Privacy Policy — SOCO ENERGY

01

Who We Are

SOCO ENERGY (Pty) Ltd is a South African renewable energy company providing solar PV, battery energy storage, and structured energy financing solutions to commercial, industrial, mining, and agricultural clients.

We operate as the Responsible Party under POPIA for all personal information collected through our website (soco.energy), contact forms, email correspondence, and business dealings.

Registered address: 313 Rivonia Road, Morningside, Sandton, Johannesburg
Email: core@soco.energy

02

Information We Collect

We collect personal information only where necessary and proportionate to our business purposes. The categories of information we may collect include:

Identity information: first name, last name, job title
Contact information: email address, phone number, company name
Business information: industry sector, site location, electricity consumption data, bill details
Communication records: enquiries, emails, form submissions, and meeting notes
Technical data: IP address, browser type, device type, pages visited, and session duration (collected via analytics tools)
Financial data: only where required for financing assessments — handled under strict confidentiality obligations

We do not collect sensitive special categories of personal information (such as health data, biometrics, or political affiliation) unless required by law or with your explicit consent.

03

How We Use Your Information

We use the personal information we collect for the following purposes:

To respond to your enquiries and provide energy assessments and proposals
To structure, negotiate, and administer financing agreements (RTO, PPA, debt finance)
To communicate project updates, maintenance schedules, and account information
To send relevant industry insights or SOCO ENERGY news — only with your consent
To improve our website, services, and customer experience
To comply with legal, regulatory, and contractual obligations
To detect and prevent fraud or misuse of our services

We do not use your personal information for automated decision-making or profiling that has legal or similarly significant effects on you.

04

Lawful Basis for Processing

Under POPIA, we process your personal information on one or more of the following grounds:

Contractual necessity: processing required to fulfil our obligations under a contract with you or to take steps at your request prior to entering a contract
Legitimate interest: processing necessary for our legitimate business interests (such as responding to enquiries or preventing fraud), provided these are not overridden by your rights
Legal obligation: processing required to comply with South African law (e.g., SARS, CIPC, NERSA regulatory requirements)
Consent: where we have obtained your voluntary, specific, and informed consent — for example, to send marketing communications

05

Sharing of Information

We do not sell, rent, or trade your personal information to third parties. We may share your information in the following limited circumstances:

Financing partners: where you engage with a SOCO CAPITAL financing product, relevant financial data may be shared with accredited South African lending institutions or investors — with your consent
Service providers: trusted third parties who assist us in operating our business (e.g., CRM platforms, email delivery, site analytics) — bound by confidentiality and data processing agreements
Legal or regulatory bodies: where required by law, court order, or regulatory authority
Successors: in the event of a merger, acquisition, or business transfer, subject to equivalent privacy protections being maintained

All third-party processors we engage with are required to comply with POPIA and to process your personal information only on our documented instructions.

06

Data Retention

We retain personal information only for as long as necessary to fulfil the purpose for which it was collected, or as required by applicable law. Our general retention guidelines are:

Enquiry and contact form data: 24 months from last contact, unless a contract is entered into
Contractual data: duration of the contract plus 5 years (as required by South African commercial law)
Financial records: 5 years minimum in accordance with the Companies Act and SARS requirements
Marketing consent records: retained until consent is withdrawn, plus 1 year
Website analytics data: up to 26 months in aggregated, anonymised form

When personal information is no longer required, we securely delete or anonymise it.

07

Security

We implement appropriate technical and organisational measures to protect your personal information against unauthorised access, disclosure, alteration, or destruction. These measures include:

Encrypted data transmission (HTTPS/TLS) across all web properties
Access controls limiting data access to authorised personnel on a need-to-know basis
Regular security assessments and staff training on data protection obligations
Secure cloud infrastructure with reputable, POPIA-compliant providers

In the event of a data breach that is likely to harm your rights, we will notify you and the Information Regulator as required under POPIA.

08

Your Rights

As a data subject under POPIA, you have the following rights:

Right of access: to request a copy of the personal information we hold about you
Right to correction: to request correction of inaccurate or incomplete information
Right to deletion: to request deletion of your personal information where we no longer have a lawful basis to retain it
Right to object: to object to processing based on our legitimate interests, including direct marketing
Right to withdraw consent: to withdraw consent at any time where processing is based on consent, without affecting the lawfulness of prior processing
Right to complain: to lodge a complaint with the Information Regulator of South Africa

To exercise any of these rights, please contact our Information Officer at core@soco.energy. We will respond within 30 days.

The Information Regulator of South Africa can be reached at www.justice.gov.za/inforeg.

09

Cookies

Our website uses cookies and similar tracking technologies to improve user experience and gather analytics data. The types of cookies we use include:

Essential cookies: required for the website to function — cannot be disabled
Analytics cookies: help us understand how visitors interact with our site (e.g., pages viewed, session duration) — collected in aggregated, anonymised form
Preference cookies: remember your settings and choices for a better experience

We do not use advertising or tracking cookies to build profiles for third-party advertising purposes. You can control or disable non-essential cookies through your browser settings at any time.

10

Third-Party Links

Our website may contain links to third-party websites, platforms, or resources. This Privacy Policy applies only to SOCO ENERGY's own digital properties. We are not responsible for the privacy practices of external sites and encourage you to review their privacy policies before providing any personal information.

11

Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or business operations. The "last updated" date at the top of this page will indicate when the most recent revision was made. Where changes are material, we will notify you directly by email or via a prominent notice on our website.

Continued use of our website or services following any changes constitutes your acceptance of the updated policy.

12

Contact Us

If you have any questions about this Privacy Policy, wish to exercise your rights, or want to raise a concern about how we handle your personal information, please contact our Information Officer:

SOCO ENERGY (Pty) Ltd
313 Rivonia Road, Morningside, Sandton, Johannesburg
core@soco.energy

We are committed to resolving any complaint or concern promptly and fairly. If you remain unsatisfied after contacting us, you have the right to approach the Information Regulator of South Africa directly.