Legal Information

POPIA Website and Email Privacy Disclosure Statement

LTS Compliance Services collects, processes, and stores information of data subjects as a usual course of our business. In South Africa, this processing is governed by the Protection of Personal Information Act (POPIA), and we are fully committed to compliance. This statement serves as our disclosure to Data Subjects and other interested parties, in broad terms, of how we achieve that.

1. Definitions

• Data Subjects: A natural person (an individual, such as an FSP Key Individual, Representative, or an FSP’s client) or a legal person (a juristic entity, such as an FSP company or close corporation) whose information is collected, processed, or stored.

• Personal Information: Information relating to an identifiable, living, natural person, and where it is applicable, an identifiable, existing juristic person, as defined in Section 1 of POPIA.

2. Why We Process Information (The Purpose)

LTS Compliance Services provides specialized regulatory support to Financial Services Providers (FSPs). To provide this service and engage in lawful data interaction, we must gather certain information to:

• Fulfill Our Professional Mandate: To develop, monitor, and audit compliance frameworks (FAIS, FICA, POPIA) specific to Category I & II FSP licenses.

• Satisfy Legal Obligations: To comply with statutory requirements under the FAIS Act, FICA, and other financial regulations that require robust record-keeping and data processing (e.g., verifying the fit and proper status of Key Individuals and Representatives).

• Provide Regulatory Feedback: To interact with regulatory bodies (such as the FSCA and FIC) on your behalf, as mandated.

The information we collect will depend on the specific reasons for processing. We will only collect information that we need for that particular purpose, as agreed upon with you, and no more than necessary.

3. How We Process Information (The Methodology)

LTS Compliance Services has a POPIA compliance framework in place, which comprises impact assessments and a formal POPIA Policy, among others.

• Direct Collection: We will usually obtain information from a Data Subject directly via various different means (e.g., during onboarding or audit processes). We may from time to time also obtain publicly available information (e.g., from the CIPC or FSCA registers).

• Third-Party Processing (Operators): Data Subject information may be processed by third parties ("Operators") like software providers, secure cloud storage providers (where data is encrypted and transferred cross-border), or other suppliers to ensure Data Subjects get great service. Agreements with these third parties mandate that they protect this data to an equivalent standard.

4. What Information We Process (The Categories)

From time to time, we may process specific categories of information of natural or legal persons, which is defined as personal information in terms of POPIA. Our specific interaction with the Data Subject will detail what information we need exactly. The categories of information we may process include:

• Juristic (Legal) Person Information: Name, registration number, taxi/VAT number, FSP number, physical/postal addresses, financial statements, and regulatory history.

• Key Individuals and Representatives: Name, ID number/passport, financial qualifications, fit and proper status, and competence records.

• End-Consumers (FSP Clients): ID number/passport, contact details, product choices, advice records, and transactional data provided by the FSP for the purpose of FAIS compliance monitoring or audit file reviews.

We may also process specialized categories of information when required to satisfy a specific legal mandate (e.g., for verifying background, education, financial, or criminal history, or biometric information of a natural person).

5. Data Subject Rights

Data Subjects have the right not to share the information as set out above. However, in that instance, we cannot offer Data Subjects our services, as the processing is essential to fulfill our professional mandate and satisfy legal requirements under FAIS and FICA.

Data Subjects have the right to:

• Access: Enquire what information of theirs we hold.

• Correction: Request that we correct their information.

• Deletion: Request that we delete the information, unless the law states that we must continue to hold the information (which is common under financial services regulation).

• Revocation: Right to revoke consent (which may terminate our service agreement).

6. Enquiries or Complaints

Anyone can approach us on our contact details on our website to speak to our Information Officer or to submit any data queries or complaints.

If you believe that LTS Compliance Services has not resolved your complaint to your satisfaction, you have the right to lodge a complaint to the Information Regulator of South Africa.

RegulatorContact Information

Information Regulator (South Africa)complaints.IR@justice.gov.za

Physical AddressWoodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg

Postal AddressP.O Box 31533, Braamfontein, Johannesburg, 2017

7. Consent

By visiting our website, engaging in professional communication with us, and utilizing our services, the Data Subject consents to the processing, including transfer of his Personal Information as set out in this disclosure.