HENRY CONSUMER PRIVACY NOTICE

Effective Date: 24 August 2026
Version: 1

This notice explains how Henry AI (Pty) Ltd, registration number 2023/620906/07, trading as Henry, Henry AI, Henry Ingest, Henry Insights and Henry Exchange (Henry, we, us or our), handles personal information when a person enters or is referred into a Henry-enabled product, matching or transaction journey. It supplements the Privacy Policy and Henry Exchange Product and Processing Schedule. If another organisation provides a product or controls part of the journey, its privacy notice also applies to that processing.

This notice is not blanket consent. Apart from the limited, lawfully authorised preliminary matching described below, Henry will display the available product categories and obtain the required product choice before using or disclosing information for a selected product journey.

Standard and Enterprise arrangements: The standard position described in this document applies unless a signed Enterprise Annex expressly varies an eligible, identified contractual matter. Where legally and operationally available, any enhanced or non-standard scope, service level, support, infrastructure, assurance, reporting, implementation or other commitment must be separately requested, assessed, approved and priced under the Enterprise Agreement. An Enterprise Annex cannot alter statutory rights or mandatory legal obligations.

1. Who Henry Is

Henry AI (Pty) Ltd, registration number 2023/620906/07, trading as Henry, Henry AI, Henry Ingest, Henry Insights and Henry Exchange, provides technology, preliminary eligibility matching, product presentation, routing, workflow and transaction support. Henry may also provide a Henry-controlled product where the relevant product notice identifies Henry as the provider.

Henry's contact details are:

2. How Information Reaches Henry

2.1. Henry may collect information directly through a Henry website, form, application, campaign or communication.

2.2. Henry may also receive information from the named business, lead provider, dealership, platform, tenant, referral partner or other organisation through which the person made, continued or was referred in connection with a request. Henry will identify the source where reasonably practicable and required by law.

2.3. Before supplying a lead, the source organisation is responsible for its own collection, lawful basis, privacy notice, information quality and authority to disclose the information to Henry. It must provide Henry with its applicable privacy notice or identify a current public version and must warrant that its disclosure is lawful. Henry does not control the source organisation's conduct before Henry receives the information and does not accept responsibility for that organisation's independent processing.

2.4. Henry remains responsible for the processing that Henry determines after receipt. Henry may request supporting evidence, restrict, quarantine, reject or stop processing where Henry reasonably suspects missing authority, unlawful processing, inaccurate provenance or a material privacy or security risk.

3. Information Henry May Process

Depending on the selected product and stage, Henry may process:

• identity, contact, residential, demographic and verification information;
• employment, income, expenses, affordability, bank-statement, bank-account, application and outcome information;
• vehicle requirements, identifiers, ownership, status, valuation and transaction information;
• product selections, consent, notice, source, referral, matching, routing and recipient information;
• quotations, offers, decisions, fulfilment, commission, payment and reconciliation information;
• communications, documents, files, images and information supplied through approved integrations; and
• device, authentication, usage, audit, fraud-prevention and security information.

Henry seeks to use only the information reasonably necessary for the relevant stage and selected product. Additional financial or regulated information should ordinarily be requested only when needed for the applicable product or provider.

4. Preliminary Matching Before Product Choice

4.1. Henry may perform limited preliminary validation, eligibility screening and matching after receiving a lead so that Henry can identify which product categories or alternatives appear potentially relevant. This processing must be covered by the source organisation's warranted authority to disclose the lead for preliminary Henry matching or by another documented lawful ground approved for the workflow.

4.2. Preliminary matching does not guarantee suitability, availability, approval, price or a product outcome. It is intended to determine which choices may be presented. Henry will not disclose the application to a product provider for an unselected product merely because a potential match was identified.

4.3. Henry may receive a failed loan application and, where appropriate, rely on a documented legitimate-interest assessment for limited internal matching and neutral presentation of potentially relevant alternatives. This ground does not apply merely because an application is incomplete. Henry must record the purpose, necessity, expected benefit, reasonably foreseeable impact and safeguards before the matching begins. Legitimate interests do not by themselves permit unsolicited electronic direct marketing or disclosure to a product provider. An alternative will not be pursued unless the person selects the relevant displayed product category or the existing recorded choice already clearly covers that materially consistent product, purpose, information and recipient category.

5. Product Categories and Consent

5.1. The available interface may present product categories such as Financing, VAPS, Rent to Own, Financial Health and other approved categories. The actual categories, included product types and providers must be displayed or meaningfully described before the person confirms the selection.

5.2. A person may select one, several or all displayed categories, subject to eligibility and product dependencies. Henry records the selected categories and any subsequent withdrawal or change.

5.3. A selected category may cover materially consistent alternatives that were clearly included in its description. For example, an appropriately described Financing category may include vehicle finance, asset-based lending and personal-loan alternatives. Consent does not extend to an undisclosed or materially different purpose, recipient category, information requirement or product merely because Henry later places it under the same label.

5.4. Henry will request a new choice before processing for a materially different product category or materially expanding the purpose, information or recipient set. Declining one category does not prevent a person from proceeding with another selected category, although eligibility or technical dependencies may affect availability.

5.5. Consent may be withdrawn through the available interface or legal@henryai.co.za. Withdrawal stops future consent-based processing within Henry's control for the affected category but does not invalidate prior lawful processing, compel an independent Responsible Party to delete a record it must lawfully retain, or reverse a disclosure already lawfully completed.

5.6. By affirmatively accepting this Notice and submitting a request, the person agrees that Henry and the approved dealers, lenders, product providers, referral partners and other participating organisations involved in the person's selected product journey may contact the person through the communication channels selected in the application. Contact must be reasonably necessary to understand, assess or assist with the request; verify or complete information; provide a quotation or decision; answer questions; arrange fulfilment; give status or outcome information; or complete or support the selected transaction. The application will identify Henry and meaningfully describe the relevant participant categories, selected purpose and communication channels before acceptance. Henry will identify the actual participant in the application before or when that participant first communicates.

5.7. Acceptance under Section 5.6 authorises only reasonable contact relating to the selected request or transaction. It does not authorise unrelated promotion or unrestricted contact. If the person wishes to receive direct marketing from Henry, the person must make a separate optional choice that identifies Henry, the specified Henry goods or services and each selected electronic communication channel. Marketing consent is not required to receive the selected product or application assistance and may be withdrawn at any time. A participant that wishes to send its own direct marketing must establish its own lawful authority and may not rely on Section 5.6 or Henry's marketing consent.

5.8. The person will be presented with the following separate choices:

Required — Application assistance: By accepting this Notice and submitting my request, I agree that Henry and the approved participating organisations shown to me for my selected request may contact me through the channels I select, only where reasonably necessary to understand, assess, assist with, fulfil or support that request or transaction. I understand that the actual sender will be identified and that this is not consent to unrelated marketing.

Optional — Henry marketing: I agree that Henry may send me marketing about the Henry goods or services described with this choice through the channels I select. I understand that this choice is optional, is not required to submit my request or receive application assistance, and may be withdrawn at any time using the free opt-out route.

The application will show the selected product or request, participating organisation or meaningful participant categories, Henry goods or services covered by the marketing choice, and available communication channels with the applicable choice. Neither choice will be preselected.

6. Henry's Role

6.1. Henry is a Responsible Party for processing whose purpose or essential means Henry determines, including:

• direct collection through Henry channels;
• Henry-controlled preliminary validation, eligibility matching, product presentation and routing;
• recording and administering Henry product choices, notices and consent;
• deciding the approved participant network, matching logic, ranking or routing used by Henry;
• a product for which the applicable notice identifies Henry as product provider; and
• Henry's platform administration, security, fraud prevention, compliance and legal records.

6.2. Henry may act as Operator where a tenant uses Henry's system to offer and administer its own product, determines the product purpose, rules, eligibility, decision and recipients, and Henry follows that tenant's lawful documented instructions without determining those matters independently.

6.3. If Henry and another organisation jointly determine a purpose or essential means, their respective responsibilities must be recorded for the approved workflow. A contractual or interface label does not override the parties' actual conduct.

7. Dealers, Lenders and Other Product Providers

7.1. Subject to the recorded product choice, Henry may make the minimum necessary user, vehicle and application information available through the Henry platform to approved dealers, lenders, finance participants or other product providers for qualification, quotation, assessment, fulfilment or transaction purposes.

7.2. A participant that independently evaluates an application, applies its own eligibility, affordability, underwriting, pricing or product rules, meets its own legal duties or supplies its own product is an independent Responsible Party for that processing. Its privacy notice and statutory disclosures apply. It may become an independent Responsible Party before a transaction closes even where communications remain within Henry's platform.

7.3. Henry withholds direct consumer contact details from a participant until the applicable transaction closes through Henry. Before closure, approved participant communications must occur through the Henry platform and may concern only the selected product and active application. Withholding contact details does not change the participant's legal responsibility for identifiable information it independently processes in the platform.

7.4. Henry provides technology, matching, routing and workflow support. Unless a product notice expressly states otherwise, Henry is not the lender, credit provider, insurer, underwriter or financial adviser and does not make the participant's regulated product decision or guarantee approval.

8. Communications and Marketing

8.1. Subject to the contact choice in Section 5.6 or another lawful ground, Henry may send communications reasonably necessary to verify identity, present and record product choices, request missing information, administer a selected product, provide status and outcome information, operate the platform, prevent fraud, protect security and close or support the requested journey. Henry determines reasonable product-specific reminder limits and may stop reminders when an application is completed, withdrawn, inactive or closed.

8.2. An approved tenant or other participant may communicate with the person through the Henry platform about the selected product and active application as permitted by the approved workflow and Section 5.6 contact choice. Where reasonably necessary to assist with the same request or transaction, Henry may also enable approved tenants and participants to communicate with one another through the application. Each message must identify the sender, remain relevant and proportionate to the active journey, and be available only to participants authorised for that conversation. These communications may not be used to conceal unrelated promotion.

8.3. An invitation concerning an unselected or materially different product is not treated as ordinary administration of the selected product. Henry may market Henry's specified goods or services to the person only where permitted by POPIA and supported by Henry's recorded consent or other applicable authority. Where a non-customer's consent is required for electronic direct marketing, Henry will use the prescribed Form 4 or a substantially similar form and will not repeat the consent request. Operational and promotional content and choices must remain separate.

8.4. Henry's marketing authority covers Henry as the identified sender only. A dealer, lender or other product provider is responsible for establishing and recording its own authority for its independently determined marketing. Receiving an application or concluding a transaction does not give a participant unrestricted marketing rights. Each marketing sender must identify itself and provide the legally required free objection or opt-out route.

9. Accuracy, Correction and Deletion

9.1. Henry maintains the current Henry-platform record. A person may ask Henry to correct information held by Henry. Henry will record a verified correction and notify affected active recipients where reasonably necessary and legally required. Henry does not warrant that an independently maintained source or recipient system will automatically update, and each independent Responsible Party remains accountable for its own records.

9.2. A deletion request applies to records within each Responsible Party's control and is subject to lawful retention, proof, security, fraud, dispute, financial and regulatory requirements. Henry will delete, de-identify or restrict Henry-controlled information where required and will notify affected tenants or recipients where applicable. Henry may coordinate the request but does not promise to erase an independent Responsible Party's lawfully retained copy.

9.3. Retention periods and exceptions appear in the Retention, Deletion and De-identification Schedule. Henry may retain limited source, notice, consent, routing, transaction, security, dispute and suppression evidence after ordinary product use ends where lawfully necessary.

10. Security, Providers and International Processing

10.1. Henry applies risk-based technical and organisational measures described in the Privacy Policy and Security and Incident Schedule.

10.2. Henry uses approved hosting, database, integration, AI, analytics, messaging, support, payment and security providers. Provider identities, purposes and qualifications appear in the Suboperator List. International-processing locations and safeguards appear in the International Transfer and Recipient Register.

10.3. Henry does not use identifiable consumer information to train a general-purpose or shared foundation model, or permit a model provider to do so, unless separately and lawfully authorised. Matching or generating an output is not the same as training a general-purpose model.

11. Rights and Complaints

11.1. Subject to POPIA and lawful limitations, a person may request access, source and recipient information, correction, deletion or restriction; object on recognised grounds; withdraw consent; object to direct marketing; request applicable human review; and complain to the Information Regulator.

11.2. Requests about Henry-controlled processing may be sent to legal@henryai.co.za with the subject Privacy request. Henry may verify identity and request scope. Where another organisation is the Responsible Party, Henry may notify or refer the request to it and provide reasonable coordination, but that organisation remains responsible for its decision and records.

11.3. The Information Regulator may be contacted at https://inforegulator.org.za, POPIAComplaints@inforegulator.org.za, 010 023 5200 or 0800 017 160.

12. Changes

12.1. Henry may update this notice to remain accurate. A new purpose or materially expanded product, information use or recipient set is not authorised merely because this notice changes; Henry will provide any additional notice or choice required by law.

END OF HENRY CONSUMER PRIVACY NOTICE