Privacy Notice: Sasol Foundation Alumni Portal

We wish to inform you about the processing of your personal information by the Sasol Foundation Trust (the “Foundation”), which forms part of the Sasol Limited group of companies (“Sasol”), when you register for and use the Sasol Foundation Alumni Portal (“Alumni Portal”). This notice will provide you with details of processing activities you can

expect from us, how we will protect your information and your rights under the Protection of Personal Information Act, 2013 (‘POPIA’).

Who is responsible for processing personal information and who is the Data Privacy Officer?

The Foundation (also referred to as “we, us, our” in this document) is the responsible party relating to your Personal Information, meaning that we decide how we hold, use and secure your Personal Information.

Address: 50 Katherine Street, Sandton, South Africa, 2196.

For any enquiries, you can reach the Data Privacy Officer at privacy@sasol.com.

Which categories of Information do we use and collect?

We will collect and process the following personal information from you when you register for and sign up to the Alumni Portal:

Contact details and general identification information (first and last name,
photograph, email address, mobile number, identity or passport number, date of
birth, residential address);
Employment information (employment status i.e., current economic activity i.e.,
employed, not employed, studying further and if not employed, whether you are
currently seeking employment, employment sector, type of employment i.e., whether
part-time, full-time etc, income bracket, occupation level i.e., entry level, middle
management, senior management etc);
Education and bursary-related information (year in which bursary was provided to
your from Sasol, bursary status i.e., whether active, withdrawn or completed,
category of study for which the bursary was granted i.e., undergraduate or post-
graduate, the specific Foundation bursary programme under which the bursary was
extended to you, type of study i.e., whether degree or diploma, field of study, year of
graduation);
Gender, race; and
Interests.

For what purposes and on what legal basis is personal information processed?

Reconnecting with our bursary recipients / alumni is a key imperative to ensure that we meaningfully measure the impact that we make in people’s lives, and to further support our

alumni to become the best versions of themselves for a better society. In order to achieve these aims, we will process your personal information as either a current or historic bursary recipient, or currently alumnus, for the following purposes:

To create a profile of you when you register and enrol onto the Alumni Portal;
To measure the impact of the Foundation’s bursary programmes with a view to improving any deficiencies in our programmes for the benefit of society at large;
To ascertain the economic activity of our bursary recipients / alumni with a view to
exposing them to potential employment opportunities;
To expose you to valuable networking, career-building and volunteering opportunities;
To invite you to any events hosted by the Foundation; and
For any troubleshooting and support purposes related to your usage of the Alumni

Portal and, any errors and technical glitches you may experience. We may process your personal information, where we have your explicit consent to do so, to fulfil a legal or regulatory obligation, in your or our legitimate interest or where applicable, in terms of an agreement which we have entered with you.

If you fail to provide personal information

If you are unable to provide us with your personal information, we will not be able enrol you onto the Alumni Portal.

Who obtains your personal information?

Within the Foundation, your personal information will only be shared with the individuals who require access to information in order to facilitate the above-mentioned processing objectives e.g., administrators of the Alumni Portal with strict role-based access. We may also share your personal information with external third parties such as our agents (including event agencies), service providers or sub-contractors, but only to achieve purposes for which we collected your personal information. We have contractually bound

these agents, service providers and sub-contractors to implement appropriate privacy controls as well as appropriate technical and organisational security measures to securely

handle your personal information. In this regard, we have appointed The Social Collective to develop and manage the Alumni Portal on our behalf. Accordingly, The Social Collective will also process your personal information for the above purposes. To better understand how The Social Collective handles your personal information, you may refer to their privacy notice, accessible at https://alumni.sasol.thesocialcollective.co/privacy As the Foundation is part of Sasol, your personal information may be transmitted to specific

companies within the Sasol group of companies if they perform personal information processing tasks centrally for the companies in the group, including the Foundation.

Sharing your personal information outside of South Africa

We may share your personal information within the Sasol group, and this may involve transferring and processing your information outside of South Africa. We may also transfer

your personal information to a third-party recipient located outside of South Africa. When we transfer personal information outside of South Africa, we will ensure that it is afforded a similar degree of protection as POPIA. In this regard we will either:

have a binding agreement in place with the third-party recipient; or
transfer your personal information to a country that provides equivalent, or better, data protection legislation than South Africa.

How long is your personal information stored?

We will retain your personal information only for as long as is necessary for the purposes set out in this privacy notice or to comply with our legal obligations, resolve disputes, adherence to auditing requirements, and to enforce our legal agreements and policies. If you have opted-out of our initial request for you to register onto the Alumni Portal, we will retain your personal information for no longer than a year, where after it will be securely and

irretrievably destroyed. Personal information of alumni in respect of whom there is inactivity on the Alumni Portal for a period of 2 (two) years, will be securely and irretrievably deleted from the Alumni Portal.

Security Safeguards

We have implemented appropriate and reasonable, technical and organisational measures to prevent loss of, damage to, unauthorised use or destruction; and unlawful access to, or processing of your personal information. We endeavour to secure your personal information stored on our information systems and held in hard copy. Personal information contained in hard copy (paper) format, where applicable, is kept secure and safe in warehouses or lockable cupboards.

Which privacy rights can you assert as a data subject?

POPIA provides you with the certain rights in relation to the processing of your personal information, you have the right to request:

confirmation on whether the Foundation holds personal information about you;
access a record of your personal information;
correction or deletion of your personal information;
the Foundation to consider an objection to the processing of your personal information under certain circumstances; or
that the Foundation respects and effects your right to withdraw consent to the processing of personal information, where your consent was initially requested.

To exercise or find out more about your privacy rights, you can contact our Data Privacy Officer using the contact details above. It is important that the personal information we hold about you is accurate and current. Please keep us informed if your personal information changes during your relationship with

us. You may do so by updating your personal information on the Alumni Portal, where relevant.

Where can you complain?

If you believe that the Foundation is using your personal information contrary to POPIA, please contact our Data Privacy Officer mentioned above. If you are not satisfied with the

outcome, then you have the right to submit a complaint to the Information Regulator of South Africa using the following details below:

Tel: 012 406 4818

Fax: 086 500 3351

Email: complaints.IR@justice.gov.za

Amendment of this notice

We may update this notice from time to time. Any changes that we may make to this notice will be posted on the Alumni Portal and will be effective from the date of being published.

SASOL FOUNDATION TRUST: PRIVACY POLICY / EXTERNAL NOTICE

The protection of your personal data is important to the Sasol Foundation Trust (the "Foundation”"). The Foundation forms part of the Sasol Limited group of companies (“Sasol”) and its mandate and vision are to create impactful change through, among other aspects, access to quality education that enables sustainable economic participation in a changing society. The Foundation’s key strategic focus areas include corporate social investment (“CSI”) and community upliftment, early childhood education, STEM (Science, Technology, Engineering, Mathematics) in schools, technical education, tertiary education and psychosocial support.

Please take note of the following information pertaining to the collection and processing of your personal data based on your interactions with us, doing business with us, or whilst making contact with us via various channels, including making use of our online platforms. The Foundation collects, uses and allows access to your personal data in accordance with the laws pertaining to data privacy, such as South Africa’s Protection of Personal Information Act, 4 of 2013.

In this privacy policy, personal data (“data”) refers to all information that can be used to determine who you are (including juristic persons in South Africa), for example your name, your e-mail address, IP address and Identity number.

Responsible body and Data Protection office

The Foundation (also referred to as “we, us, our” in this document), is the data controller and therefore responsible for collection and processing of your personal data. The physical address of the head office of Sasol is Sasol Place, 50 Katherine Street, Sandton, South Africa, 2196. If you have any questions regarding our data processing activities, your rights or any of the contents of this privacy notice please contact our Group Privacy Office at privacy@sasol.com.

Our lawful reasons for processing your personal data

At the Foundation, we respect your privacy and value the trust which you place in us. As a result, we will only process your data when we have a valid reason do so. Our lawful reasons for processing your personal data will most commonly include:

Performance of contract, which includes processing of personal data required to enter into a contract with you, such as an agreement for funding in terms of our bursary and CSI programmes or CSI project implementation initiatives;
Compliance with a legal obligation on the Foundation, including but not limited to broadbased black economic empowerment (“BBBEE”) and BBEEE verification audit requirements relating to the Foundation’s social investment spend;
Where it is necessary for our legitimate interests (or those of a third party) and your privacy right(s) do not override those interests. For example, we may obtain reports from our CSI and project implementation partners to measure whether key performance indicators relating to the Foundation’s funding have been met, and to publish our “Sasol in Society” booklet (which contains information in the aggregate not identifiable to a specific individual or legal entity);
Where it is necessary for your legitimate interests (e.g., to advance funding to you in line with our corporate social investment strategic objectives);
We may also use your personal data in the following situations, which are likely to be rare:
where we need to protect your (or someone else’s) interests, or
where it is necessary in the public interest or for official purposes;
Under limited circumstances we may also process your personal data based on your consent; and
Operational reasons that include Access Control, Investigations and Access Permit/Card process (screening) when visiting one of the Foundation’s sites or premises. In regard to specific processing activities, we may provide supplementary privacy notices to facilitate transparency, where the lawful basis, purpose or processing activities may need further elaboration. We will only use your personal data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason, that is compatible with the original purpose. If we need to use your personal data for an unrelated purpose, we will notify you (by means of direct communication to you, revised privacy notice or other appropriate means) and we will explain the legal basis which allows us to do so.

The personal data we hold

Based on the lawful reasons above, we may collect, store, and use the following categories of personal data about you, whether you are a social investment beneficiary organisation (including a non-profit organisation or “NPO”), an individual recipient of funding under one of the Foundation’s CSI programmes, a social impact implementation partner or a supplier of products / services to the Foundation:

basic information, such as your name, your employer, your title or position and your relationship to a person;
contact information, such as your physical / business or residential address, email address and phone number(s);
financial information, such as bank account details and annual financial statements;
technical information (including your IP address), such as information from your visits to our website or any applications or in relation to materials and communications we send to you electronically;
Academic information such as academic transcripts and education history;
information you provide to us for the purposes of attending meetings and events, including access and dietary requirements;
identification and background information provided by you or collected by us as part of our business acceptance, due diligence and background screening processes, such as company or NPO registration number, shareholding, tax number, names and identity numbers of your directors if you are a juristic entity, criminal checks and “politically exposed person” screening, nationality and citizenship status;
details of your visits to the Foundation’s offices;
publicly available information in order to facilitate our business dealings with you and as part of our background and screening processes; and
any other information relating to you which you may provide to us.

How we use particularly sensitive personal data

“Special categories” of particularly sensitive personal data are afforded higher levels of protection. Reference to Special categories of data includes race or ethnic origin, trade union membership, political persuasion, health or medical information and criminal behaviour. We will only collect, store and/or use your personal data which falls within this category, if we have a valid justification for processing. As required by applicable law(s), we have appropriate policies and safeguards in place, when processing these categories of information. An example of such processing is BBBEE reporting, which takes place in the aggregate to ensure that the privacy and confidentiality of your sensitive personal data, are protected. We may process special categories of personal data under the following justifications:

in limited circumstances, with your explicit written consent;
where we need to carry out our legal obligations in terms of applicable laws and regulations or exercise rights in connection with any contract, we may have with you or the organisation for whom you work; or
where it is needed in the public interest. Less commonly, we may process this type of information where it is needed in relation to legal claims or where it is needed to protect your (or someone else’s) interests and you are not capable of giving your consent, or where you have already made the information public.

Data Sharing

We may have to share your personal data with various internal Sasol functions and various entities within the Sasol group who perform administration services on the Foundation’s behalf, as stated above (e.g. Sasol Forensic Services, Sasol Security Services, Sasol HR, Sasol Group Ethics, etc.), as well as various third parties, including third-party service providers who are engaged to perform services on our behalf such as product or service delivery, credit reference checks, background screening, anti-bribery and anti-corruption due diligence checks, or business scoring. Where appropriate, before disclosing personal data to a third party, we shall contractually mandate the third party to take adequate precautions to protect that data and to comply with applicable law. In the event of a merger/acquisition or company re-structure, your personal data may be part of the transferred assets and are likely to be disclosed to the new company.

Sharing Data with third parties

All our third-party service providers and all Sasol entities, especially Sasol South Africa Limited from whom the Foundation receives certain administration services (which include human resource, information technology, legal financial management and control and company secretarial services), are required to take appropriate security measures to protect your personal data in line with our policies. We do not allow our third-party service providers to use your personal data for their own purposes. We only permit them to process your personal data for specified purposes and in accordance with our instructions and applicable legal requirements. “Third parties” includes, but is not limited to, third-party service providers such as our BBEEE verification agents, project implementation partners and external auditors (including contractors and designated agents) and other entities within our group.

Transferring data globally

We may transfer your data globally, to perform any contract that we may have with you or for other legitimate reasons. For transfers of personal data to regions other than the European Union, we will ensure that appropriate safeguards are applied to the transfer such personal data. All personal data will be transferred according to applicable data privacy laws and our privacy policy. Details of such safeguards can be obtained from the Sasol Data Privacy Officer.

Data security

The Foundation strives to secure the confidentiality, integrity and availability of your personal data by taking appropriate and reasonable, technical and organisational measures to prevent loss of, damage to, unauthorised use or destruction, and unlawful access to, or processing of your personal data. To this extent, we have due regard to generally accepted information security practices and procedures, and a dedicated information security team, which constantly reviews and improves our personal data security measures. We endeavour to secure your personal data stored on the Foundation’s information systems and held in hard copy. Personal data contained in hard copy (paper) format is kept secure and safe in warehouses or lockable cupboards.

Data retention

We will only retain your personal data, in accordance with our records management policy. We will retain personal data for as long as it is necessary to fulfil the purposes for which we collected it or where we are legally entitled / obligated to do so. This includes for the purposes of satisfying any legal, accounting, auditing or reporting requirements. To determine the appropriate retention period for personal data, we consider the purpose for which we process personal data, the volume, the nature, and sensitivity of the personal data. We further consider the potential risk of harm from unauthorized use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements. Once we no longer have a lawful basis to process your personal data, we will securely destroy your data in accordance with our records management policy and applicable laws.

Processing you can expect from us via various touch points

Data processed when you visit our website
Processed data collected:

If you visit our websites your browser automatically transmits the following data:

Date, time and duration of the time you have spent viewing a page
Name of your Internet Service Provider
The referring website
The IP (Internet Protocol) address of your device/ workstation / computer
Your internet browser type and version
The operating system of your device / workstation / computer
Purposes of data processing:

It is necessary to store data for a limited period to be able to effectively deliver the website to your browser with the necessary functionality. With the help of this data we also obtain statistical information on how our websites are used. We also collect the data to secure, prevent and track access, or misuse of our websites and IT systems.

Cookies
Processed data:

When you visit our website, we collect data with the help of cookies. Cookies are small text files that are stored on your device. Cookies usually contain a cookie ID i.e. a unique identification feature that can be used to identify your browser. Depending on the kind of the cookie, different data is collected and processed. Our website uses Analysis cookies: With the help of these cookies we track your user behaviour when you use our websites, e.g. which parts of the websites you use, how often you visit our websites. We use third party cookies only.

Purposes of data processing:

Analysis cookies help us generate statistics on how our websites are used, for instance the number of requests, duration of the visits, which parts of our websites are the most popular. This helps us to measure how effective our presence on the Internet is, to evaluate the activity on the websites and coordinate website content and functionality to improve the user experience.

Retention period and controlling options:

Some of the cookies are deleted after the browser is closed (session cookies), while others remain permanently on your device and allow us to recognise your browser (permanent cookies). You can disable the storage of cookies or selectively accept certain cookies in your browser. Please use the Help functions of your browser to learn how to change these settings. Note this may result in limited functionality of our website.

Google Analytics
Processed data:

On our website we use "Google Analytics", a web analytics service of Google Inc. ("Google"). Google Analytics uses cookies on your device which assists in evaluating the use of our website (more information can be found here: https://policies.google.com/technologies/types)

We use the code "get. _anonymizeIP“. This results in Google shortening your IP address and allowing an anonymised evaluation. The reduction of IP addresses occurs within the EU or the European Economic Area. The IP address submitted by your browser as part of Google Analytics will not be merged with other Google data.

The data collected with the help of cookies is usually transferred to a Google server and stored there. See the Google Privacy statement [https://policies.google.com/privacy] for more information.

Purposes of data processing:

On our behalf, Google uses the data collected through Google Analytics to evaluate the use of our website, to compile reports on the website activities and to provide further information related to the use of the website.

Legal basis:

Data is processed based on your consent. You consent by clicking the button on our cookie banner.

Retention period and controlling options:

Data is stored for a period of 14 months. You can prevent the storage of the Google Analytics cookies by a corresponding setting in your browser. This may restrict the functionality of our website. You may also prevent the collection of data generated by cookies and use of the website (including your IP address) by Google and the processing of such data by Google by not selecting Marketing cookies located on our cookie banner, this will place an opt-out-cookie on your browser. Learn more by clicking on the following link: https://policies.google.com/technologies/managing

Links to the Foundation and Sasol social media pages

The Foundation and Sasol have links to their various social media pages. If you visit these websites the Privacy Policy and Terms and Conditions of the specific website apply.

Data collected when you contact us
Processed data:

When you contact us via a contact form, via email or phone, we process the personal data you communicate to us, e.g. your name, your email address and your request. The data will be stored in a Sasol and / or Foundation repository. The data marked as mandatory must be provided to action your request. Refusal to provide certain information may result in the Foundation being unable to action your request.

Purposes of data processing:

We use your data to process and respond to your request.

Legal basis:

We process data to take steps to fulfil your request, as it relates to our business activity.

Retention period:

We store your data if it is necessary to fulfil the purposes mentioned above. Should the business activity referred to above result in the conclusion of a contract or other business relationship which you are party, your data may be stored as necessary according to that contract.

Your rights and duties

Privacy a fundamental right

At the Foundation, we respect your fundamental right to Privacy. Your trust and confidence are of paramount importance to us. Please see your privacy rights below, relating to the use of your personal data which may be exercised under certain circumstances.

Right to withdraw your consent:

You may withdraw your consent to the processing of your personal data at any time. Please note that the revocation does not affect the legality of the data processed thus far. As far as we process personal data for direct marketing purposes you have the right to object at any time.

Right to object:

You may object to processing of your personal data where we are relying on a legitimate interest and there is something about your situation which makes you want to object to processing on this ground.

Right to access:

This right enables you to access the personal data we hold about you and to check that we are lawfully processing it.

Right to correction

The right enables you to have any incomplete or inaccurate information we hold about you corrected.

Right to data portability

Under certain circumstances you may have the right to request the facilitation of a transfer of your personal data to another party.

Right to Deletion

This enables you to ask us to delete or remove personal data where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal data where you have exercised your right to object to processing.

Your Duties

As the party responsible for the lawful processing and security of your personal, we endeavour to treat your personal data according to this privacy policy, applicable law and international best practice. In order to facilitate the protection of your personal data, you have the following duties:

duty to inform us when there are changes to your personal data;
duty to safeguard your personal data; and
duty confirm your identity in order to action your rights.

Contact point for asserting your rights:

Should you wish to exercise any of the privacy rights above, you can direct your queries to privacy@sasol.com. Our dedicated team would appreciate any comment or complaint, on this privacy policy, or our privacy practices as whole, to assist us with ensuring we respect your privacy as you would reasonably expect.

Right to contact a supervisory authority:

You can file a claim with the respective data privacy supervisory authorities if you believe that our data processing does not meet the legal requirements, or we did not facilitate the exercise of your rights in the accordingly. Contact details for your local Information Regulator can be found on the internet or by requesting them from the Sasol Data Privacy Officer.

Updates

We reserve the right, at our sole discretion, to modify, add or remove sections of this privacy notice at any time and we will notify you of any changes. This privacy notice (and any updates to or amended versions of this privacy notice) will be published on the Foundation’s website as well as any other channels we may find appropriate.