POPIA Compliance Notice

The responsible party (the entity that determines how and why your personal information is processed) is:

• Company: The Triangle Corporation (Pty) Ltd, trading as Hlela Workspace
• Registration number: 2026/328430/07
• Address: 12 Mysori Avenue, Azaadville, Gauteng, 1750
• Email: support@hlela.app

POPIA requires every responsible party to have a registered Information Officer. Ours is:

• Name: Imraan Patel
• Title: Director and Information Officer
• Email: popia_info_officer@trianglecorp.co.za
• Information Regulator registration number: 2026-062408

The Information Officer is responsible for ensuring that The Triangle Corporation (Pty) Ltdcomplies with POPIA and for handling data subject requests and complaints.

We process the following categories of personal information in order to provide the Hlela suite of platforms:

• Identity information: your first and last name
• Contact information: your email address
• Account credentials: your password, stored securely and never in readable form
• Location information: your approximate country of registration, derived from your IP address at the time of signup, used solely for pricing
• Usage data: booking records, certifications submitted, maintenance logs, and support ticket content created within your workspace
• Technical data: IP addresses, browser type and error logs (used for security and platform improvement)
• Payment data: payment outcomes and subscription status (card details are processed exclusively by Paystack and never stored by us)
• Uploaded documents: certification files and documents you upload to the platform

We process personal information only for the following specific, lawful purposes:

• To create and manage your account on Hlela platforms
• To provide the workspace management service you signed up for
• To process subscription payments and maintain billing records
• To send you transactional communications (booking confirmations, security alerts, certification updates)
• To enforce access control and role-based permissions within workspaces
• To monitor, maintain, and improve the security and performance of the platform
• To comply with legal obligations
• To respond to support requests and enquiries

We do not process your personal information for direct marketing, profiling, or sale to third parties.

Under POPIA, we process your personal information on the following lawful grounds:

• Contract: processing is necessary to perform the service you have signed up for (account creation, bookings, billing)
• Legitimate interest: security monitoring, error logging, and platform improvement
• Consent: push notification subscriptions (you opt in and can withdraw at any time)
• Legal obligation: where we are required to retain or disclose information by South African law

We use service providers ("operators" under POPIA) to process personal information on our behalf. Each is bound by a written agreement or its own terms to protect the information and use it only for our purposes.

• Payment processing: Paystack (may process data outside South Africa)
• Hosting and infrastructure: platform and database hosting
• Email delivery: transactional email
• Document storage: uploaded documents and images
• Monitoring: error and availability monitoring

Where personal information is transferred outside South Africa, we make sure appropriate safeguards are in place, in line with Section 72 of POPIA.

• Account information is retained for as long as your account is active
• If you are removed from your last workspace, your account is scheduled for permanent deletion after 10 days, after which all associated personal information is deleted
• Support ticket records may be retained for up to 12 months for quality and compliance purposes
• Payment records are retained for the period required by South African tax and financial regulations
• Error and security logs are retained for up to 90 days
• If a trial or subscription ends or lapses, workspace data is kept for 90 days and then permanently deleted, except records we must keep by law

We use appropriate technical and organisational measures to protect your personal information against loss, misuse and unauthorised access. These include access controls, encryption, monitoring and regular review of our practices. We limit access to personal information to the people who need it, and we require the same care from the service providers we use.

No system is completely secure. If a security incident affects your personal information we will notify you and the Information Regulator as the law requires.

Under POPIA, you have the following rights:

• Right to access: you may request a record of the personal information we hold about you (Form 2 of the POPIA Regulations)
• Right to correction or deletion: you may request that inaccurate, irrelevant, or outdated information be corrected or deleted
• Right to object: you may object to the processing of your personal information in certain circumstances
• Right to withdraw consent: where processing is based on consent (e.g. push notifications), you may withdraw at any time
• Right to complain: you may lodge a complaint with the Information Regulator of South Africa if you believe your rights have been violated

To exercise any of these rights, submit a written request to our Information Officer at popia_info_officer@trianglecorp.co.za. We will respond within a reasonable timeframe and no later than the period prescribed by POPIA.

If you are not satisfied with our response to a complaint or believe we have violated POPIA, you may contact the Information Regulator of South Africa:

• Website: justice.gov.za/inforeg
• Complaints email: complaints.IR@justice.gov.za