Effective Date: 1 February 2026 | Jurisdiction: Republic of South Africa | Governing Legislation: Protection of Personal Information Act 4 of 2013 (POPIA) and the POPIA Regulations (GN R1383 of 2018); Electronic Communications and Transactions Act 25 of 2002 (ECT Act); Promotion of Access to Information Act 2 of 2000 (PAIA)

This Privacy Policy explains how HeadsUp (Pty) Ltd collects, uses, stores, and shares your personal information, and what your rights are under South African law. It forms part of our Terms of Service. By using the HeadsUp platform, you confirm that you have read and understood this policy.

1. Who We Are — The Responsible Party

HeadsUp (Pty) Ltd ("HeadsUp", "we", "us") is the responsible party as defined in POPIA. We determine the purpose and means of processing your personal information.

Contact for privacy matters: Email: info@headsup.community | Web: headsup.community | Location: Braamfontein, Johannesburg, South Africa

HeadsUp has designated a senior executive as Acting Information Officer as contemplated in section 55 of POPIA, pending formal registration of a dedicated Information Officer with the Information Regulator of South Africa. All data protection accountability obligations currently vest in the Acting Information Officer, who may be contacted at info@headsup.community. HeadsUp undertakes to register a dedicated Information Officer with the Information Regulator within a reasonable period, in compliance with section 55 of POPIA and the POPIA Regulations.

2. What Personal Information We Collect

We collect only what is necessary for the purposes described in this policy.

2.1 Information You Provide Directly

• Identity and contact information — your name, phone number, and email address, collected when you register or access the platform
• User-generated content — reports, tips, location observations, alerts, confirmations, and any other content you submit to the platform

2.2 Information Collected Automatically

• Location data — general location context you share when submitting reports or accessing location-based features; we do not require or store continuous real-time location tracking
• Device and usage data — device type, operating system, interaction timestamps, and feature usage patterns, collected automatically for platform performance and analytics

2.3 Information from Partners and Institutions

Where you access HeadsUp through a partner organisation (such as a student residence or employer), we may receive basic access or verification data from that partner to activate your access tier. This data is used only for that purpose.

3. Why We Process Your Information — Lawful Basis