Ralph Jacobs POPIA and Privacy Notice

Issued by: Coscoroba Group Holdings (Pty) Ltd trading as Ralph Jacobs South Africa

Registration number: 2019/101093/07

Version: Version 2.0

Effective date: 21 April 2026

Important notice

This is a statutory and compliance notice. It is published as part of the Ralph Jacobs legal framework and applies to the extent relevant, but it is not intended to convert every clause into a negotiated term of every sale contract.

Where applicable law requires registration, operator agreements, breach handling, retention controls or direct-marketing consent procedures, compliance depends on Ralph Jacobs operational implementation as well as this notice.

1. Purpose and scope

This Ralph Jacobs POPIA and Privacy Notice applies to the processing of personal information by Coscoroba Group Holdings (Pty) Ltd trading as Ralph Jacobs South Africa ("Ralph Jacobs", "we", "us" or "our") when you use our website, place an order, request a quote, visit our store, communicate with us through WhatsApp, telephone, email or social media, make a payment, request a refund, use our warranty or repair services, arrange collection or delivery, or otherwise interact with us in relation to our jewellery business.

This Notice is designed to operate together with our Terms and Conditions, Ralph Jacobs Return, Refund, Repair, Exchange and Cancellation Policy, Ralph Jacobs Warranty and Care Policy, Ralph Jacobs Shipping, Delivery and Collection Policy, and Payments & Payment Refund Policy.

If a mandatory law gives you stronger rights than a term in this Notice, that law will prevail to the extent of the conflict.

2. Responsible Party and contact details

Responsible Party: Coscoroba Group Holdings (Pty) Ltd trading as Ralph Jacobs South Africa

Registration Number: 2019/101093/07

Website: https://ralphjacobs.co.za

Telephone: +27 87 551 7635

Privacy / POPIA / PAIA Contact: legal@ralphjacobs.co.za

Physical Address: Street No. 1, Kiewiet Street, Lake Umuzi Waterfront, Shop 6B Ralph Jacobs, Secunda, Mpumalanga, South Africa

For POPIA and PAIA requests, complaints or questions, you may contact our Information Officer / privacy contact using the details above.

3. Who this Notice covers

• Customers, prospective customers, and website visitors;
• In-store visitors, callers, email correspondents, WhatsApp users, and social media users who engage with Ralph Jacobs;
• People linked to an order, such as authorised payers, collection contacts, delivery recipients, gift recipients, company representatives, or beneficial owners where relevant;
• People who ask for quotations, design changes, resizing, repairs, returns, refunds, exchanges, warranty support, or complaint handling; and
• Business customers, suppliers, laboratories, workshops, couriers, and other counterparties to the extent that POPIA applies to their information.

4. Personal information we may collect

Depending on the interaction, we may collect and process the following categories of personal information:

• Identity and contact information, such as your name, company name, registration number, ID or passport number, date of birth where required, telephone number, email address, physical address, delivery address, billing address, and language preferences;
• Order and product information, such as order numbers, quotations, product selections, metal type, ring size, engraving instructions, design preferences, CAD approvals, proposal or event dates if you choose to disclose them, and details of any loose diamonds, gemstones, moissanite or laboratory reports linked to the order;
• Payment and refund information, such as payment references, gateway or provider records, masked payment details, proof of payment, bank account confirmation documents for EFT refunds, chargeback or dispute information, fraud-review records, and communication about payment queries;
• Compliance and verification information, such as FICA / KYC documentation, proof of address, company registration documents, director or beneficial ownership information, source-of-funds or source-of-wealth information where lawfully required, sanctions or adverse-media screening results, and bank verification details;
• Service, warranty, returns and complaint information, such as photographs, videos, condition reports, repair notes, return authorisation details, courier waybills, communications, and records of inspection, verification, or dispute resolution;
• Delivery, collection and logistics information, such as recipient names, contact numbers, collection and dispatch records, tracking details, failed-delivery records, and proof of delivery or collection;
• Website, device and usage information, such as IP address, browser type, device information, referral source, cookie identifiers, cart history, session data, form submissions, and security logs;
• Communications and support records, including emails, chat messages, call notes, call recordings or voice notes where lawful and notified, social media messages, review responses, and complaint records;
• CCTV footage, visitor logs, access-control records, and security incident records; and
• Limited special personal information only where lawfully permitted and genuinely necessary, or where you voluntarily disclose it.

5. Sources of personal information

We may collect personal information directly from you, from a person acting on your behalf, or from other lawful sources, including:

• Our website, forms, checkout pages, payment links, in-store forms, quotations, invoices, and communications;
• Authorised payers, spouses, family members, business representatives, or other persons you allow to interact with us about your order;
• Approved payment providers, banks, card acquirers, refund verification processes, fraud tools, and chargeback or dispute systems;
• Couriers, logistics partners, laboratories, insurers, valuers, workshops, setters, repair providers, or other operators involved in your order or service request;
• Public records, sanctions lists, company registers, anti-fraud databases, identity verification services, or lawful screening sources;
• Social media or review platforms where you choose to engage with us publicly; and
• Our prior dealings with you, where the purpose of processing remains compatible with the original purpose of collection.

6. Why we process your information and our POPIA justification

We process personal information for purposes including:

• Preparing quotations, confirming orders, manufacturing custom pieces, sourcing stones, delivering or handing over orders, and providing after-sales support;
• Receiving, verifying and reconciling payments, preventing fraud, processing refunds, verifying bank-account ownership, handling chargebacks, and responding to payment disputes;
• Inspecting goods, verifying condition, managing returns or exchanges, assessing defects or wear, booking repairs, applying warranty rules, and keeping service histories;
• Complying with tax, accounting, anti-fraud, FICA / AML / CFT, sanctions, court, regulator, card-scheme, acquirer and other legal or contractual requirements;
• Securing our systems, premises, website, payment environments, staff and customers;
• Sending service updates and, where lawful, direct marketing about our own jewellery products and services; and
• Establishing, exercising or defending legal rights, responding to complaints, preserving evidence, managing audits, and protecting Ralph Jacobs and its business relationships.

Under POPIA, personal information may be processed when the data subject consents, when processing is necessary to conclude or perform a contract, when processing is required by law, when it protects a legitimate interest of the data subject, or when it is necessary for the legitimate interests of Ralph Jacobs or a third party. We do not rely on consent for every processing activity.

7. When supplying information is mandatory or voluntary

Some information is provided voluntarily, but some information is necessary for us to transact with you or to comply with the law. If you do not provide mandatory or reasonably required information, Ralph Jacobs may be unable to quote, accept payment, manufacture, dispatch, release, refund, repair, or continue with the transaction.

8. Direct marketing and customer preferences

Ralph Jacobs may market its own jewellery products and related services by email, SMS, WhatsApp, telephone or similar channels only to the extent permitted by law.

You may opt out of direct marketing at any time by using the unsubscribe facility, replying STOP where available, or emailing legal@ralphjacobs.co.za.

Withdrawing consent or objecting to marketing will not affect the lawfulness of prior processing and will not stop us from sending non-marketing service messages that are necessary for your order, payment, warranty, return or legal compliance.

Ralph Jacobs does not sell personal information to third parties for their independent direct marketing unless lawfully permitted and, where required, with your consent.

9. Website technologies, analytics and online identifiers

When you use our website or linked payment journeys, Ralph Jacobs or its approved service providers may use cookies, pixels, tags, scripts, device identifiers and similar technologies to operate the site, maintain security, remember preferences, measure traffic, detect fraud, analyse performance, and where lawful support marketing.

You can usually manage cookies through your browser settings or through website tools that we make available from time to time. Disabling certain cookies may affect the operation of the website, your cart, saved preferences, login status, or security checks.

10. Sharing personal information with operators and third parties

We may disclose or allow access to personal information, on a need-to-know basis, to the following categories of recipients:

• Website hosts, ecommerce providers, payment gateways, banks, card acquirers, wallet providers, pay-by-bank providers, QR providers, or credit / BNPL providers;
• Couriers, logistics providers, click-and-collect partners, insurers, laboratories, valuers, setters, workshops, repair providers, engravers, manufacturers, or quality-control providers;
• Professional advisers such as attorneys, auditors, accountants, tax advisers, insurers, IT providers, cybersecurity specialists, CRM providers, helpdesk providers, cloud-service providers, and records-management providers;
• Fraud-prevention, account-verification, sanctions-screening, identity-verification, chargeback, or compliance service providers;
• Regulators, law-enforcement agencies, the Financial Intelligence Centre, the Information Regulator, the South African Revenue Service, courts, tribunals, ombuds, card schemes, banks, or other competent authorities; and
• A purchaser, successor, financier or restructuring counterparty of all or part of our business, subject to appropriate confidentiality and lawful-processing requirements.

11. Cross-border transfers and international elements

Some of our service providers, cloud systems, laboratories, communications platforms or payment and fraud tools may process or store personal information outside South Africa.

Ralph Jacobs may transfer personal information across borders where this is permitted by POPIA, including where the foreign recipient is subject to an adequate level of protection, where the transfer is necessary for the performance of a contract with you or taken at your request, where the transfer is in your interest, or where you consent.

12. High-value goods, identity verification, FICA and anti-fraud processing

Ralph Jacobs sells high-value jewellery and custom pieces. For certain orders, payment methods, linked transactions or suspicious patterns, we may place the order on hold, restrict the permitted payment method, require additional verification, ask for identity or company documents, verify bank accounts for refunds, ask lawful source-of-funds questions, or request beneficial-owner information.

This is done for fraud prevention, risk management and legal compliance.

13. Security safeguards

POPIA requires Ralph Jacobs to secure the integrity and confidentiality of personal information in its possession or under its control by taking appropriate, reasonable technical and organisational measures.

We apply security measures appropriate to the information and the risk, which may include access controls, named-user accounts, strong-password and multi-factor authentication controls where supported, role-based access, physical security, secure backup and recovery processes, records controls, staff training, incident-response procedures, and approved payment and technology environments.

No system is completely secure. If there are reasonable grounds to believe that personal information has been accessed or acquired by an unauthorised person, POPIA requires notice to the Information Regulator and, subject to the law, affected data subjects as soon as reasonably possible after discovery of the compromise.

14. Retention of personal information

Ralph Jacobs keeps personal information only for as long as reasonably necessary for the purpose for which it was collected, unless a longer retention period is required or permitted by law, justified for dispute resolution, necessary for warranty or service history, required by tax or accounting obligations, needed for fraud defence or chargeback evidence, or reasonably required to protect or enforce our rights.

As a general operational rule, payment, order, fraud-review, refund, dispute, chargeback and settlement records may be retained for at least 5 years, and longer where a law, regulator, acquirer, court process, warranty history or unresolved claim requires it.

15. Your POPIA rights

Subject to POPIA, PAIA and any lawful grounds of refusal or limitation, you have the right to:

• Ask us to confirm, free of charge, whether we hold personal information about you;
• Request access to the record or a description of the personal information we hold about you;
• Request the correction, deletion or destruction of personal information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading, unlawfully obtained, or no longer authorised to be retained;
• Object, on reasonable grounds, to certain processing, and object at any time to direct marketing;
• Withdraw consent at any time where consent is the applicable lawful basis; and
• Lodge a complaint with Ralph Jacobs and, if unresolved, with the Information Regulator.

16. Requests under POPIA and PAIA

Requests for access, correction, deletion or objection should be sent to legal@ralphjacobs.co.za with enough detail to identify the requester, the relationship to the order or record, and the information or action requested.

Where appropriate, Ralph Jacobs may ask the requester to complete the prescribed or recommended forms and to follow the procedure in our PAIA Manual.

17. Complaints and the Information Regulator

We encourage you to first raise privacy concerns with Ralph Jacobs so that we can try to resolve them quickly and fairly.

If the matter is not resolved, or if you believe your personal information has been processed in a manner that interferes with your POPIA rights, you may lodge a complaint with the Information Regulator through the Regulator's eServices portal or prescribed complaint process.

Information Regulator South Africa

General Contact Email: enquiries@inforegulator.org.za

Telephone: 010 023 5200

eServices / Complaints: https://eservices.inforegulator.org.za / https://inforegulator.org.za/complaints/

18. CCTV, calls, images and in-store security

Ralph Jacobs may use CCTV, alarm systems, visitor logs and other security measures at its premises for safety, crime prevention, access control, loss prevention, staff and customer protection, verification of collections or deliveries, and the investigation or defence of complaints, losses or legal claims.

Calls, voice notes, emails, WhatsApp messages, social media messages, photographs and videos may be retained where lawful and reasonably required for order verification, support, fraud prevention, workshop instructions, quality control, warranty assessment, returns, or dispute resolution.

19. Children and special personal information

Ralph Jacobs does not intentionally market to or contract directly with children where this is not legally permitted.

We do not generally need special personal information such as information about health, religion, race or biometrics to sell jewellery. If such information is voluntarily disclosed or becomes necessary for a lawful and legitimate purpose, we will process it only to the extent permitted by law.

20. Information about other people that you give us

If you provide Ralph Jacobs with personal information about another person, you confirm that you are lawfully entitled to do so and that you have informed the person about this Notice or otherwise taken reasonable steps to make the Notice available to them.

21. PAIA Manual and related records

POPIA works together with PAIA. Ralph Jacobs must maintain the documentation of processing operations by reference to the PAIA framework and must make its PAIA Manual available in the manner required by law.

Our PAIA Manual is available on request and may also be made available on our website or at our business premises where published or required.

22. Changes to this Notice

Ralph Jacobs may amend this Notice from time to time to reflect changes in law, regulator guidance, our business operations, technology, payment methods, security practices or customer channels.

The most recent version may be published on our website, made available in-store, or supplied on request.