Privacy Notice

ZynCore Group (Pty) Ltd ("ZynCore", "we", "us") provides solar asset monitoring, assurance and risk-intelligence services. This notice describes the personal information we collect through the ZynCore Intelligence System (ZIS) platform, why we process it, who we share it with, and the rights you have over it. We are the Responsible Party for this information under POPIA.

1. Who to contact

Our Information Officer is responsible for how we handle personal information and for responding to your requests and complaints:

• Information Officer: [TO BE APPOINTED]
• Email: [privacy@zyncore.co.za — to be confirmed]
• ZynCore Group (Pty) Ltd, South Africa

2. What personal information we collect

• Account details — your name, email address, role, and mobile number (where you opt in to alerts).
• Organisation and site details — your company name and contacts, installation addresses, GPS coordinates, system specifications, and, for insured assets, policy numbers and insured values.
• Assessment and audit records — the findings, photographs and location captured when a site is assessed or audited.
• Connection credentials — where you connect an inverter, the portal login you provide, which we store in encrypted form solely to retrieve your system's data.
• Usage and security records — notification history and access/security logs.

3. Why we process it, and our lawful basis

• To deliver the service you have contracted — monitoring, assurance scoring, reporting and alerts (performance of a contract).
• To detect faults and manage risk across insured assets, including fraud prevention (our legitimate interest and that of your insurer).
• To send you alerts you have opted into, such as WhatsApp notifications (your consent, which you may withdraw at any time).

We do not use your data to train external AI models. Where our platform uses AI to explain your results, it works only from your own system's data, and our assurance scores are produced by deterministic engines with human oversight — not by automated decision-making alone.

4. Who we share it with

We share personal information only as needed to run the service: with your insurer or broker where you are insured through them, and with operators who process data on our behalf under contract — our hosting and database providers, email and messaging providers, payment processor, error-monitoring provider, and the inverter-manufacturer platforms we connect to using your credentials. We do not sell your personal information.

5. Cross-border transfer

Some of our infrastructure, including our primary database, is hosted outside South Africa (in the European Union). Where personal information is transferred abroad, we do so on the bases POPIA permits — the recipient being subject to laws or binding agreements that provide adequate protection, or with your consent — and we take steps to keep your information protected to a comparable standard.

6. How long we keep it

We keep personal information only as long as necessary for the purposes above or as the law requires. In general: account and profile data for the life of your account plus a short period; telemetry on a rolling basis before it is aggregated; audit, assessment and certificate records for up to seven years as professional and insurance records; and billing records as tax and financial law requires.

7. How we protect it

We apply appropriate safeguards, including encryption of sensitive credentials at rest, two-factor authentication, strict role-based access controls, encrypted transport, rate limiting, and security audit logging. No system is perfectly secure, but we work to protect your information and to meet our obligations to notify you and the Information Regulator of any compromise as required by law.

8. Your rights

Under POPIA you have the right to:

• Access the personal information we hold about you — you can download it any time from your account under Security & 2FA → Your data.
• Correct inaccurate information — editable in the same place.
• Request deletion of your information — also from your account; we action it unless the law requires us to retain certain records.
• Object to certain processing, and to withdraw consent for alerts at any time.

To exercise a right you cannot complete in-app, contact our Information Officer above.

9. Complaints

If you believe we have not handled your personal information lawfully, please contact our Information Officer first so we can put it right. You also have the right to complain to the regulator:

• The Information Regulator (South Africa)
• Email: POPIAComplaints@inforeg.org.za / enquiries@inforeg.org.za
• Website: inforegulator.org.za

10. Changes to this notice

We may update this notice from time to time. The date at the top shows when it was last changed, and we will make material changes clear.