PRATST PRIVACY POLICY

Last updated: July 2026

1. INTRODUCTION

1.1 PRATST (registration number 2026/254332/07) ("PRATST", "we", "us", "our") is committed to protecting your privacy and handling your personal information in accordance with the Protection of Personal Information Act 4 of 2013 ("POPIA") and other applicable South African laws.

1.2 This Privacy Policy explains:

• What personal information we collect;
• How we use, store, and protect your information;
• Who we share it with;
• Your rights regarding your information; and
• How to contact us.

1.3 By using the Site (PRATST.com) and our services, you consent to the processing of your personal information as described in this Privacy Policy. If you do not agree, please do not use our Site.

1.4 This Privacy Policy forms part of our Terms & Conditions, available at https://pratst.com/terms-conditions.

2. WHO WE ARE AND HOW TO CONTACT US

2.1 Responsible Party: PRATST (registration number 2026/254332/07)

2.2 Registered Address: Mount Redfield Road, Midlands, Midstream Estate, Centurion, 1692, South Africa

2.3 Information Officer: We have appointed an Information Officer who is responsible for overseeing questions in relation to this Privacy Policy. If you have any questions, including any requests to exercise your legal rights, please contact us at support@pratst.com for:

• Privacy queries
• Data subject requests
• General support

3. WHAT PERSONAL INFORMATION WE COLLECT

We collect personal information in the following categories:

3.1 Information you provide directly

Identity and Contact Data

Examples: Full name, username, email address, phone number, physical address.
Purpose: Account creation, communication, verification.

Profile Data

Examples: Biography, profile picture, social media links, skills, experience.
Purpose: Displaying your profile, connecting with other users.

Financial Data

Examples: Bank account details (for Licensor withdrawals), payment gateway tokens.
Purpose: Processing payments and withdrawals.

Licensor Content

Examples: Beats, audio files, studio listings, service descriptions.
Purpose: Facilitating transactions on the Site.

Transaction Data

Examples: Purchase history, licence details, booking records.
Purpose: Managing transactions and dispute resolution.

Communications

Examples: Messages sent through the Site, emails, support tickets.
Purpose: Providing support and facilitating communication.

Verification Data

Examples: Identity documents (where required).
Purpose: Preventing fraud and verifying identity.

3.2 Information we collect automatically

Device and Browser Data

Examples: IP address, browser type, operating system, device type.
Purpose: Analysing usage, improving our Site, security.

Usage Data

Examples: Pages visited, time spent, actions taken.
Purpose: Improving user experience, analytics.

Cookie Data

Examples: Session cookies, persistent cookies, analytics cookies.
Purpose: Site functionality, personalisation, analytics.

Location Data

Examples: Approximate location derived from IP address.
Purpose: Analytics and fraud prevention.

3.3 Information from third parties

PayFast

Payment confirmation, transaction status.

Google Analytics

Anonymous usage statistics.

Social media (if you link accounts)

Public profile information.

4. LAWFUL BASIS FOR PROCESSING

Under POPIA, we must have a lawful basis for processing your personal information. We rely on the following grounds:

Consent

When you voluntarily provide information (e.g., creating a profile, subscribing to marketing).

Contractual necessity

To provide our services (e.g., processing payments, fulfilling licence agreements).

Legal obligation

To comply with laws (e.g., tax records, court orders).

Legitimate interest

To improve our services, prevent fraud, and protect our users (we balance this against your rights).

5. HOW WE USE YOUR INFORMATION

We process your personal information for the following purposes:

5.1 To create and manage your account.

5.2 To facilitate transactions, including:

• Processing beat licence purchases;
• Processing studio bookings and sound engineer services;
• Crediting Wallets and processing withdrawal requests;
• Managing payments through PayFast.

5.3 To communicate with you, including:

• Sending transaction confirmations;
• Responding to support queries;
• Sending service updates and administrative messages;
• Sending marketing communications (only with your consent).

5.4 To operate and improve the Site, including:

• Analysing usage patterns;
• Troubleshooting technical issues;
• Enhancing security;
• Customising your experience.

5.5 To comply with legal obligations, including:

• Keeping records as required by tax and company law;
• Responding to court orders or lawful requests from authorities;
• Preventing fraud and illegal activity.

5.6 To enforce our Terms & Conditions and protect our rights.

6. WHO WE SHARE YOUR INFORMATION WITH

We share your personal information only as necessary and in accordance with this Privacy Policy:

6.1 Service Providers

We engage third-party service providers to help us operate the Site:

PayFast

Purpose: Payment processing.
Data shared: Transaction data, payment amounts, email address.

Google Analytics

Purpose: Website analytics.
Data shared: Anonymous usage data, IP address (anonymised).

Hosting provider

Purpose: Website hosting.
Data shared: All data stored on our servers.

6.2 Other Users

6.2.1 Your profile information (name, bio, services) is visible to other Users of the Site.

6.2.2 When you transact with another User (Licensor or Licensee), relevant information is shared to complete the transaction, including:

• Your username and contact details (for communication);
• Transaction history and licence terms.

6.3 Legal and Regulatory Authorities

We may disclose your personal information if required by law, court order, or government regulation, or if we reasonably believe it is necessary to:

• Protect our rights or property;
• Prevent fraud or illegal activity; or
• Ensure the safety of our users.

6.4 Business Transfers

If PRATST is involved in a merger, acquisition, or sale of assets, your personal information may be transferred as part of that transaction. We will notify you of any such change.

7. HOW WE PROTECT YOUR INFORMATION

7.1 We take data security seriously and implement appropriate technical and organisational measures to protect your personal information, including:

Encryption

SSL/TLS encryption (SHA 256) for data transmitted between your browser and our servers.

Access controls

Restricted access to personal information — only authorised staff who need it for their role.

Secure storage

Financial data is tokenised and stored by PayFast; we do not store card details.

Staff training

Staff are trained on data protection and confidentiality obligations.

7.2 Despite our efforts, no method of transmission over the internet is 100% secure. We cannot guarantee absolute security, but we continually work to improve our security measures.

7.3 You are responsible for keeping your account credentials confidential. Please notify us immediately of any unauthorised access to your account.

8. HOW LONG WE KEEP YOUR INFORMATION

8.1 We retain personal information only for as long as necessary for the purposes set out in this Privacy Policy, or as required by law.

Account information

Duration of your account plus 5 years after closure (for record-keeping and dispute resolution).

Transaction records

5-7 years (as required by tax and company law).

Licensor Content

Duration of your account, or until you remove it.

Communications

3 years (for support and dispute resolution).

Marketing data

Until you withdraw your consent.

Usage analytics

26 months (Google Analytics retention period).

8.2 We may keep anonymised or aggregated data indefinitely for analytical purposes, as it no longer identifies you.

8.3 When information is no longer needed, we will securely delete or destroy it.

9. YOUR RIGHTS UNDER POPIA

As a data subject, you have the following rights under POPIA:

Right of access

You may request access to the personal information we hold about you. Contact support@pratst.com.

Right to rectification

You may request correction of inaccurate or incomplete information. Update your profile or email us.

Right to deletion

You may request deletion of your personal information (subject to legal obligations). Email support@pratst.com.

Right to withdraw consent

You may withdraw consent for processing based on consent. Email support@pratst.com.

Right to object

You may object to processing based on legitimate interests. Email support@pratst.com.

Right to lodge a complaint

You may lodge a complaint with the Information Regulator. Visit www.inforegulator.org.za.

9.1 To exercise any of these rights, contact our Information Officer at support@pratst.com.

9.2 We will verify your identity before processing your request to protect your information.

9.3 We aim to respond to all legitimate requests within 30 days. If your request is complex or numerous, we may extend this period by 30 days and will inform you of the extension.

9.4 In most cases, access to information is free. However, we may charge a reasonable fee if your request is repetitive, excessive, or manifestly unfounded.

10. COOKIES

10.1 We use cookies and similar tracking technologies on the Site. Cookies are small text files placed on your device to collect standard internet log information and visitor behaviour information.

10.2 We use the following types of cookies:

Essential cookies

Enable core functionality (logging in, shopping cart, security). You cannot opt out of these.

Functionality cookies

Remember your preferences and settings to personalise your experience.

Analytics cookies

Collect anonymous information about how visitors use our Site (via Google Analytics).

Marketing cookies

Track your browsing to deliver relevant advertising (only with your consent).

10.3 You can control and manage cookies through your browser settings. However, disabling essential cookies may affect the functionality of the Site.

10.4 For more information about cookies, visit www.allaboutcookies.org.

11. THIRD-PARTY LINKS AND SERVICES

11.1 Our Site may contain links to third-party websites, services, or social media platforms. We do not control these third parties and are not responsible for their privacy practices.

11.2 This Privacy Policy does not apply to third-party websites. We encourage you to read their privacy policies before providing any personal information.

12. INTERNATIONAL DATA TRANSFERS

12.1 We do not knowingly transfer personal information to countries outside South Africa.

12.2 However, some of our service providers (such as Google Analytics) may process data on servers located outside South Africa. Where this occurs, we ensure appropriate safeguards are in place.

13. MARKETING COMMUNICATIONS

13.1 We will only send you marketing communications (such as newsletters, promotions, and offers) with your explicit consent.

13.2 You may withdraw your consent at any time by:

• Clicking the "unsubscribe" link in any marketing email; or
• Contacting us at support@pratst.com.

13.3 Even if you opt out of marketing communications, we may still send you service-related messages (e.g., transaction confirmations, account updates).

14. CHILDREN'S PRIVACY

14.1 Our Site is not directed at children under the age of 18.

14.2 We do not knowingly collect personal information from anyone under 18. If we become aware that we have collected personal information from a child under 18 without parental consent, we will take steps to delete it.

14.3 If you are a parent or guardian and believe your child has provided us with personal information, please contact us at support@pratst.com.

15. CHANGES TO THIS PRIVACY POLICY

15.1 We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated "Last updated" date.

15.2 For material changes, we will provide at least 30 days' notice by email and/or a prominent notice on the Site.

15.3 Your continued use of the Site after changes take effect constitutes acceptance of the revised Privacy Policy.

16. COMPLAINTS AND INFORMATION REGULATOR

16.1 If you believe we have not complied with this Privacy Policy or POPIA, you have the right to lodge a complaint with the Information Regulator of South Africa:

Website

www.inforegulator.org.za

Email

complaints@inforegulator.org.za

Telephone

012 406 4818

Address

JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001

16.2 We encourage you to contact us first so we can resolve your concern directly.

17. CONTACT US

If you have any questions, concerns, or requests regarding this Privacy Policy or your personal information, please contact our Information Officer:

Email: support@pratst.com
Postal address: Mount Redfield Road, Midlands, Midstream Estate, Centurion, 1692, South Africa