1. Introduction

Customer Management Solutions (Pty) Ltd ("CMS", "we", "us", or "our") respects the privacy rights of individuals and is committed to protecting personal information in accordance with the Protection of Personal Information Act, 4 of 2013 ("POPIA"), the Promotion of Access to Information Act, 2 of 2000 ("PAIA"), and other applicable laws of the Republic of South Africa.

This Privacy Notice explains how CMS collects, uses, processes, stores, shares and protects personal information when individuals interact with:

• the CMS website
• CMS products and services
• CMS communication channels
• CMS client platforms
• CMS business operations

This notice applies to all data subjects whose personal information is processed by CMS.

This Privacy Notice should be read together with the CMS PAIA Manual available on the CMS website.

2. Responsible Party

The responsible party for the processing of personal information is:

Customer Management Solutions (Pty) Ltd

Registration Number: 2013/088068/07

Physical Address:
Unit 4, Cambridge Office Park
5 Bauhinia Street
Highveld Techno Park
Centurion
0159
South Africa

Telephone: 0861 999 609

Website: www.cmssystems.co.za

3. Information Officer

In accordance with POPIA and PAIA, CMS has appointed an Information Officer responsible for overseeing compliance with applicable data protection legislation.

Information Officer
Leon Kemp
Email: leon@cmssystems.co.za

Deputy Information Officer
Francois Kemp
Email: francois@cmssystems.co.za

Data subjects may contact the Information Officer regarding any privacy-related queries, requests, or concerns.

4. Personal Information We Process

CMS may process personal information depending on the nature of the relationship with the data subject.

This may include:

Identification Information

• Name and surname
• Identity or passport number

Contact Information

• Email address
• Telephone number
• Physical or postal address

Business and Client Information

• Company contact details
• Client communications
• Service requests

Employment Information

• Employee records
• Payroll information
• Benefits administration
• Training and performance records

Financial Information

• Billing information
• Bank details
• Transaction records

Technical Information

• IP address
• Browser type
• Device information
• System activity logs

Website Interaction Information

• Website enquiries
• Contact form submissions
• Marketing consent records

5. Information Processed on Behalf of Clients

CMS provides technology platforms used by clients such as dealerships and service providers.

In these circumstances CMS may act as an Operator as defined in POPIA and process personal information strictly on the documented instructions of its clients.

Such information may include:

• Customer contact details
• Lead information
• Customer relationship management data
• Sales and service records
• Analytics and reporting data

CMS does not determine the purpose of such processing and processes the information solely in accordance with contractual instructions.

6. Purposes of Processing

CMS processes personal information for purposes including but not limited to:

• Providing and maintaining CMS systems and services
• Managing client relationships
• Responding to enquiries and support requests
• Performing contractual obligations
• Managing employment relationships
• Complying with legal and regulatory requirements
• Maintaining internal administrative records
• Monitoring system performance and security
• Improving services and technology platforms
• Conducting business development and marketing activities where permitted by law

CMS processes only personal information that is reasonably necessary for the purposes described in this Privacy Notice.

7. Lawful Basis for Processing

CMS processes personal information in accordance with POPIA on the following lawful bases:

• Performance of a contract with the data subject
• Compliance with legal or regulatory obligations
• Legitimate business interests pursued by CMS
• Consent obtained from the data subject where required
• Protection of legitimate interests of the data subject or another person

8. Disclosure of Personal Information

CMS may disclose personal information to:

• Authorised employees of CMS
• Service providers performing services on behalf of CMS
• IT infrastructure and hosting providers
• Professional advisors including auditors and attorneys
• Financial institutions
• Regulators and statutory authorities
• Business partners involved in service delivery
• Clients where CMS acts as an operator

All third parties are required to maintain appropriate confidentiality and security safeguards.

9. International Transfers

CMS may transfer personal information outside the Republic of South Africa where systems or service providers are located in other jurisdictions.

Where such transfers occur, CMS ensures that one or more of the following safeguards are implemented:

• The recipient is subject to data protection laws providing an adequate level of protection
• Contractual safeguards are implemented
• The transfer is necessary for the performance of a contract
• The data subject has consented to the transfer where required

10. Information Security

CMS implements appropriate technical and organisational measures designed to protect personal information against unauthorised access, loss, misuse or disclosure.

These measures include:

• Access control mechanisms
• Authentication controls
• Network security safeguards
• Encryption where appropriate
• Employee confidentiality obligations
• Security monitoring and auditing
• Incident detection and response procedures

CMS maintains incident response procedures designed to identify, investigate and respond to security compromises involving personal information.

If CMS becomes aware of any unauthorised access to, or compromise of, personal information under its control, CMS will take appropriate steps to investigate the incident and mitigate any potential harm. Where required in terms of Section 22 of POPIA, CMS will notify the Information Regulator and affected data subjects as soon as reasonably possible.

11. Data Retention

CMS retains personal information only for as long as necessary to fulfil the purposes for which it was collected or to comply with legal and regulatory obligations.

Retention periods are determined based on:

• Statutory requirements
• Contractual obligations
• Operational needs
• Legitimate business purposes

Personal information that is no longer required is securely destroyed or de-identified.

12. Data Subject Rights

In accordance with POPIA, data subjects have the right to:

• Request access to personal information held about them
• Request correction or deletion of inaccurate information
• Object to processing in certain circumstances
• Withdraw consent where processing is based on consent
• Lodge a complaint with the Information Regulator

Requests may be submitted to the Information Officer.

13. Complaints

If a data subject believes that CMS has processed personal information unlawfully, a complaint may be lodged with:

The Information Regulator (South Africa)
Website: https://www.inforegulator.org.za
Email: complaints.IR@inforegulator.org.za

14. Third-Party Websites

The CMS website may contain links to external websites.

CMS is not responsible for the privacy practices of such third-party websites and encourages users to review their privacy policies.

15. Changes to This Privacy Notice

CMS may update this Privacy Notice from time to time to reflect changes in:

• Regulatory requirements
• Business practices
• Technological developments

WEBSITE COOKIE POLICY

Customer Management Solutions (Pty) Ltd
Registration Number: 2013/088068/07
Last Updated: 11 March 2026

1. Introduction

This Cookie Policy explains how Customer Management Solutions (Pty) Ltd ("CMS") uses cookies and similar technologies when individuals visit the CMS website.

Cookies help improve website functionality, performance and user experience.

2. What Are Cookies

Cookies are small text files stored on a user's device when visiting a website.

They enable websites to:

• Recognise returning users
• Remember preferences
• Analyse website performance
• Improve functionality

3. Types of Cookies Used

CMS may use the following categories of cookies:

3.1 Essential Cookies

These cookies are necessary for the operation of the website.

They enable functions such as:

• Page navigation
• Secure login
• System administration
• Session management

Without these cookies the website cannot function properly.

3.2 Analytics Cookies

CMS may use analytics tools such as Google Analytics to understand how visitors interact with the website.

Information collected may include:

• Pages visited
• Time spent on pages
• Device type
• Browser type
• General geographic location

This information is aggregated and used to improve website performance.

3.3 Functional Cookies

These cookies allow the website to remember user preferences, such as:

• Language selection
• Interface preferences
• Previous interactions

3.4 Marketing Cookies

Where applicable, marketing cookies may be used to measure marketing campaign effectiveness and analyse visitor engagement.

CMS does not sell personal information collected through cookies.

4. Personal Information and Cookies

Certain cookies may collect information that constitutes personal information under POPIA, including:

• IP address
• Device identifiers
• Browsing behaviour

Where such information constitutes personal information as defined in the Protection of Personal Information Act, 4 of 2013 (POPIA), it will be processed in accordance with the CMS Privacy Notice available on the CMS website.

5. Third-Party Cookies

CMS may permit third-party service providers to place cookies on the website, including:

• Analytics providers
• Hosting providers
• Marketing technology providers

CMS does not control the processing activities of such third-party providers and encourages users to review the privacy policies of those providers.

6. Managing Cookies

Users can manage or disable cookies through their browser settings.

Most browsers allow users to:

• Block cookies
• Delete cookies
• Receive alerts before cookies are stored

Disabling cookies may affect website functionality.

7. Cookie Consent

By continuing to use the CMS website, users acknowledge the use of cookies as described in this Cookie Policy.

The CMS website may display a cookie consent banner allowing users to accept or manage the use of cookies. By continuing to use the website after being notified of cookies, users consent to the use of cookies in accordance with this Cookie Policy.

8. Changes to This Cookie Policy

CMS may update this Cookie Policy from time to time.

Any updates will be published on the CMS website.

PROTECTION OF PERSONAL INFORMATION ACT (POPIA)

With the application of the POPI Act to protect an individual’s right to privacy by offering protection against the unlawful collection, retention, dissemination and use of personal information, coming into effect from 1st July 2021, CMS Software Solutions has developed and implemented useful POPIA tools in the service flow, that provide easy management and compliance for CMS Software Solution customers.

CMS PAIA MANUAL DOWNLOAD

CONTACT US

If you have any questions about this Privacy Policy, You can contact us:

• By email: support@cmssystems.co.za
• By phone number: 0861 999 609