Aletheia Partners (Pty) Ltd (“Aletheia Partners”, “we”, “us”, or “our”) is committed to protecting the privacy and security of the personal information entrusted to us. This Privacy Policy explains how we collect, use, store, share, and protect your personal information when you visit aletheiapartners.co.za (the “Website”) or engage our services.

This policy is issued in accordance with the Protection of Personal Information Act 4 of 2013 (POPIA) and reflects our commitment to processing personal information lawfully, transparently, and responsibly.

By using our Website or providing us with your personal information, you acknowledge that you have read and understood this Privacy Policy.

---

1. Who We Are

Aletheia Partners (Pty) Ltd is a boutique analytics and modelling consultancy based in Johannesburg, Gauteng, South Africa, providing services to corporates, project sponsors, and investors.

Responsible Party (as defined in POPIA): Aletheia Partners (Pty) Ltd;Registration Number: 2025 / 553086 / 07; Johannesburg, Gauteng, South Africa

Information Officer: Mosa Bila; Email: info@aletheiapartners.co.za

---

2. What Personal Information We Collect

We collect personal information that you provide to us directly, as well as information collected automatically when you use our Website.

Information you provide directly, for example when you complete our contact form or request a discovery call:

• First name and last name
• Email address
• Company or organisation name
• Your role or position
• Any information you choose to include in the message field or share during an engagement

Information collected automatically when you visit our Website:

• IP address
• Browser type and device information
• Pages visited and time spent on the Website
• Referring website or source
• Cookie and similar tracking data (see Section 8)

Information collected during a professional engagement:

In the course of providing our services, we may process personal information contained within data, models, or documents you share with us. Where this occurs, we act as an operator (processor) on your behalf, and such processing is governed by the engagement agreement between us.

---

3. How We Collect Your Information

We collect personal information:

• Directly from you, when you complete a form, email us, telephone us, or engage our services;
• Automatically, through cookies and analytics tools when you browse the Website;
• From third parties, where you have consented or where collection is permitted by law (for example, publicly available professional information such as LinkedIn profiles).

---

4. Why We Process Your Information (Purpose and Lawful Basis)

We process your personal information only where we have a lawful basis under POPIA to do so. We use your information for the following purposes:

Purpose	Lawful basis under POPIA
Responding to enquiries and discovery-call requests	Your consent / steps to enter a contract
Providing our consulting services	Performance of a contract
Sending you scoped proposals and follow-up communications	Your consent / legitimate interest
Maintaining business records and meeting legal obligations	Compliance with law / legitimate interest
Improving our Website and understanding how it is used	Legitimate interest
Protecting our Website and systems from misuse	Legitimate interest

We will not use your personal information for purposes incompatible with those listed above without first obtaining your consent.

---

5. Disclosure of Your Information

We do not sell your personal information. We may share it in the following limited circumstances:

Service providers and operators. We use trusted third-party providers to operate our Website and business, who process personal information on our behalf under appropriate confidentiality and data-protection obligations. These include:

• Automattic Inc. / WordPress.com — Website hosting and infrastructure
• Jetpack (Automattic Inc.) — Website functionality, forms, and analytics
• Microsoft Corporation (Microsoft 365) — business email and productivity services

Legal and regulatory disclosure. We may disclose your information where required by law, regulation, court order, or to protect our rights, safety, or property.

Professional engagements. Personal information shared with us during a client engagement is handled strictly in accordance with the relevant engagement agreement and is not disclosed beyond what that agreement and the law permit.

---

6. Cross-Border Transfer of Information

Some of our service providers (including those listed in Section 5) are located outside South Africa, which means your personal information may be transferred to, and processed in, countries other than South Africa.

Where we transfer personal information across borders, we do so in accordance with Section 72 of POPIA, ensuring that the recipient is subject to laws, binding agreements, or binding corporate rules that provide an adequate level of protection substantially similar to POPIA, or that the transfer is otherwise permitted under POPIA (for example, with your consent or where necessary for the performance of a contract).

---

7. How Long We Keep Your Information

We retain personal information only for as long as necessary to fulfil the purposes for which it was collected, including to satisfy any legal, accounting, or reporting requirements.

• Enquiry and contact-form data: retained for 24 months unless an engagement results, in which case it is retained for the duration of the engagement and thereafter as required by law.
• Engagement records: retained in line with the engagement agreement and applicable legal retention obligations (for example, financial and tax records as required by South African law).

When personal information is no longer required, we will securely destroy, delete, or de-identify it.

---

8. Cookies and Tracking

Our Website uses cookies and similar technologies to function properly and to help us understand how visitors use the site.

• Strictly necessary cookies enable core functionality and cannot be switched off in our systems.
• Analytics cookies help us understand Website usage so we can improve it.

You can control or disable cookies through your browser settings. Please note that disabling certain cookies may affect the functionality of the Website.

---

9. Your Rights Under POPIA

POPIA grants you the following rights in relation to your personal information. You may:

• Access the personal information we hold about you;
• Request correction of personal information that is inaccurate, irrelevant, excessive, outdated, incomplete, misleading, or unlawfully obtained;
• Request deletion or destruction of your personal information in certain circumstances;
• Object to the processing of your personal information on reasonable grounds;
• Withdraw consent where processing is based on consent (without affecting the lawfulness of processing carried out before withdrawal);
• Not be subject to a decision based solely on automated processing that has legal or similarly significant effects, except as permitted by law;
• Lodge a complaint with the Information Regulator (see Section 12).

To exercise any of these rights, please contact our Information Officer using the details in Section 12. We may need to verify your identity before responding to your request.

---

10. How We Protect Your Information

We implement appropriate, reasonable technical and organisational measures to safeguard personal information against loss, damage, unauthorised access, and unlawful processing, as required by Section 19 of POPIA. These measures include secure infrastructure provided by our service providers, access controls, and confidentiality obligations.

While we take reasonable steps to protect your information, no method of transmission over the internet or electronic storage is completely secure, and we cannot guarantee absolute security.

In the event of a security compromise affecting your personal information, we will notify you and the Information Regulator as required by POPIA.

---

11. Children’s Information

Our Website and services are directed at businesses and professionals and are not intended for children. We do not knowingly collect personal information from children under the age of 18. If you believe we have inadvertently collected such information, please contact us so we can delete it.

---

12. Contact Us and the Information Regulator

If you have any questions about this Privacy Policy, wish to exercise your rights, or wish to lodge a complaint, please contact:

Information Officer Aletheia Partners (Pty) Ltd Email: info@aletheiapartners.co.za

You also have the right to lodge a complaint with the Information Regulator (South Africa):

The Information Regulator (South Africa) JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001 Email (complaints): complaints.IR@inforegulator.org.za Email (general / POPIA): POPIAComplaints@inforegulator.org.za Website: https://inforegulator.org.za

---

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. The “Last updated” date at the top of this policy indicates when it was most recently revised. We encourage you to review this policy periodically.

---

This Privacy Policy is provided for transparency in accordance with POPIA. It should be read together with any specific engagement agreement governing the provision of our services.