ALLWAGE PROPRIETARY LIMITED - PRIVACY NOTICE

Date: 02/09/2026

Version: 1.0

1. INTRODUCTION

1.1 This Privacy Policy explains how AllWage Proprietary Limited ("AllWage") collects, uses, discloses, safeguards, and retains personal information when you use our platform, websites, products, and services in South Africa.

1.2 AllWage is a field‑workforce and payroll platform that replaces paper and spreadsheet processes with a single, integrated system that covers time and attendance, WhatsApp communications, document management, and payroll with South African statutory reporting.

1.3 References in this policy to “AllWage” include our operation previously known as Agrigistics and reflect our ongoing South African focus.

1.4 Under South Africa’s Protection of Personal Information Act 4 of 2013 (“POPIA”), AllWage acts as the responsible party for personal information it processes for its own purposes, such as managing customer relationships and accounts, responding to enquiries and operating its websites. When we process workers’ attendance, employment, documents or payroll information on a client’s behalf, that client is the responsible party and AllWage acts as its operator under the Data Processing Addendum. The applicable role depends on the purpose for which the information is processed. AllWage’s contact details are set out below -

Company: AllWage Proprietary Limited, 5th Floor, Bloukrans

Building, Lynnwood Bridge, Pretoria, Gauteng, 0081, South Africa

Information Officer: Cilliers Geldenhuys

Email: cilliers@allwage.com

Telephone: +27 84 299 6791

1.5 Our Information Officer is appointed under section 55 of POPIA and is registered with the Information Regulator. Please use the contact details above for privacy requests.

2. WHAT THIS POLICY COVERS AND WHO IT APPLIES TO

This policy applies to personal information we process about client representatives and users of our administrative portals, wage earners whose time, attendance, activities, documents, and payroll are managed on our platform, and visitors to our websites and support resources. It covers processing that occurs through our clocking options such as rugged biometric devices, RFID wristbands, a facial clocking app, and WhatsApp clock‑ins, our central HR hub for storing worker documents, and our integrated payroll engine that generates payslips, bank files, and statutory submissions. It does not cover personal processing by our clients outside of our platform or any third‑party websites you may access via links.

3. THE PERSONAL INFORMATION WE COLLECT

3.1 We collect identity and contact details such as -

• Names;

• employee numbers;

• South African ID or passport numbers;

• mobile numbers;

• email addresses; and

• SARS tax numbers for payroll, where relevant.

3.2 We collect employment and attendance data, including -

• worksite,

• clock‑in and clock‑out timestamps,

• tasks performed,

• shift and overtime details,

• leave requests and approvals; and

• activity logs linked to supervisors and projects.

3.3 We collect payroll and financial information such as -

• pay rates;

• piece‑rates,

• earnings and deductions,

• union and provident fund contributions,

• bank account details for salary disbursement; and

• generated payslips.

3.4 We process documents and compliance records including -

• employment contracts,

• safety certificates,

• training records, licences, and

• medical records or fit‑for‑work notes maintained in our central HR hub.

3.5 We process biometric data for attendance and access control where our fingerprint or facial recognition clocking options are enabled, and we process RFID wristband identifiers and facial images where the facial clocking app is used.

3.6 Where WhatsApp clock‑ins or self‑service are enabled, we process WhatsApp identifiers, messages necessary for the service. Where enabled, we process location information recorded when employees clock using AllWage hardware devices or WhatsApp clocking, to verify presence at the worksite.

3.7 We also collect device, usage, and website information such as IP addresses, browser types, interaction logs, and cookies or similar technologies on our public sites as explained in the Cookies section of this policy.

4. HOW WE COLLECT PERSONAL INFORMATION

We collect information directly from clients and their representatives when they register, administer their workforce, sign contracts, or communicate with us through our support channels. On a client’s behalf, we also collect information directly from employees and workers when they clock in or out, request leave, view or receive payslips, or communicate through the enabled WhatsApp or support channels, and from the client or site managers who administer worker profiles, define pay rules, upload documents, and manage attendance and payroll within our platform. We receive clocking and operational data from devices you use, including rugged biometric scanners, RFID devices, and WhatsApp or mobile applications. We may receive information from third‑party service providers that support functions such as identity verification, communications, secure payslip delivery, or hosting, subject to operator agreements and POPIA.

5. WHY WE COLLECT AND USE PERSONAL INFORMATION

5.1 We use personal information to -

• provide and improve our time and attendance, activity tracking, WhatsApp communications, document management, and payroll services; this includes -

  • verifying attendance,

    • calculating earnings,

    • generating payslips,

    • preparing bank files, and

    • producing SARS and Department of Labour submissions.

• administer your profile, support HR compliance by tracking expiry of documents and certifications, and maintain a complete audit trail of changes for dispute resolution; and

• secure our services, monitor performance, prevent ghost workers and fraud, and improve accuracy and efficiency for wage‑intensive operations.

5.2 We use contact details to send operational communications including shift schedules, leave decisions, and payslips via WhatsApp where enabled, and to respond to queries and support tickets.

5.3 We use cookies and analytics to operate our websites, remember preferences, improve performance, and, where you consent, understand usage for product improvement and marketing consistent with POPIA.

6. OUR LAWFUL BASES FOR PROCESSING UNDER POPIA

6.1 AllWage contracts with its clients, who are employers, to deliver time, attendance and payroll services, including calculating pay and issuing payslips. AllWage does not contract with those clients’ employees or workers for these services. We process their personal information on the client’s behalf and on its documented instructions under the Data Processing Addendum. The client is responsible for determining the lawful basis for processing its employees’ and workers’ personal information under POPIA.

6.2 We process personal information to comply with legal obligations applicable to AllWage or, on a client’s documented instructions, to assist that client in complying with its legal obligations, such as South African tax and labour law requirements, including PAYE, UIF, SDL, and statutory reporting.

6.3 We process personal information to pursue our legitimate interests where AllWage acts as responsible party or, on a client’s documented instructions, that client’s legitimate interests, including ensuring accurate attendance, preventing ghost workers, maintaining audit trails, and improving operational efficiency, balanced against the rights of the people concerned.

6.4 Where we process special personal information on a client’s behalf, such as biometric templates and facial images for attendance, health-related records in the HR hub, or union membership for deductions, the client must obtain any required consent from the employees or workers concerned, unless another authorisation under sections 27–33 of POPIA applies. Where consent is relied on, it may be withdrawn by contacting the client, but this will not affect lawful processing based on other grounds or prior to withdrawal. AllWage assists the client in giving effect to the withdrawal in accordance with the Data Processing Addendum and applicable law.

7. SPECIAL PERSONAL INFORMATION AND CHILDREN’S INFORMATION

7.1 Where we process biometric information for fingerprint or facial recognition clocking, health information in medical records, or union membership data, we will do so on the client’s documented instructions, subject to the client establishing explicit consent or another lawful authorisation under POPIA, and with enhanced safeguards, and the client is responsible for explaining the implications to the employees or workers concerned at the point of collection.

7.2 We do not target or knowingly process the personal information of children under 18 in our services; if a client intends to process children’s information on the platform, the client is responsible for ensuring a lawful basis and compliance with sections 34 - 35, and we will support such processing only where authorised by law and with appropriate safeguards.

8. WHETHER PROVISION IS MANDATORY OR VOLUNTARY AND CONSEQUENCES OF NON‑PROVISION

8.1 Depending on the applicable service and legal requirements, certain information is mandatory to provide our services or to comply with law, including identity and tax identifiers, bank details for salary disbursement, attendance data, and documents required for labour, safety, or site access compliance. Without this information, we may be unable to deliver services or you may be unable to work on specific sites.

8.2 The client must establish the applicable authorisation under POPIA for processing biometric and health information; site safety rules alone do not establish that authorisation. Where the client relies on consent for biometric attendance and an employee or worker declines or withdraws it, the client is responsible for considering and explaining any available alternatives. AllWage supports the client through the available platform options, but some features or efficiencies may be limited.

9. SHARING PERSONAL INFORMATION WITH OPERATORS AND RECIPIENTS

9.1 We share personal information with service providers who act as our operators for information processed on our behalf, or as sub-operators for information we process on a client’s behalf, including hosting providers, secure messaging or payslip delivery services, device and communications providers, and support partners, under written contracts that require confidentiality and appropriate security measures under sections 20 and 21 of POPIA.

9.2 We share information with banks and payment channels through generated bank files to pay wages and with SARS and other authorities through statutory reporting outputs, as required by law and client configuration.

9.3 We share information within the client organisation according to role‑based access, providing managers with attendance, payroll, and documentation necessary for operational and compliance purposes, subject to audit logs and least‑privilege principles. We do not sell personal information and we do not permit operators to process it for their own unrelated purposes.

10. CROSS‑BORDER TRANSFERS

10.1 Our platform is designed for South African clients, but some operators or communications channels such as WhatsApp may process personal information on servers outside South Africa, which constitutes a cross‑border transfer under section 72. Where transfers occur, we will ensure an adequate level of protection through a law, binding corporate rules, or a binding agreement that upholds POPIA‑equivalent principles, or we will rely on the consent of the relevant data subject or contractual necessity when appropriate and lawful. Where AllWage processes employee or worker information on a client’s behalf, transfers are made on that client’s documented instructions and in accordance with the Data Processing Addendum and applicable law.

10.2 Where we intend to transfer special personal information or children’s information to a third party in a foreign country without adequate protection, the relevant responsible party must assess whether prior authorisation is required and obtain it from the Information Regulator before the processing proceeds where required by POPIA. AllWage handles this obligation where it is the responsible party; where the client is the responsible party, AllWage assists the client under the Data Processing Addendum.

11. SECURITY SAFEGUARDS

We implement appropriate, reasonable technical and organisational measures to prevent loss, damage, unauthorised destruction, and unlawful access or processing, including encryption in transit and at rest for client information processed through our platform where feasible, role‑based access controls, complete audit logs of changes, and secure delivery of payslips, and we regularly review safeguards in light of new risks. We require our operators to implement equivalent measures under written contracts and to notify us without delay if they suspect any unauthorised access or acquisition of personal information.

12. DATA BREACHES AND HOW WE WILL NOTIFY YOU

Where AllWage acts as the responsible party, if there are reasonable grounds to believe that personal information has been accessed or acquired by an unauthorised person, we will notify the Information Regulator and affected data subjects as soon as reasonably possible, taking into account law enforcement needs and restoration of system integrity, and we will provide the information that enables you to take protective measures. Notifications may be sent to your last known email or physical address, placed prominently on our website, published in news media, or made by another method directed by the Regulator.

Where AllWage processes employee or worker information on a client’s behalf, AllWage notifies the client and assists it in accordance with POPIA and the Data Processing Addendum. The client is responsible for notifying the Information Regulator and affected employees or workers as required of it as responsible party.

13. RETENTION AND DELETION

We retain personal information only for as long as is necessary to fulfil the purposes described in this policy or to comply with legal, regulatory, tax, accounting, or reporting requirements, after which we will destroy, delete, or de‑identify records in accordance with section 14. Payroll, tax and employment records are typically subject to multi-year statutory retention periods in South Africa. For employee and worker information processed on a client’s behalf, the client determines the applicable retention requirements and AllWage handles retention, return and deletion in accordance with the client’s documented instructions, the Data Processing Addendum and applicable law. AllWage’s own records are retained under its applicable retention schedules and legal obligations.

14. YOUR POPIA RIGHTS AND HOW TO EXERCISE THEM

14.1 You have the right to -

14.1.1 be notified of collection;

14.1.2 know whether we hold personal information about you;

14.1.3 request access to your personal information;

14.1.4 request correction, deletion, or destruction where it is inaccurate, excessive; out of date, incomplete, misleading, or unlawfully obtained;

14.1.5 object on reasonable grounds to processing including direct marketing;

14.1.6 object to direct marketing by unsolicited electronic communications;

14.1.7 not be subject to certain automated decisions;

14.1.8 lodge a complaint with the Information Regulator; and

14.1.9 institute civil proceedings.

15. To exercise your rights, please contact our Information Officer with sufficient detail to identify you and the information you request; we will respond within a reasonable period and may charge a prescribed fee for access as permitted by law, using the contact details below:

Responsible party: AllWage Proprietary Limited, 5th Floor, Bloukrans

Building, Lynnwood Bridge, Pretoria, Gauteng, 0081, South Africa

Information Officer: Cilliers Geldenhuys

Email: cilliers@allwage.com

Telephone: +27 84 299 6791

15.1 You may lodge complaints with the Information Regulator, which details are as follows -

Address: Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191

Email: enquiries@inforegulator.org.za ; or

POPIAComplaints@inforegulator.org.za for POPIA complaints

Telephone: 010 023 5200 or Toll free 0800 017 160.

16. COOKIES AND SIMILAR TECHNOLOGIES

Our websites use cookies and similar technologies to operate, secure, and improve the user experience, to remember preferences, and, where you consent, to measure usage and support marketing; because cookies can collect personal information, we will present a consent banner to obtain your opt‑in for non‑essential cookies and provide a cookie policy explaining each category. You can change your preferences at any time via the cookie settings link on our site or through your browser settings, though disabling certain cookies may affect site functionality.

17. OPERATORS (PROCESSORS) AND CONFIDENTIALITY

We only engage operators under contracts that require them to process personal information on our documented instructions, implement appropriate security measures, keep information confidential, and notify us of security compromises; we remain responsible for our applicable obligations under sections 20 and 21 of POPIA and, for sub-operators processing client information, under the Data Processing Addendum.

18. AUTOMATED DECISION‑MAKING

We do not make decisions with legal or similarly significant effects for you based solely on automated processing; where we use automation to calculate payroll or flag anomalies, such processing supports human decision‑making and oversight, and you may request an explanation and contest outcomes.

19. UPDATES TO THIS POLICY

We may update this policy to reflect changes in law, technology, or our operations and will take reasonably practicable steps to inform you, including by posting a prominent notice on our website; the “last updated” date will appear at the top.

20. INFORMATION OFFICER CONTACT DETAILS