54052.co.za Privacy and Data Protection Policy

Effective Date: 8 August 2022 Last Updated: 26 July 2026

Who We Are (Responsible Party)

54052.co.za is owned and operated by Port 8333 (Pty) Ltd ("Port 8333", "54052.co.za", "we", "our" or "us"), a private company incorporated in the Republic of South Africa and an authorised Financial Services Provider (FSP No. 54052) regulated by the Financial Sector Conduct Authority (FSCA).

For the purposes of the Protection of Personal Information Act, 4 of 2013 ("POPIA"), Port 8333 (Pty) Ltd is the responsible party in respect of personal information processed in connection with your access and use of 54052.co.za (the "Site"), our USSD service and mobile application for iOS and Android (the "App"), and the other services, features, products, content or applications offered by 54052.co.za (together with the Site and the App, the "Services").

This Privacy and Data Protection Policy is governed primarily by POPIA. If you use the Services from the European Economic Area ("EEA") or the United Kingdom, the additional rights described under "Users in the EEA and United Kingdom (GDPR)" below also apply to you. All defined terms not defined herein shall have the meaning ascribed to them in the 54052.co.za Terms of Service, of which this Privacy and Data Protection Policy is a part.

As used in this Policy, "personal information" has the meaning given to it in section 1 of POPIA — broadly, any information relating to an identifiable, living, natural person (and, where applicable, an identifiable, existing juristic person). "Processing" has the meaning given in POPIA and generally covers any operation concerning personal information, including collection, use, storage, dissemination and destruction. "Data subject" means the person to whom personal information relates — that is, you.

Information Officer

Our Information Officer, designated and registered with the Information Regulator of South Africa in terms of section 55 of POPIA, is:

Information Officer: Kgothatso Ngako Company: Port 8333 (Pty) Ltd (FSP No. 54052) Email: info@54052.co.za Web: https://54052.co.za/contact

You may contact the Information Officer with any question, request or complaint relating to this Policy or our processing of your personal information, including requests to exercise your rights as a data subject (see "Your Rights as a Data Subject" below).

A Few Things Upfront

We urge you to read this Policy in full, but wanted to mention a few things upfront:

This Policy covers our treatment of personal information that we collect about you (a) from you directly, when you register for and use your Account on the Services; (b) from your web browser and/or device, as you interact with the Services generally; and (c) from third parties, including our business partners and service providers (who act as "operators" as defined in POPIA where they process personal information on our behalf).
We only process your personal information where a lawful ground under POPIA exists — for example, where processing is necessary to perform our contract with you, where we are required to do so by law (including the Financial Intelligence Centre Act, 38 of 2001 ("FICA") and legislation administered by the FSCA), where you have consented, or where processing is necessary to pursue our legitimate interests or yours.
As a custodial Bitcoin wallet provider and accountable institution, we are subject to FICA. This means we are legally required to retain certain records — including identification and transaction records — for at least five (5) years, even if you ask us to delete them. See "How Long Do We Retain Your Personal Information?" below.
The Services are hosted and operated in South Africa and elsewhere in the world through us and certain of our service providers. Where your personal information is transferred outside South Africa, we do so only in accordance with section 72 of POPIA. See "Cross-Border Transfers of Personal Information" below.
If you believe we have processed your personal information unlawfully, you may complain to us directly, and you also have the right to lodge a complaint with the Information Regulator of South Africa (contact details under "Your Rights as a Data Subject" below).
This Policy does not apply to the practices of third parties that we do not own or control, including any third party websites, services, products or applications (each a "Third Party Service") that you elect to access during your use of the Services, or to individuals that we do not manage or employ. We take steps to ensure that we only work with Third Party Services that share our respect for your privacy, although we cannot take responsibility for the content, products, services or privacy policies of those Third Party Services. We encourage you to carefully review the privacy policies of any Third Party Services you access.
Port 8333 takes the protection of your personal information very seriously. To find out more, go to "How Do We Protect Your Personal Information?"

What Does This Policy Cover?

This Policy covers Port 8333's processing of personal information gathered when you access and use the Services, as well as personal information that our business partners and service providers share with us, or that we share with them.

This Policy does not apply to the practices of third parties, or their sites, services or applications, that Port 8333 does not own or control, or to individuals that Port 8333 does not employ or manage ("Third Parties"). We encourage you to carefully review the data protection policies and practices of any Third Parties you access, and to carefully consider what kind of personal information you choose to make available through the Services.

What Personal Information Do We Collect From You?

We collect personal information about you when you provide it directly to us, when third parties such as our business partners or service providers provide us with personal information about you, or when personal information is automatically collected in connection with your use of our Services. In line with POPIA's minimality principle, we collect only the personal information that is adequate, relevant and not excessive for the purposes described in this Policy.

By providing personal information of others to us, you represent that you have authority to do so. We disclaim responsibility for the information of others that you provide to us in the course of your use of the Services.

Information we collect directly from you, including without limitation:

Account information, including your:
- phone number, and
- email address.
Identification and verification information that we are required by FICA to collect and verify as an accountable institution, where and to the extent applicable to your use of the Services.
Any personal information that you make available on or through the Services.
Any personal information you provide when you communicate with us or our customer service representatives (so please only provide what is necessary).
Any personal information you provide us when purchasing Products, including your:
- first name, last name, and
- email address, and
- billing/shipping address.

Information we automatically collect when you use our Services:

IP address,
Web browser information,
Operating system information,
Pages you visit and links you click on for the Services only (not for marketing purposes), and
Certain Cookies (see below for more information) (collectively, "Usage Data").

Information we do NOT collect when you use our Services:

Browsing history outside of the Services, including the pages you visit when you exit the Services,
Publicly available information about your social media profiles, interests or preferences, or page view information, and
Event logging/tracking in our iOS or Android apps beyond what you elect to share with us for technical support.

Please note that when you access or use the Services, we use information from your web browser, including your IP address, and your device's settings and unique identifiers in order to reliably and accurately provide you with Services and information that apply to you.

Additional Information About Cookies

The Services use "Cookies" to enable our servers to recognise your web browser and tell us how and when you visit and use our Site and Services in order to operate our Services. Cookies are small files – usually consisting of letters and numbers – placed on your computer, tablet, phone, or similar device when you use that device to visit our Site.

We do not use Cookies to target you with advertising or promotions for our products and services.
We will not supplement the information we collect from you with information received from third parties.
We do not use similar technologies such as pixel tags, web beacons, clear GIFs, and JavaScript to track nor identify you.

Cookies can either be "session Cookies" or "persistent Cookies". Session Cookies are temporary Cookies that are stored on your device while you are visiting our Site or using our Services, whereas persistent Cookies are stored on your device for a period of time after you leave our Site or Services. We use persistent Cookies to keep a more accurate account of how often you visit our Services, how often you return, and how your use of the Services may vary over time. We do not use persistent Cookies to measure the effectiveness of advertising efforts nor to collect information about your online activity after you leave our Services. Because we collect browsing and persistent identifier data, the Services do not support Do Not Track requests at this time. We will not collect information about your online activity after you leave our properties.

We do not control third party Cookies. Although some Cookies may have been placed by a third party on your device we do not collect or use such information.

We use the following types of Cookies:

Essential Cookies. Essential Cookies are required for providing you with features or services that you have requested. For example, certain Cookies enable you to log into secure areas of our Site or Services, maintain your preferences over time and recognise you when you return to our Services. Disabling these Cookies may make certain features and services unavailable.

We do not use the following types of Cookies:

Performance/Analytical Cookies.
Retargeting/Advertising Cookies.

You can decide whether or not to accept Cookies through your internet browser's settings. Most browsers have an option for turning off the Cookie feature, which will prevent your browser from accepting new Cookies, as well as (depending on the sophistication of your browser software) allow you to decide on acceptance of each new Cookie in a variety of ways. You can also delete all Cookies that are already on your computer. If you do this, however, you may have to manually adjust some preferences every time you visit a site and some Services and functionalities may not work. To find out more about Cookies, including how to manage and delete them, please visit http://www.allaboutcookies.org/.

How Do We Use Your Personal Information, and On What Lawful Grounds?

We process personal information in accordance with the eight conditions for lawful processing set out in Chapter 3 of POPIA: accountability; processing limitation; purpose specification; further processing limitation; information quality; openness; security safeguards; and data subject participation.

We process personal information to operate, maintain and understand our Services. For example, we use personal information to:

Verify and establish your Account
Verify your identity where required by FICA and other applicable law
Process and fulfill your use of the Services
Protect against or deter fraudulent, illegal or harmful actions
Communicate with you about the Services, including sending you updates, offers, emails, newsletters and other information that we believe may be of interest to you
Provide support and assistance for the Services
Identify trends and other statistical information that may be useful to our business
Comply with our legal and regulatory obligations, including those under FICA and legislation administered by the FSCA
Respond to user inquiries and fulfill user requests
Resolve disputes
Enforce our Terms of Service (including, for clarity, this Policy)

We will only process your personal information where one or more of the justification grounds in section 11 of POPIA applies:

Contractual necessity (section 11(1)(b)): processing is necessary to carry out actions for the conclusion or performance of our contract with you (the Terms of Service), which enables us to provide you with the Services. Failure to provide such personal information will result in your inability to use some or all portions of the Services that require such data. This ground covers: Account information that you provide us; information that you provide us when purchasing Products through the Services; and information that you provide us when making a request or inquiry with our customer service representatives.
Legal obligation (section 11(1)(c)): processing is necessary to comply with an obligation imposed by law on us — for example, identification, verification and record-keeping obligations under FICA, and obligations arising from our authorisation as a Financial Services Provider.
Legitimate interests (sections 11(1)(d) and 11(1)(f)): processing is necessary to protect your legitimate interests, or for pursuing our legitimate interests or those of a third party to whom the information is supplied. This ground covers Account information that you provide us and Usage Data we collect in connection with your use of the Services. Examples of these legitimate interests include: protection from fraud or security threats; operation, maintenance and improvement of our business, products and services; provision of customer support; and completion of corporate transactions.
Consent (section 11(1)(a)): in some cases, we process personal information based on the voluntary, specific and informed consent you expressly grant to us at the time we collect such data. When we process personal information based on your consent, it will be expressly indicated to you at the point and time of collection, and you may withdraw your consent at any time (see "Your Rights as a Data Subject" below).

How and With Whom Do We Share Your Personal Information?

We share limited personal information with vendors, third party service providers, and agents who process personal information on our behalf as "operators" (as defined in POPIA) and provide us with services related to the purposes described in this Policy or our Terms of Service. As required by section 21 of POPIA, we contractually require operators to process personal information only with our knowledge and authorisation, to treat it as confidential, and to maintain appropriate security safeguards. We limit sharing to the minimum information required for such parties to perform the required services. These parties include:

Hosting service providers;
Email providers;
Payment processors;
Cloud communication service providers;
Shipping providers; and
Contractors.

We also share personal information when we believe it is necessary to:

Comply with applicable law or respond to valid legal process, including requests from the Financial Intelligence Centre, the FSCA, law enforcement or other regulators and government agencies.
Protect us, our business or our users, for example to enforce our Terms of Service, prevent spam or other unwanted communications and investigate or protect against fraud.

As part of the Services, you will receive from 54052.co.za email and other communications. You acknowledge and agree that by availing yourself of the Services, you allow 54052.co.za to send you email and other communication that it determines in its sole discretion relate to your use of the Services. Where any such communication constitutes direct marketing by electronic means, we will comply with section 69 of POPIA, and you may opt out at any time free of charge.

Last, we also share information with third parties when you give us your express consent to do so.

Furthermore, Port 8333 will NOT buy or sell personal information to or from a third party under any circumstances, except solely in the event that we, or substantially all of our assets, were acquired, or if we go out of business or enter bankruptcy, in which case personal information would be one of the assets that is transferred to or acquired by the third party that is acquiring our assets. HOWEVER, you should know that:

Port 8333 will provide its customers with a notification detailing the acquisition and a grace period of a month for customers to deactivate and delete all personal information they may have shared with the Services at the time of acquisition (subject to records we are required by law to retain, including under FICA);
Port 8333 would only choose to sell its business or assets to, or to be acquired by, an entity that we believe will take a customer-first approach to personal information, like Port 8333 does; and
Any entity acquiring our business or assets would have an obligation to use the personal information that comes with it strictly in accordance with this Policy, as we've outlined above in "How Do We Use Your Personal Information?".

You acknowledge that such transfers may occur, and that any acquirer of us or our assets may continue to use your personal information only as set forth in this Policy.

Cross-Border Transfers of Personal Information

The Services are hosted and operated in South Africa and elsewhere in the world through Port 8333 and its service providers, where the laws may differ from the laws where you reside.

We will only transfer your personal information to a third party in a foreign country where one of the conditions in section 72 of POPIA is met, namely where:

the recipient is subject to a law, binding corporate rules or a binding agreement which provides an adequate level of protection that effectively upholds principles for reasonable processing substantially similar to the conditions in POPIA, including provisions substantially similar to section 72 relating to onward transfers;
you consent to the transfer;
the transfer is necessary for the performance of a contract between you and us, or for the implementation of pre-contractual measures taken in response to your request;
the transfer is necessary for the conclusion or performance of a contract concluded in your interest between us and a third party; or
the transfer is for your benefit, and it is not reasonably practicable to obtain your consent, and if it were reasonably practicable, you would be likely to give it.

By using the Services, you acknowledge that personal information about you may be hosted on South African servers and on servers in other countries, and that your personal information may be processed in countries where laws regarding the processing of personal information may be less stringent than in your country. Please contact our Information Officer at info@54052.co.za with any questions or concerns.

How Long Do We Retain Your Personal Information?

In accordance with section 14 of POPIA, we do not retain personal information for longer than is necessary for achieving the purpose for which it was collected, unless retention is required or authorised by law or you have consented to longer retention.

We retain personal information about you for as long as you have an open Account with us or as otherwise necessary to provide you the Services, or until you contact us to request deletion (see "Your Rights as a Data Subject" below). Afterwards, we retain some information in a de-identified or aggregated form, but not in a way that would identify you personally.

FICA record retention — please read this carefully. As an accountable institution under FICA, we are legally obliged to keep records of, among other things, your identity, the documents or information used to verify your identity, and the transactions you conduct through the Services, for a period of at least five (5) years from the date on which our business relationship with you is terminated or the relevant transaction was concluded (and longer if directed by the Financial Intelligence Centre or another competent authority). This statutory retention obligation overrides any request you make for the deletion of such records. If you request deletion of your personal information, we will delete or de-identify all personal information we are not legally required to keep, and we will retain the FICA-mandated records (and any other records we are required by law to retain, or that are necessary to resolve disputes or collect fees owed) for the remainder of the statutory retention period, after which they will be deleted or de-identified.

How Do We Protect Your Personal Information?

In accordance with section 19 of POPIA, we secure the integrity and confidentiality of personal information in our possession or under our control by taking appropriate, reasonable technical and organisational measures to prevent loss of, damage to or unauthorised destruction of personal information, and unlawful access to or processing of personal information, based on the type of personal information and applicable processing activity. As a security-first company we go to extreme measures to protect the security and privacy of our customers and our employees.

We keep personal information tracking at a minimum, and only store that which we need to in order to deliver the Services.
- We employ 'least privilege principles' when it comes to giving employees access to personal information – employees should only be able to access data if it is necessary for them to carry out the duties of their role. We also minimise the use of Third Party Services to only those required to deliver the Services.
  - For example, we do not use Google Analytics, third party Cookies, or any similar technologies such as pixel tags, web beacons, clear GIFs, and JavaScript, although it negatively impacts our ability to track customer activity and trends.

If we have reasonable grounds to believe that your personal information has been accessed or acquired by an unauthorised person, we will notify the Information Regulator and, unless we are unable to identify you or a public body responsible for detection or investigation of offences determines that notification would impede a criminal investigation, we will notify you as soon as reasonably possible, in accordance with section 22 of POPIA.

To prevent unauthorised access to your Account and personal information you should select and protect (and periodically update) your password/pin appropriately and use a password manager to randomly generate your password. You should also limit access to your device and browser by signing off after you have finished accessing your Account.

We understand the importance of the security of the information we collect, but we cannot promise that our security measures will eliminate all security risks or avoid all security breaches. Unauthorised entry or use, hardware or software failure, and other factors, may compromise the security of user information at any time.

Your Rights as a Data Subject (POPIA)

Under POPIA, you have the following rights in respect of your personal information. To exercise any of these rights, please contact our Information Officer at info@54052.co.za. We may need you to provide us with additional information to verify your identity and the nature of your request. Please note that in some circumstances we may not be able to fully comply with your request — for example, where a statutory retention obligation (such as under FICA) applies, where the request is frivolous or vexatious, or where compliance would jeopardise the rights of others — but in those circumstances we will still respond to notify you of our decision and the reasons for it.

Right to be notified (sections 18 and 22): to be notified that your personal information is being collected (which this Policy serves to do), and to be notified if your personal information has been accessed or acquired by an unauthorised person.
Access (section 23): to request confirmation, free of charge, of whether we hold personal information about you, and to request a copy of, or the record or a description of, that personal information, in accordance with POPIA and the Promotion of Access to Information Act, 2 of 2000 ("PAIA"). You can also access certain of your personal information by logging into your Account.
Correction (section 24): to request that we correct or update personal information that is inaccurate, irrelevant, excessive, out of date, incomplete or misleading. You can correct certain information yourself by logging into your Account.
Deletion or destruction (section 24): to request that we delete or destroy personal information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading, obtained unlawfully, or that we are no longer authorised to retain. You can request Account deletion by logging into your online Account and deleting your account. Please note that (a) records we are required to retain under FICA and other applicable law will be retained for the statutory retention period notwithstanding your deletion request, as described above; and (b) Account deletion may not ensure complete removal of content or information that has been stored, shared or re-posted by other users or third parties.
Objection (section 11(3)): to object, on reasonable grounds relating to your particular situation, to processing based on legitimate interests, unless legislation provides for such processing.
Objection to direct marketing (section 69): to object at any time, free of charge, to the processing of your personal information for purposes of direct marketing, and to opt out of direct marketing by electronic communication.
Withdrawal of consent (section 11(2)): where processing is based on your consent, to withdraw that consent at any time by emailing info@54052.co.za. Withdrawal does not affect the lawfulness of processing carried out before withdrawal, and may mean that you are unable to use some or all of the Services that depend on that processing.
Automated decision-making (section 71): not to be subject, in certain circumstances, to a decision which results in legal consequences for you, or which affects you to a substantial degree, which is based solely on the automated processing of your personal information intended to provide a profile of you.
Civil remedies (section 99): to institute civil proceedings regarding alleged interference with the protection of your personal information.
Complaints to the Information Regulator (section 74): to submit a complaint to the Information Regulator of South Africa regarding an alleged interference with the protection of your personal information. We would appreciate the chance to address your concerns first, but you are entitled to approach the Regulator at any time:

The Information Regulator (South Africa) JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001 P.O. Box 31533, Braamfontein, Johannesburg, 2017 Complaints: POPIAComplaints@inforegulator.org.za General enquiries: enquiries@inforegulator.org.za Website: https://inforegulator.org.za

Users in the EEA and United Kingdom (GDPR)

If you are using the Services in the European Economic Area, the United Kingdom, Liechtenstein, Norway, or Iceland, you may have certain additional rights regarding the personal data we collect from you under the European Union General Data Protection Regulation ("GDPR") and the UK GDPR. For purposes of the GDPR, Port 8333 (Pty) Ltd is a controller of personal data collected from you through the Services, and the lawful bases on which we rely are contractual necessity, consent, compliance with legal obligations, and legitimate interests, as described above.

If you are such a user, you have the following rights, which you can exercise by emailing info@54052.co.za:

Access: You can request more information about the personal data we hold about you and request a copy of such personal data.
Rectification: If you believe that any personal data we are holding about you is incorrect or incomplete, you can request that we correct or supplement such data.
Erasure: You can request that we erase your Account from our systems, subject to the statutory retention obligations described in this Policy.
Withdrawal of consent: If we are processing your personal data based on your consent, you have the right to withdraw your consent at any time.
Portability: You can ask for a copy of certain of your personal data in a machine-readable format. You can also request that we transmit the data to another controller where technically feasible.
Objection: You can object to the further use or disclosure of your personal data for certain purposes, such as for direct marketing purposes.
Restriction of processing: You can ask us to restrict further processing of your personal data.
Right to file a complaint: You have the right to lodge a complaint about our practices with respect to your personal data with the supervisory authority of your country or EU Member State.

What If You Have Questions Regarding Your Personal Information?

If you have any questions about this Policy or our data practices generally, please contact our Information Officer using the following information:

Port 8333 (Pty) Ltd (operating as 54052.co.za)

info@54052.co.za

https://54052.co.za/contact

Changes to this Privacy and Data Protection Policy:

We may amend this Policy from time to time. Use of information we collect now is subject to the Policy in effect at the time such information is used. If we make changes in the way we use personal information, we will notify you by posting an announcement on our Site or Services or sending you an email. Users are bound by any changes to the Policy when they use the Services after such changes have been first posted.

Effective Date of Privacy and Data Protection Policy: 8 August 2022