Privacy Policy

The purpose of this Privacy Policy is to assure that nuvoteQ (Pty) Ltd (hereinafter referred to as nuvoteQ) adheres to the Protection of Personal Information Act 4 of 2013 (POPIA), the Electronic Communications and Transactions Act 25 of 2002 (ECTA), the European Union (EU) General Data Protection Regulation (GDPR), the Health Insurance Portability and Accountability Act (HIPAA) and other applicable data protection laws (“Data Protection Laws”).

This Privacy Policy applies to Personal Information (subject hereto that such Personal Information falls within the application of POPIA) that nuvoteQ collects from you during your interactions with nuvoteQ, including through nuvoteQ's websites (including mobile sites) and social media sites, mobile sites/applications and/or other online platforms (collectively “Online Services”) that link to this Privacy Policy, in writing or orally, or Personal Information that nuvoteQ may collect offline or receive from third parties.

This Privacy Policy applies to you if you:

• Are a visitor to the nuvoteQ website.
• Create a user account on a nuvoteQ Online Service / Electronic Platform.
• Add to and manage your personal profile on a nuvoteQ Online Service / Electronic Platform.
• Contact or communicate with nuvoteQ via an Online Service / Electronic Platform.
• You accept all the terms of this Privacy Policy when you register on a nuvoteQ Online Service. If you do not agree with anything in this Privacy Policy or subsequent updates, you may be able to modify your browser and/or mobile device settings so that you are notified when receiving cookies, or you can choose to restrict or block cookies. Please be aware that parts of our websites may not function correctly if you disable cookies.
• Any suspected Security Breach or compromise of Personal Information or Confidential Information will be addressed as detailed in PC-GM-03 “Privacy, Security and Protection of Personal Information”.

Key terms used in this Privacy Policy:

• Confidential Information — All business information, operations, products or plans, personal information or plans which are not known to the general public and disclosed by nuvoteQ, or that has been clearly marked as “Confidential” by a Client.
• Consent — Any voluntary, specific and informed expression of will by which permission is given for the Processing of Personal Information.
• Cookies — A small text file (up to 4KB) created by a website that is stored in the user's computer either temporarily for that session or permanently on the hard disk (persistent cookie).
• Data — Information, facts and statistics used for reference or analysis in electronic form. For this Policy, all references to Data may include Personal Information and/or Confidential Information.
• Data Protection Officer (DPO) — Someone, either an employee or a professional hired externally, who has responsibility for ensuring that their organisation is compliant with GDPR.
• Data Subject — The person to whom the Personal Information relates.
• Electronic Platform — A secure electronic system used by authorised nuvoteQ staff in accordance with their documented access rights for the delivery of electronic information (including, without limitation, documents).
• General Data Protection Regulation (GDPR) — Regulation 2016/679 on data protection and privacy in the EU and the EEA. It also addresses the transfer of personal data outside the EU and EEA areas.
• Information Officer — The “head” of a private body (such as a company) or the most senior person of a particular public body, or any person duly authorised by such acting person. “Data Protection Officer” has a corresponding meaning.
• Information Regulator — An independent body established in terms of Section 39 of POPIA, empowered to monitor and enforce compliance by public and private bodies with the provisions of POPIA.
• IP address — A unique address that identifies a device on the internet or a local network.
• Online Services — A system/platform that collects Data during a user's interaction and includes, without limitation, the nuvoteQ website (including mobile sites) and social media sites (Facebook, LinkedIn etc.), mobile sites/applications and/or other online platforms.
• Personal Information — Information relating to an identifiable, living natural person, or an identifiable, existing juristic person, as defined in POPIA. Personal Information must always be treated as Confidential Information, even after the individual's death, and includes Pseudonymised or de-identified data that can be re-attributed.
• Processing — Any operation or activity concerning Personal Information, including collection, receipt, recording, organisation, collation, storage, updating or modification, retrieval, alteration, consultation or use; dissemination by means of transmission, distribution or making available in any other form; or merging, linking as well as restriction, degradation, erasure or destruction of information.
• Promotion of Access to Information (PAIA) — Act No. 2 of 2000; South Africa's access to information law giving legislative effect to the right of access to information in accordance with section 32 of the Constitution.
• Protection of Personal Information Act (POPIA) — Act No. 4 of 2013; regulates the lawfulness of processing activities of South Africa's Personal Information.
• Pseudonymisation — A technique that replaces or removes information in a data set that identifies an individual, per the European GDPR definition. Pseudonymised data and Anonymised data are not the same.
• Records — Any recorded information that a business holds in any form or medium (paper and electronic), including records created by third parties that are now under the control of the business.
• Security Breach — Any potential or actual breach of information security, whether intentional or unintentional, that has an effect on Personal Information and the Responsible Party and/or Operator's company resources and reputation, including viruses, hacking or computer theft.
• Traffic data — Any data processed for the purposes of the conveyance of a communication on an electronic communications network, including data relating to the routing, duration or time of a communication.
• User — A person who uses a computer and/or other devices to access an Online Service.
• Web browser — An application used to access and view this website (e.g. Google Chrome, Safari, Edge, Firefox).

The following internal nuvoteQ procedural documents are related to this Policy:

• ML-GM-01 — Promotion of Access to Information Manual.
• ML-GM-02 — GDPR — Right of Access, Correction, Restriction of Processing and Erasure of Personal Data Manual.
• ML-HR-01 — Employee Manual.
• OP-GM-03 — Confidentiality of Information.
• OP-IT-01 — Security, Management and Use of Information Technology.
• OP-SD-04 — Application Management.
• PC-GM-03 — Privacy, Security and Protection of Personal Information.
• PC-HR-01 — Code of Conduct.
• WI-GM-01 — Good Documentation Practice.

Users that communicate with nuvoteQ through an Online Service / Electronic Platform will no longer be anonymous to nuvoteQ, since users will provide certain Personal Information to nuvoteQ.

Personal Information is any information that identifies users as an individual or relates to users as an identifiable individual. Depending on how users interact with nuvoteQ, Personal Information collected may include, without limitation, a user's name and surname, email address, telephone number, log-in and account information for authentication purposes and account access, gender, qualification and experience details, and other details relating to nuvoteQ's Online Services / Electronic Platforms — including, but not limited to, traffic data, location data, weblogs and other communication data; information users provide to nuvoteQ, including Records of correspondence; marketing and other preference information; and social media account information.

nuvoteQ may also collect other information that does not personally identify users. Such other information includes browser and device information, website and application usage data, IP addresses, demographic information such as marketing preferences, geographic location, primary language, and information collected through cookies and other technologies or information that has been anonymised or aggregated. If nuvoteQ links this information with users' Personal Information, nuvoteQ will treat that linked information as Personal Information.

Note: It is possible to modify and/or block the installation of cookies sent by the nuvoteQ website; however, the quality of the operations of the services may be affected (PC-GM-03).

Users can choose not to provide Personal Information to nuvoteQ when requested. However, if this is necessary to provide users with nuvoteQ's solutions and services, access to Online Services / Electronic Platforms, or to perform administrative functions, nuvoteQ may be unable to do or perform these functions.

nuvoteQ does not collect sensitive Personal Information about users, e.g. information relating to health, religion, political beliefs, race or sexual orientation via our Online Services and asks that users do not send or provide this information to nuvoteQ unless specifically requested to do so in writing and via a documented Consent process (ML-GM-01, PC-GM-03).

nuvoteQ may collect Personal Information from users in a variety of ways when users interact with nuvoteQ, including without limitation when:

• You access nuvoteQ's Online Services or interact with nuvoteQ in any other way.
• You reach out to nuvoteQ regarding potential business opportunities and/or nuvoteQ's services, create an account with nuvoteQ on one of our online platforms or Electronic Platforms, perform administrative and business functions and when you communicate with nuvoteQ.
• nuvoteQ responds to your enquiries and requests, obtains feedback from you about our services or you apply for employment with nuvoteQ.
• nuvoteQ collects Personal Information from third parties, including public databases, social media sites, business partners with whom nuvoteQ offers services or engages in joint marketing activities, and third parties that provide list enhancement or similar services.
• When users use nuvoteQ's Online Services / Electronic Platforms, nuvoteQ and third parties nuvoteQ engages with may automatically collect data, including Personal Information, through use of cookies and similar technologies.

When nuvoteQ processes Personal Information in connection with the purposes set out in this Privacy Policy, nuvoteQ may rely on one or more of the following legal bases, depending on the purpose for which the Processing activity is undertaken and the nature of nuvoteQ's relationship with the user:

• Our legitimate business interests (or those of a third party with whom we share users' Personal Information) for the purpose of managing, operating or promoting our business, including marketing, for business and administrative purposes — except where such interests are overridden by users' interests or fundamental rights or freedoms which require protection of Personal Information; and/or
• Where this is necessary to comply with a legal obligation on nuvoteQ; and/or
• To protect the vital interests of any individual; and/or
• Where users have Consented to the use of their Personal Information.

nuvoteQ may use Personal Information to enable users to effectively use and to improve nuvoteQ's Online Services / Electronic Platforms. For example, to:

• Perform administrative and business functions and internal reporting.
• Send administrative information to users.
• Obtain feedback from users about our services, including through client satisfaction surveys, in which event nuvoteQ will only use Personal Information for the sole purpose of sending users a survey (through our third-party email delivery provider).
• Respond to enquiries and fulfil requests by users.
• Assess the performance of Online Services / Electronic Platforms and to improve their operation.
• Inform users about and provide users with nuvoteQ's services and solutions.
• Update nuvoteQ's Records and keep contact details up to date.
• nuvoteQ engages in these activities to manage nuvoteQ's contractual relationship with clients/users, to comply with nuvoteQ's legal obligations, or for nuvoteQ's legitimate business interests.

nuvoteQ may share Personal Information for the purposes set out in this Privacy Policy (as applicable) with:

• nuvoteQ's direct and indirect affiliates and subsidiaries for the purposes set out in this Privacy Policy. nuvoteQ is the party responsible for the management of jointly used Personal Information.
• Business partners with whom nuvoteQ offers services or engages in joint marketing activities.
• Service providers to provide operational services or facilitate transactions on nuvoteQ's behalf, including but not limited to Processing of orders, assisting with services, client support, email delivery, data analytics and auditing.
• Where Data Subjects Consent to the sharing of their Personal Information.
• In connection with any joint venture, merger, sale of company assets, consolidation or restructuring, financing, or acquisition of all or a portion of nuvoteQ's business by or to another company.
• For other legal reasons.
• In response to a request for information by a competent authority in accordance with, or required by, any applicable law, regulation or legal process (ML-GM-01), including compliance with judicial proceedings, court orders or government orders; or to protect the rights, property or safety of nuvoteQ, its business partners, Data Subjects, or others as otherwise required by applicable law.
• Any third parties with whom we share Personal Information are contractually required to implement appropriate data protection and security measures to protect Personal Information and are not permitted to use Personal Information for any purpose other than the purpose for which they are provided with or given access to Personal Information.

nuvoteQ is committed to protecting Personal Information from accidental or unlawful destruction, loss, alteration, unauthorised access or disclosure by using a combination of physical, administrative and technical safeguards, and contractually requiring that third parties to whom nuvoteQ discloses Personal Information do the same.

However, while nuvoteQ has implemented reasonable technical and organisational precautions to protect the security and integrity of Personal Information, due to the inherent nature of the internet as an open global communications vehicle, nuvoteQ cannot guarantee that information, during transmission through the internet or while stored on nuvoteQ's systems or otherwise in nuvoteQ's care, will be absolutely safe from intrusion by others, such as hackers.

nuvoteQ maintains physical, electronic and procedural safeguards to protect Personal Information. We strive to protect information transmitted on or through nuvoteQ's Online Services / Electronic Platforms; however, nuvoteQ cannot and do not guarantee the security of any data or information nuvoteQ transmits on or through the Online Services / Electronic Platforms, and users do so at their own risk.

As a global company, nuvoteQ may transfer Personal Information to countries where nuvoteQ does business or to international organisations in connection with the purposes identified above and in accordance with this Privacy Policy.

Where nuvoteQ transfers Personal Information to a country or international organisation that does not provide a level of protection for Personal Information which the POPIA Information Regulator deems adequate, nuvoteQ enters into a Data Processing Agreement to ensure adequate protection measures.

nuvoteQ adheres to applicable Data Protection Laws in South Africa as well as the European Union (GDPR) (ML-GM-02), which provide Data Subjects with certain rights relating to Personal Information (subject hereto that such Personal Information falls within the application of POPIA and further subject to the limitations as set out in POPIA). Data Subjects' rights include without limitation:

• The right to access Personal Information that nuvoteQ processes about them.
• The right to rectify inaccurate Personal Information nuvoteQ holds about them without undue delay, taking into account the purposes of the Processing, and to have incomplete Personal Information about them completed.
• The right to ask nuvoteQ to delete their Personal Information without undue delay in certain circumstances.
• The right to restrict the Processing of their Personal Information in certain circumstances.
• Where nuvoteQ processes Personal Information based on a Data Subject's Consent, the Data Subject has the right to withdraw his/her Consent at any time for future Processing.
• Where nuvoteQ processes Personal Information based upon nuvoteQ's legitimate interests or those of a third party, the Data Subject has the right to object to the Processing of Personal Information at any time (including any profiling).
• Where nuvoteQ processes Personal Information for direct marketing purposes, the Data Subject has the right to object to Processing at any time, including profiling to the extent that it is related to such direct marketing.
• The right not to be subject to a decision based solely on automated Processing, including profiling, which produces legal effects concerning Data Subjects or similarly significantly affects Data Subjects.
• The right to lodge a complaint to the Information Regulator.
• nuvoteQ will consider such requests and respond to requestors within 30 (thirty) days. nuvoteQ may require verification of a requestor's identity before providing a copy of the Personal Information, as permitted by law (ML-GM-01).

When users access nuvoteQ's Online Services / Electronic Platforms, nuvoteQ uses Cookies and similar technologies. nuvoteQ uses Cookies to assist with activities such as:

• Ensuring that web pages can function properly.
• Knowing user navigation and user experience.
• Collecting anonymous statistical information, such as which sections have been visited, and how long a user has been in the nuvoteQ environment.
• These technologies collect information that users' browsers send to nuvoteQ's Online Services / Electronic Platforms, including a user's browser type, information about IP address (a unique identifier assigned to a user's computer or device which allows a user's PC or device to communicate over the internet), together with the date, time and duration of a user's visit, the pages users view and the links users click (PC-GM-03).

nuvoteQ's Online Services / Electronic Platforms may contain links to third party websites and applications. Some of the content, advertising and functionality on nuvoteQ's Online Services / Electronic Platforms may be provided via third parties that are not affiliated with nuvoteQ. For example, nuvoteQ enables users to share certain materials with others through social networking services such as Facebook and LinkedIn. nuvoteQ are not responsible for and make no representations or warranties in relation to the privacy practices or content of any third-party websites, service functionality provided and applications.

These third parties may collect or receive certain information about users of the websites (including through the use of cookies, beacons and similar technologies) and such information may be collected over time and combined with information collected across different websites and online services. nuvoteQ do not control the data collection and use practices of these companies and users should check the relevant privacy notices and policies before using the services provided by these companies. Users' use of such sites and applications are subject to the applicable third-party privacy statement/policy and are at users' own risk.

nuvoteQ may send direct marketing communications about nuvoteQ's solutions and services. Recipients thereof can choose whether they wish to receive marketing communications from nuvoteQ by email, SMS and phone.

Recipients may opt out of receiving marketing materials from nuvoteQ at any time and manage their communication preferences by contacting nuvoteQ using the contact details on nuvoteQ's website. Recipients should include their contact details and a description of the marketing material they no longer wish to receive from nuvoteQ. nuvoteQ will comply with such requests as soon as is reasonably practicable.

If recipients opt out of receiving marketing related communications from nuvoteQ, nuvoteQ may still send recipients administrative messages as part of their ongoing use of our solutions and services, which recipients will be unable to opt out of.

nuvoteQ do not provide Personal Information to unaffiliated third parties for direct marketing purposes or sell, rent, distribute, or otherwise make Personal Information commercially available to any third party.

nuvoteQ will retain Personal Information for as long as is necessary to fulfil the purpose for which it was collected unless a longer retention period is required to comply with legal obligations, resolve disputes, protect assets or enforce agreements (PC-GM-03, ML-GM-01, OP-SD-01). The criteria nuvoteQ uses to determine retention periods include without limitation whether:

• nuvoteQ has a legal, contractual or other obligation to retain Personal Information, or as part of a business agreement, an investigation, or for litigation purposes.
• Personal Information is needed to maintain accurate business and financial Records.
• There are automated means to enable users to access or update their Personal Information at any time.
• The Personal Information is sensitive Personal Information — in which event nuvoteQ will generally retain this for a specific purpose and limited period of time.
• You have Consented to nuvoteQ retaining your Personal Information for a longer retention period, in which case nuvoteQ will retain Personal Information in accordance with your Consent.

nuvoteQ reserves the right to update, amend or modify this Privacy Policy at any time without prior notice. The “Document History” section at the bottom of this Privacy Policy reflects all updates, amendments and modifications made to this Privacy Policy.

We encourage you to regularly review this Privacy Policy to stay informed about our privacy practices.

If you have any questions about how your Personal Information is processed by nuvoteQ, you have a privacy concern or you wish to make a request or a complaint relating to your Personal Information, please contact our Information Officer / Data Protection Officer using the following email address:

Email: support@nuvoteq.io

Additional contact details and process are set out in the nuvoteQ PAIA Manual available on the nuvoteQ website at www.nuvoteq.io.

This Policy is grounded in the following regulations and standards:

• Electronic Communications and Transactions Act 25 of 2002 (ECTA).
• European Union (EU) Data Protection Directive (95/46/EC).
• Health Insurance Portability and Accountability Act (HIPAA) of 2013.
• ICH E6(R2) Integrated Addendum to ICH E6(R1): Guideline for Good Clinical Practice (2016).
• Protection of Personal Information Act No. 4 of 2013 (POPIA).
• Promotion of Access to Information Act 2 of 2000 (PAIA).
• Regulation (EU) 2016/679 of the European Parliament, repealing Directive 95/46/EC (General Data Protection Regulation).
• South African Good Clinical Practice: Clinical Trial Guidelines, Third edition, 2020. Department of Health, South Africa.
• United Kingdom Data Protection Act (2018).
• United States Privacy Act of 1974.