Privacy Policy Effective Date: February 10, 2024 4POS Software (“4POS Software”, “we”, “us” or “our”) respects your privacy. When it comes to your personal information, we believe in transparency, not surprises. That’s why we’ve set out here what personal information we collect, what we do with it and your choices and rights. By using any of 4POS Software’s Services, you confirm you have agreed to the Terms of Service and read and understood this Privacy Policy. Certain jurisdictions require us to provide you with specific additional information. 1. Some key terms In our Privacy Policy, when we refer to “Users”, we mean our customers who use our Services, including visitors to our sites. We explain who we are in the “Who is 4POS Software?” section below. The users, visitors and customers of our Users’ sites are “End Users”. Any other capitalized terms not defined in this Privacy Policy have the meanings in our Terms of Service. 2. How does this Privacy Policy apply? This Privacy Policy describes what we do with personal information that we collect and use for our own purposes (i.e., where we are a controller), such as your account information and information about how your use and interact with our Services, including information you submit to our customer support as well as certain information relating to your End Users. This Privacy Policy does not apply to personal information of our employees or job applicants (except to the extent employees or job applicants are Users). This Privacy Policy also includes the right to object to certain types of processing we carry out (see Section 7 below to find out more). With respect to personal information in 4POS Software’s possession, we play a few different roles under global data privacy laws. In order to understand your and 4POS Software’s obligations, it’s important to understand the difference between 4POS Software Controlled PI and User Controlled PI. • “4POS Software Controlled PI” means personal information for which 4POS Software determines the purposes and means of processing. • “User Controlled PI” means personal information for which a User determines the purposes and means of processing. For User Controlled PI, 4POS Software acts as a data processor, • service provider or similar term under applicable law. User Controlled PI includes User Content and End Users' personal information described in Section 12 that we host and process on behalf • of our Users. Our Users tell us what we do with User Controlled PI on our Users’ instructions. Our Users are responsible for ensuring that their collection and processing of User Controlled PI • complies with applicable law. If you are a User looking for contractual provisions about how 4POS Software will treat and secure your User Controlled PI. We explain below how we collect and use 4POS Software Controlled PI and your rights. If you are an End User of one of our User’s sites and want to know how a User handles your information, you should check the site's privacy policy. 3. Personal information we collect We collect various personal information regarding you or your device. This includes the following: • Information you provide to create an Account, specifically email address, first name and last name. • Information you provide if you sign up for Paid Services. For most Paid Services, this will include your billing address as well as a portion of your payment information which is provided to us • from our payment processor (such as the last four digits, the country of issuance and the expiration date of the payment card). • The emails and other communications that you send us or otherwise contribute, such as customer support inquiries or posts to our customer message boards or forums. Please be aware that • information on public parts of our sites is available to others. • Information you share with us in connection with surveys, contests or promotions. • Information from your use of the Services or, where you are an End User, from your use of Users’ sites. This includes: IP addresses, preferences, web pages you visited prior to coming to our or • our Users’ sites, information about your browser, network or device (such as browser type and version, operating system, internet service provider, preference settings, unique device IDs and language • and other regional settings), information about how you interact with the Services and our Users’ sites (such as timestamps, clicks, scrolling, browsing times, searches, transactions, referral pages, • load times, and problems you may encounter, such as loading errors). • Information we get from our partners to support our marketing initiatives, improve our Services and better monitor, manage and measure our ad campaigns, such as details about when a partner of ours • shows you one of our ads on or via its advertising platform. • Other information you submit to us directly or through Third Party Services if you use a Third Party Service to create an Account (based on your privacy settings with such Third Party Service). 4. How we collect personal information We obtain personal information from various sources. We do this in three main ways: • You provide some of it directly (such as by registering for an Account). • We record some of it automatically when you use our Services or Users’ sites (including with technologies like cookies). • We receive some of it from third parties (like when you register for an account using a Third Party Service, when you purchase our products from an authorized reseller or when you make payments to us • using our payment processor or via a mobile app store). We’ve described this in more detail below. a. Personal information you provide When you use our Services, we collect information from you in a number of ways. For instance, we ask you to provide your name and email address to register and manage your Account. We also maintain your marketing preferences and the emails and other communications that you send us or otherwise contribute, such as customer support inquiries or posts to our customer message boards or forums. You might also provide us with information in other ways, including by responding to surveys, submitting a form or participating in contests or similar promotions. b. Personal information obtained from your use of our Services When you use our Services, we collect information about your activity on and interaction with the Services, such as your IP address(es), your device and browser type, the web page you visited before coming to our sites, what pages on our sites you visit and for how long and identifiers associated with your devices. If you’ve given us permission through your device settings, we may collect your location information in our mobile apps. c. Personal information obtained from other sources Not applicable 5. How we use your personal information We use the personal information we obtain about you for the following purposes: • Provision of the Services to Users. Create and manage your Account, provide and personalize our Services, register or transfer your Voucher, process payments and respond to your inquiries. • Communicating with you. Communicate with you, including by sending you emails about your transactions and Service-related announcements. • Surveys and contests. Administer surveys, contests and other promotions. • Promotion. Promote our Services and send you tailored marketing communications about products, services, offers, programs and promotions of 4POS Software and our partners and measure the success of • those campaigns. For example, we may send different marketing communications to you based on your subscription plan or what we think may interest you based on other information we hold about you. • Advertising. Analyze your interactions with our Services and third parties’ online services so we can tailor our advertising to what we think will interest you. • Customizing the Services. Provide you with customized services. For example, we use your location information to determine your language preferences or display accurate date and time information. We also • use cookies and similar technologies for this purpose, such as remembering which of Your Sites you most recently edited. • Improving our Services. Analyze and learn about how the Services are accessed and used, evaluate and improve our Services (including by developing new products and services and managing our communications) • and monitor and measure the effectiveness of our advertising. We usually do this based on anonymous, pseudonymized or aggregated information which does not identify you directly. For example, if we learn that • most Users of Paid Services use a particular integration or feature, we might wish to expand on that integration or feature. • Security. Ensure the security and integrity of our Services. • Third party relationships. Manage our vendor and partner relationships. • Enforcement. Enforce our Terms of service and other legal terms and policies. • Protection. Protect our and others’ interests, rights and property (e.g., to protect our Users from abuse). • Complying with law. Comply with applicable legal requirements, such as tax and other government regulations and industry standards, contracts or law enforcement requests. • Consent. You have consented to the use of your personal information in a particular way. When you consent, you can change your mind at any time. • Performance of a contract. We need your personal information to provide you with services and products requested by you, or to respond to your inquiries. In other words, so we can perform our contract with you • or take steps at your request before entering into one. For example, we need your email address so you can sign in to your 4POS Software account. • Legal obligation. We have a legal obligation to use your personal information, such as to comply with applicable tax and other government regulations or to comply with a court order or binding law enforcement request. • Legitimate interests. We have a legitimate interest in using your personal information, but we won't process your information if your interests, or your fundamental rights and freedoms, override ours. In particular, we • have a legitimate interest in the following cases: o To operate the 4POS Software business and provide you with tailored advertising and communications to develop and promote our business. o To analyze and improve the safety and security of our Services - we do this as it is necessary to pursue our legitimate interests in ensuring 4POS Software is secure, such as by implementing and enhancing security o measures and protections and protecting against fraud, spam and abuse. o To provide and improve the Services, including any personalized services - we do this as it is necessary to pursue our legitimate interests of providing an innovative and tailored offering to our Users on a sustained basis. o To share your personal information with other 4POS Software group companies that help us provide and improve the Services. o To comply with a court order or binding law enforcement request. o To anonymize and subsequently use anonymized information. • Protecting you and others. To protect your vital interests, or those of others. • Others’ legitimate interests. Where necessary for the purposes of a third party’s legitimate interests, such as our partners who have a legitimate interest in delivering tailored advertising to you and monitoring and measuring • its effectiveness or our Users who have a legitimate interest in having their sites function properly and securely and analyzing the usage of their sites so they can understand trends and improve their services. 6. How we share your personal information We share personal information in the following ways: • Affiliates. We share personal information with our affiliates when it is reasonably necessary or desirable, such as to help provide services to you or analyze and improve the services we or they provide. • Users. We share with our Users data regarding usage by End Users of their sites. For example, we provide a User with information about what web page the End User visited before coming to their site and how their • End Users interacted with their site. This is so Users can analyze the usage of their sites and improve their services. • Following the law or protecting rights and interests. We disclose your personal information if we determine that such disclosure is reasonably necessary to comply with the law, protect our or others’ rights, property • or interests (such as enforcing our Terms of Service) or prevent fraud or abuse of 4POS Software or our Users or End Users. In particular, we may disclose your personal information in response to lawful requests by • public authorities, such as to meet national security or law enforcement requirements. • Business transfers. If we're involved in a reorganization, merger, acquisition or sale of some or all of our assets, your personal information may be transferred as part of that deal or the negotiation of contemplated deals. 7. Your rights and choices Where applicable law requires (and subject to any relevant exceptions under law), you may have the right to access, update, change or delete personal information. You can access, update, change or delete personal information (or that of your End Users) in your Account. You can also delete your account. Please note that we may need to verify your identity in connection with your requests, and such verification process may, if you do not have access to your Account, require you to provide us with additional information we maintain about you to verify your identity. Even if you have access to your Account, we may request additional information if we believe it’s necessary to verify your identity. If we are unable to verify your identity or request, we may not, in accordance with applicable law, be able to fulfill your request. You may also contact us by email at support@4pos.co.za to submit an access, update, change or deletion request. You can also elect not to receive marketing communications by changing your preferences in your Account or by following the unsubscribe instructions in such communications. Please note that, for technical reasons, there is likely to be a delay in deleting your personal information from our systems when you ask us to delete it. We also will retain personal information in order to comply with the law, protect our and others’ rights, resolve disputes or enforce our legal terms or policies, to the extent permitted under applicable law. You may have the right to restrict or object to the processing of your personal information or to exercise a right to data portability under applicable law. You also may have the right to lodge a complaint with a competent supervisory authority, subject to applicable law. We do not use cookies to collect any data from you. If you are an End User of one of our User’s sites, you should contact them to exercise your rights with respect to any information they hold about you which they control. 8. How we protect your personal information While no service is completely secure, we have a security team dedicated to keeping personal information safe. We maintain administrative, technical and physical safeguards that are intended to appropriately protect against accidental or unlawful destruction, accidental loss, unauthorized alteration, unauthorized disclosure or access, misuse and any other unlawful form of processing, of the personal information in our possession. We employ security measures such as using firewalls to protect against intruders, building redundancies throughout our network (so that if one server goes down, another can cover for it) and testing for and protecting against network vulnerabilities. 9. How we retain your personal information We retain personal information regarding you or your use of the Services for as long as your Account is active or for as long as needed to provide you or our Users with the Services. We also retain personal information for as long as necessary to achieve the purposes described in this Privacy Policy, for example, to comply with our legal obligations, to protect us in the event of disputes and to enforce our agreements and to protect our and others’ interests. The precise periods for which we keep your personal information vary depending on the nature of the information and why we need it. Factors we consider in determining these periods include the minimum required retention period prescribed by law or recommended as best practice, the period during which a claim can be made with respect to an agreement or other matter, whether the personal information has been aggregated or pseudonymized, and other relevant criteria. For example, the period we keep your email address is connected to how long your Account is active, while the period for which we keep a support message is based on how long has passed since the last submission in the thread. As Users may have a seasonal site or come back to us after an Account becomes inactive, we don’t immediately delete your personal information when your trial expires or you cancel all Paid Services. Instead, we keep your personal information for a reasonable period of time, so it will be there for you if you come back. You may delete your Account by following the instructions in contacting us at support@4pos.co.za and 4POS Software will delete the personal information it holds about you (unless we need to retain it for the purposes set out in this Privacy Policy). Please note that in the course of providing the Services, we collect and maintain aggregated, anonymized or de-personalized information which we may retain indefinitely. 10. Data transfers Personal information that you submit through the Services may be transferred to countries other than where you live, such as, for example, to our servers in the U.S. We also store personal information locally on the devices you use to access the Services. Your personal information may be transferred to countries that do not have the same data protection laws as the country in which you initially provided the information. For example, data we store may be accessible to law enforcement and national security authorities under certain circumstances. We rely upon a number of means to transfer personal information which is subject to: (a) the European General Data Protection Regulation (“GDPR”) in accordance with Chapter V of the GDPR; or (b) applicable UK data privacy laws in accordance therewith. References to GDPR and its provisions include the GDPR as amended and/or incorporated into UK law. These include: • Standard data protection clauses. We transfer, in accordance with Article 46 of the GDPR, personal information to recipients that have entered into the European Commission approved contract for the transfer of personal data • outside the European Economic Area (“EEA”). We transfer, in accordance with UK law, personal information to recipients that have entered into the UK Information Commissioner’s Office approved international data transfer • agreement and the UK addendum to such European Commission approved contract. • Other means. We may, in accordance with Articles 45 and 46 of the GDPR, transfer personal information to recipients that are in a country the European Commission or a European or UK data protection supervisory authority • has confirmed, by decision, offers an adequate level of data protection, pursuant to an approved certification mechanism or code of conduct, together with binding, enforceable commitments from the recipient to apply the • appropriate safeguards, including as regards data subjects’ rights, or to processors which have committed to comply with binding corporate rules. o Data Privacy Frameworks. We transfer personal data to 4POS Software, Inc. in the US from, as applicable, the EEA, Switzerland and the UK pursuant to the EU- U.S. Data Privacy Framework, the Swiss-U.S. Data o Privacy Framework and the UK Extension to the EU-U.S. Data Privacy Frameworks (each individually and jointly, the “Data Privacy Frameworks”). In accordance with Article 45 of the GDPR, an adequacy decision o was adopted for the EU-U.S., Swiss-US and UK Extension to the EU-US Data Privacy Frameworks. You can find out more information about these transfer mechanisms at support@4pos.co.za or you can request a copy from us. 11. Data Privacy Frameworks 4POS Software, Inc. complies with the Data Privacy Frameworks to provide a legal basis for transfers of personal data to 4POS Software If you have a question or complaint you believe to be within the scope of our Data Privacy Frameworks certification, please contact us first at support@4pos.co.za, or using the contact details in the “How to contact us” section below. We'll respond within 45 days. 12. End Users’ personal information Our Users who have created a site using 4POS Software are responsible for what they do with the personal information they collect, directly or through 4POS Software, about their End Users where they are a controller for such processing. This Section 12 is directed to such Users. a. Your relationship with End Users If you’re one of our Users, you will collect personal information about your End Users. For example, during checkout you may ask your End Users to provide their name, address, email address and payment information so that you can complete their orders. You may also use cookies and similar technologies to analyze usage and other trends. You're solely responsible for complying with any laws and regulations that apply to your collection and use of your End Users’ information, including personal information you collect about them from us or using 4POS Software functionality or cookies or similar technologies. Please be aware that you and 4POS Software may be independent controllers of some data (“Independently Controlled Data”). Independently Controlled Data includes data related to your End Users’ interactions with Your Site such as IP address, device/browser details, web pages visited prior to coming to Your Site and browsing activity on Your Site. Independently Controlled Data may be collected by the Services through an End User’s browser and technologies like cookies. Note that Independently Controlled Data is 4POS Software Controlled PI with respect to processing by 4POS Software (for which we determine the purposes and means of the processing) and User Controlled PI with respect to processing by a User (for which the User determine the purposes and means of the processing). You must publish your own privacy and cookie policies and comply with them. We’re not liable for your relationship with your End Users or how you collect and use personal information about them (even if you collect it from us or using 4POS Software functionality or cookies or similar technologies) and we won’t provide you with any legal advice regarding such matters. b. End User payment information If you use the 4POS Software Payments Services through the Services, in accordance with the 4POS Software Payments Terms, you accept that 4POS Software, the Processor providing the Processor Services and certain 4POS Software Payments Services third party service providers have the authority to access, use and transmit your End Users’ Transaction, payment (cardholder information) and other information. We share such End Users’ Transaction, payment (cardholder information) and other information with the Processor and certain 4POS Software Payments Services third party service providers to provide the Payments Services, to perform administrative payment functions, to perform individual identity or bank verification, to prevent or investigate suspected risk, fraud, security threats, illegal and malicious activity. If you integrate Your Site with a third party eCommerce Payment Processors, Your End Users’ payment information may be processed via third party eCommerce Payment Processors, in accordance with such eCommerce Payment Processors’ terms and policies. We transmit your End Users’ complete payment information when they initially provide or update it only so that we can pass it along to the eCommerce Payment Processors you agree to use. With respect to such third party eCommerce Payment Processors integrated with Your Site, we don’t collect or store your End Users’ payment information. 13. Updates to this Privacy Policy We’ll update this Privacy Policy from time to time to reflect changes in technology, law, our business operations or any other reason we determine is necessary or appropriate. When we make changes, we’ll update the “Effective Date” at the top of the Privacy Policy and post it on our sites. If we make material changes to it or the ways we process personal information, we’ll notify you (by, for example, prominently posting a notice of the changes on our sites before they take effect or directly sending you a notification). We encourage you to check back periodically to review this Privacy Policy for any changes since your last visit. This will help ensure you better understand your relationship with us, including the ways we process your personal information. 14. Who is 4POS Software? When we say “4POS Software” (or “we”, “us” or “our”), we mean: (a) 4POS Software If your place of residence or principal place of business changes, the 4POS Software entity that controls your personal information will be determined by your new residence or principal place of business from the date it changes. 15. How to contact us If you have questions, comments or complaints about this Privacy Policy or our privacy practices or if you would like to exercise your rights and choices, please email us at support@4pos.co.za