POPIA Compliance Statement

This statement explains how AO Group and the applicable affiliated legal entity approach the processing of personal information under POPIA. It is intended to give customers, employees, suppliers, partners and other individuals a clear view of AO's privacy approach and the channels available to them.

This statement is a general description of approach. It is not a legal opinion, a certification, or a warranty of compliance in respect of any particular processing activity.

“AO Group” is a collective brand used by a number of affiliated legal entities. The entity that determines why and how personal information is processed will ordinarily be the responsible party under POPIA. The applicable entity may be identified from the relevant agreement, invoice, employment documentation, application, website interaction or correspondence.

• AO Connect Holdings (Pty) LtdCIPC registration number: 2023/772549/07
• AO Connect Solutions (Pty) LtdCIPC registration number: 2023/845987/07
• AO Digital Solutions (Pty) LtdCIPC registration number: 2025/250438/07
• AO Software Solutions (Pty) LtdCIPC registration number: 2025/259939/07

Pieter Hendrik du Toit — Information Officer. Formally registered as AO Group Holdings (Pty) Ltd’s Information Officer (company registration number 2026/639738/07), and registered Information Officer for the AO South African entities listed on this page. Telephone +27 (0) 12 035 1530.

Email: info@aogroup.co.za

AO Group Holdings (Pty) Ltd (South African company registration number 2026/639738/07; business and contact address: Ground Floor, Buildings 2 and 3, Centurion Gate Office Park, 1951 Akkerboom Street, Zwartkop, Centurion, 0157, South Africa; telephone +27 (0) 12 035 1530) is the responsible party (under POPIA) and controller (under the GDPR, where it applies) for the public AO Group website at weareao.group, its website analytics, its cookie and consent management, general contact and discovery enquiries submitted through this website, the public Privacy Centre, and the publication of this notice.

• “AO Group” is a collective brand used by a number of affiliated legal entities operating in different countries.
• AO Group Holdings (Pty) Ltd controls the public group website at weareao.group and its general website analytics, consent management and website enquiry handling.
• An enquiry submitted through this website may be referred internally to the AO entity best placed to respond to it.
• Where you enter into a contract, an employment relationship, a supplier relationship or another direct interaction with an AO subsidiary, that subsidiary may be the responsible party or controller for that specific processing.
• The relevant entity is identified in the applicable contract, proposal, invoice, application, employment document, collection notice or correspondence.

When you visit this website, AO Group Holdings (Pty) Ltd may process website interaction and analytics information such as pages viewed, device and browser information, approximate location and general usage patterns. Where you have consented, this may include information collected by Microsoft Clarity, an optional analytics provider, and Microsoft Advertising UET, an optional advertising provider used to measure the performance of AO's advertising.

Both of these optional categories are switched off until you actively accept them, and consent is the lawful basis relied on for each. You can withdraw your consent at any time in the Privacy Centre's cookie preferences, without affecting the lawfulness of processing carried out before you withdrew it.

This information may be shared with Microsoft as the relevant analytics or advertising provider, and with other operators and service providers that support the hosting, security and operation of this website, acting on AO Group Holdings (Pty) Ltd's instructions. Because these providers operate internationally, website interaction information may be processed outside South Africa, subject to the safeguards required by applicable law.

AO Group Holdings (Pty) Ltd applies technical and organisational safeguards to this website, including masking or truncating identifiers where appropriate for analytics purposes, to reduce the risk to individuals.

Full details of the cookies and similar technologies used on this website, including the four consent categories (necessary, analytics, marketing and advertising, and third-party content) and how to change your choice, are set out in the Cookie Policy. Details of how this website and its enquiry channels handle personal information more generally are set out in the Website Privacy Notice.

Questions or complaints about the public website, its analytics or its advertising cookies may be directed to the Information Officer, Pieter Hendrik du Toit, at info@aogroup.co.za. You may also have the right to lodge a complaint with the Information Regulator (South Africa), the statutory authority for POPIA complaints.

This document is designed to support alignment with POPIA, the GDPR (where it applies) and applicable cookie-consent requirements. It is not a certification or a guarantee of compliance, and it remains subject to review by AO's Information Officer and legal adviser.

AO seeks to apply POPIA's eight conditions for lawful processing across the lifecycle of personal information:

1. 01Accountability. We assign responsibility for privacy governance and the management of personal information.
2. 02Processing limitation. We seek to process information lawfully, reasonably and only to the extent appropriate for the purpose.
3. 03Purpose specification. We seek to collect personal information for specific and defined purposes.
4. 04Further processing limitation. We assess whether any new use of information is compatible with the original purpose or otherwise legally permitted.
5. 05Information quality. We take reasonable steps to maintain relevant, complete and accurate information.
6. 06Openness. We aim to explain what information is collected, why it is used and who is responsible for it.
7. 07Security safeguards. We apply organisational and technical safeguards appropriate to the information and risk.
8. 08Data subject participation. We provide channels through which individuals can exercise applicable privacy rights.

These summaries are not the complete legal text of POPIA and do not replace the Act.

Depending on the relationship and the relevant AO entity, personal information may include:

• Customers and prospects: Contact details, Communications, Requirements and service records, Account and contract information.
• Employees, contractors and applicants: Contact and identity information, Qualifications and employment history, Payroll and statutory information, Performance, leave and operational records.
• Suppliers and partners: Contact details, Contracts, Compliance and onboarding records, Invoices and payment information.
• Technology and security: User accounts, System access records, Device and network information, Support and audit information, Credentials where operationally necessary and contractually authorised.
• Website and marketing: Website interactions, Form submissions, Communication preferences, Consent and unsubscribe records, Relevant analytics information.
• Finance and governance: Billing and banking details, Tax and corporate records, Legal and regulatory correspondence, Risk and compliance records.

AO aims to collect only information that is relevant and reasonably necessary for a defined business, legal, contractual or operational purpose.

• To provide contracted services
• To communicate with customers, suppliers and partners
• To manage projects, support and service delivery
• To recruit, employ and manage people
• To process invoices and payments
• To operate and secure AO systems
• To meet legal, regulatory and contractual duties
• To manage risk, fraud prevention and business continuity
• To improve services and customer experience
• To send permitted business communications
• To maintain records and defend legal rights

The specific purpose and legal basis depend on the relevant processing activity, relationship and jurisdiction.

Personal information may be shared with:

• Authorised AO employees and contractors
• Other AO entities where required for legitimate group operations
• Approved technology, hosting and service providers
• Professional advisers
• Customers or partners where contractually necessary
• Regulators, courts or public authorities where legally required
• Lawful transaction parties during a corporate transaction

AO does not sell personal information.

Where third parties process information on AO's behalf as operators, AO seeks to use appropriate contractual, confidentiality and security arrangements.

AO applies organisational and technical safeguards appropriate to the nature of the information, the systems involved and the risks presented. Depending on the entity and system, these may include:

• Role-based access controls
• Authentication and account-management controls
• Encryption and secure communications where appropriate
• Endpoint and infrastructure security
• Backup and recovery processes
• Monitoring and incident-management processes
• Supplier and operator due diligence
• Confidentiality obligations
• Staff awareness and training
• Secure document and record management
• Retention and disposal procedures
• Periodic access and control reviews

AO operates across multiple jurisdictions and may use systems, service providers or group resources located outside the country in which personal information was collected. Where personal information is transferred internationally, AO seeks to apply the appropriate contractual, legal and security safeguards required by the applicable law.

AO retains personal information only for as long as reasonably necessary for the purpose for which it was collected, or as required by legal, regulatory, contractual, operational or evidential obligations. Retention periods may differ according to:

• The type of information
• The relevant AO entity
• The customer or employment relationship
• Contractual commitments
• Tax, labour or corporate requirements
• Litigation or dispute requirements
• Security and audit needs

When information is no longer required, AO seeks to delete, destroy, anonymise or securely archive it as appropriate.

Depending on the applicable law and circumstances, a data subject may have the right to:

• Ask whether AO holds personal information about you
• Request access to that information
• Request correction of inaccurate or incomplete information
• Request deletion or destruction where legally permitted
• Object to certain processing
• Request restriction of processing where GDPR applies
• Withdraw consent where processing relies on consent
• Request data portability where GDPR applies
• Object to direct marketing
• Lodge a complaint with the relevant supervisory authority

These rights are not absolute and may be limited by legal, contractual, regulatory or evidential requirements.

Privacy requests may be submitted by email to info@aogroup.co.za using the subject line “Privacy Request — [Your Name]”. AO may request reasonable proof of identity or authority before acting on a request, and may contact the requester for clarification. Requests for access to records under PAIA follow a separate prescribed process.

Contact info@aogroup.co.za so that AO can investigate any privacy concern. A data subject may also have the right to lodge a complaint with the relevant privacy regulator or supervisory authority.

Owner: Information Officer, AO Group and the applicable affiliated legal entity.

Version and effective date: pending formal approval. This web statement is published as AO's general description of approach. The formally approved, versioned PDF will be published in the privacy document centre once approved.