MitoGenix (PTY) LTD

Privacy Policy

Effective Date: 1 August 2026

1.Introduction

MitoGenix (PTY) LTD ("MitoGenix", "we", "us", "our") is committed to protecting your personal information and respecting your right to privacy. This Privacy Policy explains how we collect, use, store, share, and protect your personal information when you interact with us through our website, online store, email, WhatsApp, or any other channel.

This policy is issued in compliance with the Protection of Personal Information Act 4 of 2013 ("POPIA") and all other applicable South African data protection legislation. By visiting our website or purchasing from us, you acknowledge that you have read and understood this Privacy Policy and consent to the processing of your personal information as described herein.

We reserve the right to update this Privacy Policy at any time. Changes will be posted on this page with a revised effective date. Continued use of our website after any update constitutes your acceptance of the revised policy.

2.Information We Collect

We collect the following categories of personal information:

Contact and Account Details

• Full name, email address, phone number, and date of birth;
• Account login credentials including username and password;
• Identity or business registration number where applicable.

Order and Transaction Information

• Shipping and billing address, order history, and purchase records;
• Payment information — processed securely via third-party payment providers. We do not store your card details on our systems.

Device and Website Usage Data

• IP address, browser type, operating system, and device identifiers;
• Pages viewed, time spent on site, referring URLs, clickstream behaviour, and interactions;
• Cookie identifiers and similar tracking data (see Section 6).

Communications

• Queries, feedback, or messages submitted via email, WhatsApp, contact forms, or social media;
• Marketing preferences and opt-out records.

Where you provide us with personal information about a third party, you warrant that you have that person's consent to do so and that they are aware of this Privacy Policy.

3.How We Collect Your Information

We collect personal information through the following means:

• Directly from you when you register an account, place an order, complete a form, or contact us;
• Automatically through your use of our website via cookies, log files, web beacons, and analytics tools;
• From third-party service providers such as payment processors, courier partners, and analytics platforms;
• Through social media platforms when you engage with our content or use social login functionality;
• Where you partially complete a form or abandon a cart — we may use this information to follow up with you.

4.How We Use Your Information

We process your personal information only for lawful purposes, including:

• Fulfilling and managing your orders, including processing payments, arranging delivery, and issuing invoices and confirmations;
• Providing customer support and responding to queries via email, WhatsApp, or any other channel;
• Sending order updates, shipping notifications, and tracking information;
• Operating, maintaining, and improving our website, products, and services;
• Conducting internal analytics, statistical analysis, and fraud screening;
• Sending marketing communications and product information where you have consented — you may opt out at any time;
• Complying with our legal, regulatory, and contractual obligations;
• Detecting, preventing, and investigating fraud, security incidents, or unlawful activity.

We will never sell your personal information to third parties.

5.Sharing Your Information

We may share your personal information with the following categories of third parties, strictly for the purposes described in this policy:

• Payment processors and financial institutions, to facilitate secure transactions;
• Courier and logistics providers, to arrange delivery of your orders;
• IT, hosting, and e-commerce platform service providers;
• Analytics and marketing platforms (e.g. Google Analytics), to help us understand website usage and deliver relevant advertising;
• Legal and regulatory authorities, where disclosure is required by law, court order, or regulatory request — in such cases, only the minimum necessary information will be disclosed;
• Professional advisors including attorneys and auditors, for compliance and legal purposes;
• Any successor entity in the event of a merger, acquisition, or sale of business assets.

All third parties are contractually required to handle your personal information with strict confidentiality and in accordance with applicable data protection law. Where personal information is transferred outside South Africa, we ensure that appropriate safeguards are in place in line with POPIA requirements.

We do not share your personal information with third parties for their own marketing purposes without your explicit consent.

6.Cookies and Tracking Technologies

Our website uses cookies and similar technologies including log files, web beacons, and tracking pixels. These tools help us to:

• Recognise your device and remember your preferences;
• Analyse how visitors use our website and measure the effectiveness of our content and marketing;
• Deliver relevant advertising and retargeted marketing across platforms such as Google and Facebook;
• Detect and prevent fraud and security issues.

You may accept or decline cookies through your browser settings. Disabling cookies may affect the functionality of certain parts of our website. For guidance on managing cookies, visit www.allaboutcookies.org.

You may opt out of targeted advertising by adjusting settings on relevant platforms (e.g. Google Ads Settings, Facebook Ad Preferences) or by visiting the Digital Advertising Alliance opt-out portal at optout.aboutads.info.

We do not currently alter our data collection practices in response to browser "Do Not Track" signals.

7.Email and WhatsApp Communications

By providing your contact details and placing an order, you agree to receive transactional communications from us, including order confirmations, shipping updates, and customer service responses.

Where you have opted in to marketing, we may contact you by email, SMS, or WhatsApp with promotional content, product news, and special offers. You may withdraw this consent at any time by:

• Clicking the unsubscribe link in any marketing email;
• Replying STOP to any WhatsApp marketing message;
• Contacting us directly using the details at the end of this policy.

Opting out of marketing communications does not affect transactional messages related to your active orders.

8.Security and Storage of Your Information

We take all reasonable technical and organisational measures to protect your personal information against unauthorised access, loss, alteration, or disclosure, including:

• Encryption of payment card details and sensitive data during transmission;
• 3D Secure authentication required for online card transactions;
• Restricted access to personal information within our organisation on a need-to-know basis;
• Secure server environments with access controls and monitoring.

No method of electronic transmission or storage is completely secure. While we apply commercially reasonable safeguards, we cannot guarantee absolute security during internet transmission.

You are responsible for keeping your account password confidential. Do not share your password with anyone.

We retain your personal information for as long as is necessary to fulfil the purposes in this policy, comply with legal and regulatory obligations, and resolve any disputes. Certain records — such as tax and transaction records — are retained for a minimum of 5 (five) years in accordance with the Tax Administration Act 28 of 2011 and other applicable legislation. Once no longer required, information will be securely deleted or anonymised.

9.Minors

Our website and services are not intended for persons under the age of 18. We do not knowingly collect personal information from minors without parental or guardian consent. If we become aware that we have inadvertently collected information from a minor, we will take steps to delete that information promptly.

10.Your Rights Under POPIA

As a data subject under POPIA, you have the following rights regarding your personal information:

• Right of Access: Request confirmation of whether we hold your personal information and details of how it is processed.
• Right to Rectification: Request correction of any inaccurate or incomplete personal information we hold about you.
• Right to Erasure: Request deletion of your personal information, subject to our legal retention obligations.
• Right to Object: Object to processing in certain circumstances where consent is not required.
• Right to Withdraw Consent: Withdraw your consent to processing at any time, without affecting the lawfulness of prior processing.
• Right to Lodge a Complaint: Escalate concerns to the South African Information Regulator at www.justice.gov.za/inforeg/.

To exercise any of these rights, please contact us using the details at the end of this policy.

11.Social Media and Third-Party Platforms

Our website may contain links to third-party websites and social media platforms. This Privacy Policy does not apply to those platforms. We encourage you to review the privacy policies of any third-party site you visit, as we have no control over or responsibility for their information-handling practices.

Where you engage with our content on social media, information shared on those platforms is governed by the relevant platform's own privacy policy.

12.Lawful Basis for Processing

We process your personal information on the following lawful grounds under POPIA:

• Contract: Processing is necessary to fulfil your order or provide the services you have requested;
• Legal Obligation: Processing is required to comply with applicable law or regulatory requirements;
• Legitimate Interest: Processing is necessary for our legitimate business interests such as fraud prevention, security, and service improvement, where those interests are not overridden by your rights;
• Consent: Where none of the above apply, we will seek your explicit consent before processing your personal information.

13.Changes to This Privacy Policy

We may update this Privacy Policy periodically to reflect changes in our practices, legal requirements, or operational needs. The revised policy will be posted on our website with an updated effective date. Continued use of our website after any changes constitutes your acceptance of the updated policy.

Contact Us

For any questions, complaints, or requests relating to this Privacy Policy or your personal information, please contact our Information Officer: