Privacy Policy (POPIA Section 18 Privacy Notice)

K2023120042 (South Africa) (Pty) Ltd t/a willandtrust.co.za

This notice explains, as required by section 18 of the Protection of Personal Information Act 4 of 2013 ("POPIA"), what personal information we collect, why, who we share it with, and what your rights are. Please read it together with our Terms of Service and PAIA Manual.

1. Who is responsible for your information

The responsible party is K2023120042 (South Africa) (Pty) Ltd t/a willandtrust.co.za. Our Information Officer is Muhammad Khan, reachable at lunleamk@gmail.com. You can contact the Information Officer about your information, your rights, our breach-notification process, our cross-border transfers and our data-residency position.

2. Who we are and how our business works

We are a marketing, lead-intake and referral business for estate-planning and related financial-services journeys. In plain language: when you submit an enquiry or speak to us, we collect your details, help qualify your needs, and — with your consent — refer you to independent, authorised advisors and product suppliers (including Capital Legacy) who provide the actual will-drafting, estate-planning and financial services. Our advisor partners pay us a fee for our marketing and lead-generation services. That fee is not calculated with reference to any premium, commission or product outcome, and it does not change the price you pay for any product.

3. What we collect and why

We collect: your identity and contact details; the source of your lead (and, if we did not collect your details directly from you, the source from which we obtained them); your needs and circumstances relevant to estate planning; call recordings and transcripts; your marketing preferences and consent records; your referral status; technical and session logs; and compliance records.

We collect these to: respond to your enquiry; qualify your needs; schedule human follow-up; administer referrals to our partners; keep compliance records; improve our service quality; and meet our legal obligations.

4. Whether you must give us information

Giving us your information is voluntary, but if you do not give us the information we reasonably need, we may not be able to help you, qualify your needs, or arrange a referral or follow-up. We will tell you where a particular field is required.

5. Sensitive and children's information

Estate-planning journeys may involve ordinary personal information, financial and family information, and, where relevant, special personal information (such as health information) and children's information under POPIA. We collect these only where we genuinely need them for your journey, we rely on an applicable authorisation or justification under POPIA, and we protect them with heightened safeguards and restricted access.

6. Our AI assistant, call recording and analytics

6.1 AI assistant. An AI assistant may help collect and summarise your information, handle calls, answer factual questions, route your enquiry and prepare a handoff to a human. It will identify itself as an AI assistant, and you can ask for a human at any time.

6.2 Call recording. Calls may be recorded and transcribed for quality, verification, compliance, dispute-handling and evidence. For calls we make to you, we tell you this at the start of the call, and you may ask for a person or ask us not to record. We record as a party to the call under section 4 of RICA, and the recording and transcription are processed under POPIA as described in this notice. Ordinary recording and transcription does not include voice-biometric, identity-verification or emotion analysis; no such processing occurs without your explicit consent, and it can be switched off at your request.

6.3 Analytics on de-identified data. We use analytics (including AI tools) to understand campaign performance and lead quality and to improve our targeting and service. Before this analytics processing, the data is de-identified: personal identifiers are stripped and records are referenced only by an internal lead ID, with the linking key held separately and securely and with controls to prevent re-identification. We do not allow our vendors to train their AI models on your identifiable personal information by default.

7. The lawful basis for each use

8. Your consent choices (separate and granular)

You can choose each of these separately when you engage with us, and change your mind at any time at no cost by contacting lunleamk@gmail.com:

• I agree to receive marketing by phone / SMS / email / WhatsApp (you can opt out at any time).
• I agree that calls may be recorded and transcribed for quality, evidence and compliance.
• I understand that an AI assistant may help collect and summarise my information.
• I agree to the referral of my details to the named recipient or category of recipient (for example, an authorised estate-planning advisor or Capital Legacy).
• I agree to the use of my de-identified conversation data to improve systems.
• I agree to voice biometric processing for the stated purpose (only if this feature is enabled — it is currently not).

Withdrawing consent does not affect processing that lawfully took place before withdrawal.

9. Who we share your information with

We may share your information with:

• Authorised advisors and financial services providers — the independent advisors we refer you to, with your consent. From the moment your details are delivered to an advisor, that advisor processes your information as an independent responsible party under POPIA for the purpose of contacting you and rendering its own services, and is responsible for its own compliance.
• Product suppliers — including Capital Legacy, where your journey involves their products and you have consented.
• Lenders — only if your journey involves credit, you have consented, and the regulated steps under the National Credit Act have been met.
• Our operators — service providers (such as CRM, telephony/dialer, hosting, messaging and AI vendors) who process on our behalf under written contracts that require confidentiality, POPIA section 19 security safeguards, breach notification and processing only on our instructions.
• Regulators, courts or others — where the law requires or permits it.

We do not sell your personal information to data brokers or unrelated third parties. We are paid by our advisor partners for marketing and lead-generation services, and your details are only referred to a partner with your consent, as described above.

10. Sending information outside South Africa

If we use service providers outside South Africa (for example, cloud or AI providers), we will only transfer your information where there is a lawful basis under POPIA section 72 — such as the recipient being subject to comparable data-protection law, binding corporate rules or a binding agreement, your consent, or necessity for your contract. We keep a record, for each provider, of the country or region, the purpose, the transfer basis and the safeguards. You may ask the Information Officer for details of our current cross-border transfers.

11. Automated decisions

We do not make decisions that have a legal effect on you, or that significantly affect you (such as eligibility, affordability, suitability, advice or product selection), based solely on automated processing, without human involvement. Lead-quality scoring informs only our own campaign and marketing decisions. You may ask for human review of any decision, make representations about it, and ask us to explain the main logic used — contact lunleamk@gmail.com.

12. How long we keep your information

We keep your information only for as long as there is a lawful purpose, and then delete or de-identify it in line with our retention schedule:

You may ask the Information Officer for the period applicable to any specific record.

13. Your rights

You may ask us to:

• confirm whether we hold personal information about you, and give you access to it;
• correct or delete information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or unlawfully obtained;
• stop using your information for direct marketing (at any time, free of charge);
• object to processing based on legitimate interests;
• withdraw any consent you have given; and
• not be subject to a decision based solely on automated processing (see section 11).

To exercise these rights, contact the Information Officer at lunleamk@gmail.com. We will verify your identity, log your request, and respond in writing within a reasonable time with reasons. Our PAIA Manual explains the formal access-request procedure.

You also have the right to complain to the Information Regulator (South Africa): JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001 · complaints.IR@inforegulator.org.za · https://inforegulator.org.za/.

14. Keeping your information safe and telling you about breaches

We protect your information with appropriate, reasonable technical and organisational measures, including access control, encryption in transit and at rest where appropriate, logging, least-privilege access and secure credential management, and we require the same of our operators by written contract. If a security compromise occurs that affects your information, we will notify the Information Regulator and you as soon as reasonably possible after we discover it, describe what happened and the likely consequences, tell you what we are doing about it, and tell you what you can do to protect yourself.

15. Cookies and technical information

Our website may use cookies and similar technologies for essential functionality, security and analytics. Analytics data is used in aggregated or de-identified form to understand how the site is used. You can control cookies through your browser settings; blocking essential cookies may affect how the site works.

16. Changes to this notice

We may update this notice from time to time. The current version, with its effective date, is always available at willandtrust.co.za/privacy/. Material changes will be brought to your attention before they take effect.

---

K2023120042 (South Africa) (Pty) Ltd t/a willandtrust.co.za · Reg No. 2023/120042/07 · 185 Gingerbeer Road, Stanger, KwaZulu-Natal, 4450 · Information Officer: Muhammad Khan, lunleamk@gmail.com · Version 1.0, effective 7 July 2026