Inyanga Trading 304 (Pty) Ltd
Trading as Vic Legacy Auto
POPIA-Aligned Company Policy

Effective: 17 September 2026
Information Officer: Victor Manual Moutinho Correia
Physical Address: 40 General Smuts Road, Duncanville, Vereeniging
Telephone: 016 018 0224
Version: 1.0

Prepared for the lawful, responsible and transparent processing of personal information in accordance with the Protection of Personal Information Act 4 of 2013 (POPIA) and other applicable South African law.

1. Introduction

Inyanga Trading 304 (Pty) Ltd, trading as Vic Legacy Auto (“Vic Legacy Auto”, “we”, “us” or “our”), respects the constitutional right to privacy of customers, prospective customers, employees, job applicants, suppliers, service providers and other persons with whom we conduct business.

We are committed to processing Personal Information lawfully, reasonably, transparently and responsibly, and in a manner that does not unjustifiably infringe the privacy of Data Subjects. This Policy explains how we collect, use, store, protect, share, retain and dispose of Personal Information.

2. Purpose and Scope

This Policy establishes the principles and procedures followed by Vic Legacy Auto when processing Personal Information in the ordinary course of its motor dealership and related business activities.

• Dealership visits, vehicle enquiries, quotations, purchases, sales and trade-ins.
• Finance and insurance applications and related supporting documentation.
• Vehicle registration, licensing, ownership transfer and delivery processes.
• Telephone, email, WhatsApp, website, social-media and online communications.
• Competitions, promotions, marketing and customer relationship activities.
• CCTV, premises security and asset-protection activities.
• Supplier, contractor, recruitment and employment administration.
• Any other legitimate business activity for which Personal Information is reasonably required.

3. Definitions

Data Subject: the person to whom Personal Information relates, including a natural person and, where POPIA applies, a juristic person.

Personal Information: information relating to an identifiable living natural person and, where applicable, an identifiable juristic person, as contemplated in POPIA.

Processing: any operation or activity concerning Personal Information, including collection, receipt, recording, organisation, storage, updating, retrieval, use, distribution, restriction, erasure or destruction.

Special Personal Information: the categories of information afforded additional protection under POPIA, including certain information concerning health, race or ethnic origin, religious or philosophical beliefs and criminal behaviour.

Operator: a person who processes Personal Information for Vic Legacy Auto in terms of a contract or mandate without coming under our direct authority.

4. Personal Information We May Collect

• Name, surname, identity or passport details and date of birth where required.
• Residential, postal or business address and contact details.
• Driver’s licence, vehicle registration, ownership and vehicle identification information.
• Banking, payment, employment and income information where required for a lawful transaction.
• Credit and finance-related information where lawfully permitted.
• Finance, insurance, trade-in, sale and purchase documentation.
• Communications and records of enquiries, appointments and customer service interactions.
• CCTV footage and other security-related records.
• Website usage, device and cookie information where applicable.
• Social-media interactions, promotional or competition entries.
• Supplier, service-provider, recruitment and employment information.
• Other information reasonably required to provide a service, conclude a transaction or comply with law.

5. How We Collect Personal Information

Where reasonably practicable, Vic Legacy Auto collects Personal Information directly from the Data Subject. Information may also be obtained from third parties where permitted by law or authorised by the Data Subject.

• Banks, vehicle-finance providers and insurers.
• Credit bureaux and verification providers.
• Vehicle manufacturers, distributors and registration or licensing service providers.
• Government departments, regulators and lawful public records.
• Suppliers, service providers and professional advisers.
• Other parties authorised by the Data Subject or permitted by applicable law.

6. Purposes for Processing

6.1 Vehicle sales, purchases and trade-ins

We may process Personal Information to prepare quotations, verify transaction information, buy or sell vehicles, process trade-ins, arrange delivery, complete documentation and administer customer relationships.

6.2 Finance and insurance

Where requested or applicable, Personal Information may be processed or shared with authorised banks, finance institutions, insurers, F&I service providers and related parties to facilitate finance or insurance applications.

Submission of information does not guarantee approval; the relevant financial institution remains responsible for its own credit and lending decisions.

6.3 Registration and licensing

Information may be processed where necessary to facilitate vehicle registration, licensing, ownership changes and other statutory or regulatory requirements.

6.4 Customer service and administration

We may process information to respond to enquiries, prepare quotations, arrange appointments, communicate about transactions, provide after-sales assistance, manage accounts and maintain appropriate business records.

6.5 Marketing and promotions

Where permitted by law, we may communicate information about vehicles, products, services, promotions and competitions.

Where consent is required for unsolicited electronic direct marketing, the required consent will be obtained. A Data Subject may object to direct marketing or withdraw applicable consent.

6.6 Security and legal compliance

Information, including CCTV footage where applicable, may be processed for security, crime prevention, safety and asset protection.

We may also process information to comply with legislation, regulatory requirements, court orders, lawful authority requests, tax, accounting and other legal obligations.

7. Data Protection Principles

Vic Legacy Auto seeks to ensure that Personal Information is:

• Processed lawfully and reasonably and in a manner that does not unjustifiably infringe privacy.
• Collected for specific, explicitly defined and lawful purposes.
• Adequate, relevant and not excessive for the purpose for which it is processed.
• Processed transparently, fairly and with appropriate notice to Data Subjects.
• Collected directly from the Data Subject where reasonably practicable, subject to lawful exceptions.
• Kept complete, accurate, not misleading and updated where reasonably necessary.
• Protected by reasonable technical and organisational safeguards.
• Retained only for as long as required or permitted by law or reasonably necessary for a lawful purpose.
• Destroyed, deleted or de-identified when no longer lawfully required.

8. Lawful Processing and Consent

Vic Legacy Auto will process Personal Information only where a lawful justification exists.

Depending on the circumstances, this may include consent; performance of a contract; steps requested before entering a contract; compliance with a legal obligation; protection of a legitimate interest of the Data Subject; performance of a public-law duty where applicable; or pursuit of our legitimate interests or those of a third party, subject to applicable law.

Where processing is based on consent, consent may be withdrawn subject to applicable law and any lawful consequences arising from the withdrawal.

9. Sharing of Personal Information

Vic Legacy Auto does not sell Personal Information. We may disclose Personal Information where reasonably necessary for a legitimate business purpose, to perform a transaction, where authorised by the Data Subject, or where required or permitted by law.

• Banks, finance institutions, credit bureaux and insurers.
• Vehicle manufacturers, distributors, registration and licensing service providers.
• Accountants, auditors, attorneys and other professional advisers.
• IT, software, hosting, communications and security providers.
• Marketing service providers acting lawfully on our behalf.
• Debt-collection and legal service providers where applicable.
• Government departments, regulators, law-enforcement bodies and courts where lawfully required.
• Other service providers reasonably required to complete a transaction or provide a requested service.

Where an Operator processes Personal Information on our behalf, we will take reasonable steps to ensure appropriate confidentiality and security arrangements are in place as required by POPIA.

10. Security of Personal Information

Vic Legacy Auto takes reasonable and appropriate technical and organisational measures to safeguard the integrity and confidentiality of Personal Information and to protect it against loss, damage, unauthorised destruction, unlawful access, alteration or disclosure.

Measures may include access controls, passwords, physical security, secure document storage, appropriate IT safeguards, staff confidentiality obligations and controls over third-party processing.

No electronic system can be guaranteed to be completely secure, but safeguards will be appropriate to the nature of the information and reasonably foreseeable risks.

11. Security Compromises

Where there are reasonable grounds to believe that Personal Information has been accessed or acquired by an unauthorised person, Vic Legacy Auto will manage the incident in accordance with POPIA.

Where legally required, the Information Regulator and affected Data Subjects will be notified as soon as reasonably possible, subject to lawful restrictions or instructions.

Reasonable measures will be taken to contain, investigate and address the incident.

12. Retention and Destruction

Personal Information will be retained only for as long as reasonably necessary to fulfil the purpose for which it was collected, or for a longer period where required or permitted by law, contract, tax or accounting obligations, dispute resolution or another legitimate purpose.

When no longer required, information will be destroyed, deleted or de-identified in accordance with applicable requirements.

13. Special Personal Information and Children’s Information

Vic Legacy Auto will avoid processing Special Personal Information unless the processing is necessary and authorised or otherwise permitted under POPIA or other applicable law. Additional care will be taken when such information is processed.

We will not knowingly process Personal Information relating to children except where legally permitted, reasonably necessary and appropriately authorised. Where consent of a competent person is required, that consent will be obtained.

14. Direct Marketing

Vic Legacy Auto may market vehicles, products, promotions and services in accordance with POPIA and other applicable law.

Where consent is legally required before unsolicited electronic direct marketing is sent, the necessary consent will be obtained.

Data Subjects may object to direct marketing or withdraw applicable marketing consent at any time, subject to reasonable processing time.

15. Cookies and Website Information

Our website may use cookies and similar technologies.

Cookies are small files stored on a user’s device and may help remember preferences, improve functionality, analyse website performance, enable third-party services and support appropriate advertising or marketing where permitted by law.

Users may be able to control or disable cookies through browser settings. Disabling certain cookies may affect website functionality.

16. Social Media and Electronic Communications

Vic Legacy Auto may communicate with customers through platforms such as Facebook, Instagram, WhatsApp and other digital services.

Information submitted through a third-party platform may also be processed by the operator of that platform under its own privacy terms.

Data Subjects should avoid sending unnecessary sensitive Personal Information through public social-media channels.

17. CCTV

CCTV surveillance may be used at Vic Legacy Auto premises for legitimate purposes including security, prevention and detection of crime, protection of employees and customers, protection of vehicles and other assets, and investigation of security incidents.

CCTV footage will be accessed, used and retained only for legitimate purposes and subject to applicable law.

18. Cross-Border Transfers

Where Personal Information is transferred outside the Republic of South Africa, Vic Legacy Auto will take reasonable steps to ensure that the transfer complies with POPIA.

This may include ensuring that the recipient is subject to an appropriate law, binding corporate rules or agreement providing an adequate level of protection, or obtaining consent where appropriate.

19. Data Subject Rights

Subject to POPIA and other applicable legislation, a Data Subject may have the right to:

• Ask whether Vic Legacy Auto holds Personal Information about them.
• Request access to their Personal Information.
• Request correction of inaccurate, incomplete or outdated information.
• Request deletion or destruction where legally permissible.
• Object to certain processing and to direct marketing.
• Withdraw consent where processing is based on consent.
• Lodge a privacy complaint with Vic Legacy Auto.
• Lodge a complaint with the Information Regulator of South Africa.

Requests may be subject to legal limitations, prescribed procedures and reasonable identity verification before information is released, corrected or deleted.

20. Information Officer

The Information Officer responsible for overseeing privacy and POPIA compliance for Inyanga Trading 304 (Pty) Ltd t/a Vic Legacy Auto is:

Information Officer: Victor Manual Moutinho Correia
Company: Inyanga Trading 304 (Pty) Ltd t/a Vic Legacy Auto
Physical Address: 40 General Smuts Road, Duncanville, Vereeniging
Telephone: 016 018 0224
Email: ____________________________________________

Note: The source document itself leaves the email field blank here, so I have preserved it exactly rather than filling it in from another document.

21. Information Regulator

A Data Subject who believes that their Personal Information has been processed contrary to POPIA may lodge a complaint with the Information Regulator of South Africa.

Current official contact details and complaint procedures should be obtained from the Information Regulator’s official channels.

22. Employees and Authorised Personnel

Employees and other authorised persons who have access to Personal Information must handle it responsibly and confidentially and may access it only where reasonably necessary for their duties or otherwise authorised.

Unauthorised disclosure, copying, distribution or use of customer, employee, supplier or company Personal Information may constitute misconduct and may result in disciplinary action, subject to applicable labour law.

23. Third-Party Service Providers

Where reasonably practicable and required by POPIA, Operators processing Personal Information on behalf of Vic Legacy Auto will be subject to appropriate contractual confidentiality and security obligations.

They must process information only for authorised purposes and implement reasonable security safeguards.

24. Accuracy of Information

Vic Legacy Auto will take reasonably practicable steps to ensure that Personal Information is complete, accurate, not misleading and updated where necessary, having regard to the purpose for which it is processed.

Data Subjects are encouraged to notify us when their Personal Information changes.

25. Automated Decision-Making

Vic Legacy Auto will not subject Data Subjects to decisions based solely on automated processing that produces legal consequences or substantially affects them where prohibited by POPIA.

Finance or credit applications submitted to third-party financial institutions may be subject to those institutions’ own credit assessments and decision-making processes.

26. Policy Changes

This Policy may be amended from time to time to reflect changes in legislation, business practices, technology or regulatory requirements.

Where a material amendment affects how Personal Information is processed, reasonable steps will be taken to make the updated policy available.

The most recent approved version applies.

27. Responsibility and Review

Management of Inyanga Trading 304 (Pty) Ltd t/a Vic Legacy Auto is responsible for supporting compliance with this Policy.

The Information Officer is responsible for carrying out the duties assigned under POPIA and applicable regulations.

This Policy should be reviewed at least annually and whenever material changes occur in applicable law, business activities, information systems or processing arrangements.

Policy Approval

This Privacy & Data Protection Policy is adopted for use by Inyanga Trading 304 (Pty) Ltd t/a Vic Legacy Auto.

Company: Inyanga Trading 304 (Pty) Ltd t/a Vic Legacy Auto
Information Officer: Victor Manual Moutinho Correia
Information Officer Signature: __________________________
Date: __________________________
Director / Authorised Representative: __________________________
Signature: __________________________
Approval Date: __________________________
Next Review: Annually, or sooner if required

VIC LEGACY AUTO
40 General Smuts Road, Duncanville, Vereeniging | 016 018 0224