Privacy Notice

Protection of Personal Information Act 4 of 2013 (POPIA)

Version 1, 5 October 2026. This notice is published for public information. It is not legal advice.

This Privacy Notice explains how Emthunzini Consortium (Pty) Ltd (Registration No. 2016/374801/07) trading as Emthunzini Financial Services (“EFS”, “we”, “us”, “our”) collects, uses, shares and protects personal information. It applies to clients and policyholders, visitors to our website and Smart Compare tools, WhatsApp and other lead enquiries, and Legacy Connect Community Members / Community Partners.

Our PAIA Manual is available at paia-manual.html.

1. Responsible party

The responsible party under POPIA is:

• Emthunzini Consortium (Pty) Ltd t/a Emthunzini Financial Services
• Registration No.: 2016/374801/07
• Authorised Financial Services Provider: FSP 54028
• Physical address: 35 Newquay, New Redruth, Alberton, 1449
• Website: www.emthunzinifs.co.za
• Telephone: 087 183 1300
• WhatsApp: 082 923 6025
• Email: hello@emthunzinifs.co.za / compliance@emthunzinifs.co.za

Funeral cover distributed by EFS (including Legacy Shield) is underwritten via Anayasure Underwriting Managers (FSP 52695). Where Anayasure or an insurer processes personal information as a responsible party in its own right, their privacy notices also apply.

2. Information Officer

• Information Officer: Mr Thulasizwe Nyandeni
• Email: thulasizwen@emthunzinifs.co.za
• General compliance: compliance@emthunzinifs.co.za
• Deputy Information Officer: To be appointed by the Director (none designated yet). Until then, address PAIA and POPIA requests to the Information Officer.
• Information Officer telephone: 087 183 1300 (company line; WhatsApp 082 923 6025)

3. Whose information we process

We process personal information about:

• Clients and policyholders (and, where relevant, spouses, children, extended family members named on applications or policies, beneficiaries and claimants);
• Website and Smart Compare users who browse our sites or use comparison / quotation tools;
• WhatsApp, phone, email and web-form leads who enquire about our products or services;
• Legacy Connect Community Members / Community Partners who register for our community programme; and
• People whose contact details are introduced to us with their permission by a Community Member.

4. What we collect

Depending on your relationship with us, we may collect:

• Identity and contact details: full name, identity or passport number, date of birth, age band, cell number, email address, physical or postal address;
• Policy and financial details: plan chosen, premiums, bank or debit-order details, payment history, policy numbers, claims information;
• Family / dependant details needed for funeral cover applications (for example names and ages of children or extended family members you ask us to cover);
• Special personal information where necessary (see section 6), such as health-related information for medical-aid matching or claims;
• Community Member details: registration details, consents, referrals submitted, and (where rewards apply) verified identity and bank details;
• Website and technical data: IP address, device/browser information, pages visited, referral source, and cookie or similar technology data (see section 12);
• Communication records: WhatsApp, SMS, email and call notes, consent and opt-out records; and
• Complaints and regulatory records required for FAIS, Treating Customers Fairly and related duties.

We aim to collect only what is reasonably necessary for the purpose. We do not buy scraped contact lists.

5. Why we process personal information (purposes)

• To respond to enquiries and provide information about EFS products and services;
• To quote, underwrite, issue and administer policies (including Legacy Shield) and to process claims;
• To operate Smart Compare and related tools that help you compare options (including medical-aid matching where you choose to use that service);
• To register and manage Legacy Connect Community Member / Partner accounts, record consents and referrals, and administer any lawful rewards under published Programme Rules or a Community Partner Agreement;
• To verify identity and contact details (including before paying any referral fee or reward);
• To send operational messages about your policy, account, application or membership;
• To send direct marketing only where the law allows (see section 11);
• To meet legal, FAIS, insurance, tax, audit and record-keeping duties; and
• To detect, prevent and investigate fraud, misuse or security incidents.

6. Special personal information

POPIA treats certain categories as special personal information, including information about health. We process health-related information only where it is necessary for a lawful purpose you have engaged us for — for example medical-aid matching through Smart Compare, or assessing and administering a claim — and only on a POPIA-recognised ground (such as your consent, or another ground permitted by section 27 or related provisions). We do not use special personal information for general marketing.

In practice, the special personal information we may process is limited to health information (for example yes/no answers and optional condition categories for medical-scheme matching through Smart Compare, and health information needed to assess or administer an insurance claim). We do not process biometric information, religious or philosophical beliefs, race or ethnic origin, trade-union membership, political persuasion, or criminal behaviour as a routine part of our services. If that changes, we will update this notice. We will seek Information Regulator prior authorisation where POPIA requires it.

7. Lawful basis and consent

We process personal information on one or more POPIA grounds, including where:

• you have given consent;
• processing is necessary to conclude or perform a contract with you (for example a policy or Community Member registration);
• processing is necessary to comply with an obligation imposed by law (including FAIS and insurance laws);
• processing protects a legitimate interest of yours; or
• processing is necessary for our legitimate interests or those of a third party, balanced against your rights.

Where we rely on consent, you may withdraw it where the law allows. Withdrawal does not affect processing already lawfully done, and we may still keep information we must retain by law. Withdrawing consent for Community Membership may mean that membership ends.

8. How we obtain information

• Directly from you (website forms, Legacy Connect, applications, WhatsApp, phone, email, in person);
• From a Community Member who confirms they have your permission to introduce you;
• From the underwriting manager / insurer and related parties as needed to place and administer cover; and
• From service providers who support our platforms (under appropriate agreements).

9. Sharing of personal information

We do not sell your personal information. We may share it with:

• Anayasure Underwriting Managers (FSP 52695) and the relevant insurer, for quoting, underwriting, policy administration and claims;
• The Legacy Connect platform provider / developer (Eddie Digital Solutions / the developer engaged for Legacy Connect — legal entity name to be confirmed by the Director), acting as an operator under POPIA to host and support the portal;
• Other service providers (operators) in these categories: website and app hosting; email and WhatsApp communications tools; payment and debit-order collection; identity and bank verification; document generation and cloud storage; and professional advisers (legal, compliance, accounting). A named list is kept by the Information Officer and is available on request.
• Regulators, ombuds and law-enforcement where required or permitted by law; and
• Anyone else you instruct us to share with, or where another POPIA ground applies.

Operators who process personal information for us are required to do so under a written agreement and appropriate security measures.

10. Cross-border transfers

Some of our service providers may process or store information outside the Republic of South Africa (for example cloud hosting). Where we transfer personal information outside South Africa, we do so in line with POPIA section 72, including using providers in jurisdictions with adequate protection or putting appropriate agreements / safeguards in place.

Some operators may process or host data outside South Africa (for example cloud hosting or communications platforms). Where that happens, we rely on POPIA section 72 (adequacy, binding agreements, or your consent). Specific countries and cloud regions: to be confirmed by the Director / IT and listed here once verified.

11. Direct marketing (POPIA section 69)

We distinguish operational messages (about your enquiry, application, policy, claim or Community membership) from direct marketing (promotional messages about products or offers).

• Marketing by electronic means (including WhatsApp, SMS and email) is sent only with your consent, or as otherwise allowed by section 69 (for example, existing-customer marketing of our own similar products where you were given a free opt-out opportunity).
• Marketing opt-in boxes are not pre-ticked.
• Every marketing message will identify EFS and tell you how to opt out (for example, reply STOP). Opting out is free.
• You may opt out at any time by replying STOP, by emailing compliance@emthunzinifs.co.za, or by contacting the Information Officer.

Opting out of marketing does not stop messages we must send about your policy, claim or account.

12. Cookies and similar technologies

Our websites may use cookies or similar technologies that are necessary for the site to work, and may use analytics or preference cookies to understand how the site is used and to improve it. You can control cookies through your browser settings. Blocking some cookies may affect site functionality.

As at the date of this notice, we use only cookies or similar technologies that are needed for the site and portal to work (for example session and security cookies). If we later add analytics or marketing cookies (for example Google Analytics), we will update this section and, where required, ask for your consent. Exact tools in use: to be confirmed by the Director / website developer.

13. Retention

We keep personal information only for as long as needed for the purposes above, or as required by law. In particular, FAIS and related financial-services record-keeping rules generally require certain records to be kept for at least five (5) years after the termination of the relevant product or relationship (or as otherwise prescribed). After the retention period, information is deleted or de-identified where practicable.

As a guide (subject to a detailed schedule kept by the Information Officer):

• Client / policy / advice / claims records: at least 5 years after the relationship or last transaction ends (FAIS and related rules);
• Community Member / Partner registration and acceptance records: at least 5 years after membership ends;
• Smart Compare leads that do not become clients: deleted within 6 months of the last contact, unless a longer period is required for a complaint or investigation;
• Incomplete online forms: deleted within 7 days if not submitted;
• Marketing opt-ins: until you opt out, then suppressed as needed;
• Website logs: kept only as long as needed for security and troubleshooting, then deleted or anonymised.

14. Security

We take reasonable technical and organisational measures to protect personal information against loss, damage, unauthorised access and unlawful processing, in line with POPIA section 19. No method of transmission or storage is completely secure. If a security compromise affects your information in a way that requires notification under POPIA, we will notify you and the Information Regulator as required.

15. Your rights as a data subject

Subject to POPIA, you may:

• ask whether we hold personal information about you, and request access to it (also via PAIA — see our PAIA Manual);
• request correction or deletion of personal information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or unlawfully obtained;
• object to processing in certain cases;
• object to or opt out of direct marketing;
• withdraw consent where processing is based on consent; and
• lodge a complaint with the Information Regulator (see section 16).

To exercise these rights, contact the Information Officer at thulasizwen@emthunzinifs.co.za or compliance@emthunzinifs.co.za. We may need to verify your identity before responding.

16. Complaints

First, contact us: phone 087 183 1300, WhatsApp 082 923 6025, or email hello@emthunzinifs.co.za / compliance@emthunzinifs.co.za. We will log and respond in line with our complaints procedure.

If your complaint relates to a financial service or product and is not resolved to your satisfaction, you may escalate it through the insurer / underwriting manager route and thereafter to the National Financial Ombud Scheme (NFO): Tel 0860 800 900, email info@nfosa.co.za, www.nfosa.co.za.

Information Regulator (South Africa) — for POPIA / PAIA complaints (contacts verified on inforegulator.org.za as at drafting):

• Website: https://inforegulator.org.za
• Physical address: Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191
• General enquiries: 010 023 5200 / Toll free 0800 017 160 / enquiries@inforegulator.org.za
• POPIA complaints: POPIAComplaints@inforegulator.org.za (Form 5 / eServices portal)
• PAIA complaints: PAIAComplaints@inforegulator.org.za

Note: An older address sometimes seen in public materials, complaints.IR@inforegulator.org.za, was not listed on the Information Regulator’s contact or complaints pages at the time of this Version 1. Prefer the addresses above.

17. Children

We may process children’s personal information where they are named as dependants on a funeral policy or similar product, with the consent of a competent person, or as otherwise allowed by POPIA. Our websites and Legacy Connect Community registration are not directed at children under 18 acting on their own.

18. Changes to this notice

We may update this Privacy Notice from time to time. The version date at the top of the page will change when we do. The current version will be published on this website. Material changes may also be notified by email, WhatsApp, SMS or a notice in Legacy Connect where appropriate.

19. Contact

Questions about this Privacy Notice: Information Officer, Mr Thulasizwe Nyandeni — thulasizwen@emthunzinifs.co.za or compliance@emthunzinifs.co.za.

Emthunzini Consortium (Pty) Ltd t/a Emthunzini Financial Services is an authorised Financial Services Provider (FSP 54028). Underwritten via Anayasure Underwriting Managers (FSP 52695). Illustrative benefits subject to plan terms and conditions. Waiting periods, exclusions and sub-limits apply.

Version 1, 5 October 2026.