Vyler Privacy Policy

CLEARHOLD (Pty) Ltd ("CLEARHOLD", "we", "us" or "our") operates Vyler ("Vyler", "the Platform"), a transaction-protection platform designed to facilitate safer transactions between buyers and sellers through structured transaction agreements, protected payments, fulfilment requirements, inspection procedures and dispute-resolution mechanisms. We recognise that the information entrusted to us is important and must be handled responsibly. This Privacy Policy explains how Vyler collects, uses, stores, processes, protects and shares personal information and relevant business information when individuals access or use the Platform. Our approach is based on collecting information for legitimate purposes, limiting access to authorised circumstances, protecting stored information, and maintaining appropriate records to support secure transactions and the prevention of fraudulent or unlawful activity. This Privacy Policy applies to Vyler's ordinary commercial transaction platform, including its website, user accounts, identity-verification processes, transaction workflows, customer-support services and associated features. It does not govern the separate Sovereign Procurement platform. Registered Address: 16 Haenertsberg ST, ALBERTON, GAUTENG, 1448 Director: Tumelo Tsotetsi | Founder: Mutshidzi Khorombi | Tax No: 9430315243

Vyler processes personal information in accordance with applicable South African law, including the Protection of Personal Information Act 4 of 2013 ("POPIA"), together with other applicable legal and regulatory requirements. Where applicable, our processing activities may also be informed by obligations concerning customer identification, financial crime prevention, anti-money laundering controls, fraud prevention, recordkeeping and the Financial Intelligence Centre Act 38 of 2001 ("FICA"). The precise legal obligations applicable to a particular processing activity depend on the nature of the activity, the parties involved and the requirements of the relevant law. Nothing in this Privacy Policy is intended to exclude or diminish a right afforded to an individual under applicable law.

Vyler follows a purpose-driven approach to information collection and processing. We seek to collect and retain information that is reasonably necessary to operate user accounts, facilitate transactions, support identity and business verification, administer payments, prevent misuse, resolve disputes and meet applicable legal obligations. • We do not sell users' personal information. • We do not publish users' private identity documents, identity-verification records, personal contact details or other confidential account information as public profile information. Access to personal information is restricted to authorised circumstances and legitimate purposes, subject to applicable law and our operational arrangements with relevant service providers. The fact that information is collected does not mean that every employee, service provider or other party has unrestricted access to it.

4.1 Individual account information Vyler may collect and retain: first name and surname, account email address, contact information, account identifiers, identity-verification status, transaction participation, and customer support correspondence. 4.2 Identity-verification information Vyler uses Didit as an identity-verification service provider. Depending on the process, Didit may process identity documents, facial images, and liveness-verification information. Vyler does not retain the underlying identity-document images and physical document copies on Vyler's own servers. Instead, Vyler retains specified verification outcomes, confirmation results, and status needed to administer the account. 4.3 Business and company information Where a user transacts on behalf of a company, Vyler may collect: registered company name, trading name, entity type, registered physical address, company registration verification status, and relevant beneficial-ownership information. The underlying company-registration documents are processed through Didit and not retained on Vyler's own servers. 4.4 Transaction information When transacting, we collect: transaction identifiers, counterparty identifiers, item descriptions, agreed transaction values and fees, delivery addresses, milestones, inspection periods, delivery and evidence records, and dispute records. 4.5 Payment-related information Vyler uses TradeSafe for protected-funds infrastructure. Payment information includes transaction amounts, payment references, release status, and refund status. Protected funds are handled through TradeSafe; Vyler does not hold funds directly. 4.6 Communications and support information Includes correspondence, dispute evidence, support requests, and incident reports. 4.7 Technical and security information Device and browser data, IP addresses, diagnostic logs, and authentication events used to maintain security and prevent abuse.

Vyler processes personal information only for legitimate purposes connected with operating and protecting the Platform: • Account creation and administration. • Identity verification and reducing impersonation. • Company and business verification. • Know Your Customer (KYC) and Know Your Business (KYB) checks. • Financial crime and anti-money-laundering (AML) screening. • Transaction administration, delivery tracking, and milestone confirmation. • Payment administration, protected-funds reconciliation, and refund routing. • Dispute resolution and evidence review. • Fraud prevention, account security, and abuse detection. • Authorised audits, security reviews, and compliance assessments. • Customer support, technical reliability, and platform protection. • Compliance with statutory legal obligations.

Didit performs the identity-verification and related document-processing functions assigned to it under our service arrangements. For the verification processes described in this policy, Didit may process identity documents, facial images, liveness information, and company-registration files. Vyler's own systems retain the specified account and business verification results, rather than the underlying identity-document and company-document images processed through Didit. Didit's collection, storage, retention, and deletion of information are subject to the applicable service agreements and privacy terms governing that service.

Where business verification requires it, Vyler may process information concerning the persons who ultimately own or control a company or other legal entity. Beneficial-ownership checks help establish the identity of relevant controllers, verify corporate data, and support sanctions screening, anti-money-laundering checks, and financial-crime prevention. Beneficial-ownership information is treated as confidential account or compliance information and is not published as public profile data.

Vyler does not sell personal information. We share information only where appropriate and lawful: • Didit: For identity verification and business checks. • TradeSafe: For transaction-protection and protected-funds escrow processing. • Payment and financial service providers: For processing transfers, card payments, and refunds. • Technology and infrastructure providers: For secure hosting, communication delivery, and system monitoring. • Auditors and professional advisers: For legal, accounting, compliance, and security oversight. • Law enforcement and public authorities: Pursuant to a valid legal process, court order, or statutory reporting obligation. • Transaction counterparties: Sharing delivery details and necessary transaction data required to fulfill the contract. • Business transfers: In the event of a lawful corporate restructuring, merger, or asset transfer under appropriate safeguards.

Vyler's ordinary escrow platform is intended for private commercial transactions between users. Personal identity documents, private account information, verification records, beneficial-ownership information and confidential transaction records are not automatically displayed publicly. Where transaction information must be shared with a counterparty, service provider, auditor or public authority, the sharing must be limited to the relevant legitimate purpose and permitted by applicable law.

POPIA requires personal information to be processed lawfully and for an explicitly defined purpose. Vyler relies on: • The user's consent, where consent is the applicable basis. • Processing necessary to take steps requested by the user before entering into a contract. • Processing necessary to perform a contract with the user. • Processing necessary to comply with an obligation imposed by law (such as FICA or tax requirements). • Processing justified by a legitimate interest recognised under applicable law, subject to appropriate safeguards.

Vyler retains personal information only for as long as reasonably necessary for the purpose for which it was collected: • Account information is retained while active and for an appropriate period after closure. • Verification results are retained to administer verified status, prevent repeated abuse, and meet legal obligations. • Transaction and dispute records are retained for statutory audit, tax, and contractual retention periods. • Security logs are retained for appropriate monitoring periods. When information is no longer required, it is deleted, destroyed, or de-identified securely.

Vyler takes reasonable and appropriate technical and organisational measures to protect personal information: • All sensitive data strings are encrypted at rest using AES-256-GCM standards. • Browser and safe-room communications are secured with TLS 1.3 encryption. • Access restrictions, authentication controls, and security monitoring are enforced. • While no system can guarantee 100% security, Vyler actively maintains robust incident-response and containment procedures.

Some service providers may process or store information outside South Africa. Where personal information is transferred across borders, Vyler ensures that the transfer complies with POPIA, utilizing contractual safeguards, binding corporate rules, or adequate statutory protections in the recipient territory.

Vyler may use essential cookies, session identifiers, and local storage technologies required to maintain sessions, remember user preferences, and protect against fraudulent traffic. Optional tracking technologies are configured in compliance with applicable law.

Under POPIA and South African data privacy legislation, users have the right to: • Request confirmation of whether Vyler holds personal information about them. • Request access to personal information in accordance with applicable law. • Request correction of inaccurate, incomplete, or misleading information. • Request deletion or destruction of information where statutory retention periods have lapsed. • Object to specific forms of processing where permitted by law. • Lodge a complaint with the Information Regulator of South Africa.

To submit a privacy inquiry, access request, or data correction request, contact: Email: support@vyler.co.za Website: https://vyler.co.za Organisation: CLEARHOLD (Pty) Ltd Please provide sufficient information to verify your identity before disclosing, correcting, or deleting records.

If you believe that Vyler has processed your personal information unlawfully or failed to respect your statutory rights under POPIA, you may lodge a complaint directly with the regulator: Information Regulator of South Africa Website: https://inforegulator.org.za/ This does not limit any other judicial remedies available under South African law.

Users must not submit another person's personal information without lawful authority or consent. Users must not impersonate other parties, forge verification files, or misuse third-party identity documents.

Vyler uses automated tools to assist with verification, sanctions screening, and fraud detection. An automated match or alert does not automatically establish wrongdoing; where appropriate, results are reviewed in context by authorized personnel.

We may update this Privacy Policy to reflect changes in platform architecture, service providers, security controls, or legal regulations. The latest version will be published on the website with an updated effective date.

CLEARHOLD (Pty) Ltd operates Vyler and is responsible for the personal information it processes, acting as the responsible party under POPIA. CLEARHOLD (Pty) Ltd Company registration number: 2026/035423/07 Tax Number: 9430315243 Email: support@vyler.co.za Website: https://vyler.co.za

Vyler is committed to handling personal and business information responsibly, limiting its use to legitimate purposes, protecting confidential account records, and collaborating with regulated partners like TradeSafe and Didit to ensure secure, private, and accountable transactions. End of Privacy Policy