In line with the requirements of POPIA, CRH-Africa Automotive (Pty) Ltd commits to the following principles when processing personal information:

1. The Company is responsible for ensuring that personal information is processed in compliance with POPIA.
2. Personal information will only be collected for specific, legitimate purposes and not further processed in a way incompatible with those purposes.
3. Personal information will be collected only for specific, lawful purposes related to the Company’s activities and will not be used for any other purposes.
4. The Company will take reasonable steps to ensure that personal information is complete, accurate, and up-to-date.
5. The Company will make information available to data subjects about the processing of their personal information.
6. Personal information will be safeguarded through appropriate technical and organizational measures to prevent unauthorized access, disclosure, or loss.
7. Data subjects (individuals whose personal information is processed) will have access to their personal information and will be able to correct, update, or delete inaccurate information.

CRH-Africa Automotive (Pty) Ltd may collect the following types of personal information:

• Employee Information: Name, contact details, identification numbers, bank account details, job title, performance reviews, disciplinary records, etc.
• Customer Information: Name, contact details, transaction history, payment information, feedback, and customer preferences.
• Supplier Information: Company name, contact details, banking details, payment records, and contractual agreements.
• Shareholder Information: Name, contact details, shareholding information.
• Third-party Information: Any other personal information necessary for the Company’s operations (e.g., service providers, consultants, etc.).

Personal information is collected for the following purposes:

• To manage employment contracts, payroll, benefits, training, and performance.
• To provide products and services, manage orders, and respond to inquiries and complaints.
• To manage procurement, payments, and supply chain management.
• To comply with legal and regulatory requirements (e.g. tax reporting, health and safety).
• For administrative, financial, and marketing purposes, as necessary for the Company’s operations.

CRH-Africa Automotive (Pty) Ltd implements the following measures to ensure the safeguarding of personal information:

1. Only authorized employees and third parties will have access to personal information on a need-to-know basis.
2. Personal information will be encrypted where appropriate, especially for sensitive or confidential data.
3. Offices and areas where personal information is stored will have appropriate physical security measures in place.
4. The Company will conduct regular audits to monitor compliance with POPIA and ensure that information security practices are effective.
5. Personal information will only be retained for as long as necessary for the purposes for which it was collected. Once no longer required, personal information will be securely destroyed or anonymized.