MR PRICE GROUP PRIVACY POLICY

1. INTRODUCTION

We, the Mr Price Group (“Group”, “we”, or “us”, “our”), including our trading divisions namely Mr Price, Mr Price Home, Mr Price Sport, Sheet Street, Miladys, Power Fashion and Mr Price Money and all our subsidiary companies including Mr Price Foundation, are committed to safeguarding the privacy of your personal information (“PI”). This Policy (“Policy”) explains how we process your PI, which means, in relation to your PI, various activities including collecting, receiving, recording, storing, updating, using, transferring or erasing.

This Policy applies to any and all interactions with us where we process PI including your use of any of our websites or mobile applications or engaging with us telephonically or in person and forms part of our website and mobile application terms and conditions. By visiting or using any of our websites or mobile applications, you agree to the terms of this Policy as updated from time to time. We will let you know of any material changes to the Policy.

2. SCOPE

This Policy applies to all data subjects (persons, whether a natural or juristic person, to whom PI relates) (“you”, “your”), whose PI we collect, regardless of the country where you live or work.

This Policy applies to all PI, whether it was provided to us through our websites, mobile applications or through any other form of communications with you such as email, telephone, or otherwise (“Channels”), through or by third parties or tools that collect PI.

3. WHAT PERSONAL INFORMATION DO WE COLLECT?

3.1. PI means information relating to an identifiable, living, natural person, and where it is applicable, an identifiable, existing juristic person, including: information relating to race, gender, marital status, ethnicity or social origin, age, disability (mostly as required by labourand credit laws); an identifiable number, e-mail address, physical address, telephone number, identification number, location information, online identifier; biometric information; personal preferences, views or opinions; correspondence of a private or confidential nature;and a name if it appears with other PI relating to you or if disclosing your name itself will reveal information about you. PI can be found in electronic or paper records.

3.2 The PI we collect about you is dependent on:

1. the transaction you are completing,
2. the reason you are communicating with us and
3. the Channel used to communicate with us.
4. PI may include your: name, contact information including e-mail address, postal address, physical address, primary and secondary telephone numbers, date of birth; employment history, criminal history, ethnic origin, language, (these specifically relate to employment applications); gender, age, financial information (as required by law, relating to financial services and credit products and services), biometric information (in order for us to identify you when you phone us), billing information, additional information which we are required or permitted by applicable legislation to collect and process, as well as information you elect to share publicly, including on social media and customer forums.

3.3. PI excludes:

• information that has been made anonymous so that it does not identify a specific person;
• permanently de-identified information that does not relate or cannot be traced back to you specifically; and
• non-personal statistical information collected and compiled by us.

4. ACCEPTANCE

1. You must accept all the terms of this Policy when you order any of our products or, register for, or use the website, application or any of our services. By accepting this Policy, you are deemed to have read, understood, accepted, and agreed to be bound by all of its terms.
2. Legal capacity
   The age requirement for engaging with our Channels is 18 years of age. To the extentrequired by applicable law, users under the age of 18 years of age must obtain parental or guardian consent. We will afford the same level of protection to all PI processed, regardless of the age of the person the PI pertains to.

5. WHEN DO WE COLLECT YOUR PERSONAL INFORMATION?

We collect your PI and only the PI we require for a specific purpose when you:

• voluntarily provide us with information when you interact with us, for example when yousend us online enquiries, or you subscribe to or consent to receiving newsletters or other communications from us;
• browse, visit or participate in our various Channels;
• register an online profile on our websites or apps to purchase our products;
• purchase, return, exchange or enquire about products and service from us;
• agree to the terms and conditions of credit applications and other products and services that contain provisions dealing with the use or disclosure of your PI;
• make general enquiries, lodge complaints, and communicate with us;
• apply for vacancies on our Careers portal by submitting your CV and thereafter should you be employed as an associate of the Group;
• make donations to our Mr Price Foundation;
• participate in any of our events including competitions where we may also collect photos which could be used in the future;
• visit our offices;
• enter into an agreement with us.

From time to time, we collect your PI from trusted third parties, in which case we will ensurethat you have provided your consent for your PI to be disclosed to us

We do not collect or retain your bank card details used to purchase products or services. MRPG is compliant in terms of PCI DSS. This information is collected by financial institutions that have their own privacy policies. You are advised to never respond to emails that seem to be from us requesting bank card details as this request is most likely fraudulent and should be reported to us immediately.

1. Cookies
   We do not collect your PI when using cookies about when and how you use our websites, apps or when you click on an advert of ours that is contained on another website. A cookie is a small text file that is stored on your computer or mobile device when you use it. Cookies hold information such as the identity of the computer or deviceyou used to access our Channels, your server address, domain name, the time and date that you visited our Channels, pages, product and documentation that youaccessed or viewed and which internet browser you used.
   
   We do this so that we can:
   • provide you with more personalised service, communication and products by better understanding your browsing and purchasing behaviour;
   • track, count and analyse website visits and usage data;
   • understand product preferences and popularity; and
   • improve our websites and your online shopping experience.
2. Your internet browser generally accepts cookies automatically, but you can often change this setting to stop accepting them. You can also delete cookies manually. However, no longer accepting cookies or deleting them will prevent you from accessing certain aspects of our website where cookies are necessary. You can find out more about cookies at www.allaboutcookies.org.

2. Third-party services
   We use trusted third-party services including Google Analytics that collect, monitor and analyse our users’ usage. To prevent your PI from being used by Google Analytics you can install an opt-out browser add-on (visit https://tools.google.com/dlpage/gaoptout for details).
   
   Most web browsers can be adjusted to inform you when a cookie has been sent to you and provide you with the opportunity to refuse that cookie. Refusing a cookie may, in some cases, preclude you from using, or negatively impact, the display or function of our websites or certain areas or features of our websites.
   
   You may only send us your own personal data or the information of another data subject where you have their permission to do so.
3. Recording Calls and CCTV
   We may monitor and record any telephone calls that occur between the Group and yourself, including any to our call centres. We record calls to improve our service delivery, have a recording of your details to update them and or to meet any regulatory requirement. We may also record your movements where we have CCTV systems in our stores, distribution centre (DC) or head office.

6. WHY DO WE PROCESS YOUR PERSONAL INFORMATION?

1. Processing includes gathering your personal data, disclosing it as stipulated in clause 7 below, and combining it with other personal information. We collect and process your PI to: -
   • provide our goods and services to you, for example apparel, household goods, insurance and mobile products
   • communicate with you for marketing purposes regarding new product features, personalised products, services, offers and events that we think may be of interest to you;
   • analyse (including for historical, statistical or research purposes), develop, continually improve and enhance the use, functionality and performance of our websites and apps, products and services to manage the security of our sites, networks and systems;
   • comply with applicable laws, including our obligations to make disclosures to authorities, regulators and government bodies; and
   • engage in our legitimate business, related interests, and legal purposes, including but not limited to detecting and preventing fraud and conducting our business as a fashion-value retailer.
2. We will not use your PI other than for the purpose for which it was provided or collected, and in accordance with our legitimate interests and legal obligations.

2. Transferring your PI
   We may transmit or transfer PI outside of the country in which it was collected to a foreign country and process it in that country. PI may be stored on servers located outside the country in which it was collected in a foreign country whose laws protecting personal information may not be as stringent as the laws in the country in which it was collected. You consent to us processing your personal information in a foreign country whose laws regarding processing of personal information may be less stringent.

7. WHEN WILL WE DISCLOSE YOUR PERSONAL INFORMATION?

1. We may provide access to or share some of your PI, when necessary and for the reasons that it was provided or collected, to:
   • our associates, other divisions or companies within the group of companies to which we belong, so as to provide joint content and services like registration for transactions and customer support, to help detect and prevent potentially illegal acts and violations of our policies;
   • our merchandise suppliers, service providers, auditors, consultants and agents if they are required under contract to process it for us or to provide services for or tous, including product deliveries and returns, email service providers, analytics companies, distribution and courier companies, information hosting, communication providers, development and administration, information technology and related infrastructure services, technical support and other support services relating to our legitimate business interests and our contractual obligations to you (our contracts dictate that these merchandise suppliers or service providers only use your information in connection with the goods they supply or services they perform for us and not for their own benefit);
   • credit bureaus to report account information, as permitted by law;
   • banking partners as required by credit card association rules for inclusion on their list of terminated merchants (in the event that you utilise the services to receive payments and you meet their criteria); and
   • other third parties who provide us with relevant services where appropriate.
2. Change of ownership
   We may share PI with third parties in the event of a reorganisation, merger, sale, joint venture, assignment, transfer or other type of sale of all or any portion of our business, assets or stock.
3. Regulators and law enforcement
   We may provide access to or share your PI as required by law, court order or other lawful reasons, where we believe in good faith that disclosure is necessary to protect our rights, protect your safety or the safety of others, investigate fraud, or respond to government requests, including public and government authorities.
   When we share or provide access to your PI with third parties, they are contractually restricted from using or disclosing your PI except as necessary to perform services on our behalf or to comply with legal requirements.
4. No selling
   We will not sell your PI. No PI will be disclosed to anyone except as provided for in this Policy.

8. JUSTIFICATION FOR PROCESSING PERSONAL INFORMATION IF YOU ARE IN THE EUROPEAN UNION (EU)

To communicate with you and to attend to your requests, processing of your PI is required, and we have a legitimate business interest in processing your PI:

• to process transactions with customers, suppliers, job applicants, donors and investors;
• to action purchases, returns and applications,
• to fulfil an obligation where we have entered into a contract with you;
• to process PI in relation to marketing and promotional activities based on your consent when your PI was collected;
• pursuant to our legitimate business interest to market and promote our products and services;
• to analyse, develop, improve and optimize our Channels, products and services, and to maintain the security of our sites, networks and systems;
• to comply with applicable laws, or
• to process your opt-out instruction.

9. ACCURATE AND UP TO DATE

We will try to keep the PI we collect as accurate, complete and up to date as is necessary for the purposes defined in this Policy. From time to time we may request you to update your PI.

10. STORAGE, RETENTION AND DELETION OF PERSONAL INFORMATION

1. We will keep your PI for different periods of time depending on the use or purpose your PI was provided or collected for, as well as your preferences regarding marketing, recruitment and other correspondence.
2. We will only keep your PI for as long as necessary to fulfil the purposes set out in this Policy and in our PAIA manual (which can be found on our website www.mrpricegroup.com), unless:

• retention of the PI is required or authorised by law; or
• you have consented to the retention of the PI.

2. We will safely delete or destroy PI which we are no longer required or not permitted to retain, or for which we do not have your consent.

11. SECURING YOUR PERSONAL INFORMATION

We take the security of PI very seriously and always do our best to comply withapplicable data protection laws. We secure the integrity and confidentiality of your PI that isin our possession and under our control by taking the appropriate reasonable technical and organisational measures to prevent loss, damage, unauthorised destruction, unlawful access, or unlawful processing of your PI. We authorise access to PI only for those employees who require it to fulfil their job responsibilities. In doing so we have due regard to generally accepted industry information security practices and procedures.

12. YOUR RIGHTS

You have the following rights in respect of your PI that we process:

• you may enquire from us (at no cost) whether we hold your PI, (we will only provide you with this information when you provide us with adequate proof of your identity);
• where necessary, request the correction or deletion of your PI;
• object to, restrict or limit the processing of your PI; and
• object to using your PI for purposes of direct marketing.

You can exercise any of your rights listed above by sending an email to [email protected]. . If you want to change your email preferences, you can do so by selecting the preference settings on the most recent email that you received from us. Where we have reasonable doubt as to the identity of the person making an enquiry, we may requestadditional information to confirm the identity of the person, such as an identity document, including a driver’s licence or passport.

Please note that the above rights are not absolute, and we may be entitled to refuse requests where exceptions apply. Should we determine that you are not entitled to exercise a specific right, we will provide you with the reasons why.

Should we have reasonable grounds to believe that your PI has been accessed or acquired by any unauthorised person, we will, as soon as is reasonably possible and lawfully required, notify the applicable regulator, as well as yourself, unless we are unable to establish the identity of the PI that has been unlawfully accessed.

13. LIMITATION

We are not responsible for, give no warranties, nor make any representations in respect of the privacy policies or practices of linked or any third-party websites.

14. CHANGES TO THIS PRIVACY POLICY

This privacy Policy is effective as of 1 July 2021. The latest version of our Privacy Policy is always available on our websites. We may need to update or change our Policy from time to time, and we will notify you regarding any material changes to this Policy using the channels that we normally use to communicate. We will also place a notice in a prominent place on the website or application. Your continued use of our websites, products and services after you have been notified of any amendments to the Policy will represent your acknowledgment of any changes and your agreement to adhere to the updated Policy.

15. DISPUTE RESOLUTION OR LODGING A COMPLAINT

1. Should you have any concerns relating to our Policy you may submit an email to [email protected]. We will review your concerns and try to resolve any complaint relating to the protection of PI, in this Policy and applicable law.
2. If you live or work in the EU and believe there has been an infringement of your data protection rights, you are entitled to submit a complaint to a data protection authority in the EU Member State where you live or work. The contact details of each EU Data Protection Authority can be found at the following website: http://ec.europa.eu/justice/data-protection/article-29/structure/data-protection-authorities/index_en.htm
3. We will acknowledge your request as required under applicable data protection laws. However, the rights mentioned in this Policy are not absolute: the rights do not always apply, and exemptions may be applicable. We will ask you to verify your identity and/or ask you information to assist us in better understanding your request. In the event we do not comply with your request, we will explain why.

Mr Price Group’s Head Office is located at:
Durban Station, Upper Concourse
65 Masabalala Yengwa Avenue
Durban
South Africa
Tel: 031 310 8000

Policy updated 23/12/2021