PRIVACY POLICY

QC Pack Accelerator
Larrec Holdings (Pty) Ltd | Reg. No. 2015/139416/07

Version

Effective date

Last reviewed

Responsible party

Contact email

Website

1.0

[DATE — insert before publishing to website]

[DATE]

Anton Croukamp, Larrec Holdings (Pty) Ltd t/a QC Pack Accelerator

[email protected]

qcpacks.com

POPIA compliance notice

This Privacy Policy is drafted to comply with the Protection of Personal Information Act 4 of 2013 (POPIA) of the Republic of South Africa, which came into full effect on 1 July 2021. It also addresses the requirements of the European Union General Data Protection Regulation (GDPR) for personal information collected from data subjects located in the European Economic Area and the principles of other applicable data protection frameworks for international clients. QC Pack Accelerator recommends that this policy be reviewed by a qualified South African attorney with POPIA expertise before publication.

1. Who we are

This Privacy Policy applies to Larrec Holdings (Pty) Ltd, Registration Number 2015/139416/07, trading as QC Pack Accelerator ("QC Pack Accelerator", "we", "us", or "our"). We operate the website at qcpacks.com and provide QC documentation production services to clients in the engineering, construction, and industrial sectors.

For the purposes of POPIA, QC Pack Accelerator is the Responsible Party in respect of personal information collected through qcpacks.com, the QC Pack Readiness Scorecard, the newsletter subscription form, client engagements, and all other touchpoints described in this policy.

We can be contacted at:

Email

Website

Postal address

[email protected]

qcpacks.com

[REGISTERED BUSINESS ADDRESS — add before publishing]

2. Scope of this policy

This Privacy Policy applies to:

• Visitors to qcpacks.com and all subpages.

• Individuals who complete the QC Pack Readiness Scorecard.

• Individuals who subscribe to the QC Pack Accelerator Bulletin newsletter.

• Clients and prospective clients who engage with us by email, telephone, video call, or through any contact form on the website.

• Individuals whose personal information is provided to us in the course of a client engagement — including client representatives,

project contacts, and procurement personnel.

This policy does not apply to third-party websites linked from qcpacks.com. We are not responsible for the privacy practices of any third-party website or service.

3. Personal information we collect

3.1 Information you provide directly

Examples

Full name, job title, company name

Email address, telephone number

Industry sector, project role, project phase, project type

Project name, location, phase, disciplines, pack count estimate, timeline

Purchase history, payment pathway, package tier selected

Enquiries, questions, and correspondence sent to us by email or through the website

Open-text responses provided voluntarily

Collected where

Scorecard, contact form, client engagement

Scorecard, newsletter opt-in, contact form, client engagement

Scorecard responses (Q1–Q5)

Discovery calls, Worksheets, Scope of

Work

Order placement, invoicing

Email, contact form

Scorecard Q6, post-engagement feedback

3.2 Information collected automatically

When you visit qcpacks.com, we and our third-party service providers may collect certain technical information automatically, including:

• IP address and approximate geographic location.

• Browser type and version.

• Pages visited, time spent on pages, and referring URLs.

• Device type and operating system.

This information is collected through cookies and similar tracking technologies. See Section 9 for details on our cookie use.

3.3 Information we do not collect

We do not collect or process the following categories of special personal information as defined under POPIA:

• Religious or philosophical beliefs.

• Race or ethnic origin.

• Trade union membership.

• Political persuasion.

• Health or sex life information.

• Biometric information.

• Criminal behaviour or offences.

We do not knowingly collect personal information from individuals under the age of 18. If you are under 18, please do not submit personal information through qcpacks.com. If we become aware that we have collected personal information from a minor, we will delete it

promptly.

4. How we use your personal information

We process your personal information for the following purposes and on the following lawful bases:

Purpose

Responding to scorecard completions and delivering scorecard results

Sending the QC Pack Accelerator Bulletin newsletter

Managing discovery call bookings and consultations

Delivering QC Pack production services under a signed Service Agreement

Issuing quotes, invoices, and processing payments

Completing vendor or supplier registration on behalf of the client

Communicating service updates and relevant industry information to existing clients

Improving our website, scorecard, and service delivery

Complying with legal obligations under South African law

Personal information

Name, email, Q1–Q5 responses

Name, email address

Name, email, phone, professional information

All project and contact information provided

Name, company, contact details,

commercial information

Company registration details, contact information

Name, email address

Anonymised and aggregated usage data

As required by applicable law

Lawful basis (POPIA / GDPR)

Consent / Legitimate interest

Consent — explicit opt-in required

Pre-contractual steps / Legitimate interest

Performance of contract

Performance of contract / Legal obligation

Performance of contract

Legitimate interest — existing client relationship

Legitimate interest

Legal obligation

Newsletter consent

We will only send you the QC Pack Accelerator Bulletin if you have explicitly opted in. Completing the scorecard does not automatically subscribe you to the newsletter. The opt-in is a separate, unticked checkbox. You may unsubscribe at any time by clicking the unsubscribe link in any newsletter issue or by emailing [email protected].

5. How we share your personal information

5.1 We do not sell your information

We do not sell, rent, or trade your personal information to any third party for their own marketing or commercial purposes, under any circumstances.

5.2 Service providers (operators)

We share personal information with third-party service providers who process it on our behalf as operators under POPIA. These providers are contractually required to process personal information only on our instructions and to maintain appropriate security measures. Our current service providers include:

Provider category

Email platform (e.g. Google Workspace)

Website hosting provider

Newsletter platform (e.g. Mailchimp or equivalent)

Scorecard platform

Payment processor

Cloud storage provider

Purpose

Email communication and storage

Hosting qcpacks.com

Newsletter delivery and list management

Delivering and processing scorecard responses

Processing online payments (Pay Now pathway)

Storing project files and client documents

Location

United States

To be confirmed on deployment

United States

To be confirmed on deployment

We will update this table when specific service providers are confirmed. Where providers are located outside South Africa, we take steps to ensure adequate protection as described in Section 6.

5.3 Legal and regulatory disclosure

We may disclose personal information where required to do so by law, court order, or regulatory authority — including the Information Regulator of South Africa. We will notify affected individuals of any such disclosure where we are legally permitted to do so.

5.4 Business transfers

If QC Pack Accelerator undergoes a merger, acquisition, restructuring, or transfer of business to another entity — including the planned future incorporation of QC Packs LLC — personal information held at the time of transfer may form part of the transferred assets.

Affected individuals will be notified in advance of any such transfer and their rights under this policy will be maintained.

6. Cross-border transfer of personal information

Some of the third-party service providers listed in Section 5.2 are located outside South Africa — in particular in the United States. POPIA requires that we take steps to ensure that personal information transferred outside South Africa receives equivalent protection to that

afforded under POPIA.

Where personal information is transferred to recipients in jurisdictions that have been assessed by the South African Information Regulator as providing adequate protection, we rely on that adequacy determination. Where no such determination exists, we ensure adequate protection through one or more of the following:

• Binding contractual clauses that impose POPIA-equivalent obligations on the recipient.

• The recipient's binding corporate rules (where applicable).

• Your explicit consent to the transfer (where required and appropriate).

For data subjects located in the European Economic Area, transfers to countries outside the EEA are conducted in accordance with GDPR Chapter V requirements, including the use of Standard Contractual Clauses where applicable.

7. Retention of personal information

We retain personal information only for as long as necessary for the purpose for which it was collected, or as required by law. Our standard retention periods are:

Retention period

12 months from completion

For the duration of the subscription, plus 30 days after unsubscription

3 years from the date of the call

7 years from project completion

7 years from the date of issue

7 years from termination or expiry

3 years from the date of the correspondence

26 months (standard analytics platform retention)

Reason

Lead nurturing window; deleted if no engagement occurs

Active consent basis; removed on

unsubscription

Legitimate interest in business record-keeping

South African legal and tax record-keeping requirements

South African Income Tax Act and Companies Act requirements

Business record and dispute resolution

purposes

Contract law and dispute resolution purposes

Performance monitoring; anonymised — not personal information after processing

When personal information is no longer required, we securely delete or anonymise it. We review our data holdings annually and remove records that have exceeded their retention period.

8. Your rights

8.1 Rights under POPIA

As a data subject under POPIA, you have the following rights in respect of your personal information:

Right

Right of access

Right to correction

Right to deletion

Right to object

Right to restrict processing

Right to withdraw consent

Right to lodge a complaint

What it means

Request confirmation of whether we hold your personal information and a copy of that information

Request correction of inaccurate, incomplete, or outdated personal information

Request deletion of personal information we are no longer legally required or entitled to retain

Object to processing based on legitimate interest or for direct marketing purposes

Request that we limit how we use your personal information pending correction or objection

Withdraw consent at any time where processing is based on consent — this does not affect the lawfulness of prior

processing

Lodge a complaint with the Information Regulator of South Africa if you believe we have violated your rights

How to exercise

[email protected]

[email protected] or use the unsubscribe link in any email

[email protected]

[email protected] or use the unsubscribe link

www.inforegulator.org.za

8.2 Additional rights for EEA residents

If you are located in the European Economic Area, you have the additional right to data portability — the right to receive your personal information in a structured, commonly used, machine-readable format and to transmit that data to another controller. To exercise this

right, email [email protected].

8.3 How to exercise your rights

To exercise any of the rights listed above, please contact us at [email protected] with the subject line "Privacy Rights Request" and a description of your request. We will respond within 30 days of receiving your request. We may ask you to verify your identity before processing the request to protect your personal information.

8.4 Information Regulator contact details

If you have a concern about how we handle your personal information that we have not resolved to your satisfaction, you have the right to lodge a complaint with the Information Regulator of South Africa:

9. Cookies and tracking technologies

9.1 What are cookies

Cookies are small text files placed on your device when you visit a website. They are used to remember your preferences, understand how you use the site, and improve your experience. Some cookies are essential for the website to function. Others are optional and used for

analytics or marketing purposes.

9.2 Cookies we use

Cookie type

Essential cookies

Analytics cookies

Marketing and tracking cookies

Purpose

Required for the website to function — session management, security, form

submission. Cannot be disabled without affecting website functionality.

Used to understand how visitors use qcpacks.com — pages visited, time on site, traffic sources. Data is anonymised and aggregated.

Used to track visits from external platforms (e.g. LinkedIn, Google). May be used for retargeting advertising.

Can be declined

Yes — via cookie banner

9.3 Your cookie choices

When you first visit qcpacks.com, a cookie consent banner will give you the option to accept or decline non-essential cookies. You can change your cookie preferences at any time by clicking the "Cookie Settings" link in the website footer. You can also manage cookies through your browser settings — please note that disabling all cookies may affect website functionality.

10. How we protect your information

We implement appropriate technical and organisational measures to protect personal information against unauthorised access, loss, destruction, alteration, or disclosure. These measures include:

• Encrypted email communication using Google Workspace.

• Secure storage of client project files using access-controlled cloud storage.

• Password protection and two-factor authentication on all accounts that store personal information.

• Limiting access to personal information to individuals who need it to perform their role.

• Regular review of security practices as the business scales.

No method of electronic transmission or storage is completely secure. While we take all reasonable precautions, we cannot guarantee absolute security. In the event of a personal information breach that is likely to result in serious harm to a data subject, we will notify the

Information Regulator and affected individuals as required by POPIA Section 22, within the timeframe prescribed by law.

11. Third-party links

qcpacks.com may contain links to third-party websites, including LinkedIn, YouTube, and other platforms referenced in our content. This Privacy Policy does not apply to those websites. We encourage you to review the privacy policies of any third-party websites you visit. We are not responsible for the privacy practices or content of any third-party website.

12. Children's personal information

QC Pack Accelerator's services are directed exclusively at business professionals and engineering practitioners. We do not knowingly collect personal information from individuals under the age of 18. If you believe a minor has provided personal information to us, please contact us at [email protected] and we will delete the information promptly.

13. Changes to this privacy policy

We may update this Privacy Policy from time to time to reflect changes in our practices, services, or applicable law. When we make material changes, we will:

• Update the version number and effective date at the top of this document.

• Post the updated policy on qcpacks.com.

• Notify newsletter subscribers by email where the changes materially affect how we process their personal information.

The current version of the Privacy Policy is always available at qcpacks.com/privacy-policy.

Continued use of qcpacks.com or our services after the effective date of a revised policy constitutes acceptance of the revised terms.

14. Contact us

If you have any questions, concerns, or requests regarding this Privacy Policy or how we handle your personal information, please contact us:

Responsible party

Trading name

Legal entity

Email

Website

Response time

Anton Croukamp

QC Pack Accelerator

Larrec Holdings (Pty) Ltd, Reg. No. 2015/139416/07

[email protected]

qcpacks.com

Within 30 days of receiving your request

Before publishing this policy

Complete all items marked [in square brackets] before this policy goes live on qcpacks.com:

(1) Insert the effective date and last reviewed date.

(2) Add your registered business address.

(3) Confirm all third-party service providers and update the table in Section 5.2 with their actual names and locations.

(4) Add a Cookie Settings link to the website footer.

(5) Create a dedicated / privacy-policy page on qcpacks.com.

(6) Have this policy reviewed by a South African attorney with POPIA expertise before the scorecard goes live.

This document was prepared by QC Pack Accelerator as a working draft. It does not constitute legal advice. Larrec Holdings (Pty) Ltd recommends independent legal review before publication.