Starafrica Corporation Limited (“Starafrica”, “the Group”, “we”, “us”, or “our”) is committed to protecting your privacy and to ensuring that your personal information is collected, used, and safeguarded properly, lawfully, transparently, and securely. This Notice explains how we collect, use, store, share, and protect personal information obtained through our website, online platforms, and digital communication channels, in line with the Cyber and Data Protection Act [Chapter 12:07], Statutory Instrument 155 of 2024, and Starafrica’ s Group Data Protection Policy.

This Notice sets out:

• Who we are
• What information we collect, and how
• Why we process your information, and on what lawful basis
• Cookies and similar technologies
• To whom we disclose your information
• Whether your information leaves Zimbabwe, and how it is protected
• How long we keep your information
• How we safeguard your information
• Your rights, and how to exercise them
• How we protect the privacy of minors
• Changes to this Notice
• How to contact us and the Information Regulator

WHO WE ARE

Starafrica Corporation Limited is a company incorporated and listed on the Zimbabwe Stock Exchange (ZSE), operating across sugar, packaging, and related industrial and consumer-facing businesses in Zimbabwe. References to “Starafrica”, “the Group”, “we”, “us”, or “our” refer to Starafrica Corporation Limited and its subsidiaries. We are the controller of personal information collected through our digital platforms, meaning we decide why and how your personal information is processed.

This Notice applies to all visitors, users, and individuals interacting with Starafrica’s digital platforms, including our corporate website enquiry forms, investor relations pages, supplier and distributor onboarding portals, career application pages, and consumer engagement channels.

WHAT INFORMATION WE COLLECT

We collect and process your personal information, generally with your consent or another lawful basis described below, mainly to respond to your enquiries, to provide you with access to our services, and to help us improve our offerings to you. Where possible, we will tell you what information you are required to provide and what information is optional.

We collect information directly from you, for example when you:

• Submit an enquiry through our website contact or investor relations forms;
• Register as a supplier or distributor on our onboarding portal;
• Apply for a career opportunity through our careers page;
• Contact us as a shareholder or investor with a query.
  We also collect information automatically and from other sources, including but not limited to:
• Technical and website usage data: IP address, browser and device type, operating system, referring pages, and session data, collected automatically when you visit our website.
• Cookies and tracking technologies: as described in our Cookie Policy, available on our website.
• Identity and contact information: name, email address, telephone number, physical or postal address, and, where relevant to a supplier, distributor, or career application, identity documentation such as a National ID or company registration details.
• Financial and commercial information: banking details, tax registration, and trading history submitted as part of supplier or distributor onboarding.
• Investor and shareholder information: shareholding details and communications, to the extent required for ZSE and SECZ disclosure and shareholder engagement purposes.
• Employment and career information: CVs, qualifications, references, and other details submitted through career application pages.

WHY WE PROCESS YOUR INFORMATION

We use your personal information for the following purposes:

• Responding to enquiries, supplier and distributor registrations, and service requests;
• Assessing career applications and managing recruitment processes;
• Providing and improving our online services, including career and procurement portals;
• Conducting analytics to understand and improve website usage and performance;
• Complying with legal and regulatory obligations, including ZSE and SECZ disclosure requirements applicable to investor-facing content, and other applicable company and securities law;
• Preventing and detecting fraud, and protecting the security of our platforms;
• Sending marketing or promotional communications, where you have given your consent, which you may withdraw at any time.

LAWFUL BASIS FOR PROCESSING

We only process your personal information where we have a lawful basis to do so. This will typically be one of the following:

• Consent — where you have opted in to receive marketing communications, or where cookies require your agreement;
• Contractual necessity — where processing is required to fulfil a service, supply, distributor, or career application request;
• Legitimate interests — where it is necessary for our legitimate business interests, provided this does not unfairly override your rights and interests;
• Legal obligation — where processing is required by applicable law, including securities, corporate governance, and data protection legislation.

COOKIES

Starafrica uses cookies and similar technologies on its website to recognise you, remember your preferences, and understand how our website is used. A full description of the cookies we use, their purpose, and how you can manage your preferences is available in our Cookie Policy, accessible on our website. Where cookies are not strictly necessary for the website to function, we will only place them with your consent.

DISCLOSURE OF YOUR INFORMATION

We may share your personal information with:

• Technology service providers, such as hosting, IT support, and analytics providers, under appropriate data processing agreements that require them to protect your information to the same standard we apply;
• Professional advisors, including auditors, lawyers, and consultants, where necessary for the purposes described in this Notice;
• Regulatory authorities, including POTRAZ, the Zimbabwe Stock Exchange (ZSE), and the Securities and Exchange Commission of Zimbabwe (SECZ), where required by law;
• Law enforcement or other government authorities, where we are legally required or permitted to do so;
• Other companies within the Starafrica Group, where necessary for the purposes described in this Notice.

We do not sell your personal information to third parties.

CROSS-BORDER DATA TRANSFERS

Where necessary for example, where a service provider’s servers or support functions are located outside Zimbabwe your personal information may be transferred to, and processed in, a country other than Zimbabwe. Where this occurs, we take steps to ensure that your information continues to receive an adequate level of protection, in line with the requirements of the Cyber and Data Protection Act [Chapter 12:07] and its regulations. This includes ensuring that any recipient of your information outside Zimbabwe is bound by contractual or other safeguards requiring them to protect your personal information to a standard consistent with this Notice and applicable law.

DATA RETENTION

We retain personal information collected through our website only for as long as necessary to fulfil the purpose for which it was collected, or as required by applicable law, whichever is longer. As a general rule, enquiry and contact data is retained for a maximum of two years unless an ongoing commercial, supply, or shareholder relationship is established, in which case information is retained for the duration of that relationship and thereafter in line with our Data Retention and Disposal Policy. Career application data is retained for a limited period following the conclusion of the relevant recruitment process, after which it is securely deleted unless you have consented to us retaining it for future opportunities.

HOW WE SAFEGUARD YOUR INFORMATION

We are committed to providing adequate protection for the personal information we hold, and to preventing unauthorised access, use, alteration, or disclosure of that information. We maintain security policies and procedures covering, among other things:

• Physical security of our premises and records;
• Computer, network, and information system security;
• Controls over who may access personal information, and on what basis;
• Secure methods of communication and data transfer;
• Security requirements imposed on third parties to whom we outsource activities or functions;
• Retention and secure disposal of information once it is no longer needed;
• Governance and regulatory compliance oversight;
• Monitoring of access to and use of personal information; and
• Identifying, investigating, and responding to security incidents, including notifying affected individuals and the Information Regulator where required by law.

Where we engage third parties to process personal information on our behalf, we require them, through appropriate data processing agreements, to apply security, confidentiality, and privacy safeguards consistent with this Notice.

YOUR RIGHTS

Subject to applicable law, you have the right to:

• Access the personal information we hold about you;
• Request correction of inaccurate or incomplete information;
• Request erasure of your information where no legal basis exists for us to continue holding it;
• Object to, or request restriction of, our processing of your information in certain circumstances;
• Withdraw your consent to marketing communications, or to any other processing based on consent, at any time;
• Lodge a complaint with the Information Regulator (POTRAZ) if you believe we have not complied with this Notice or applicable law.

To exercise any of these rights, please contact our Data Protection Officer using the details set out below. We will take reasonable steps to verify your identity before responding to your request, and any access request may be subject to a legally permitted fee.

PRIVACY OF MINORS

Our website and digital platforms are not directed at, and are not intended for use by, children under the age of 18. We do not knowingly collect personal information directly from minors. Where information relating to a minor is submitted to us for example, as a dependant on an employee or shareholder record this will only be processed where it has been provided by, or with the consent of, that minor’s parent or legal guardian. If you believe we have inadvertently collected personal information from a minor without appropriate consent, please contact us so that we can address this promptly.

CHANGES TO THIS NOTICE

We may amend this Notice from time to time to reflect changes in our digital services, processing activities, or applicable legislation, and will review it at least annually. We encourage you to check this page periodically to stay informed of any changes. This Notice was last approved on the date shown in the document control details above.

HOW TO CONTACT US

If you have questions about this Notice, believe we have not adhered to it, need further information about our privacy practices, or wish to give or withdraw consent, exercise your preferences, or access or correct your personal information, please contact our Data Protection Officer:

Name: Diana Runyemba
Designation: Data Protection Officer
Email: drunyemba@acr4solutions.com
Phone: 0772 524 364

INFORMATION REGULATOR

If you are not satisfied with our response, you have the right to lodge a complaint with the Information Regulator:

POTRAZ — Data Protection Authority
Email: the.regulator@potraz.gov.zw
Toll free: 0800 4303
Tel: +263 242 333032