Effective date: 26 October 2026

Website: https://qwerti.co.za

1. WHO WE ARE AND THE PURPOSE OF THIS NOTICE

1.1 Qwerti (Pty) Ltd (“Qwerti”, “we”, “us” or “our”), registration number 2022/232250/07, provides managed IT, technical support, cybersecurity, cloud, software, consulting and related technology services.

1.2 This notice explains how Qwerti processes personal information about website visitors, prospects, customer representatives and end-users, suppliers, contractors and other people who engage with us, in accordance with the Protection of Personal Information Act 4 of 2013 (“POPIA”). It also applies, where relevant, to personal information about businesses and other juristic persons protected by POPIA.

1.3 Qwerti acts as a responsible party when it determines the purpose and means of processing information for its own business, such as customer accounts, billing, marketing, staff administration and website enquiries. When we process information in a customer’s IT environment on that customer’s instructions, we may act as an operator under POPIA. Those activities are also governed by the applicable customer agreement and data-processing obligations.

2. INFORMATION WE MAY COLLECT

Depending on your relationship with us and the services involved, we may process:

• Names, job titles, company details, contact information, identification and authorised signatory details.
• Enquiries, quotations, service agreements, purchase orders, invoices, payment and credit-related information.
• Helpdesk tickets, technical support communications, device and asset information, system and account identifiers, IP addresses, logs, support history and information supplied to diagnose or resolve problems.
• Information accessed or processed when providing authorised remote support, monitoring, security services, cloud administration, backup, recovery or related customer services.
• Supplier and contractor details, due diligence records and business correspondence.
• Recruitment and employment information where applicable.
• Website usage information, online identifiers, cookies and similar technical data, depending on the tools in use.
• Communications with us, which may include call recordings where calls are lawfully recorded with appropriate notice.

We aim to collect information that is adequate, relevant and not excessive for the purpose concerned. Certain information is required to respond to enquiries, perform contracts or meet legal obligations. If necessary information is not supplied, we may be unable to respond fully or deliver the requested service.

3. WHERE INFORMATION COMES FROM

We may obtain personal information directly from you, from your employer or the business you represent, from customer-authorised users or administrators, from service providers or technology vendors, from relevant public or lawful verification sources, or automatically through your use of our website and services. We will take reasonable steps to provide the notifications required by POPIA.

4. WHY WE PROCESS INFORMATION

We process personal information where there is an applicable lawful basis, including where processing is necessary for a contract with the data subject, to comply with a legal obligation, to protect legitimate interests, or where valid consent is required and obtained. Our purposes include:

• Responding to enquiries, preparing quotations, onboarding customers and administering contracts.
• Delivering, supporting, securing, monitoring and maintaining technology products and services.
• Managing helpdesk requests, remote access, service incidents, licences and vendor escalations.
• Billing, credit assessment, payment administration, debt recovery, fraud prevention and record keeping.
• Managing suppliers, contractors, recruitment, employment and company operations.
• Protecting networks, devices, systems, personnel and premises; investigating security events; and meeting legal requirements.
• Improving service quality, understanding website usage, conducting relevant customer communications and carrying out lawful marketing.

We do not treat the mere use of our website or services as blanket consent to all processing. Consent is one lawful basis among others and is obtained where required.

5. PERSONAL INFORMATION PROCESSED FOR MSP CUSTOMERS

5.1 While delivering managed services, Qwerti may encounter personal information within a customer’s systems, mailboxes, endpoints, cloud services, backups, security tools or support records. Where Qwerti acts as an operator, the customer ordinarily determines the purposes of this processing, and Qwerti processes the information on the customer’s lawful instructions, subject to applicable law and the relevant contract.

5.2 Access to customer information is limited to what is reasonably necessary for authorised service delivery, security, troubleshooting or other legitimate customer instructions. Staff and authorised service providers are subject to appropriate access and confidentiality controls.

5.3 If a privacy request concerns information controlled by one of our managed-services customers, Qwerti may refer the requester to that customer or coordinate with the customer as appropriate. Qwerti remains responsible for privacy requests concerning information for which Qwerti itself is the responsible party.

6. WHO MAY RECEIVE INFORMATION

Where necessary and legally permitted, personal information may be disclosed or made accessible to:

• Qwerti personnel and authorised group-company personnel who need it for relevant functions.
• Technology vendors, cloud and hosting providers, software licensors, security and monitoring services, backup providers and other service operators.
• Telecommunications, courier, installation, repair and professional service providers supporting service delivery.
• Payment service providers, banks, credit bureaus and financial, payroll or benefit administrators, as applicable.
• Auditors, insurers, attorneys, professional advisers, consultants, and authorised parties assisting with a proposed or completed corporate transaction, subject to appropriate safeguards.
• Courts, regulators, law enforcement and other public authorities where required or permitted by law.

Service providers processing personal information for Qwerti are required to protect it under appropriate confidentiality, security and contractual arrangements. We do not sell personal information as an independent commercial product.

7. INTERNATIONAL PROCESSING

7.1 Qwerti uses or may use cloud services, technology vendors, overseas-based consultants and professional advisers that store, support, back up or access certain business and personal information outside South Africa. This may include information connected with service delivery, customer administration, suppliers, staff or potential corporate transactions.

7.2 Where POPIA section 72 applies to an international transfer, Qwerti will rely on an applicable lawful ground and appropriate safeguards, such as suitable contractual protections or other permitted arrangements. International processing does not mean that every overseas recipient can access all information.

8. INFORMATION SECURITY AND INCIDENTS

8.1 Qwerti employs reasonable technical and organisational safeguards appropriate to the information and risks involved. These may include access controls, authentication, endpoint and network protection, monitoring, backup and recovery measures, physical security, staff confidentiality obligations and incident-handling procedures.

8.2 No technology environment can be guaranteed completely free from risk. We assess and respond to suspected incidents and notify the Information Regulator, affected individuals or responsible-party customers where required by applicable law and our contractual obligations.

9. HOW LONG WE KEEP INFORMATION

Qwerti keeps personal information for as long as necessary for the purpose for which it was collected or lawfully processed, including contract performance, customer service, legal or tax retention obligations, security, legitimate business records and dispute resolution. We securely delete, destroy or de-identify information when no longer lawfully required, subject to relevant legal holds and customer contractual requirements. Not all information can be deleted immediately upon request.

10. MARKETING AND CUSTOMER COMMUNICATIONS

10.1 We may send service, security, billing, account and other operational communications where appropriate for our relationship with you. These are distinct from optional promotional communications.

10.2 For unsolicited electronic direct marketing, including promotional email or SMS, Qwerti will comply with POPIA section 69, including consent requirements where applicable and the statutory conditions relating to existing customers. Each electronic marketing message will provide an appropriate way to opt out, and objections or withdrawals will be honoured.

10.3 To stop promotional messages, use the unsubscribe option provided or contact info@qwerti.co.za. Opting out of marketing does not necessarily stop necessary contractual or operational messages.

11. COOKIES AND WEBSITE TECHNOLOGIES

11.1 Our website may use essential cookies and similar technologies to enable normal operation and may use analytics, advertising or website performance technologies. Such tools can process technical information such as IP addresses, browser characteristics, cookie identifiers and pages visited. Qwerti’s website uses Google Tag Manager, which can be used to administer third-party tracking tags. The exact enabled tools may change over time.

11.2 Browser settings generally allow users to restrict or delete cookies. Where website consent controls are provided, visitors may also use those controls to manage relevant optional tracking. Disabling some technologies can affect optional website features.

11.3 Continued browsing alone is not treated as affirmative consent where applicable law requires consent. Qwerti will apply the consent and other processing requirements relevant to the particular technologies in use. Questions about the tools or privacy choices available on this Website may be sent to info@qwerti.co.za.

12. YOUR PRIVACY RIGHTS

12.1 Subject to POPIA and other applicable law, you may:

• Ask us to confirm, free of charge, whether we hold personal information about you.
• Request access to your personal information, subject to applicable statutory procedures, refusal grounds and prescribed fees, if any.
• Ask us to correct or delete personal information that is inaccurate, irrelevant, excessive, outdated, incomplete, misleading or unlawfully obtained, or request deletion where we are no longer authorised to retain it.
• Object to certain processing of your personal information, including direct marketing.
• Withdraw consent where processing depends on consent, without affecting processing already lawfully performed.
• Lodge a complaint with the Information Regulator.

12.2 Requests for correction, deletion or objection may be submitted free of charge by email or another reasonably accessible channel. Relevant POPIA forms are available on request, but we will not reject an otherwise valid request merely because our particular form was not used. We may request adequate proof of identity or authority before acting.

12.3 Please direct privacy requests to info@qwerti.co.za and mark them for the attention of the Information Officer. Formal requests for access to records may be submitted in accordance with Qwerti’s PAIA Manual, available on our website.

12.4 For more information about your rights or to complain, visit the Information Regulator at https://inforegulator.org.za/.

13. CONTACT INFORMATION

Responsible party: Qwerti (Pty) Ltd

Registration number: 2022/232250/07

Address: Level 2, 33 6th Street, Wynberg, Sandton, Johannesburg, 2090, South Africa

Telephone: +27 87 805 3396

Email and privacy enquiries: info@qwerti.co.za (Attention: Information Officer)

Website: https://qwerti.co.za

14. UPDATES TO THIS NOTICE

We may update this Privacy Notice when our services, technology, practices or legal obligations change. The current version and effective date will be published on the website. A change to this notice does not by itself create consent or alter rights under applicable law.