ACCEPTABLE USE POLICY

Date: 02/09/2026

Version: 1.0

1. INTRODUCTION AND SCOPE

1.1 This Acceptable Use Policy ("AUP" or "Policy") sets out the rules and conditions governing the use of the website: www.allwage.com, the AllWage web portal, mobile application, biometric and clocking devices, WhatsApp integration, and all related services (collectively, the "Platform" and "Services") provided by AllWage (Pty) Ltd (Registration Number: 2018/531527/07) ("AllWage", "we", "us", or "our").

1.2 This Policy applies to all persons who access or use the Platform and Services, including employer Customers, their designated administrators, Authorised Users, and end-user employees (collectively, "Users" or "you").

1.3 By accessing, browsing, registering on, or using the Platform or any of the Services, you acknowledge that you have read, understood, and agree to be bound by this Policy, our Privacy Policy, our Terms of Service, and all applicable laws, including the Protection of Personal Information Act 4 of 2013 ("POPIA" or "the Act").

1.4 If you do not agree with this Policy, you must immediately cease all use of the Platform and Services.

1.5 This Policy must be read together with, and is supplementary to, the AllWage Privacy Policy, Cookie Policy, Terms of Service, and any applicable Operator Agreement or Data Processing Agreement concluded between AllWage and the Customer. References in this Policy to the Terms of Service mean the AllWage Terms and Conditions, and references to an Operator Agreement or Data Processing Agreement mean the Operator Schedule and Data Processing Addendum incorporated into the Customer's Master Agreement.

2. DEFINITIONS

In this Policy, unless the context indicates otherwise, the following terms bear the meanings assigned to them:

1. "the Act" or "POPIA" means the Protection of Personal Information Act 4 of 2013, as amended, together with any regulations promulgated thereunder;

1.2 "Authorised User" means any natural person authorised by a Customer to access and use the Platform on behalf of that Customer, including administrators and employees;

1.3 "Biometric Information" means information relating to the physical or behavioural characteristics of a natural person, including fingerprint data, facial recognition data, or any other biometric identifiers collected via clocking or time-and-attendance devices, which constitutes special personal information as defined in Section 26 of POPIA;

1.4 "Customer" means the employer or business entity that has contracted with AllWage for access to and use of the Platform and Services;

1.5 "Data Subject" means the person to whom personal information relates, as defined in Section 1 of POPIA;

1.6 "Information Officer" means the person registered with the Information Regulator in terms of Section 55 of POPIA to fulfil the responsibilities set out in Sections 55 and 56 of POPIA on behalf of AllWage;

1.7 "Information Regulator" means the Information Regulator established in terms of Section 39 of POPIA, being the independent statutory body responsible for the enforcement of POPIA;

1.8 "Operator" means a person who processes personal information for a responsible party in terms of a contract or mandate, without coming under the direct authority of that responsible party, as defined in Section 1 of POPIA;

1.9 "Personal Information" means information relating to an identifiable, living, natural person, and where applicable, an identifiable, existing juristic person, as defined in Section 1 of POPIA, including but not limited to identity numbers, contact details, employment information, financial and payroll data, biometric data, and location data;

1.10 "Platform" means the AllWage website (www.allwage.com), web portal, mobile application, biometric and clocking devices, WhatsApp integration, application programming interfaces, and all associated infrastructure and technology;

1.11 "Processing" means any activity or set of activities, whether or not by automatic means, concerning personal information, as defined in Section 1 of POPIA;

1.12 "Responsible Party" means the public or private body, or any other person, which, alone or in conjunction with others, determines the purpose of and means for processing personal information, as defined in Section 1 of POPIA;

1.13 "Services" means the workforce management, payroll processing, time-and-attendance, leave management, reporting, WhatsApp-based employee communication, and all other services provided by AllWage through the Platform;

1.14 "Special Personal Information" means personal information as contemplated in Section 26 of POPIA, including information concerning a data subject's religious or philosophical beliefs, race or ethnic origin, trade union membership, political persuasion, health or sex life, biometric information, or criminal behaviour;

1.15 "User" means any person who accesses or uses the Platform and Services, including Customers, Authorised Users, and end-user employees.

3. POPIA ROLES AND RESPONSIBILITIES

3.1 For the purposes of POPIA, the parties' respective roles in relation to the processing of personal information through the Platform are as follows:

3.1.1 The Customer (employer) is the Responsible Party as defined in Section 1 of POPIA. The Customer determines the purpose of and means for the processing of personal information of its employees, workers, and other data subjects whose information is uploaded to or processed through the Platform.

3.1.2 AllWage acts as an Operator as defined in Section 1 of POPIA. AllWage processes personal information solely on behalf of the Customer and in accordance with the Customer's documented instructions, save where required to do otherwise by law.

3.2 The relationship between AllWage as Operator and the Customer as Responsible Party is governed by a separate Operator Agreement (also referred to as a Data Processing Agreement), which sets out the terms, conditions, and security measures applicable to AllWage's processing of personal information on behalf of the Customer, as required by Section 21 of POPIA.

3.3 AllWage processes certain personal information in its own capacity as a Responsible Party (for example, information relating to its direct customers for account management, billing, communication, and compliance purposes). The AllWage Privacy Policy governs such processing.

3.4 Each Customer warrants and undertakes that it has complied, and will continue to comply, with all obligations imposed on a Responsible Party under POPIA, including the eight conditions for lawful processing set out in Chapter 3 of the Act.

4. PERMITTED USE OF THE PLATFORM

4.1 Users may use the Platform and Services solely for their intended lawful purposes, which include:

4.1.1 managing workforce attendance, time and clocking records, and biometric verification;

4.1.2 processing payroll, statutory deductions (PAYE, UIF, SDL), and generating regulatory returns;

4.1.3 managing leave applications, activity tracking, and production records;

4.1.4 communicating with employees via WhatsApp integration (payslips, clocking, timesheets, and notifications);

4.1.5 generating reports for compliance, costing, and business management purposes; and

4.1.6 any other use expressly authorised by AllWage in writing or through the Platform's functionality.

4.2 Users must use the Platform in accordance with this Policy, the Terms of Service, all applicable laws (including POPIA, the Basic Conditions of Employment Act 75 of 1997, and the National Minimum Wage Act 9 of 2018), and any instructions or guidelines published by AllWage from time to time.

4.3 Users are responsible for ensuring that all information submitted to the Platform is accurate, complete, and lawfully obtained.

5. PROHIBITED CONDUCT

5.1 Users shall not, and shall ensure that their Authorised Users do not, engage in any of the following conduct in connection with the Platform or Services:

5.1.1 accessing or attempting to access the Platform, any user account, or any data without proper authorisation, or exceeding the scope of authorised access;

5.1.2 sharing, disclosing, or transferring login credentials, passwords, or multi-factor authentication tokens to any third party, or permitting any unauthorised person to use your account;

5.1.3 impersonating any person or entity, or misrepresenting your identity, affiliation, or authority;

5.1.4 uploading, transmitting, or storing any content that is unlawful, defamatory, obscene, fraudulent, threatening, harassing, hateful, or that infringes any third party's intellectual property rights or rights of privacy;

5.1.5 introducing or transmitting any virus, worm, Trojan horse, ransomware, spyware, or other malicious code or harmful technology to or through the Platform;

5.1.6 circumventing, disabling, or interfering with any security features, access controls, encryption, or authentication mechanisms of the Platform;

5.1.7 using automated tools, bots, scrapers, crawlers, or similar technologies to access, extract, copy, or monitor any data or content from the Platform without AllWage's prior written consent;

5.1.8 reverse engineering, decompiling, disassembling, or otherwise attempting to derive the source code, algorithms, or underlying structure of the Platform or any component thereof;

5.1.9 using the Platform to process personal information without a lawful basis as contemplated in Section 11 of POPIA, or in a manner that contravenes any of the eight conditions for lawful processing;

5.1.10 collecting, uploading, or processing personal information that is inadequate, irrelevant, or excessive having regard to the purpose for which it is processed, in contravention of Section 10 of POPIA;

5.1.11 using personal information obtained through the Platform for any secondary purpose that is incompatible with the original purpose for which it was collected, in contravention of Section 15 of POPIA;

5.1.12 engaging in unlawful direct marketing by electronic means, including unsolicited communications in contravention of Section 69 of POPIA;

5.1.13 transferring personal information to a recipient in a foreign country in contravention of Section 72 of POPIA;

5.1.14 interfering with or disrupting the integrity, availability, or performance of the Platform or its infrastructure, including through denial-of-service attacks or excessive automated requests;

5.1.15 using the Platform in any manner that could damage, disable, overburden, or impair AllWage's servers or networks;

5.1.16 using the Platform for any purpose that is unlawful under the laws of the Republic of South Africa or any other applicable jurisdiction; and

5.1.17 facilitating or assisting any third party in performing any of the acts described in this clause 5.

5.2 AllWage reserves the right to investigate any suspected violation of this Policy and to take such action as it deems appropriate, including suspension or termination of access, reporting to law enforcement, and co-operation with the Information Regulator.

6. USER OBLIGATIONS REGARDING PERSONAL INFORMATION AND POPIA COMPLIANCE

6.1 Each User who uploads, submits, or otherwise causes personal information of employees, workers, or other data subjects to be processed through the Platform warrants and undertakes that:

6.1.1 it has a lawful basis for such processing, whether by consent (as defined in Section 11 of POPIA), for the performance of a contract, in compliance with a legal obligation, for the protection of a legitimate interest of the data subject, for the proper performance of a public law duty, or the pursuit of the legitimate interests of the responsible party or a third party to whom the information is supplied (Section 11(1)(a)-(f) of POPIA);

6.1.2 where consent is relied upon as the basis for processing, such consent was obtained voluntarily, specifically, and on an informed basis, and can be withdrawn at any time;

6.1.3 it has taken reasonably practicable steps to ensure that data subjects are aware that their personal information is being collected and processed, in compliance with the notification requirements of Section 18 of POPIA, including informing data subjects of the purpose of processing, the identity of the responsible party, and their rights under POPIA;

6.1.4 the personal information collected and uploaded to the Platform is adequate, relevant, and not excessive in relation to the specific, explicitly defined, and lawful purpose for which it is processed (Section 10 of POPIA);

6.1.5 it takes reasonable steps to ensure that personal information is complete, accurate, not misleading, and updated where necessary (Section 16 of POPIA);

6.1.6 personal information is not retained for longer than is necessary for achieving the purpose for which it was collected or subsequently processed, unless retention is required or authorised by law, required for contractual purposes, or consented to by the data subject (Section 14 of POPIA);

6.1.7 it honours and gives effect to data subject participation rights, including the right of a data subject to request confirmation of whether their personal information is held, to request access to such information, to request correction or deletion of information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading, or unlawfully obtained, to object to the processing of personal information on reasonable grounds, and to withdraw previously given consent (Sections 23 and 24 of POPIA);

6.1.8 it does not use personal information obtained through the Platform for any purpose other than the purpose for which it was originally collected, unless the further processing is compatible with the original purpose as determined in accordance with Section 15 of POPIA.

6.2 Users acknowledge that AllWage, as Operator, relies on the Customer's representations and warranties regarding the lawfulness of the personal information provided to it and is not in a position to independently verify the lawful basis for each item of personal information uploaded to the Platform.

6.3 Users shall promptly notify AllWage if they become aware of any data subject request, complaint, or regulatory inquiry relating to personal information processed through the Platform, and shall cooperate with AllWage in responding to same.

7. SPECIAL PERSONAL INFORMATION AND CHILDREN'S PERSONAL INFORMATION

7.1 The Platform processes biometric information (including fingerprint and facial recognition data) for the purpose of time-and-attendance verification. Biometric information constitutes special personal information under Section 26 of POPIA and is subject to the general prohibition on processing unless an exemption in Section 27 applies.

7.2 Customers who enable biometric clocking or verification features on the Platform warrant and undertake that:

7.2.1 they have obtained the data subject's consent to the processing of biometric information, or that another applicable exemption under Section 27 of POPIA applies (such as processing required by law, for the establishment, exercise, or defence of a right, or for a legitimate purpose identified by the Information Regulator);

7.2.2 data subjects have been informed, in accordance with Section 18, that biometric information will be collected, the purpose for which it will be used, and how it will be stored and protected;

7.2.3 biometric information will not be used for any purpose other than workforce time-and-attendance verification unless a separate lawful basis exists;

7.2.4 appropriate safeguards are in place, including limiting access to biometric data to authorised personnel only.

7.3 Users shall not upload or cause to be processed through the Platform any other special personal information (as defined in Section 26 of POPIA) unless such processing is justified under Section 27, and shall not upload personal information relating to children (persons under the age of 18) unless such processing is justified under Section 35 of POPIA and the prior consent of a competent person (parent or guardian) has been obtained where required.

7.4 AllWage shall process special personal information and children's personal information in accordance with the security measures set out in the Operator Agreement and applicable law.

8. SECURITY SAFEGUARDS

8.1 AllWage maintains appropriate technical and organisational measures to secure the integrity and confidentiality of personal information processed through the Platform, as required by Section 19 of POPIA. These measures are designed to prevent loss, damage, unauthorised destruction, and unlawful access to personal information.

8.2 Users are responsible for:

8.2.1 maintaining the confidentiality and security of their login credentials, passwords, and any multi-factor authentication tokens;

8.2.2 ensuring that devices used to access the Platform (including mobile devices and biometric clocking devices) are secured against unauthorised access;

8.2.3 logging out of the Platform after each session, particularly on shared or public devices;

8.2.4 reporting any suspected or actual security compromise, loss of credentials, or unauthorised access to AllWage without undue delay, and in any event within 24 hours of becoming aware of such incident.

8.3 AllWage shall not be liable for any loss or damage arising from a User's failure to comply with the obligations in clause 8.2.

9. SECURITY COMPROMISES AND DATA BREACH NOTIFICATION

9.1 In the event that a User becomes aware of, or reasonably suspects, a security compromise (as defined in Section 22 of POPIA) affecting personal information processed through the Platform, the User must immediately notify AllWage by contacting the Information Officer at:

Responsible party: AllWage Proprietary Limited, 5th Floor, Bloukrans Building, Lynnwood Bridge, Pretoria, Gauteng, 0081, South Africa

Information Officer: Cilliers Geldenhuys

Email: cilliers@allwage.com

Telephone: +27 84 299 6791

9.2 AllWage will, upon becoming aware of a security compromise that may affect the personal information of data subjects:

9.2.1 investigate the nature and scope of the compromise;

9.2.2 take reasonable steps to mitigate and contain the compromise;

9.2.3 where AllWage acts as Responsible Party, notify the Information Regulator and affected data subjects as soon as reasonably possible after discovery, in accordance with Section 22 of POPIA, unless the identity of the data subjects cannot be established;

9.2.4 where AllWage acts as Operator, notify the Customer and cooperate with it, as Responsible Party, in fulfilling notification obligations and remediation measures in accordance with the Data Processing Addendum and applicable law.

9.3 The notification to affected data subjects shall include sufficient information to allow the data subject to take protective measures, including a description of the possible consequences, the measures taken or proposed to address the compromise, and a recommendation regarding steps the data subject can take.

10. CROSS-BORDER AND TRANSBORDER INFORMATION FLOWS

10.1 AllWage primarily stores and processes personal information within the Republic of South Africa.

10.2 Where personal information is transferred to a recipient in a foreign country, AllWage will ensure that such transfer complies with Section 72 of POPIA and is only made where:

10.2.1 the recipient is subject to a law, binding corporate rules, or a binding agreement which provides an adequate level of protection substantially similar to the conditions for lawful processing under POPIA;

10.2.2 the data subject has consented to the transfer;

10.2.3 the transfer is necessary for the performance of a contract between the data subject and the responsible party, or for the implementation of pre-contractual measures taken in response to the data subject's request;

10.2.4 the transfer is necessary for the conclusion or performance of a contract concluded in the interest of the data subject between the responsible party and a third party; or

10.2.5 the transfer is for the benefit of the data subject and it is not reasonably practicable to obtain the data subject's consent, and if it were, the data subject would be likely to consent.

10.3 Users shall not use the Platform to transfer personal information to recipients outside South Africa except in accordance with Section 72 of POPIA and with AllWage's prior written approval where required under the Operator Agreement.

11. COOKIES AND WEBSITE TRACKING

11.1 The Platform uses cookies and similar tracking technologies to enhance user experience, analyse usage patterns, and improve the Services.

11.2 AllWage obtains users' consent before placing non-essential cookies on their devices, in compliance with POPIA and applicable electronic communications legislation. Users may manage their cookie preferences at any time through the cookie consent mechanism provided on the Platform.

11.3 Full details regarding the types of cookies used, their purposes, and users' choices are set out in the AllWage Cookie Policy, available at www.allwage.com.

11.4 AllWage does not make access to the Platform conditional upon the acceptance of non-essential cookies.

12. DIRECT MARKETING

12.1 AllWage and Users shall comply with Section 69 of POPIA in respect of direct marketing by means of electronic communications (including email, SMS, and WhatsApp).

12.2 Users shall not use the Platform to send unsolicited direct marketing communications to data subjects unless:

12.2.1 the data subject has given prior consent to receiving such communications; or

12.2.2 the data subject is an existing customer of the User, the communication relates to similar products or services, the data subject was given a reasonable opportunity to object at the time their details were first collected, and on each subsequent communication, and the data subject has not objected.

12.3 Every direct marketing communication must clearly identify the sender, contain accurate contact details, and include a clear, simple, and free mechanism for the recipient to opt out of future communications.

12.4 AllWage shall not be liable for any direct marketing communications sent by Users through the Platform in contravention of Section 69 of POPIA.

13. INTELLECTUAL PROPERTY

13.1 All intellectual property rights in and to the Platform, including but not limited to the software, source code, algorithms, databases, user interfaces, designs, trademarks, logos, documentation, and all related content, vest exclusively in AllWage or its licensors and are protected by the laws of the Republic of South Africa and applicable international intellectual property treaties.

13.2 Nothing in this Policy or in the use of the Platform grants the User any right, title, or interest in AllWage's intellectual property, save for the limited, non-exclusive, non-transferable, revocable licence to use the Platform for its intended purposes in accordance with the Terms of Service.

13.3 Users shall not copy, reproduce, modify, adapt, translate, create derivative works from, distribute, licence, sell, or exploit any part of the Platform or its content without AllWage's prior written consent.

14. SUSPENSION AND TERMINATION

14.1 AllWage may, in its sole discretion and without prejudice to any other rights or remedies available to it, immediately suspend or restrict a User's access to the Platform, in whole or in part, if AllWage reasonably suspects or determines that:

14.1.1 the User has breached any provision of this Policy, the Terms of Service, or any applicable law;

14.1.2 the User's conduct poses a security risk to the Platform, other Users, or data subjects;

14.1.3 suspension is necessary to comply with a court order, regulatory directive, or instruction from the Information Regulator; and

14.1.4 the User's account has been compromised or is being used fraudulently.

14.2 AllWage may terminate a User's access to the Platform permanently if:

14.2.1 the User commits a material or repeated breach of this Policy;

14.2.2 the User fails to remedy a remediable breach within 10 (ten) days of receiving written notice to do so; and

14.2.3 the Customer's service agreement with AllWage is terminated for any reason.

14.3 Suspension or termination shall not relieve the User of any obligations that have accrued prior to such suspension or termination, including obligations relating to personal information, confidentiality, and indemnification.

15. DISCLAIMERS AND LIMITATION OF LIABILITY

15.1 The Platform and Services are provided on an "as is" and "as available" basis. To the maximum extent permitted by applicable law, AllWage disclaims all warranties, whether express, implied, or statutory, including but not limited to implied warranties of merchantability, fitness for a particular purpose, accuracy, and non-infringement.

15.2 AllWage does not warrant that the Platform will be uninterrupted, error-free, secure, or free from viruses or other harmful components, nor that defects will be corrected within any particular timeframe.

15.3 To the maximum extent permitted by law, AllWage shall not be liable for any indirect, incidental, special, consequential, or punitive damages, including but not limited to loss of profits, loss of data, business interruption, or loss of goodwill, arising out of or in connection with the use of or inability to use the Platform or Services, howsoever caused, whether in contract, delict (tort), strict liability, or otherwise.

15.4 AllWage's total aggregate liability to any User for all claims arising out of or in connection with this Policy or the use of the Platform shall not exceed the total fees paid by the Customer to AllWage in the 12 (twelve) months immediately preceding the event giving rise to the claim.

15.5 Nothing in this Policy shall exclude or limit liability that cannot be excluded or limited under applicable law, including liability for fraud, gross negligence, or wilful misconduct.

16. INDEMNITY

16.1 Each User agrees to indemnify, defend, and hold harmless AllWage, its directors, officers, employees, agents, and affiliates from and against all claims, demands, actions, damages, losses, costs, liabilities, and expenses (including reasonable legal fees on an attorney-and-client scale) arising out of or in connection with:

16.1.1 the User's breach of this Policy, the Terms of Service, or any applicable law;

16.1.2 the User's unlawful processing of personal information, including processing without a lawful basis, failure to obtain required consents, or failure to comply with data subject rights;

16.1.3 any enforcement action, administrative fine, infringement notice, or penalty imposed by the Information Regulator arising from the User's non-compliance with POPIA;

16.1.4 any claim by a data subject arising from the User's handling of their personal information; and

16.1.5 the User's negligence, fraud, or wilful misconduct in connection with the Platform or Services.

16.2 This indemnity survives the termination or expiry of the User's access to the Platform.

17. REPORTING VIOLATIONS AND CONTACT DETAILS

17.1 Users who become aware of any violation of this Policy, any security incident, or any suspected unlawful processing of personal information through the Platform must report it promptly to AllWage's Information Officer:

17.2 Users may also lodge a complaint directly with the Information Regulator (South Africa) which details are as follows:

Physical address: Woodmead North Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191

Email address: complaints.IR@justice.gov.za

Website: www.inforegulator.org.za

Toll Free: +27 80 001 7160

17.3 AllWage will investigate all reported violations and take appropriate remedial action.

18. CHANGES TO THIS POLICY

18.1 AllWage reserves the right to amend, modify, or replace this Policy at any time. Material changes will be communicated to Users by means of a prominent notice on the Platform, email notification to registered Users, or such other reasonable means as AllWage deems appropriate.

18.2 The updated Policy shall take effect on the date specified in the notification or, if no date is specified, 14 (fourteen) days after notification.

18.3 Continued use of the Platform after the effective date of any amendment constitutes acceptance of the amended Policy. Users who do not agree with the amendments must cease using the Platform.

18.4 Users are encouraged to review this Policy periodically to stay informed of their obligations.

19. GOVERNING LAW AND DISPUTE RESOLUTION

19.1 This Policy shall be governed by and construed in accordance with the laws of the Republic of South Africa.

19.2 Any dispute arising out of or in connection with this Policy shall, in the first instance, be referred to senior representatives of the parties for resolution by negotiation within 14 (fourteen) business days of written notice of the dispute.

19.3 If the dispute is not resolved by negotiation, either party may refer the dispute to mediation in accordance with the rules of the Arbitration Foundation of Southern Africa ("AFSA"), or such other mediation body as the parties may agree.

19.4 If the dispute is not resolved by mediation within 30 (thirty) days (or such longer period as the parties may agree), either party may refer the dispute to arbitration in accordance with the rules of AFSA, to be held in Johannesburg, South Africa, before a single arbitrator, conducted in the English language.

19.5 Nothing in this clause shall prevent either party from approaching a court of competent jurisdiction for urgent interim relief.

19.6 The parties consent to the jurisdiction of the High Court of South Africa, Gauteng Division, Johannesburg, for any proceedings not subject to arbitration.