Privacy Policy

Her Life Lab respects your privacy and is committed to handling personal information responsibly.

This Privacy Policy explains how we collect, use, store, share and protect personal information when you visit our website, create an account, use UltiMom or MerryMagic, purchase a service or communicate with us.

We aim to comply with the Protection of Personal Information Act 4 of 2013 (POPIA) and other applicable South African privacy laws.

Our services may allow you to organise personal and family information in one place. This can include information about children, personal notes, health-related details, emergency information and important documents. We recognise that some of this information is sensitive and should be handled with care.

Please read this Policy before using our services.

For the purposes of POPIA, the responsible party is: · Her Life Lab · Sole proprietorship owned and operated by Sharelle Ridley · Business address: 3A Carlswald Decor Centre, Cnr Harry Galaun and 5th Street, Halfway Gardens, Midrand, Gauteng, South Africa · Email: hellomom@herlifelab.co.za · Telephone: 074 586 5565

Country: South Africa

In this Policy, “Her Life Lab”, “we”, “us” and “our” refer to the business operated by Sharelle Ridley.

The information we collect depends on which services and features you use.

3.1 Account and contact information

This may include:

• Your name and email address.
• Login and account information.
• Contact details you choose to provide.
• Account preferences and settings.

3.2 Family and children’s information

If you use family organisation features, you may choose to enter:

• Children’s names, birthdays and other profile details.
• Family relationships and household information.
• School, activity and appointment details.
• Calendar entries and reminders.
• Photographs or other content, if supported and uploaded.
• Children’s memorable sayings, milestones or personal memories.

3.3 Personal organisation information

This may include:

• Shopping lists, gift lists and savings goals.
• Birthday, party and Christmas planning details.
• Guest lists and event information.
• Notes, projects and reminders.
• Household schedules and family commitments.
• Personal preferences and other information you choose to record.

3.4 Health-related and sensitive information

Depending on the features you use, you may choose to enter information relating to health, wellbeing, medication reminders, menstrual cycles, weight, pregnancy or other personal matters.

We may also process other sensitive personal information that you choose to enter, including information about a child or another family member.

We ask you to consider carefully whether you need to enter sensitive information and to avoid adding details that are not necessary for the feature you want to use.

3.5 Documents and emergency information

If document-storage or emergency-planning features are available, you may choose to enter or upload information such as:

• Emergency contacts.
• Insurance or policy numbers.
• Important personal documents.
• Details of service providers.
• Funeral preferences or personal wishes.
• Other family or emergency information.

Please be particularly careful with identity documents, financial details, policy information and documents containing information about other people. Only upload such material if you have a lawful reason to do so and are comfortable with the risks associated with digital storage.

3.6 Payment and transaction information

If you purchase a paid service, information relating to the transaction may be processed, such as the subscription selected, payment status, transaction reference, billing information and purchase history.

Payments may be handled by a third-party payment processor. The information we receive will depend on the provider and the payment method. We do not claim to store full payment card details ourselves unless we specifically disclose that this is the case.

3.7 Technical and usage information

Depending on the configuration of our website and apps, we may collect technical information such as:

• Device and browser information.
• IP address and approximate location derived from it.
• Login activity, usage events and diagnostic information.
• Error reports and performance information.
• Cookie or similar technology identifiers.

Whether particular analytics, tracking or cookie technologies are used depends on the tools enabled on our website and apps.

3.8 Communications

If you email, message or otherwise contact us, we may retain the content of your communication and the contact information needed to respond to you, handle a complaint or maintain appropriate business records.

We may collect personal information:

• Directly from you when you create an account or complete a form.
• When you enter information into an app feature.
• When you upload documents, images or other content.
• When you make a purchase or manage a subscription.
• When you contact us for support.
• Automatically through technical systems used to operate and secure our services, where enabled.
• From a service provider involved in a transaction or service you have requested, where lawful and appropriate.

Where we request information, you may choose not to provide it. However, certain features may not work without the information required to provide them.

We may use personal information for the following purposes:

Providing our services

• Creating and managing accounts.
• Displaying and organising your entries, lists, profiles, notes and documents.
• Providing calendars, reminders and planning features.
• Delivering purchased features and subscriptions.
• Maintaining user preferences.

Payments and administration

• Processing or confirming purchases through relevant providers.
• Managing subscriptions, billing enquiries, cancellations and refunds.
• Maintaining appropriate financial and business records.

Support and communication

• Responding to questions, complaints and requests.
• Sending service-related messages, including important account, security or product notices.
• Explaining changes that affect the services you use.

Security and reliability

• Detecting or investigating suspected fraud, misuse and security incidents.
• Troubleshooting errors.
• Protecting our users, systems and business.
• Maintaining backups and recovering data where supported.

Improvement and development

• Understanding how our services are used.
• Identifying bugs and improving usability.
• Developing new features and improving existing products, where the processing is lawful.

Legal and regulatory obligations

• Complying with applicable law.
• Responding to lawful requests from competent authorities.
• Establishing, exercising or defending legal claims where appropriate.

We will not use personal information for a purpose that is incompatible with the original purpose unless permitted by law or otherwise lawfully authorised.

Under POPIA, we process personal information only where a lawful justification applies.

Depending on the circumstances, this may include:

• Your consent.
• The necessity of processing to perform an agreement with you or take steps at your request before entering into an agreement.
• Compliance with a legal obligation.
• The protection of a legitimate interest of yours or another person, where applicable.
• A legitimate interest pursued by us or a third party, where this is permitted by POPIA and does not improperly prejudice your rights.
• Another justification permitted by applicable law.

Where consent is required, we will seek it in an appropriate manner. You may withdraw consent where processing relies on consent, although this will not make processing that occurred lawfully before withdrawal unlawful. Withdrawal may also mean that certain features are no longer available.

Our services may allow a parent or guardian to record information about children and other family members.

The person entering the information is responsible for ensuring that they have the necessary authority or lawful basis to provide it.

POPIA provides additional protections for children’s personal information. Where required, we will seek consent from a competent person or rely on another lawful authorisation applicable to the circumstances.

Please avoid entering unnecessary information about children or other individuals, particularly information that could expose them to harm, embarrassment, identity theft or unwanted contact.

If you believe a child’s personal information has been provided unlawfully or without appropriate authority, contact us using the details in this Policy so that we can assess the request.

Certain information, including health information and some information about children, receives additional protection under POPIA.

We will handle sensitive personal information only where a lawful justification applies and subject to any additional requirements imposed by law.

Please remember that information you choose to enter into a digital service may be exposed if your account, device or a service provider’s systems are compromised. Use a strong, unique password, protect your devices and avoid sharing login details.

Our apps are not intended to replace secure specialist medical, banking, identity-management or clinical record systems.

We do not sell your personal information to third parties as a business model.

We may share personal information only where reasonably necessary and lawful, including in the following circumstances:

Service providers

We may use third-party providers to help operate our services. Depending on our actual configuration, these may include:

• Website and app hosting providers.
• Database, storage and backup providers.
• Authentication and account-management services.
• Payment processors.
• Email, messaging and customer-support providers.
• Security, diagnostic and analytics providers.

These providers may process personal information on our behalf to deliver their services. Where POPIA requires it, we will take appropriate steps to ensure that operators are subject to suitable confidentiality and security obligations.

Legal requirements and protection

We may disclose information where required by law, a court order or a lawful request from a competent authority, or where reasonably necessary to establish, exercise or defend legal rights.

Business changes

If our business or a product is reorganised, transferred or acquired, relevant information may be transferred as part of that transaction, subject to applicable law and appropriate safeguards.

With your direction or consent

We may share information where you specifically ask us to do so or where you have provided the necessary consent or other lawful authorisation.

We do not authorise service providers to use personal information entrusted to them for unrelated purposes where doing so would breach applicable law or our contractual arrangements.

Some third-party technology providers may store or process information outside South Africa.

Whether this occurs depends on the hosting, database, authentication, payment, email, analytics and other providers actually used by our services.

Where personal information is transferred outside South Africa, we will take steps to ensure that the transfer complies with section 72 of POPIA, including applicable requirements relating to adequate protection, binding agreements, consent or other lawful grounds, as relevant to the circumstances.

If you require information about the countries in which a particular provider processes data, you may contact us using the details below.

Cookies and similar technologies may be used to support website functionality, remember preferences, maintain sessions, improve security or measure usage, depending on the technologies enabled.

Where non-essential cookies or similar technologies are used and consent is required, we will provide an appropriate means of obtaining and managing that consent.

You may also be able to manage cookies through your browser settings. Disabling certain cookies may affect website functionality.

The specific cookies, analytics tools and tracking technologies used by Her Life Lab will depend on the website and app configuration.

We take reasonable steps appropriate to the circumstances to protect personal information against loss, unauthorised access, disclosure, alteration or destruction.

Depending on the systems used, safeguards may include access controls, authentication, restricted permissions, secure connections, provider security measures, backups and procedures for responding to suspected incidents.

No website, application, internet transmission or storage system can be guaranteed to be completely secure. We therefore cannot promise absolute security.

You can help protect your information by using strong passwords, securing your devices, logging out of shared devices and avoiding unnecessary uploads of highly sensitive information.

If we become aware of a security compromise affecting personal information, we will assess the incident and take the steps required by applicable law, including notifying the Information Regulator and affected individuals where required.

We retain personal information only for as long as reasonably necessary for the purpose for which it was collected, unless a longer period is required or permitted by law.

Retention periods may depend on:

• Whether your account remains active.
• The type of information and feature involved.
• Whether you request deletion.
• Applicable tax, accounting or other recordkeeping requirements.
• Security, dispute-resolution or legal obligations.
• Whether information remains in backups or systems operated by service providers.

When personal information is no longer needed, we will take reasonable steps to delete, destroy or de-identify it, as appropriate and subject to applicable law.

We cannot promise that every copy will be erased immediately from all backups or third-party systems. Where information remains in a backup, we will handle it in accordance with our applicable retention and security practices.

Subject to applicable law, you may request access to personal information we hold about you and ask us to correct or update information that is inaccurate, incomplete, misleading or outdated.

You may also request deletion or destruction of personal information where the requirements of POPIA are met.

If you want to make a request, contact us at hellomom@herlifelab.co.za and describe the information and action you are requesting. We may need to verify your identity and authority before responding, particularly where the request concerns a child or another person’s information.

Some information may need to be retained to comply with law, resolve disputes, maintain required business records or protect legal rights. Where we cannot fulfil a request in full, we will explain this where required or appropriate.

Deleting information from an account may not automatically delete records held separately by a payment provider or other independent third party. You may need to contact that provider directly where its own records are concerned.

Depending on the circumstances, you may have the right to:

• Be notified that your personal information is being collected or has been accessed by an unauthorised person, where required by law.
• Request access to personal information held about you.
• Request correction, deletion or destruction of personal information where legally permitted.
• Object to certain forms of processing on grounds recognised by POPIA.
• Withdraw consent where processing relies on consent.
• Object to direct marketing communications where applicable.
• Lodge a complaint with the Information Regulator.
• Seek an appropriate remedy where your rights under POPIA have been infringed.

To exercise your rights, email hellomom@herlifelab.co.za.

You may also contact the South African Information Regulator through its official website: https://inforegulator.org.za/

The Regulator’s contact details and complaint procedures may change, so please check its official website for the latest information.

We may send service-related communications that are necessary to administer your account, subscriptions, purchases or use of our services.

We will handle promotional communications in accordance with applicable law. Where consent or another legal requirement applies to electronic direct marketing, we will comply with that requirement.

You may opt out of promotional emails by using the unsubscribe mechanism provided, where available, or by contacting us at hellomom@herlifelab.co.za.

Opting out of marketing will not necessarily stop essential service messages, such as security notices, payment confirmations or important account updates.

Our website or apps may contain links to external websites or rely on third-party services.

This Privacy Policy does not govern the independent privacy practices of third parties that operate outside our control. Please review their privacy policies before providing information directly to them.

Where a third party processes information on our behalf, we will take the steps required by applicable law to govern that processing appropriately.

We may update this Policy when our services, technology, business practices or legal obligations change.

The latest version will be published on our website with an updated effective date. Where a material change affects how we process personal information, we will provide notice where appropriate or required by law.

You should review this Policy periodically.

For privacy questions, access requests, correction requests, deletion requests or complaints, contact: · Her Life Lab · Attention: Sharelle Ridley, sole proprietor · Business address: 3A Carlswald Decor Centre, Cnr Harry Galaun and 5th Street, Halfway Gardens, Midrand, Gauteng, South Africa · Email: hellomom@herlifelab.co.za

Telephone: 074 586 5565

Please include enough information for us to understand and respond to your request. Do not email passwords or unnecessary sensitive documents.

This Privacy Policy is intended to be interpreted in accordance with the laws of the Republic of South Africa, including POPIA and other applicable privacy and consumer protection legislation.