session logs and location of usage;
• Authentication Information: including PINs or other verification credentials used to authorise loyalty transactions; and
• Marketing and Communications Preferences: including records of your decision to opt into or out of receiving marketing communications from Puma Energy.

3. Manner of Collection

We collect your personal information through the following lawful means:

• Direct provision by you: including registration data, transaction instructions, and communication initiated by you with Puma Energy;
• Automated collection: including limited device, log and usage information generated when you access or interact with the PRIS App or our support channels;
• Authorized partners: where required to process loyalty points, payments or top-ups, Puma Energy may receive information from authorised third parties such as mobile money operators or payment processors;
• Information received from third-party service providers involved in transaction processing and settlement; and
• Where you participate in the PRIS loyalty programme at a service station, your personal information (such as your mobile number or loyalty identifier) may be captured by a site attendant via a handheld device and transmitted to Puma Energy systems through authorised service providers, including Payments24, for validation and transaction processing.

4. Purpose of Processing

Your personal information will only be processed for legitimate, lawful and specific purposes associated with the PRIS programme, which may include:

• Administering, operating and maintaining the PRIS App and loyalty programme;
• Verifying your identity and eligibility to participate in PRIS;
• Recording and executing transactions, rewards and redemptions;
• Preventing, detecting and responding to fraudulent activity, misuse or security incidents;
• Providing customer support and responding to queries or complaints;
• Facilitating transaction processing through authorised service providers, including the validation of loyalty participation, application of rewards, and settlement of related transactions; and
• Complying with statutory and regulatory obligations applicable to Puma Energy.

Marketing communications (email & SMS) — We will send email, WhatsApp & SMS marketing communications only with your consent. You may grant or withhold consent separately for each channel in the PRIS App. You may withdraw your consent at any time by unsubscribing.

Geolocation — The PRIS App will access your device location for store-finding, contextual offers, or fraud prevention only if you explicitly enable location services for the App on your device and toggle geolocation consent in the App. You may withdraw this consent at any time via device settings and in-App controls.

5. Compulsory Data & Consequences of Non‑Provision

Certain categories of information are compulsory for the establishment and operation of a PRIS account, including but not limited to name, mobile number and national identification details. Failure to provide such information will render Puma Energy unable to provide you with access to the PRIS App or its services. Optional information may be provided at your discretion, and refusal to provide optional information will not restrict your ability to participate in PRIS.

Puma Energy determines the purposes for which personal information is processed, and the conditions under which PRIS services are provided in accordance with applicable law.

6. Legal Basis for Processing

Puma Energy processes personal information in PRIS on the following lawful bases:

• Consent: where you have given explicit consent, for example to receive marketing communications;
• Contractual necessity: to perform obligations relating to your participation in PRIS;
• Legal obligation: to comply with South African law and regulatory frameworks; and
• Legitimate interest: where processing is reasonably required to protect Puma Energy's rights, prevent fraud or improve services, and such interests are not overridden by your fundamental rights.

7. Data Sharing & Disclosure

Puma Energy may disclose personal information to the following authorised recipients:

• Puma Energy group companies and affiliates, on a need-to-know basis;
• Service providers who support the PRIS App (including IT, hosting, maintenance, payment processors), subject to binding confidentiality and data protection obligations;
• Service providers, Payments 24 (Pty) Ltd, who support the operation of the PRIS programme. Payments 24 processes personal information on behalf of Puma Energy to facilitate transaction processing, loyalty point accrual and redemption, and system integration. These providers act solely on Puma Energy's instructions and in compliance with applicable data protection laws;
• Regulatory authorities, law enforcement bodies or courts of competent jurisdiction, where disclosure is required or permitted by law; and
• Professional advisors, such as auditors and lawyers and third parties involved in a corporate transaction such as a merger, acquisition or sale of assets, in which case safeguards will be applied to ensure continuity of protection.

Puma Energy requires all operators processing personal information on its behalf to do so only on documented instructions, to implement appropriate security measures, and to maintain confidentiality.

8. Cross‑Border Transfers

Your personal information may be transferred to, and stored in, countries outside of South Africa for purposes of IT hosting or group-level administration. Where such transfers occur, Puma Energy will implement appropriate safeguards in accordance with applicable data protection laws, including contractual protections or transfers to jurisdictions with adequate data protection laws, to ensure that your data is protected to a standard consistent with this Policy and applicable law.

9. Security Measures

Puma Energy implements appropriate technical and organisational measures to ensure the integrity and confidentiality of personal information, including encryption in transit, access restrictions, secure storage facilities, and periodic review of security protocols. While we take reasonable and appropriate steps to protect personal information, no information system can be guaranteed to be completely secure, and Puma Energy disclaims liability for unauthorised access beyond our reasonable control.

In the event of a security compromise, Puma Energy will notify you and, where applicable, the relevant supervisory authority and take the necessary steps to mitigate the impact and comply with its obligations under applicable law.

10. Data Retention & Accuracy

We retain personal information for as long as is necessary to fulfil the purposes described in this Policy, including to meet legal, regulatory, tax, accounting or evidentiary requirements. Thereafter, information is securely deleted or anonymised in accordance with internal policies and procedures. You are responsible for notifying Puma Energy of any changes to your personal information. Whilst Puma Energy takes reasonable steps to maintain accurate records, Puma Energy cannot be responsible for any inaccuracies arising from information that has not been updated by you.

11. Your Rights

Subject to applicable law, you may exercise the following rights:

• Request access to the personal information held about you;
• Request correction of inaccurate or incomplete data;
• Request deletion where information is no longer required;
• Withdraw consent previously given (without affecting lawfulness of prior processing); and
• Object on reasonable grounds to the processing of your personal information, including direct marketing.

Requests should be directed to the Contact Us form or prisafricasupport@pumaenergy.freshdesk.com and will be addressed in accordance with statutory timelines. Puma Energy reserves the right to charge a fee for reproduction costs, transcription, and search and preparation time. For more information, please refer to the Puma Energy South Africa PAIA Manual located at https://pumaenergy.com/wp-content/uploads/2023/05/Puma-Energy-South-Africa-PAIA-Manual.pdf.

12. Cookies & Similar Technologies

The PRIS App may use cookies or similar technologies for core operational purposes (such as maintaining session state) and for limited analytical purposes. You may disable cookies through your device settings, but please note this may impair the functionality of the PRIS App. You can refer to the cookie policy of Puma Energy here (https://pumaenergy.com/privacy-policy/).

13. Children

The PRIS App and loyalty programme are not intended for use by individuals below the legal age of majority in South Africa. Puma Energy does not knowingly collect information from minors without parental or guardian consent. Should such data be inadvertently collected, Puma Energy will promptly delete it on being notified.

14. Amendments to this Policy

Puma Energy may amend this Policy from time to time to reflect changes in law, regulation or operational practices. Material changes will be notified through the PRIS App or other reasonable communication methods. Continued use of the PRIS App following such notice shall constitute acceptance of the amended Policy.

15. Contact & Complaints

For questions, requests or complaints regarding this Policy, please contact:

Data Protection Officer – Puma Energy South Africa (Pty) Limited
Email: dpo@pumaenergy.com or privacysa@pumaenergy.com

If you are dissatisfied with Puma Energy's response, you have the right to escalate the matter to the Information Regulator in South Africa:

Address: Woodmead North Office Park, 54 Maxwell Dr, Woodmead, Johannesburg, 2191
Telephone: 010 023 5200
Email: POPIAComplaints@inforegulator.org.za