POPIA Statement

Layer 4 (Pty) Ltd t/a Hyper Layer | hyperlayer.net | Last Updated: 10 March 2026

This statement is issued in terms of the Protection of Personal Information Act 4 of 2013 ("POPIA") and governs the collection, processing, storage, and sharing of Personal Information by Layer 4 (Pty) Ltd, trading as Hyper Layer ("Hyper Layer", "we", "us", or "our"), in the course of its business as a hosting service provider.

In this statement, the following definitions apply:

• "Personal Information" means any information or set of information that identifies or can identify a natural or juristic person, as described in Chapter 1, Section 1 of POPIA.
• "Processing" means any operation or set of operations concerning Personal Information, including collection, storage, use, modification, dissemination, or destruction.
• "Data Subject" means the natural or juristic person to whom Personal Information relates.
• "Third Parties" includes, but is not limited to, operators, shareholders, subsidiaries, affiliated companies, joint ventures, suppliers, and parties providing products, goods, equipment, systems, or services, including information technology providers.
• "Information Regulator" means the Information Regulator of South Africa, established under POPIA.

Processing of Customer Personal Information

Hyper Layer collects and processes Personal Information only where there is a lawful basis for doing so under POPIA. This includes where:

• The data subject has given consent to the processing;
• Processing is necessary for the conclusion or performance of a contract to which the data subject is a party;
• Processing is required to comply with a legal obligation applicable to Hyper Layer;
• Processing protects a legitimate interest of the data subject; or
• Processing is necessary for pursuing the legitimate interests of Hyper Layer or a Third Party to whom the information is supplied, provided those interests are not outweighed by the rights of the data subject.

The categories of Personal Information we typically collect include: full name, email address, physical and postal address, contact number, IP address, login activity logs, and any other information voluntarily provided during account registration or support interactions. With regard to payment information, Hyper Layer does not store customer card numbers, CVV codes, or any other sensitive card data on its servers. Card payments are processed directly through our third-party payment gateway providers, and all card data is entered and stored exclusively on the gateway's secure systems. Hyper Layer only stores a secure payment token issued by the gateway, which is used solely to facilitate recurring or automated payments and cannot be used to retrieve or reconstruct the underlying card details. Where a customer requests an EFT refund or an affiliate programme payout, we collect banking details (such as account holder name, bank name, branch code, and account number). These details are captured within the support ticket and stored on the customer's account profile. They are retained indefinitely as part of the customer's account record and may be used to process future EFT transactions. Customers may request deletion of their banking details at any time by submitting a billing ticket through our client portal.

We use cookies in our client area to maintain login sessions and to track affiliate referrals. Affiliate tracking cookies expire after three (3) months. We also log the IP address of all logins to our client area for account security purposes. For more detail on cookie usage, please refer to our Cookie Policy.

Retention of Personal Information

Hyper Layer retains Personal Information for as long as is necessary to fulfil the purpose for which it was collected, or as required by applicable law. Our general retention periods are as follows:

• Account information (including name, email address, contact details, and billing history): retained indefinitely for as long as your account remains active, or until you request deletion of your account and associated data.
• Support and ticket history: retained indefinitely while your account is active, or until a deletion request is submitted.
• IP address and login logs: retained for a reasonable period for security and fraud prevention purposes.
• Invoices and financial records: retained for a minimum of five (5) years in accordance with South African tax and financial record-keeping requirements, even if an account deletion request is submitted. Payment tokens issued by third-party gateways are retained for as long as your account is active and automatic billing is enabled, and are revoked upon account closure or at your request. Banking details provided for EFT refunds or affiliate payouts are stored within the associated support ticket and on the customer's account profile, and are retained indefinitely as part of the account record unless the customer specifically requests their removal.

You may request deletion of your account and all associated Personal Information (excluding records subject to mandatory retention obligations) at any time by submitting a billing ticket through our billing portal at https://billing.hyperlayer.net/submitticket.php. Upon receipt of a valid deletion request, we will process it within a reasonable timeframe and confirm once completed.

Distribution of Personal Information to Third Parties

Hyper Layer may provide access to or transfer Personal Information to Third Parties where it is necessary to give effect to our business activities, fulfil our contractual obligations to customers, or as otherwise required by law.

We take reasonably practicable steps to ensure that Personal Information transferred to Third Parties is handled confidentially and in accordance with applicable legal requirements. We will only transfer Personal Information to Third Parties in other jurisdictions where those parties are subject to and comply with laws, policies, or agreements providing substantially equivalent protection to POPIA.

We may disclose Personal Information to Third Party service providers whose services customers elect to use, provided that we have obtained the necessary consent or there is another lawful basis for the disclosure. We maintain agreements with such Third Parties to ensure compliance with confidentiality and data protection obligations.

Receiving Personal Information as a Third Party

In its capacity as a hosting service provider, Hyper Layer may from time to time receive or store Personal Information belonging to Third Parties on behalf of its customers. Hyper Layer will process such information in accordance with POPIA and its obligations as an operator, as defined in the Act. Hyper Layer will ensure that any processing or storage of Third Party Personal Information complies with all applicable legislative requirements.

Your Rights as a Data Subject

As a data subject, you have the following rights under POPIA, which you may exercise by submitting a billing ticket through our billing portal at https://billing.hyperlayer.net/submitticket.php:

• The right to be notified that your Personal Information is being collected and the purpose for which it is being processed.
• The right to access Personal Information we hold about you.
• The right to request correction or deletion of inaccurate, incomplete, or outdated Personal Information.
• The right to object to the processing of your Personal Information on reasonable grounds.
• The right to request restriction of processing in certain circumstances.
• The right to lodge a complaint with the Information Regulator if you believe your rights under POPIA have been infringed.

To exercise any of the above rights, please submit a billing ticket through our billing portal at https://billing.hyperlayer.net/submitticket.php. We will respond to all requests within a reasonable timeframe and in accordance with POPIA.

Data Breach Notification

In the event of a security compromise that involves Personal Information and is reasonably likely to result in harm to the affected data subjects, Hyper Layer will:

• Notify the Information Regulator as soon as reasonably possible after becoming aware of the breach, in accordance with Section 22 of POPIA;
• Notify affected data subjects of the breach, the nature of the information compromised, and the steps taken or to be taken to address the breach, where required; and
• Take all reasonable steps to mitigate the impact of the breach and prevent further compromise.

Hyper Layer maintains internal procedures for detecting, reporting, and investigating data breaches. If you become aware of or suspect a security incident affecting your data, please notify us immediately by submitting a ticket through our billing portal at https://billing.hyperlayer.net/submitticket.php.

Security of Personal Information

Hyper Layer takes reasonable technical and organisational measures to protect Personal Information in our custody against unauthorised access, loss, destruction, or disclosure. These measures include access controls, encryption where appropriate, IP logging, and two-factor authentication where enforced. Despite these measures, no system is completely secure and we cannot guarantee absolute security of information transmitted over the internet.

Complaints and the Information Regulator

If you are not satisfied with the manner in which we have handled your Personal Information or have responded to a request under POPIA, you have the right to lodge a complaint with the Information Regulator of South Africa:

Information Regulator (South Africa) Website: www.inforegulator.org.za Email: [email protected] Postal Address: JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001

Information Officer

Hyper Layer has designated an Information Officer responsible for ensuring compliance with POPIA. For all data subject requests, please use the billing ticket system in our client portal. The Information Officer details are provided below for reference and regulatory purposes only:

Name: Adam Gliori Role: Information Officer Company: Layer 4 (Pty) Ltd t/a Hyper Layer Contact: Via billing ticket at https://billing.hyperlayer.net/submitticket.php Website: hyperlayer.net

For more information about your rights or our data practices, please also refer to our Terms of Service.

---

Layer 4 (Pty) Ltd t/a Hyper Layer | hyperlayer.net | Last Updated: 10 March 2026