PRIVACY STATEMENT

1. Introduction

• This Statement will apply whenever you submit Personal Information to BASF, which will include (but is not limited to) when you browse our website and software or mobi applications (“Website”) or engage with us or any of our product and/or service offerings including instances where your Personal Information is submitted to us through or by a third party (collectively “Services”). The Statement is even expressly incorporated under our standard Terms & Conditions of Sale.
• Your continued use of our Services indicates that you have both read and consented to the terms of this Privacy Statement.
• If you do not agree to any of the provisions of this Statement, then you should not submit any Personal Information to BASF. However, we note that if you do not consent to this Statement, or any parts thereof, we may not be able to provide you with our products and services.
• Our Services are only intended to be used by persons aged 18 years or over.
• For purposes of this Statement:
• • “Applicable Laws” means all laws and regulations that BASF is required to comply with;
  • "Client" or “you” means any prospective, new or existing client of BASF and its subsidiaries and any website users or browsers of this or any BASF affiliate website and/or any mobi-site, software applications or similar; and
  • "BASF " or “we” or "us" means BASF Holdings South Africa (Pty) Ltd, BASF South Africa (Pty) Ltd, BASF Agricultural Specialities (Pty) Ltd, BASF Coatings Services (Pty) Ltd, Chemetall (Pty) Ltd, BASF Zambia Ltd, BASF East Africa Ltd, Nunhems Ethiopia Plc, BASF Djibouti Free Trade Zone Operation FZE, BASF Trade Representative Office (Ethiopia), BASF West Africa Ltd, BASF Operations LFTZ Enterprise and their direct and indirect subsidiaries. To obtain more information on these subsidiaries please look at north_east https://www.basf.com/za/en/who-we-are/Companies-and-Locations.html .
• This Statement sets out how your personal information will be used by BASF and applies to any information, including personal and special personal information, you give to BASF or which BASF may collect from third parties.
• It is important that you read this Statement carefully before submitting any personal information to BASF.
• By submitting any personal information to BASF you provide consent to the processing of your personal information as set out in this Statement.
• The provisions of this Statement are subject to mandatory, unalterable provisions of Applicable Laws;
• Please do not submit any personal information to BASF if you do not agree to any of the provisions of this Statement. If you do not consent to the provisions of this Statement, or parts of the Statement, BASF may not be able to provide its products and services to you.

2. How to contact us

If you have any comments or questions about this Statement please contact the Information Officer

Postal Address: P O Box 2801, Halfway House 1685, South Africa

Street Address: 852 Sixteenth Road, Midrand, 1685, South Africa.

Telephone: +27 11 203 2000

Email: mail AfricaInfoOfficer@basf.com

3. Amendment of this Statement

We may amend this Statement from time to time for any of the following reasons:

• to provide for the introduction of new systems, methods of operation, services, products, property offerings or facilities;
• to comply with changes to any legal or regulatory requirement;
• to ensure that our Statement is clearer and more favourable to you;
• to rectify any mistake that may be discovered from time to time; and/or
• For any other reason which BASF, in its sole discretion, may deem reasonable or necessary.

Any such amendment will come into effect and become part of any agreement you have with BASF when notice is given to you of the change by publication on our website. It is your responsibility to check the website often.

4. Privacy and indemnity

• BASF takes your privacy and the protection of your personal information very seriously, and we will only use your personal information in accordance with this Statement and applicable data protection legislation. It is important that you take all necessary and appropriate steps to protect your personal information yourself (for example, by ensuring that all passwords and access codes are kept secure).
• We have implemented reasonable technical and operational measures to keep your personal information secure.
• You hereby indemnify and hold BASF harmless from any loss, damages or injury that you may incur as a result of any unintentional disclosures of your personal information to unauthorised persons or the provision of incorrect or incomplete personal information to BASF.

5. Information which we may collect about you

We may collect the following information about you:

• this information may include your name, address, contact details, date of birth, place of birth, identity/registration number, passport number, bank details, financial information and electronic information (including your internet address, domain, activity logs, unique identifiers and geo-locations);
• records of correspondence or enquiries from you or anyone acting on your behalf;
• details of transactions you carry out with us;
• details of contracts, sales or leases you carry out with us;
• sensitive or special categories of personal information, including biometric information, such as images, fingerprints and voiceprints.

Where you provide us with the personal information of third parties you should take steps to inform the third party that you need to disclose their details to us, identifying us. We will process their personal information in accordance with this Statement.

6. How we collect information

We may be provided with and/or collect your personal information:

• directly or indirectly (through an agent acting on your behalf, or an introducer), by completing an application form for our products and services or requesting further information about our products and services, whether in writing, through our website, over the telephone or any other means.
• from any regulator, or other third party that may hold such information.

7. Use of information collected

We may use, transfer and disclose your personal information for the purposes of:

• providing you with the Services and notifying you about important changes to these Services and to improve or evaluate the effectiveness of BASF’ s business, products, services or offerings;
• managing your account or relationship and complying with your instructions or requests;
• detecting and preventing fraud and money laundering and/or in the interest of security and crime prevention;
• assessing and dealing with complaints and requests;
• operational, marketing, auditing, legal and record keeping requirements;
• verifying your identity or the identify of your beneficial owner;
• transferring or processing your personal information outside of the country in accordance with Applicable Law , including for cloud storage purposes and the use of any of our websites;
• complying with Applicable Laws, including lawful requests for information received from local or foreign law enforcement, government and tax collection agencies;
• recording and/or monitoring your telephone calls and electronic communications to/with BASF in order to accurately carry out your instructions and requests, to use as evidence and in the interests of crime prevention;
• where you have unsubscribed from certain direct marketing communications, ensuring that we do not send such direct marketing to you again;
• disclosing your personal information to third parties for reasons set out in this Statement or where it is not unlawful to do so this may include but is not limited sharing information with credit bureaus and prospective buyers or sellers of our business or assets)
• monitoring, keeping record of and having access to all forms of correspondence or communications received by or sent from BASF or any of its employees, agents or contractors, including monitoring, recording and using as evidence all telephone communications between you and BASF;

We may from time to time (and at any time) contact you for market research and about, services, products and offerings, available from BASF or our specific subsidiaries or affiliates, which we believe may be of interest to you, by email, phone, text or other electronic means, unless you have unsubscribed from receiving such communications. You can unsubscribe from receiving such communications by emailing the Information Officer at: mail AfricaInfoOfficer@basf.com .

8. Disclosure of your information

• Your personal information may be shared with BASF’s affiliates, subsidiaries, employees, our agents and sub-contractors, and selected third parties who process the information on our behalf.
• We may also disclose your personal information to third parties for those reasons recorded in clause 7.
• If you do not wish us to disclose this information to third parties, please contact us at the contact details set out above. We may, however, not be able to provide products or services to you if such disclosure is necessary.

9. Retention of your information

We may retain your personal information indefinitely, unless you object, in which case we will only retain it if we are permitted or required to do so in terms of Applicable Laws. However, as a general rule, we will retain your information in accordance with retention periods set out in Applicable Laws, unless we need to retain it for longer for a lawful purpose. (For example, for the purposes of complaints handling, legal processes and proceedings.)

10. Access to, correction and deletion of your personal information

• You may request details of personal information which we hold about you under the Promotion of Access to Information Act, 2000 (“PAIA”). Fees to obtain a copy or a description of personal information held about you are prescribed in terms of PAIA. Confirmation of whether or not we Internal hold personal information about you may be requested free of charge. If you would like to obtain a copy of your personal information held by BASF, please review our PAIA Manual located at: north_east https://www.basf.com/za/en/who-we-are/Companies-and-Locations/BASF-Holdings-South-Africa.html.
• You have a right in certain circumstances to request the destruction or deletion of and, where applicable, to obtain restriction on the processing of personal information held about you. If you wish to exercise this right, please contact us using the contact details set out above.
• You have a right to object on reasonable grounds to the processing of your personal information where the processing is carried out in order to protect our legitimate interests or your legitimate interests, unless the law provides for such processing.

11. Complaints

Should you believe that BASF has utilised your personal information contrary to Applicable Laws, you undertake to first attempt to resolve any concerns with BASF.

If you are not satisfied with such process, you may have the right to lodge a complaint with the Information Regulator, using the contact details listed below:

• Tel: 012 406 4818
• Fax: 086 500 3351
• Email: inforeg@justice.gov.za.

12. Log Files

• When you visit our website, even if you do not create an account, we may collect information, such as your IP address, the name of your ISP (Internet Service Provider), your browser, the website from which you visit us, the pages on our website that you visit and in what sequence, the date and length of your visit, and other information concerning your computer's operating system, language settings, and broad demographic information. This information is aggregated and anonymous data and does not identify you specifically. However, you acknowledge that this data may be able to be used to identify you if it is aggregated with other Personal Information that you supply to us. This information is not shared with third parties and is used only within BASF on a need-to-know basis. Any individually identifiable information related to this data will never be used in any way different to that stated above, without your explicit permission.

13. Cookies

We use cookies. A cookie is a small piece of information stored on your computer or smart phone by the web browser. The two types of cookies used on the website are described below:

• "Session cookies": These are used to maintain a so-called 'session state' and only last for the duration of your use of the website. A session cookie expires when you close your browser, or if you have not visited the server for a certain period of time. Session cookies are required for the Platform to function optimally but are not used in any way to identify you personally.
• "Permanent cookies": These cookies permanently store a unique code on your computer or smart device hard drive in order to identify you as an individual user. No Personal Information is stored in permanent cookies. You can view permanent cookies by looking in the cookies directory of your browser installation. These permanent cookies are not required for the website to work but may enhance your browsing experience.

14. Third Party Links on the Website

• The services available through the website, may contain links to other third-party websites, including (but not limited to) social media platforms, payment gateways, appointment scheduling and/or live chat platforms ("Third-Party Websites"). If you select a link to any Third-Party Website, you may be subject to such Third-Party Website's terms and conditions and/or other policies, which are not under our control, nor are we responsible, therefore.
• Hyperlinks to Third Party Websites are provided "as is", and we do not necessarily agree with, edit or sponsor the content on Third Party Websites.
• We do not monitor or review the content of any Third-Party Website. Opinions expressed or material appearing on such websites are not necessarily shared or endorsed by us and we should not be regarded as the publisher of such opinions or material. Please be aware that we are not responsible for the privacy practices, or content, of other websites, either.
• Users should evaluate the security and trustworthiness of any Third-Party Website before disclosing any personal information to them. We do not accept any responsibility for any loss or damage in whatever manner, howsoever caused, resulting from your disclosure to third parties of personal information.

15. Privacy of Children

• This Website and our Services are intended to be used by persons aged 18 and older. We do not seek to collect information about persons under the age of 18.
• No information should be submitted to or posted on the Websites by persons younger than 18 years of age. If such a person submits personal information via the Websites, we shall delete that information as soon as we are made aware of their age and thereafter shall not use it for any purpose whatsoever. If you become aware that any information of this nature has been submitted, you are obliged to inform us immediately

16. Modifications and Amendments

• BASF may amend this Statement from time to time.
• To the extent permitted by applicable law, any such amendments will come into effect and become binding when notice is given of the change on the Website. It is your responsibility to regularly check the Website.
• All amendments or modifications will require your acceptance prior to your continued use of the Website and shall thereby be construed as your consent. Your only remedy, should you disagree with such modifications, will be to refuse to accept the amended or updated Statement thereby preventing you from using the Website and or Services.

You have the option to reject any cookie category (except the necessary cookies for the performance of the webiste) by clicking the "cookie settings" button.

Embedded YouTube videos

a. Data processing

We have integrated YouTube videos into our online offering, which are stored on the YouTube platform and can be played directly from our website. YouTube is a service of Google LLC, D/B/A YouTube. 901 Cherry Ave., San Bruno, CA 94066, USA (hereinafter as ‘Google’). The videos are all embedded in the so-called ‘2-click-mode’, which means that no data about you as a user is being transferred to Google if you do not activate the video function. Before the video function’s activation, only a preview image loaded from our own web server is being displayed.

Data will only be transferred to Google if you activate such video functions. Once being activated, we have no influence on this data transfer. The data transfer is carried out regardless of whether Google provides a user account through which you are logged in or whether no user account exists. If you are logged in at Google, your data will be assigned directly to your account.

b. Purposes and legal basis

We use YouTube videos on our website to present those to you in an easy way.

The legal basis for the processing of your personal data is your consent according to Art. 6 para. 1 sentence 1 lit. a GDPR. You grant this consent by activating the video function. If activated, your personal data will be transferred to Google as described above.

In the course of the data transfer to Google, your personal data will be transferred to servers of Google, which might also be located in the USA. The USA is a country that does not have a level of data protection which is adequate to that of the EU. In particular, this means that personal data can be accessed by US authorities in a simplified manner and that there are only limited rights to such measures. If you activate the YouTube video function, you expressly consent to the transfer of data to Google and to the transfer of your personal data to servers located in the USA.

If you have given your consent, you have the right to revoke it at any time without affecting the lawfulness of the processing carried out on the basis of the consent until revocation.

c. Further information

Further information on data processing, in particular on the legal basis and storage period by Google, can be found in the provider's privacy policy (https://policies.google.com/privacy) and in the privacy banner on the YouTube platform. There you will also find further information on your rights and setting options to protect your privacy.

Google may also process your personal information in the United States, a third country without an adequate level of data protection.

Embedded Google Maps

a. Data processing

We have integrated Google Maps into our online offering, which are stored on the Google Maps platform and can be displayed directly from our website. Google Maps is a service of Google LLC, D/B/A YouTube. 901 Cherry Ave., San Bruno, CA 94066, USA (hereinafter as ‘Google’). The maps are all embedded in the so-called ‘2-click-mode’, which means that no data about you as a user is being transferred to Google if you do not activate the map function. Before the map function’s activation, only a preview image loaded from our own web server is being displayed.

Data will only be transferred to Google if you activate such maps functions. Once being activated, we have no influence on this data transfer. The data transfer is carried out regardless of whether Google provides a user account through which you are logged in or whether no user account exists. If you are logged in at Google, your data will be assigned directly to your account.

b. Purposes and legal basis

We use Google Maps on our website to present those to you in an easy way.

The legal basis for the processing of your personal data is your consent according to Art. 6 para. 1 sentence 1 lit. a GDPR. You grant this consent by activating the map function. If activated, your personal data will be transferred to Google as described above.

In the course of the data transfer to Google, your personal data will be transferred to servers of Google, which might also be located in the USA. The USA is a country that does not have a level of data protection which is adequate to that of the EU. In particular, this means that personal data can be accessed by US authorities in a simplified manner and that there are only limited rights to such measures. If you activate the Google Maps function, you expressly consent to the transfer of data to Google and to the transfer of your personal data to servers located in the USA.

c. Further information

Further information on data processing, in particular on the legal basis and storage period by Google, can be found in the provider's privacy policy ( north_east https://policies.google.com/privacy ). There you will also find further information on your rights and setting options to protect your privacy.

Google may also process your personal information in the United States, a third country without an adequate level of data protection.