Privacy Policy

1. Introduction and scope

MD Harper Holdings (Pty) Ltd, registration number 2022/448017/07 (“MDH Group”, “MDH”, “we”, “us” or “our”), is a South African investment, operating and development group with interests that may include fuel and retail operations, property and development projects, gas infrastructure, strategic ventures and related businesses.

This Privacy Policy explains how MDH Group processes Personal Information when you visit or use an MDH Group website, submit an enquiry, communicate with us, engage with one of our businesses or services, apply for an opportunity, enter into a business relationship with us, or otherwise provide Personal Information to us.

This Privacy Policy applies to MDH Group and, where applicable, the businesses, subsidiaries, affiliates and operating entities controlled by or associated with MDH Group, subject to the entity responsible for the relevant processing.

This Privacy Policy does not automatically apply to third-party websites, platforms, applications or services that may be linked to or accessible through our websites or services. You should review the privacy policy applicable to those third parties.

2. Personal Information

“Personal Information” means information relating to an identifiable, living natural person and, where applicable, an identifiable existing juristic person, as contemplated by applicable South African data-protection law.

Depending on the nature of our relationship with you, we may process information such as:

name and surname, identity or other identifying information;

contact details, including telephone number, email address, postal and physical address;

company, employment, business and professional information;

information contained in enquiries, applications, proposals, contracts and correspondence;

transactional, account, payment and billing information where relevant;

website, device, browser, IP address, usage and technical information;

location information where relevant and permitted;

information provided through forms, WhatsApp, email, telephone, social media or other communication channels; and

other information that you voluntarily provide or that we are lawfully entitled to obtain.

We will only seek to collect information that is reasonably necessary for the relevant purpose, or that we are otherwise permitted or required to process by law.

3. How we collect Personal Information

We may collect Personal Information directly from you, including when you:

complete a form or submit an enquiry;

contact us by telephone, email, WhatsApp, social media or another communication channel;

request information about a property, development, fuel station, partnership, gas pod, investment or other opportunity;

enter into an agreement or business relationship with us;

apply for employment or provide information in connection with recruitment;

visit or use our websites or digital services; or

participate in promotions, surveys, events or other activities.

We may also receive Personal Information from third parties where lawful and appropriate, including service providers, professional advisers, business partners, publicly available sources and entities within the MDH Group.

4. Purposes for processing

We may process Personal Information for purposes including:

responding to enquiries and requests;

providing, administering and improving our products and services;

assessing and progressing business, property, development, fuel, gas and partnership opportunities;

managing customer, supplier, contractor, tenant, investor and other business relationships;

processing applications and managing recruitment and employment-related activities;

performing contracts and managing our commercial, financial and operational obligations;

communicating with you about services, opportunities, developments, changes and relevant information;

maintaining records and administering our systems;

conducting research, analysis and reporting, including aggregated or de-identified analysis;

protecting our people, businesses, property, systems and customers and detecting fraud, abuse or security incidents;

complying with legal, regulatory, tax, accounting and other applicable obligations; and

any other lawful purpose that is compatible with the purpose for which the information was collected or otherwise permitted by law.

MDH Group will process Personal Information in accordance with the Protection of Personal Information Act 4 of 2013 (“POPIA”) and other applicable law.

Depending on the circumstances, processing may be based on consent, the performance or conclusion of a contract, compliance with a legal obligation, protection of a legitimate interest, or another lawful basis recognised by applicable law.

Where consent is required, we will seek consent in an appropriate manner. Where legally permitted, you may withdraw consent, although withdrawal will not affect processing that occurred lawfully before withdrawal and may affect our ability to provide certain services.

6. Sharing of Personal Information

We do not sell Personal Information for commercial gain. We may share Personal Information where reasonably necessary and lawful, including with:

companies within the MDH Group and their authorised personnel;

employees, contractors, agents and professional advisers;

IT, hosting, communications, payment, accounting, recruitment and other service providers;

business partners, suppliers and contractors where necessary to provide a service or administer a relationship;

auditors, insurers, financiers and other professional or commercial counterparties where appropriate;

government departments, regulators, law-enforcement bodies or other authorities where required or permitted by law; and

a purchaser, investor, successor or other party involved in a corporate transaction, restructuring or transfer of a business, subject to applicable law.

Where third parties process Personal Information on our behalf, we will take reasonable steps to ensure that appropriate confidentiality and information-security obligations apply.

7. Direct marketing

Where permitted by law, we may communicate with you about MDH Group services, developments, opportunities, products, events or other information that may be relevant to you.

Where applicable, you may opt out of direct marketing communications by following the unsubscribe mechanism provided or by contacting us using the details in section 17.

We will comply with the consent and other requirements applicable to electronic direct marketing under POPIA and the Electronic Communications and Transactions Act, where relevant.

8. Cookies and website information

Our websites may use cookies, analytics tools and similar technologies to operate the website, remember preferences, understand website usage, improve functionality and, where applicable, support marketing activities.

You may be able to control cookies through your browser or device settings. Disabling certain cookies may affect website functionality.

Website systems may automatically record technical information such as IP address, browser type, operating system, device information, pages viewed, approximate location and access times, subject to applicable law.

9. Security

MDH Group takes reasonable technical and organisational measures designed to protect Personal Information against loss, damage, unauthorised access, unlawful processing, alteration, disclosure or destruction.

Access to Personal Information will be limited to persons who require it for legitimate business or operational purposes, subject to appropriate confidentiality and security requirements.

No method of transmission or electronic storage can be guaranteed to be completely secure. Where a security incident occurs, MDH Group will respond in accordance with applicable law and its information-security procedures.

10. Retention

We retain Personal Information only for as long as reasonably necessary for the purpose for which it was collected, or for as long as required or permitted by applicable law, contractual obligations, legitimate business requirements or evidentiary needs.

Retention periods may differ depending on the type of information and the nature of the relationship. When Personal Information is no longer required, we will take reasonable steps to delete, destroy or de-identify it, subject to applicable legal and operational requirements.

11. Accuracy and updating of information

We take reasonable steps to ensure that Personal Information in our possession is accurate, complete and up to date where required by law.

You should notify us if your Personal Information changes or if information we hold about you is incorrect or incomplete.

12. Your rights

Subject to applicable law and any lawful limitations, you may have the right to:

request access to Personal Information we hold about you;

request correction or updating of inaccurate or incomplete information;

object to certain processing of your Personal Information;

object to processing for direct marketing purposes;

request deletion or destruction of Personal Information where legally appropriate;

withdraw consent where processing is based on consent; and

lodge a complaint with the Information Regulator if you believe your rights have not been appropriately addressed.

Requests must be made using the contact details in section 17. We may need to verify your identity before processing a request and may be entitled or required to retain certain information or decline a request where permitted by law.

13. Special Personal Information and children’s information

We do not generally seek to collect Special Personal Information unless there is a lawful and legitimate reason to do so and the requirements of applicable law are satisfied.

We do not knowingly collect Personal Information from children except where permitted by applicable law and with the required consent or authority.

14. Cross-border transfers

Where Personal Information is transferred outside South Africa, MDH Group will take reasonable steps to ensure that the transfer and subsequent processing comply with POPIA and other applicable legal requirements.

15. Third-party websites and services

Our websites or communications may contain links to third-party websites, platforms or services. MDH Group is not responsible for the privacy practices of those third parties. You should review their applicable privacy notices before providing Personal Information.

16. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our businesses, services, technology, legal requirements or information-processing practices.

The latest version will be made available through the relevant MDH Group website or other appropriate communication channel. The effective date will be indicated at the beginning of the policy.

17. Queries, requests and complaints

For privacy-related enquiries, requests or complaints, please contact:

MD Harper Holdings (Pty) Ltd (MDH Group)

Registration number: 2022/448017/07

Email: info@mdhgroup.co.za

18. Information Regulator

Where you are dissatisfied with how we have handled a privacy matter, you may have the right to lodge a complaint with the Information Regulator of South Africa, subject to the procedures and requirements applicable at the time.

19. Governing law

This Privacy Policy is governed by the laws of the Republic of South Africa.

If any provision of this Privacy Policy is found to be invalid or unenforceable, the remaining provisions will continue to apply to the extent permitted by law.

20. Important note

This document is a working draft prepared using the structure and subject matter of the PetroCONNECT Privacy Policy supplied for this purpose. It should be reviewed and approved by MDH Group’s legal adviser / information officer before publication, particularly in relation to POPIA compliance, the responsible entity or entities, contact details, cookies, direct marketing, retention periods, cross-border processing and the applicable rights-request procedure.