Third Party Information Privacy Notice (the Notice) For the purposes of this document a Third Party includes all parties external to MTN SA whether a juristic entity or a natural person supplying a product or service to MTN SA as a result of a formalised agreement. This then includes but is not limited to contractors, vendors, suppliers and partners. Note: "You" means you the reader, reading this document in your capacity as an authorised representative of your company, the Third Party or as a natural person providing a product or service. Background The Third Party Information Privacy Notice explains how MTN Processes your Personal Information, as is required by the Protection of Personal Information (PoPl) Act 4 of 2013. MTN is committed to protecting Third Party information privacy and to ensure that your Personal Information is Processed properly, lawfully and transparently. To whom does this Notice apply? All prospective, existing and Former MTN SA Third Parties, during and after contracting with MTNSA including Third Parties' consultants and staff members. Who we are (MTN South Africa and the MTN Group) MTN refers to Mobile Telephone Networks (Pty) Limited, registration number 1993/001436/07, situated at 216, 14th Ave, Fairlands. MTN is a limited liability private company duly incorporated in the Republic of South Africa and a member of the MTN Group Limited. MTN will be registered to process your Personal Information with the Information Regulator's office. Key Definitions The following key terms should be read in conjunction with this Notice: Term Definition Consent Any voluntary, specific and informed expression of will in terms of which permission is given by the Customer for the Processing of Personal Information Data Subject The person (natural or juristic) to whom Personal Information relates. In this respect the Third Party. PAIA The Promotion of Access to Information Act, 2000 (Act No. 2 of 2000). Personal Information Information relating to an identifiable, living, natural person, and where it is applicable, an identifiable, existing juristic person as defined in the PoPI Act. Processing/ Process of Personal Any operation or activity or any set of operations, whether by automatic means, concerning company Personal Information, including- Information (a) the collection, receipt, recording, organisation, collation, storage, updating or modification, retrieval, alteration, consultation or use; (b) dissemination by means of transmission, distribution or making available in any other form; or Term Definition (c) merging, linking, as well as res riction, degrada ion, erasure or destruction of Personal Information. Operator A third party ex ernal to MTN who Processes your Personal Information for MTNin erms of a contract or mandate, wi hou coming under he direct authori y of MTN. Responsible Party A public or priva e body or any other person which, alone or in conjunction wi h others, determines he purpose of and means For Processing your Personal lnforma ion. Special Personal Information  The religious or philosophical beliefs, race or ethnic origin, rode union membership, poli ical persuasion, health or sex life/ orienta ion or biome ric Personal Information of a Data Subject,  The criminal behaviour of a Data Subject o he ex ent tha such informa ion rela es to:  The alleged commission by a Data Subject of any offence; or  Any proceedings in respect of any offence allegedly committed by a Data Subject or the disposal of such proceedings. Third Par y  Any person or juristic en i y who works For or provides services o or on behalf of MTNand receives, or is en i led to receive, remunera ion and any o her person who assists in carrying ou or conducting the business of MTN on behalf of the Third Party. I includes, wi hou limi a ion, directors (execu ive and non- executive), all permanen , emporary and par - ime staff, as well as contract workers appointed by the Third Party. Personal Information Management What is being collected? MTN collects Personal Information about the Supplier ha maybeused in the procurement and contracting processes. This Personal lnforma ion includes, bu is no limi ed o, details such as your company's registered name, registration number, director's names, identi y numbers, addresses and o her company details which could include Financial informa ion and banking details. MTN also collects information about the usage of MTN information technology and electronic equipment including, but not limi ed to, telephone, interne usage and emails as defined in he Accep able Usage Policy. Where is Personal Information collected from? MTN collects Personal lnforma ion directly From you during he on- boarding process, self­ regis ra ion process, pre-qualifica ion process and the procuremen process where they provide us wi h your Personal lnforma ion. Where possible, we will inform you what Personal Information is mandatory and what Personal Information is optional. We also collect Personal Information about you From o her sources with your permission such as third parties providing CCTV Footage and biome ric informa ion and informa ion echnology equipment rela ed to your employment or products and or services provided. Why is Personal Information collected? MTN collects your Personal information (including special company information): • o carry out and manage business opera ions • to Fulfil contractual agreement(s) • to administer the benefits and services to you • For vetting and verification, occupational health administration; work management; business travel; corporate security; organisational charts; archiving emails For disaster recovery purposes, legal reporting obligations; and any other legitimate business interests. Monitoring without notice MTN will monitor your activity without notice when there are grounds For suspecting criminal activity or investigations and proceedings as well as regular auditing, when informing you about the monitoring would make it difficult to prevent or detect such wrongdoing. To whom does MTN disclose your Personal Information? MTN may disclose your Personal Information to the Following recipients with your duly authorised Consent except when not required to do so by law or legal process. • Internal MTNprocessing - Personal Information shared with other business units and the MTNGroup. • Subject to the provisions of the PoPI Act and related legislation, regulator's or judicial commissions of enquiry, any court, administrative or judicial Forum, arbitration, statutory commission, or ombudsman making a request For data or discovery in terms of the applicable rules. • South African Revenue Services, or any other Government authority. • Third Parties with whom MTN has a contractual relationship For the retention of data and/or provision of relevant business services. • Anyone making a successful application For access to information in terms of PAIA. Safeguard your Personal Information MTN takes reasonably practical information security measures to ensure the confidentiality, integrity and availability of your Personal Information in our possession against unauthorised or unlawful processing, loss, destruction or damage. IF necessary, MTN requires Operators in South Africa to whom MTN transfers your Personal Information to agree to our information privacy principles, associated policies and practices, which are no less than the minimum required by the PoPI Act. Cross-Border data transfers MTN may require the Processing of your Personal Information in other countries For business purposes. These countries may not have the same level of protection as South Africa. IF necessary, MTN will legally bind these Operators to whom MTN transfers your Personal Information to our information privacy principles, at a minimum as prescribed by the PoPI Act and associated policies and practices. Internal MTN communication MTN will use your Personal Information to send you MTN news, general communication and internal marketing communications with your Consent, which will be obtained From you From time to time. During the tenure of your contract, MTN may collect videos and/or photographic pictures about your resources which may be published internally or externally with your Consent, including but not limited to the MTN website and MTN social media pages. Rights to Privacy Access to Personal Information In addition to the rights that PAIA provides, you have the right to request a copy of your Personal Information that MTNholds about you or your company. Please note that any such access request may be subject to a payment of a nominal Fee. MTN will take all reasonable steps to confirm your idenmy before providing you with details of your Personal Information. Quality of Personal Information MTN has established procedures to ensure that your Personal Information is as accurate and complete as possible. You are encouraged to regularly check our records For accuracy and ensure any necessary amendments are made to bring your records up-to-date. Keeping your Personal Information up-to-date and accurate remains your responsibility. The necessary updates may be done through the self-service portal. Where such service is not available to you, you may notify the Procurement department or your allocated business partner account manager to make the necessary amendments. Some changes will only be made once the necessary supporting documentation has been obtained. Access to this Notice You have the right to request a copy of this Notice. Access to this Notice (language) This Notice is documented in English. As required by law, this Notice must be provided in a language understandable to you. Should this not be the case, MTN may assist with translation and/or assist with reading this Notice to you. This may be necessary to overcome any language barriers or to cater For the visually impaired. In the event of a Breach MTN takes reasonably practicable security measures to ensure your information privacy. In the event of a Personal Information breach, a designated MTN official will conduct an internal investigation and provide you with details as to the status of your Personal Information. Contact Details For Further information, queries, complaints, objections relating to the Processing of your Personal Information you may contact MTN or the Information Regulator's office using the Following details: MTN Contact Details Information Regulator's Contact Details Information Privacy Officer The Information Regulator (South Africa) MTN Innovation Centre SALU Building, 216 14th Avenue 316 Thabo Sehume Street, Fairlands PRETORIA popi@mtn.com Ms Mmamoroke Mphelo Tel: 012 406 4818 Fax: 086 500 3351 inforeg@justice.gov.za Where is the Notice published? An electronic version of this Notice is stored on the MTN website at www.mtn.co.za/ privacy . Printed copies may be made available on request. The Third Party Information Privacy Notice always Forms part of your registration process and the duty to Familiarise yourself with this Notice rests with you, the Third Party. Changes to this Notice MTN reserves the right to amend this Notice at any time. All amendments to this Notice will be published on the Y'elloWorld portal. The current version shall always supersede and replace all previous versions of this Notice and the duty to Familiarise yourself with amendments to this Notice rests always with you, the Third Party. Applicable Laws This Third Party Information Privacy Notice is governed by the laws of South Africa. Any disputes which may arise out of this Notice are subject to the jurisdiction of the South African courts. Date of Last Update - 30-04-2020 Information Privacy Notice AN IMPORTANT NOTICE CONCERNING YOUR INFORMATION PRIVACY PLEASE READ THIS NOTICE CAREFULLY TO ASSIST MTN IN PROTECTING YOUR PERSONAL INFORMATION 1. Main aining your rus andconfidence is high priori y. We wan you o unders and how we pro ec your informa ion privacy when we ob ain Personal lnforma ion abou you andhowwemayuse his and safeguard ha informa ion. 2. Weob ain your Personal lnforma ion during he online self-regis ra ion process where applicable or a any ime ha youengage wi h us ei her via our websi e or any o her channel. 3. We may disclose any\all he Personal lnforma ion ha weob ain abou youasrequired by he Sou h African Revenue Services or any o her legal body who has he righ of access o your Personal lnforma ion and o any par y as a resul of a successful PAIA applica ion. 4. We may disclose non-public Personal lnforma ion abou youduring your engagemen . o he Following ypes of par ies: a. Financial lnsmu ions b. Non-Financial companies 5. We may disclose non-public Personal lnforma ion abou youor your affilia es For he purposes of Fulfilling your services as agreed in your con rac , ha we hink may be of service o you during your con rad erm. 6. You are wi hin your righ s o reques access o your Personal lnforma ion by sending a reques o he MTN lnforma ion Privacy Office via he Following email address: popi@m n.com. I agree D I do no agree □