Privacy and POPIA Notice

1. Plain-language privacy summary

Before the detail, here is the short version. When you engage Mbalwa Investment Services — whether as a prospective client, an existing client, or simply a visitor to this website — we collect only the personal information reasonably needed to provide advice, meet our regulatory obligations, and communicate with you. We protect that information with appropriate technical and organisational safeguards, we do not sell it, and we only share it with third parties who genuinely need it to help deliver our service to you. You have the right to know what we hold about you, to correct it, to ask us to delete it, to object to certain uses, and to lodge a complaint if you believe we have handled it improperly. Our Information Officer is available at the contact details in Section 13 to answer any question about this notice or your personal information.

---

2. Responsible party details

The "responsible party" for the purposes of POPIA — the organisation that determines why and how your personal information is processed — is:

Mbalwa Investment Services (Pty) Ltd
Authorised Financial Services Provider, FSP 55090
4th Floor, Fredman Towers, 13 Fredman Drive, Sandton, Johannesburg, 2196

3. Personal information we collect

The personal information we collect depends on how you interact with us. It may include:

• Identity and contact details — full name, ID or passport number, date of birth, physical and postal address, email address and telephone numbers.
• Financial circumstances — income, expenses, assets, liabilities, existing financial products, employment details and other information needed to assess your goals, risk profile and financial needs.
• FICA and verification information — proof of identity, proof of address and other documentation required under the Financial Intelligence Centre Act (FICA) before advice can be implemented or a product opened.
• Communication records — records of meetings, calls, emails and correspondence relating to advice given and instructions received.
• Website usage information — technical and analytics information collected automatically when you browse this website, described further in Section 6.

4. Purpose of processing

We process your personal information to:

• Understand your financial circumstances, goals and risk profile in order to provide suitable advice.
• Prepare, implement and review a financial plan or recommendation on your behalf.
• Comply with our obligations as an authorised Financial Services Provider under the Financial Sector Conduct Authority (FSCA), the Financial Advisory and Intermediary Services Act (FAIS), and FICA record-keeping and verification requirements.
• Communicate with you about your plan, our services, and matters relevant to your relationship with us.
• Maintain accurate business records and respond to regulatory, legal or audit requests where required.

5. Legal grounds and consent

We process personal information on one or more of the legal grounds recognised under POPIA: your consent, the necessity of processing to perform a contract with you (such as providing advice), compliance with a legal obligation we are subject to (such as FICA or FAIS record-keeping), or our legitimate business interests, provided these do not unreasonably override your own privacy interests. Where we rely on consent — for example, to send you marketing communications — you may withdraw that consent at any time without affecting the lawfulness of processing carried out before withdrawal.

---

6. Cookies and analytics

This website may use essential cookies needed for the site to function correctly, and analytics cookies that help us understand how visitors use the site so that we can improve it. Analytics information is generally aggregated and does not identify you personally. You can control or delete cookies at any time through your browser settings — most browsers allow you to block cookies entirely, though doing so may affect how parts of this website function.

7. Third-party service providers

We may share personal information with carefully selected third parties who help us deliver our service, including investment platform administrators, product providers, professional advisers, and IT and website hosting providers. These third parties are only given the information they need to perform their function, and are contractually bound to keep it confidential and to use it only for the purpose we have authorised.

8. Cross-border processing, where applicable

In most cases your information is processed within South Africa. Where a recommendation involves an offshore investment, your information may need to be shared with an offshore platform administrator or product provider for the purposes of administering that investment. Where this applies, we take reasonable steps to ensure the receiving party is subject to a level of data protection consistent with POPIA before any cross-border transfer takes place.

9. Data security

We maintain appropriate technical and organisational measures to protect personal information against loss, unauthorised access, alteration or disclosure. These measures include restricted access to client records, secure storage of physical and electronic documents, and ongoing review of our internal processes. No system can be guaranteed completely secure, but we take reasonable, industry-appropriate steps to protect the information entrusted to us.

10. Data retention

We retain personal information for as long as needed to provide our service and to meet our regulatory record-keeping obligations. In line with typical requirements under FAIS, this generally means retaining client records for at least five years after the end of the business relationship, unless a longer period is required by law or a legitimate business purpose. Once no longer required, information is securely destroyed or de-identified.

11. Data-subject rights

Under POPIA, you have the right to:

• Request confirmation of whether we hold personal information about you, and to access that information.
• Request correction of personal information that is inaccurate, incomplete, misleading or outdated.
• Request deletion or destruction of personal information we are no longer authorised to retain.
• Object, on reasonable grounds, to the processing of your personal information.
• Withdraw consent, where processing is based on consent.
• Lodge a complaint with the Information Regulator if you believe your rights under POPIA have not been respected.

To exercise any of these rights, please contact our Information Officer using the details in Section 13. We will respond within a reasonable time and in accordance with POPIA's requirements.

---

12. Complaints and regulator information

If you have a concern about how your personal information has been handled, we encourage you to raise it with our Information Officer first so that we can try to resolve it directly. If you remain unsatisfied, POPIA-related complaints may be referred to:

• The Information Regulator (South Africa) — the statutory body responsible for overseeing compliance with POPIA.

Complaints relating specifically to financial advice, rather than the handling of personal information, may instead fall under the FSCA's regulatory oversight or the Office of the FAIS Ombud — see our regulatory disclosure for the relevant escalation path.

13. Contact details

Questions, requests or complaints relating to this notice or your personal information can be directed to our Information Officer:

Mbalwa Investment Services (Pty) Ltd
Attention: Information Officer
Email: advice@mbalwa.co.za (marked "Attention: Information Officer")
4th Floor, Fredman Towers, 13 Fredman Drive, Sandton, Johannesburg, 2196

14. Version and effective date

Version 1.0 · Effective 1 July 2026 · Last reviewed 1 July 2026