Privacy Policy

1. Introduction

This Privacy Policy explains how Rhumb (Pty) Ltd (“we”, “us”, “our”, the “Owners”) collects, uses, shares and protects Personal Information through the Rhumb mobile app and advisor web portal (together, the “App”).

Capitalised terms used but not defined here (including “Personal Information”, “Processing”, “Responsible Party” and “Operator”) have the meaning given to them in POPIA (the Protection of Personal Information Act 4 of 2013) and in our Terms & Conditions, which this Policy should be read together with.

The App connects licensed Financial Advisers with their Clients, so this Policy covers both types of User.

2. Who This Policy Applies To

This Policy applies to Financial Advisers and Clients who use the App, and to visitors to the advisor web portal's public pages (such as the login and sign-up screens).

For Client Personal Information, the Financial Adviser who invited that Client is the Responsible Party under POPIA. We act as an Operator, processing that information on the adviser's behalf, solely to provide and maintain the App.

3. Information We Collect

We collect only what is needed to operate the App:

• Account information: full name, email address, and password (your password is managed by our authentication provider and is never visible to us in plain text).
• Contact details: phone number (Advisers and Clients), and, where provided, a Client's age and city.
• Adviser profile details: brokerage name, a profile photo, and a brokerage logo, where an Adviser chooses to upload them.
• Financial goal data: the goals a Client and Adviser set up together, including goal type, target amounts, contribution amounts, frequency, and each logged contribution (amount, date, and any note attached to it).
• Usage information: when a Client was last active in the App, and high-level engagement events (such as logging a contribution), used to help Advisers see which Clients may need a check-in.
• Communications: any messages, notes or documents Users choose to exchange or upload through the App.

4. How We Collect Information

Most information is provided directly by you — when an Adviser creates an account, invites a Client, sets up a goal, or uploads a profile photo, and when a Client accepts an invite, completes onboarding, or logs progress toward a goal.

Some information (such as when you were last active) is generated automatically by the App as you use it.

5. How We Use Information

We use Personal Information to:

• Create and administer Adviser and Client accounts;
• Enable goal tracking and progress logging between a Client and their Adviser;
• Let an Adviser and their linked Client see each other's relevant goal and progress information;
• Send in-app and device reminders about upcoming or overdue goal contributions;
• Maintain the security of the App and prevent fraud or unauthorised access;
• Comply with legal and regulatory obligations; and
• Understand how the App is used so we can maintain and improve it.

6. Sharing of Information

We do not sell Personal Information, and we do not share it with advertisers.

Within the App, a Client's goal and progress information is visible to the Financial Adviser they are linked to, and an Adviser's profile (name, brokerage, contact details they choose to display) is visible to their own Clients. This sharing is core to how the App works and is described in our Terms & Conditions.

We share Personal Information with service providers who process it on our behalf solely to operate the App, currently:

• Supabase (database, authentication, and file storage) — our infrastructure provider;
• Vercel (web hosting for the advisor portal).

7. Cross-Border Transfer

Our database infrastructure is hosted in the European Union (Ireland). This means Personal Information is processed outside South Africa.

Where this occurs, we take reasonable steps to ensure the recipient is subject to a level of data protection that is substantially similar to POPIA, and that the information is processed only as we have instructed.

8. Data Security

All data sent between the App and our servers is encrypted in transit (HTTPS/TLS).

Access to data within our database is restricted so that a Client can only see their own information and that of their linked Adviser, and an Adviser can only see the information of their own Clients — enforced at the database level, not just in the App's interface.

No method of storage or transmission is completely secure. We take reasonable technical and organisational measures to protect Personal Information but cannot guarantee absolute security.

9. Data Retention

We retain Personal Information only for as long as reasonably necessary to provide the App, comply with our legal obligations, resolve disputes, and enforce our agreements.

If a Client's account is removed by their Adviser, or a User closes their account, associated goal and progress records are deleted along with it, other than information we are required to retain by law.

10. Your Rights

Clients should generally direct requests about their own goal data to their Financial Adviser first, since the Adviser is the Responsible Party for that information. You can also contact us directly using the details in Section 13.

Subject to applicable law, you may request to:

• Access the Personal Information we hold about you;
• Correct inaccurate or outdated information;
• Request deletion of your account and associated information;
• Object to certain processing of your information.

11. Children's Privacy

The App is intended for use by Financial Advisers and their adult Clients. It is not directed at, and we do not knowingly collect Personal Information from, children.

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes to the App or our legal obligations. We will update the “Effective date” below when we do. Continued use of the App after a change constitutes acceptance of the updated Policy.

13. Contact Us

Questions about this Privacy Policy, or requests relating to your Personal Information, can be directed to:

Marco Knoop and Jobrie du Preez

Email: adviserclientcompass@gmail.com

Physical Address: [INSERT]

Telephone: [INSERT]