Information Officer Notice

Issued by: Toker Effective Date: 28 June 2026 Document Version: 1.0-draft

This Notice is published in compliance with Regulation 4 of the POPIA Regulations, 2018 (issued under the Protection of Personal Information Act 4 of 2013, "POPIA"). It identifies the Information Officer and Deputy Information Officer of Toker who are responsible for ensuring compliance with POPIA, and explains how they may be contacted.

1. Why this Notice exists

POPIA s.55 requires every responsible party (i.e. every entity that processes personal information) to register an Information Officer with the Information Regulator of South Africa, and to publish the Information Officer's contact details.

Regulation 4 of the POPIA Regulations, 2018, requires the Information Officer to:

• Take responsibility for compliance with POPIA by the responsible party;
• Manage the relationship with the Information Regulator;
• Ensure that the responsible party's internal measures give effect to POPIA's eight processing conditions;
• Receive and respond to data subject access requests (POPIA s.23);
• Investigate complaints and report to the Information Regulator;
• Maintain a register of all operators (subprocessors) of the responsible party;
• Coordinate with the Information Regulator in case of a security breach.

2. Information Officer of Toker

2.1 Duties of the Information Officer

The Information Officer is responsible for:

3. Deputy Information Officer of Toker

3.1 Duties of the Deputy Information Officer

The Deputy Information Officer assists the Information Officer and may exercise the powers and perform the duties of the Information Officer in their absence. The Deputy Information Officer's responsibilities mirror those of the Information Officer (Reg 4).

4. How to contact the Information Officer

4.1 For data subject access requests (POPIA s.23)

4.2 For privacy-related questions or complaints

4.3 For security incident reports

4.4 Response times

5. The Information Regulator of South Africa

If you wish to lodge a complaint directly with the Information Regulator:

We would, however, appreciate the opportunity to address your concern first — please email information.officer@go-toker.com.

6. Operator register (POPIA s.21)

The Information Officer maintains an Operator Register of every third party that processes personal information on behalf of Toker. The register is available on request to information.officer@go-toker.com and is summarised in the Privacy Policy §7.3.

The current published summary is in the Privacy Policy §7.3.

7. Security measures (POPIA s.14)

The Information Officer is responsible for ensuring that appropriate, reasonable technical and organisational measures are in place to prevent loss, damage, unauthorised destruction, unlawful access, and unauthorised processing of personal information. These measures are described in the Privacy Policy §10 and in our internal security documentation (docs/SECURITY_AUDIT.md).

8. Data breach notification (POPIA s.22 + Cybercrimes Act)

In the event of a security incident that compromises the integrity or confidentiality of personal information:

1. The Information Officer will be notified within 1 hour of the incident being identified;
2. The Information Officer will assess whether the incident constitutes a "security compromise" under POPIA s.22 (i.e. there is a reasonable belief that the personal information has been accessed or acquired by an unauthorised person);
3. If so, the Information Officer will:
4. Notify the Information Regulator in writing within a reasonable time, providing the details required by POPIA s.22(3) and the Cybercrimes Act 19 of 2020;
5. Notify affected data subjects in writing, by email or by prominent notice on the Platform, providing sufficient information to allow them to take protective measures;
6. Engage with the Information Regulator's investigation;
7. Document the incident in the audit log (7-year retention).

9. Annual compliance audit (POPIA s.14 + Reg 4)

The Information Officer conducts an annual POPIA compliance audit of Toker. The audit covers:

• The eight processing conditions in POPIA s.8–25;
• The security measures in POPIA s.14;
• The operator register (s.21);
• The breach response procedure (s.22);
• The data subject rights procedure (s.23–25);
• The cross-border transfers register (s.72);
• The information security controls (technical + organisational).

The audit report is filed with the board of Toker and is made available to the Information Regulator on request.

10. Changes to this Notice

We may update this Notice from time to time. When we make a material change:

• We will update the "Last Updated" date at the top of this document;
• We will post a notice on the Platform;
• We will notify the Information Regulator of any change to the designated Information Officer or Deputy Information Officer within 14 days of the change.

11. Contact

*This Notice is governed by the laws of the Republic of South Africa.* *Document version 1.0-draft — pending Information Officer registration and South African legal counsel sign-off.*