reproduced, copied, and/or transmitted (in any form or for any purpose) without Shoprite’s prior written consent.

The Shoprite Group Data Privacy Statement

Last modified: June 2023

Protecting your privacy is as important to us as it is to you. For us, it is more than just making sure we comply

with the relevant legislation; you trust us with your personal information, and we respect that trust. This

Privacy Statement explains why and how we collect, use, and store your personal information. The processing

of personal information must be transparent and secure, in conformity with the privacy legislation of the

countries in which Shoprite Group operates including the Protection of Personal Information Act 4 of 2013

(POPIA). This Privacy Statement contains the information required by POPIA and other relevant data privacy

legislation.

For purposes of this Privacy Statement, the term "data privacy legislation" means all law relating to data

protection and privacy or of similar purposes or effect as amended, updated, re-enacted, or replaced from

time to time including, but not limited to, POPIA. Furthermore, any term which refers to a POPIA concept or

process (for example, personal information, data subject, operator, or responsible party) shall be deemed to

include a reference to the equivalent concept or process in any other jurisdiction in which this Privacy

Statement may apply.

1. What is this notice about?

We want you to understand who you are sharing your information with, what kind of

information we collect and how we use the information.

In your day-to-day dealings with the Shoprite Group of Companies we obtain information about you. We

want you to know exactly what that information is and what we do with it. This Privacy Statement describes

how we collect, use, process, and disclose your personal information, in conjunction with your access to and

use of Shoprite Group’s web and app platforms.

POPIA protects you.

The Protection of Personal Information Act (POPIA) is aimed at protecting your personal information and

prescribes what we must and must not do with it. POPIA created an Information Regulator who checks that

companies like Shoprite manage personal information in a responsible manner that respects your privacy.

Other legislation applies to your personal information.

As Shoprite conducts its business activities in various countries throughout Africa, the data privacy legislation

applicable in these countries also applies to our processing of your personal information. In certain respects,

the data privacy legislation applicable in these countries may differ or provide for more extensive protections

than POPIA. To this end, please refer to Annexure A for specific data privacy exemptions not mentioned in

this Privacy Statement.

Furthermore, other legislation also applies to your personal information. For instance, if you are applying for

reproduced, copied, and/or transmitted (in any form or for any purpose) without Shoprite’s prior written consent.

a Shoprite Money Transfer account, the Financial Intelligence Centre Act

38 of 2001 (FICA) must be complied

with, or if you buy a SIM card, the Regulation of Interception of Communications and Provision of

Communication-Related Information Act

70 of 2002 (RICA) must be complied with. This means that from time

to time we will be obligated to process your personal information in a certain way (or keep it for a certain

period).

This Privacy Statement is part of our agreement with you.

This Privacy Statement forms part of our agreement with you as a natural person or as a business. You should

read it along with the terms and conditions that apply. These terms and conditions can be accessed on the

specific Shoprite Group websites or products, and www.shopriteholdings.co.za.

This notice may change from time to time.

From time to time, we may have to amend this notice to accommodate changes in our business or services

or if legal requirements change. It is your responsibility to check that you have read the latest version.

2. Who you are sharing your information with

Your personal information is shared within the Shoprite group of companies. Shoprite is a group of companies

or brands. For this document we will refer to the Shoprite Group. Our principal place of business is at Cnr

William Dabbs Street & Old Paarl Roads, Brackenfell, 7561 but we recommend you contact our Compliance

Officer at privacy@shoprite.co.za.

We may also create an audience list based on your shopping behaviour and share your information with

external entities for the purpose of direct marketing the external entities’ products and services.

3. When this Privacy Statement applies

This Privacy Statement applies:

● when you use any of our products or services;

● when you apply to us for a job or work placement;

● when you supply services to us where this involves any personal information;

● as a result of your relationship with our clients; and/or

● to any information collected from or shared with third parties.

This Privacy Statement also applies to our websites, apps and online services as well as any publications or

newsletters that you request.

4. What information we collect

‘Personal information’ is any information that can be used to identify you or that we can link to you as a

natural person or juristic person. Where you use our services, we will collect personal information directly

reproduced, copied, and/or transmitted (in any form or for any purpose) without Shoprite’s prior written consent.

from you.

The information you provide may include current and historical personal information including your name, contact

details, title, identification, employment, positions held and enquiry/complaint details and information about the

organisation with which you are affiliated

, employee/personnel personal information and financial information

(account number, payments and history) and company name and registration number. We may also collect

personal information about your other dealings with us and our clients, including any contact we have with you

in person, by telephone, email or online.

We may also collect personal information from third parties such as your employing organisation, regulatory

authorities, recruitment agencies, credit reporting agencies, information or service providers, publicly

available records, and the third parties described in this Privacy Statement.

Information that you voluntarily provide to us

We collect information that you voluntarily provide to us including when you communicate with us via forms,

email or other channels; when you sign up for newsletters, alerts, or other materials; and when you respond

to our communications or requests for information.

The information you provide may include current and historical personal information including your name,

contact details, title, identification, employment, positions held and enquiry/complaint detail, information

about the organisation with which you are affiliated and information provided by an employer for purposes

of Shoprite's services. We may also collect personal information about your other dealings with us and our

clients, including any contact we have with you in person, by telephone, email, app or online.

Information from other sources

We may collect information from other sources, such as social media platforms that share information about

how you interact with our social media content, and any information gathered through these channels will

be governed by the privacy settings, policies, and/or procedures of the applicable social media platform,

which we strongly encourage you to review and information provided by an operator or third party services

provider in rendering services to Shoprite or otherwise processing personal information on its behalf (e.g.

Peach Payments or Yonder). We will handle any unsolicited information in accordance with law, including

destroying or de-identifying such information where we are required to do so.

When you use our online services, we may collect the following:

Information you provide by completing forms (this includes information you give us, submitting material,

requesting services, entering competitions, registering for any of our online offerings or subscribing to our

newsletters or other services):

● Your name and address.

● Your delivery address (if different to above).

● Website cookies.

● Your contact telephone number in case we need to call you.

● Your credit or debit card number, expiry date and security code.

● Information you provide by your participation in competitions, live chats or message boards.

reproduced, copied, and/or transmitted (in any form or for any purpose) without Shoprite’s prior written consent.

● Information you provide to us if you contact us, for example to report a problem with our online

services or raise a query or comment.

● Where our online services require that you enter a password or other information in order to access

certain features, we will collect such credentials when you enter them.

Accounts, Money Market Account, purchase cellphone or SIM card, purchase of tickets,

money transfer and other services

We must collect some of your information for various services we provide to you. These include but are not

limited to when you open an account or sign up for a Money Market Account, purchase a cellphone or SIM

card, purchase tickets for an event, make a booking via Computicket, replace a lost or stolen gift card or

transfer a gift card to another branch, pay certain accounts at our Money Market counter, receive a payout

at our Money Market counter, transfer money via Shoprite Money Transfers and other services, and further

processing for purposes of the provision of Verification Services.

If you apply for a job with us

We may request personal information about your education, employment, racial background and state of

health. As part of your application you will be asked to provide your express consent to our use of this

information to assess your application and to allow us to carry out both recruitment analytics and any

monitoring activities which may be required of us under applicable law as an employer.

We may also carry out screening checks (including reference, background, directorship, financial, identity,

eligibility to work, vocational suitability and criminal record checks) and consider you for other positions. We

may exchange your personal information with academic institutions, recruiters, screening check providers,

health service providers, professional and trade associations, law enforcement agencies, recruitment

analytics providers, referees and your current and previous employers.

We may also gather additional information about you from publicly available resources such as LinkedIn or

other social or professional media platforms and collate this with the information that you provide to us.

Without your personal information, we may not be able to progress considering you for positions with us. In

some instances, personal information must be provided to us in order for us to legally or contractually

perform services to you, for example where we are required by law to gather personal information for anti-

money laundering identification purposes. Where relevant we will highlight to you those details that we are

required to collect.

We collect information when you contact our call centres to respond to your query.

When you contact our customer support services, we collect information that helps us to categorise your

query, respond to it and, if applicable, investigate what went wrong. We also use this information to track

potential problems and trends to customise our support responses to provide a better service to you. Calls

are recorded for quality control and record-keeping purposes.

reproduced, copied, and/or transmitted (in any form or for any purpose) without Shoprite’s prior written consent.

Our call centres are committed to keeping your personal information safe and secure. Please take care not

to provide more information than what we ask for. Please do not provide your bank account details or

passwords to our Call Centre Agents. Any unnecessary information you give us will not be retained.

We collect information while you use our websites.

Every time you connect to our websites, we store web server logs which show your IP address (the unique

number which your machine uses when it is connected to the Internet), what you looked at, whether the

page request was successful or not, and which browser you used to view the pages. The use of this data is

strictly for statistical and personalisation purposes only. This helps us understand which areas of the site are

of particular interest and also which pages are not being requested. It also tells us how many hits and page

requests we get.

We use cookies to optimise your website experience, but you can opt out.

A cookie is a small piece of information stored by your browser on your device. It may contain some personal

details in an encrypted format, which can be recalled when you return to the website. These speeds up our

identification, ordering and delivery processes.

We use cookies to identify the device you use to connect to our website. We use anonymous cookies to

collect data about how you use our website, so that we can improve and optimise your website experience.

You can opt out of cookies by activating the setting on your web browser which allows your web browser to

refuse cookies. However, if you select this setting, you may be unable to access certain parts of our website,

and this may have a detrimental effect on your experience and the web-based services that we can offer you.

You may delete the cookies stored on your computer at any time.

Other tracking pixels may also be collected as required.

For further information, please refer to our Cookies Policy.

Our stores and facilities may be monitored by CCTV cameras.

Our facilities may be monitored by CCTV cameras for public safety and crime prevention. The footage is

stored in a secure location and every precaution is taken to keep it secure.

We do not collect the information of persons under 18.

We do not knowingly collect the information of persons under 18 without the consent of their parents or

guardians unless otherwise stated in our product Terms and Conditions. If you are under the age of 18 you

must not provide personal information to us without the consent of your parent or guardian and we reserve

the right to ask for proof of guardian or parent’s consent.

reproduced, copied, and/or transmitted (in any form or for any purpose) without Shoprite’s prior written consent.

5. Why we need your personal information

We use your personal information to provide our products and services to you.

We use your personal information to provide our products and services to you. This includes but is not limited

to:

● processing your payment card details in order to complete any purchase;

● processing your orders and transactions for goods and services;

● delivering products that you order online;

● processing your basket details to create a profile to give you personalised offers;

● responding to your queries and comments;

● accessing your medical information to dispense medicine at Medirite;

● creating an audience list based on your shopping behaviour;

● when we have a legal duty to use or disclose your information.

We need your personal information if you apply for credit.

We use your personal information to process your application for credit, this includes checking your identity,

credit status, contact details and financial track record. We use automated decision making based on the

information you provide in the credit granting process. We also need personal information to send

statements and other legal documents and collect payments you owe us.

We use your personal information to learn more about the products and services that

interest you.

● To conduct market research to understand your preferences, learn more about the products and

services that you are interested in and improve the products and services we offer to you;

● To create an audience list based on your shopping behaviour;

● To inform and provide you with the opportunity to make use of products, services and benefits

that we offer and that we believe may be of interest to you.

Please note that we will not contact you telephonically for unsolicited marketing purposes or send unsolicited

marketing communications to you by mail, SMS or email if you have not opted in to receive them.

6. Sharing your information

Your privacy is important to us, and we undertake not to use or share your personal information unless for

business purposes.

You agree that we may make your information available to the following people and organisations in order

to process your data as set out in this Privacy Statement:

● Your data may be used by other divisions and entities in the Shoprite Group.

● We only share your personal information with companies that help us to provide our services to you and

reproduced, copied, and/or transmitted (in any form or for any purpose) without Shoprite’s prior written consent.

who have agreed to keep your information secure and to only use it for authorised purposes.

● With any third-party advertisers/businesses to better accommodate and run campaigns.

● We use suppliers or service providers who we trust to provide services to us and sometimes that involves

sharing your information with them. They operate under strict requirements aimed at keeping your

personal information secure and confidential and they will only use it for the purpose for which we have

sent it to them. We will engage external service providers with appropriate Non-Disclaimer and/or Data

Sharing Agreements to protect your data.

● We may share your personal information with banking institutions and the issuers of payment cards

you use.

● We may share your personal information with external entities if you form part of an audience list to

enable these entities to directly market their products or services to you.

● To governmental, judicial, regulatory and law enforcement bodies and agencies, including any credit

regulator.

Sometimes we must send your personal information to other countries.

Some of these service providers may be in other countries that may not have the same levels of protection

of personal information as South Africa. If this is the case, we will ensure that anyone to whom we transfer

personal information is subject to a law or binding agreement which provides an adequate level of protection,

and the third party agrees to treat that personal information with the same level of protection as we are

obliged under the data privacy legislation.

7. Your rights and preferences

You have the right to know what personal information we have about you, to correct it

and to opt out of any marketing.

You have the right to:

● ask what personal information we hold about you;

● ask what information was sent to our suppliers, service providers or any other third party;

● ask us to update, correct or delete any out-of-date or incorrect personal information we hold about you,

under certain conditions;

● unsubscribe from any direct marketing communications we may send you;

● submit a complaint to a relevant supervisory authority;

● to not be subjected to automated decision making which results in legal

consequences for you or which affects you to a substantial degree;

● object to the processing of your personal information;

● ask us to restrict the processing of your personal information, under certain conditions.

It can take us up to 21 days to respond to your request and we may charge a small fee. If you want us to

delete all personal information we have about you, you will probably have to terminate all agreements you

have with us. We cannot maintain our relationship with you without having some of your personal

reproduced, copied, and/or transmitted (in any form or for any purpose) without Shoprite’s prior written consent.

information. We can refuse to delete your information if we are required by law to keep it or if we need it to

protect our rights.

Please contact our Compliance Officer shown at the beginning of this Privacy Statement if you want to submit

any request to us. We will provide you with a form and the amount of any fee.

Some of your information is available online.

You can view and correct some of your information online by creating an online profile, via our mobile apps

such as Sixty60 or Money Market Account, our websites or our call centres. Other information can be

corrected on request via email to privacy@shoprite.co.za.

8. Security

We take your privacy and the security of your personal information seriously.

We have implemented reasonable security safeguards to protect the personal information that you give us.

For example, sensitive data (such as your credit card information) is protected by TLS encryption when it is

exchanged between your web browser and our website.

You can play a role in protecting your information by never sharing your username, PIN or password with

anyone or submitting it to a website you don’t recognise. Always log off after a web session and change your

password regularly.

We regularly monitor our systems for possible vulnerabilities and attacks. No system is perfect so we cannot

guarantee that information may not be accessed, disclosed, altered or destroyed by breach of any of our

physical, technical or managerial safeguards.

Please note that any email you send to us is not encrypted and may be monitored by us. Please do not send

us sensitive or confidential personal information by email.

We will inform you if your privacy is ever compromised.

Although we cannot prevent all security threats, we have measures in place to minimise the threat to your

privacy. Should there be a data breach where your personal information is directly affected, we will follow

the guidelines provided by data privacy legislation in order to inform you and relevant local supervisory

authority.

reproduced, copied, and/or transmitted (in any form or for any purpose) without Shoprite’s prior written consent.

Annexure A

Country

Specific data privacy rights

Ghana

The Data Protection Act, 2012 provides you with the right to be informed of the

logic or rationale behind the decision that was made based on the processing where

the processing constitutes the sole basis for the taking of a decision which

significantly affects you.

Zambia

The Data Protection Act, 2021 provides you with a right to data portability meaning

you have the right to receive your personal data in a structured, commonly used,

machine readable or otherwise legible format and the right to have this data

transmitted to another data controller.