GENIOUS SERVICES PRIVACY POLICY & NOTICE

Last Updated: May 2026

1. INTRODUCTION

This is the privacy statement of Genious Services (Pty) Ltd. In this document, “we”, “us”, or “our” refer to Genious Services (Pty) Ltd.

We are company number 2021/405092/07 registered in South Africa, with our registered offices at Unit 28 Office 07, 587 Jones Road, Jet Park, Boksburg, 1459.

The Constitution of the Republic of South Africa, 1996, recognises and protects the right to privacy as a fundamental human right. To give effect to this right, the Protection of Personal Information Act, No. 4 of 2013 (“POPIA”) was promulgated and became law on 1 July 2021. This Privacy Policy explains how we collect, use, store, share, and protect your personal information when you visit our website, book services online, or engage with us in any other way. It also informs you of your rights regarding your personal data.

This policy complies with:

• The Protection of Personal Information Act, 4 of 2013 (“POPIA”)
• The Electronic Communications and Transactions Act, 25 of 2002 (“ECT Act”)
• The Consumer Protection Act, 68 of 2008 (“CPA”)
• The Promotion of Access to Information Act, 2 of 2000 (“PAIA”)

We are extremely concerned to protect your privacy and confidentiality. We understand that all users of our website and services are quite rightly concerned to know that their data will not be used for any purpose unintended by them and will not accidentally fall into the hands of a third party. Our policy is both specific and strict.

2. DEFINITIONS

For the purposes of this Privacy Policy:

• “Personal Information” means information relating to an identifiable, living natural person or, where applicable, an identifiable, existing juristic person. This includes, but is not limited to: name, surname, identity number, email address, physical address, telephone number, location information, online identifiers, device information, and any other particular assignment to a person.
• “Special Personal Information” means personal information requiring additional protection under POPIA, including but not limited to health data, criminal records, biometric data, race, or religious beliefs.
• “Data Subject” means the person (natural or juristic) to whom personal information relates.
• “Processing” means any operation concerning personal information, including collection, receipt, recording, organisation, storage, updating, retrieval, use, dissemination, restriction, erasure, or destruction.
• “Responsible Party” means Genious Services (Pty) Ltd, as the entity determining the purpose of and means for processing personal information.
• “Operator” means a third party that processes personal information on our behalf in terms of a contract or mandate.

3. PERSONAL INFORMATION WE COLLECT

We collect personal information from you in several ways, primarily when you book a device for repair or service through our website, visit our premises, or contact us.

3.1 Information You Provide to Us Directly

When you book a device for repair or service online, or when you complete our Service & Repair Form (in person or online), we collect the following information:

• Customer Details: Full name, phone number (including WhatsApp), email address, physical address, ID number or company registration number.
• Client Company Details (if billing to a company): Company name, registration number, VAT number, company telephone, company email, company address.
• Device Details: Device type, brand, model, IMEI or serial number, password/PIN/iCloud/BIOS lock information (if voluntarily provided), RAM size, storage capacity, drive type, operating system.
• Accessories Received: Information about any accessories (chargers, cables, cases, controllers, SIM/memory cards, etc.) you provide with your device.
• Device Condition Information: Whether the device has suffered liquid damage, impact/drop damage, or has been previously repaired.
• Requested Service / Reported Faults: Details of the specific faults you report and the services you request (battery replacement, screen replacement, micro‑soldering, board‑level repair, etc.).
• Board Count Information: Number of boards requiring micro‑soldering or board‑level repair.
• Payment Information: Payment method, deposit amounts, balance due, EFT reference numbers.
• Communications: Any correspondence you send to us via email, WhatsApp, SMS, or our website contact forms.

3.2 Information We Collect Automatically

When you visit our website, we may automatically collect certain technical information:

• IP address
• Browser type and version
• Operating system
• Device type
• Location information
• Browsing behaviour and pages you visit
• Referring website
• Date and time of your visit
• Cookies and tracking data (see Section 10 below)

3.3 Information We Obtain from Third Parties

We may receive data from third‑party service providers, such as analytics providers (e.g., Google Analytics) or website hosting platforms. No such information is identifiable to you unless you have voluntarily provided it to us through those platforms.

3.4 Information You Provide to Us in Other Ways

• Job Applications: If you send us information in connection with a job application, we may keep it for up to three years in case we decide to contact you at a later date.
• Complaints: When we receive a complaint, we record all the information you have given to us to resolve your complaint.

4. PURPOSE OF PROCESSING YOUR PERSONAL INFORMATION

We process your personal information only for lawful, specific, and explicitly defined purposes. These purposes include:

4.1 Primary Purposes

• To provide our repair and service offerings to you: We use your information to diagnose faults, quote for repairs, perform the requested services, and communicate with you about the progress of your repair.
• To verify your identity: For security purposes and to prevent fraud.
• To manage your booking and job ticket: We record your request and our reply to increase the efficiency of our business and to maintain accurate records.
• To process payments: We use your information to invoice you and process payments (cash, EFT).
• To communicate with you: We use your contact details to notify you when your device is ready for collection, to send you quotes, updates, and service‑related information.
• To confirm collection: We record your signature and collection details to confirm that you have collected your device in the condition stated.
• To comply with legal and regulatory obligations: Including record‑keeping for tax purposes (minimum of five years as required by SARS) and to support any claim or defence in court.

4.2 Secondary Purposes

• For warranty administration: We use your information to manage warranty claims and track warranty periods.
• For statistical analysis: Information which does not identify any individual may be used in a general way to improve our services, analyse trends, and assess customer satisfaction.
• For marketing purposes: With your consent, we may send you information about our services, promotions, or news. You may opt out at any time (see Section 14).
• For audit and record‑keeping purposes.
• In connection with legal proceedings or to detect and prevent fraud or crime.

We will not use your personal information for purposes that are incompatible with those for which it was initially collected without your explicit consent.

5. LAWFUL BASIS FOR PROCESSING

Under POPIA, we process personal information only where there is a lawful justification:

• Consent: Where you have given voluntary, specific, and informed permission for us to process your information (e.g., for marketing communications or non‑essential cookies).
• Contractual necessity: Where processing is necessary for the performance of a contract with you (e.g., to provide the repair services you have requested).
• Legal obligation: Where we are required by law to process your information (e.g., tax record‑keeping).
• Legitimate interests: Where we pursue legitimate business interests (such as security, fraud prevention, analytics, and improving our services) and these interests do not override your rights as a data subject.
• Protection of legitimate interests: For the data subject, third parties, or the Company.

6. DISCLOSURE OF YOUR PERSONAL INFORMATION

Except as set out in this policy, we do not share, sell, rent, or disclose to a third party any personally identifiable information collected at this site or through our services.

We may disclose your personal information in the following circumstances:

6.1 To Our Employees and Contractors

Our employees and contractors who need to know your information to perform their duties (e.g., technicians performing repairs, administrative staff managing bookings) have access to your personal information. They are bound by confidentiality obligations.

6.2 To Third‑Party Service Providers (Operators)

We may share your personal information with trusted third‑party service providers who assist us in operating our business, including:

• IT and web hosting providers (e.g., our website hosting platform)
• Payment processors
• Analytics providers (e.g., Google Analytics)
• Email and communication service providers
• Security and fraud prevention services

All third‑party service providers are contractually obligated to protect your personal information, maintain confidentiality, and comply with POPIA requirements.

6.3 To Regulatory and Government Authorities

We are subject to the law like everyone else. We may be required to give information to legal authorities if they so request or if they have the proper authorisation, such as a search warrant or court order.

6.4 In Connection with Business Transfers

In the event of a merger, acquisition, restructuring, or sale of assets, your personal data may be transferred as part of that transaction. We will take reasonable steps to ensure the protection of your personal information and will notify you of any such transfer.

6.5 With Your Consent

We may disclose your personal information to third parties where you have given your prior written consent to such disclosure.

6.6 To Protect Our Rights

We may disclose information where required to protect our rights, enforce our terms and conditions, or in connection with legal proceedings.

6.7 Records of Disclosure

If information is released with your consent, we will retain a record of the information released, the third party to which it was released, the reason for the release, and the date of release for a period of one year.

7. INTERNATIONAL TRANSFERS OF DATA

Our websites may be hosted outside of South Africa due to our Internet Service Provider having a global footprint. We also use outsourced services in countries outside South Africa from time to time in other aspects of our business. Accordingly, data obtained within South Africa may be “processed” outside South Africa and data obtained in any other country may be processed within or outside that country.

When we transfer personal information internationally, we ensure that appropriate safeguards are in place, as required under POPIA, such as processing in jurisdictions with adequate data protection laws or through binding agreements and standard contractual clauses that ensure POPIA‑compliant safeguards.

8. DATA RETENTION AND STORAGE

We retain personal information only for as long as necessary to fulfil the purposes for which it was collected or as required by law.

• Business records (including customer and device information): We keep information which forms part of our business record for a minimum of five years. This is because we may need it in some way to support a claim or defence in court, and this is also the period within which our tax collecting authorities (SARS) may demand to know it.
• Website usage data and analytics: Retained for as long as necessary for analytical and improvement purposes.
• Marketing information: Retained until you withdraw your consent or opt out.
• Job application information: Kept for up to three years in case we decide to contact you at a later date.
• Employee information: Kept for five years after employment has ended before destroying or deleting it.
• Records of information disclosed to third parties: Retained for a period of one year from the date of disclosure.

Once the information is no longer needed, we will securely delete or destroy it.

9. DATA SECURITY

We take the security of your personal information seriously and have implemented appropriate technical and organisational measures to safeguard it from unauthorised access, loss, or misuse.

These measures include:

• Physical security of our premises
• Computer and network security (firewalls, encryption, secure servers)
• Access controls (restricted access to personal information on a need‑to‑know basis)
• Secure communications (SSL encryption for our website)
• Regular security audits and reviews
• Confidentiality obligations imposed on all employees, contractors, and third‑party service providers

However, no data transmission or storage system can be guaranteed to be 100% secure. While we strive to protect your information, we cannot guarantee absolute security.

Data Breach Notification: In the event of a data breach that may compromise your personal information, we will notify you and the Information Regulator in accordance with POPIA requirements. If you suspect or are concerned about a breach relating to your data, please contact us immediately at [email protected].

10. COOKIES

10.1 What Are Cookies?

Cookies are small text files that are placed on your computer’s hard drive through your web browser when you visit any website. They are widely used to make websites work, or work more efficiently, as well as to provide information to the owners of the site.

10.2 How We Use Cookies

Like all other users of cookies, we may request the return of information from your computer when your browser requests a web page from our server. Cookies enable our web server to identify you to us and to track your actions and the pages you visit while you use our website.

The cookies we use may last for a single visit to our site (session cookies, which are deleted when you close your browser) or may remain on your computer until you delete them or until a defined period of time has passed.

Here are the ways we use cookies:

• Essential cookies: To allow essential parts of our website to operate for you (e.g., the online booking form). These do not require consent under POPIA.
• Session cookies: To operate the online booking/contact form. This cookie is set on your arrival at our website and deleted when you close your browser.
• Security cookies: To enhance security on our forms.
• Analytics cookies: To collect information about how visitors use our site in an anonymous form (including the number of visitors, where they have come from, and the pages they visited). We use this information to improve your experience of our site.
• Functionality cookies: To store your preferences so that you do not have to provide them afresh when you visit the site next time.
• Marketing cookies: To deliver relevant advertising and measure effectiveness. Consent is required under POPIA for marketing cookies.

10.3 Your Cookie Choices

We recommend that you allow the use of cookies in order to take advantage of the features of our website that rely on their use. If you prevent their use, you will not be able to use all the functionality of our website.

Although your browser software enables you to disable cookies, please note that if you do so, certain services on our website may not be available to you.

Strictly necessary cookies do not require your consent. For all other types of cookies (analytics, functionality, marketing), we will obtain your consent before placing them on your device.

10.4 Third‑Party Cookies

We may use embedded content from third parties (e.g., YouTube videos). These third parties may place their own cookies on your device. We do not control these cookies, and you should refer to the privacy policies of the relevant third parties for more information.

11. YOUR RIGHTS AS A DATA SUBJECT

POPIA recognises and respects the rights of data subjects. You have the following rights regarding your personal information:

• Right to be Notified: You have the right to be notified when your personal information is being collected or when there has been unauthorised access to your personal information.
• Right of Access: You have the right to request access to the personal information we hold about you. To make an access request, please contact us at [email protected] with a copy of your ID document for identity verification. Access requests may be subject to a legally allowable fee.
• Right to Rectification: You have the right to request that we correct, update, or amend your personal information if it is inaccurate or incomplete. To make a correction request, please contact us at [email protected] with a copy of your ID document for identity verification.
• Right to Deletion / Destruction: You have the right to request that we delete or destroy your personal information where there is no lawful reason for us to continue processing it. To request deletion, please contact us at [email protected].
• Right to Object: You have the right to object to the processing of your personal information on reasonable grounds.
• Right to Object to Direct Marketing: You have the right to object to direct marketing by means of unsolicited electronic communications (email, SMS, WhatsApp). You may opt out at any time by:
  • Clicking the “unsubscribe” link in any marketing email we send you
  • Replying “STOP” to any marketing SMS or WhatsApp message
  • Contacting us at [email protected]
• Right to Institute Civil Proceedings: You have the right to institute civil proceedings for damages resulting from unlawful processing of your personal information.

Verification of Identity: To better safeguard your information, we will take reasonable steps to verify your identity before granting access to or making corrections to your information.

12. USE OF SITE BY CHILDREN

We do not market to children, nor do we sell products or services for purchase by children. We do not sell products and services for end use by children, but for purchase by adults. If you are under 18 years of age, you may use our site only with consent from a parent or guardian.

We do not knowingly collect personal information from children under the age of 18. If we become aware that we have collected personal information from a child under 18 without parental consent, we will take steps to delete that information.

13. MARKETING AND RE‑MARKETING

13.1 Marketing Communications

With your permission, we may use your email address, phone number, or WhatsApp number to send you information about our services, promotions, or news that we consider may be of interest to you. You may opt out of this service at any time (see Section 11 above).

13.2 Re‑marketing

We may use re‑marketing from time to time. This involves Google or some other supplier placing a tag or marker on your browser in order to serve an advert for our products/services when you visit some other website. You can opt out of Google’s use of cookies by visiting Google’s Ads Settings.

14. COMPLAINTS

When we receive a complaint, we record all the information you have given to us. We use that information to resolve your complaint. If your complaint reasonably requires us to contact some other person, we may decide to give to that other person some of the information contained in your complaint. We do this as infrequently as possible, but it is a matter for our sole discretion as to whether we do give information, and, if we do, what that information is.

We may also compile statistics showing information obtained from this source to assess the level of service we provide, but not in a way that could identify you or any other person.

15. JOB APPLICATIONS AND EMPLOYMENT

If you send us information in connection with a job application, we may keep it for up to three years in case we decide to contact you at a later date.

If we employ you, we collect information about you and your work from time to time throughout the period of your employment. This information will be used only for purposes directly relevant to your employment. After your employment has ended, we will keep your file for five years before destroying or deleting it.

16. CHANGES TO THIS PRIVACY POLICY

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. We will notify you of any material changes by posting the updated policy on our website with a new “Last Updated” date. We encourage you to review this policy periodically.

Your continued use of our website and services after any changes to this Privacy Policy constitutes your acceptance of the updated policy.

17. CONTACT US

If you have any questions, concerns, or requests regarding this Privacy Policy or our handling of your personal information, please contact us:

18. COMPLIANCE WITH THE LAW

This Privacy Policy has been compiled so as to comply with the law of every jurisdiction in which we aim to do business, with specific reference to South African law, including POPIA, the ECT Act, the CPA, and PAIA. If you think it fails to satisfy the law of your country, we should like to hear from you, but ultimately it is your choice as to whether you wish to use our website.