Privacy Policy

Symplenormics builds and operates the NormiOps platform. Our clients are insurance companies and administrators, who use NormiOps to manage their own policyholders' information and to communicate with them. Symplenormics processes personal information on the NormiOps platform on behalf of, and as instructed by, our clients— we do not use or make independent decisions about policyholder information for our own purposes.

In terms of POPIA, our appointed Information Officer is:

• Name: Batseba Molepo
• Email: batseba@symplenormics.co.za
• Address: 1 Wedgewood Link Rd, Bryanston, Johannesburg, Gauteng, 2191

Depending on how a policyholder interacts with our clients through NormiOps, this may include:

• Contact information: name, phone number, email address, physical address
• Identification information: South African ID number (or other identification), date of birth
• Financial information: bank account and debit order details, for premium collection
• Health and medical information: where required for life insurance underwriting, claims assessment, or policy servicing — this is treated as special personal information under POPIA and is only processed with explicit consent or another valid legal basis
• Communications data: the content of messages sent via WhatsApp, email, or SMS, and related metadata (timestamps, delivery status)
• Policy and claims information: details relating to a policy, premiums, and any claims submitted

Information is collected directly from policyholders (via forms, phone calls, WhatsApp, email, or SMS) by our clients, their brokers or intermediaries, and processed through NormiOps on their behalf.

Our clients use NormiOps to:

• Administer and service insurance policies
• Process premium payments and debit orders
• Assess and pay claims
• Communicate with policyholders, including reminders, renewals, and policy changes
• Send marketing communications about relevant products, where the policyholder has consented (opt-out available at any time)
• Comply with legal and regulatory obligations, including those of the Financial Sector Conduct Authority (FSCA)

Symplenormics facilitates this processing through the NormiOps platform at our clients' instruction; we do not determine the purpose or means of processing policyholder information ourselves.

To deliver NormiOps' communication features, Symplenormics engages the following sub-processors:

• Meta Platforms, Inc.(WhatsApp Business Platform) — to send and receive WhatsApp messages
• Twilio Inc.— for voice call services
• SendGrid (Twilio Inc.)— to send email communications
• BulkSMS— to send SMS communications
• Amazon Web Services (AWS)— for secure hosting and encryption of stored data

Information is also shared with our clients themselves (the insurance companies and administrators who operate on NormiOps), and, where required, with underwriters, reinsurers, and regulators for claims, underwriting, or compliance purposes.

We do not sell personal information to anyone.

Some of the sub-processors listed above (including Meta, Twilio, SendGrid, and AWS) process data outside South Africa, including in the United States. Where personal information is transferred across borders, appropriate safeguards are in place, as required by section 72 of POPIA, including relying on these providers' own data protection commitments and contractual safeguards.

Symplenormics applies technical and organisational security measures appropriate to the sensitivity of the information involved, including:

• Encryption of sensitive stored credentials and data using industry-standard envelope encryption (AES-256) with keys managed via AWS Key Management Service, where a service's own ability to decrypt a secret is deliberately limited to only the systems that need it
• Access controls restricting who within NormiOps can view personal information
• Secure transmission of data between NormiOps and the sub-processors listed above

Personal information is retained for as long as necessary to fulfil the purposes described in this policy, and in line with South African insurance record-keeping obligations — typically a minimum of five years following termination of a policy or finalisation of a claim, in accordance with applicable FSCA and insurance legislation requirements. Specific retention periods are determined by each client in line with their own regulatory obligations.

Under POPIA, policyholders have the right to:

• Request access to the personal information held about them
• Request correction of inaccurate or outdated information
• Request deletion of their personal information, subject to legal and regulatory retention obligations
• Object to the processing of their personal information, including for direct marketing
• Withdraw consent at any time, where processing is based on consent
• Opt out of marketing communications at any time (reply “STOP” to SMS/WhatsApp, or use the unsubscribe link in emails)

To exercise any of these rights, contact the relevant insurance company client directly, or our Information Officer at the details in section 2, who can direct the request appropriately.

Complaints about how personal information has been handled may be lodged with us directly, or with the Information Regulator of South Africa:

• The Information Regulator (South Africa)
• Email: enquiries@inforegulator.org.za / complaints.IR@justice.gov.za
• Website: www.inforegulator.org.za

This policy may be updated from time to time. The “Last Updated” date above reflects the most recent revision.