PRIVACY POLICY

Last updated September 29, 2026

This Privacy Policy is issued by Grapevine Media (Pty) Ltd. ('we', 'us', or 'our'). We are the responsible party for your personal information under the Protection of Personal Information Act, 4 of 2013 (POPIA). This policy describes how and why we access, collect, store, use and share ('process') your personal information when you use our services ('Services'), including when you:

• Visit our website at https://woolworthsmedia.co.za/
• Use the Woolworths Booking Platform, an invitation-only retail media booking platform operated by Grapevine Media (Pty) Ltd. It enables authorised brand, Woolworths and Grapevine users to view media availability, submit and manage campaign booking requests, approve bookings and administer user accounts.
• Contact us about the platform

The platform is intended for use in South Africa only. It is not used for marketing or advertising purposes.

Questions or concerns? Reading this Privacy Policy will help you understand your privacy rights and choices. If you do not agree with our policies and practices, please do not use our Services. If you have any questions or concerns, please contact our Information Officer, Rika Lynn, at rika@grapevine.co.za, or email info@grapevine.co.za.

SUMMARY OF KEY POINTS

This summary provides key points from our Privacy Policy, but you can find out more details about any of these topics by clicking the link following each key point or by using our table of contents below to find the section you are looking for.

What personal information do we process? We process the details needed to create and manage your account and to administer campaign bookings, such as your name, email address, job title, company or brand, and booking information. Learn more about personal information we process.

Do we process any sensitive personal information? No. We do not process special or sensitive personal information.

Do we collect information from third parties? The platform is by invitation only, so your account details may be supplied to us by your employer or by a Grapevine administrator. We do not obtain information from marketing partners, data brokers or social media platforms. Learn more about information provided by others.

How do we process your information? We process your information to give you access to the platform, administer campaign bookings, keep the platform secure, communicate with you about your account and bookings, and comply with the law. We do not use it for marketing. Learn more about how we process your information.

Do we share your personal information? We do not sell it or share it for marketing or advertising. It is visible only to authorised platform users, according to their role, and to service providers who host and secure the platform. Learn more about when and with whom we share your personal information.

How do we keep your information safe? Your information is stored in an isolated, managed database, encrypted at rest and in transit, and protected by role-based access controls. However, no electronic system can be guaranteed to be 100% secure. Learn more about how we keep your information safe.

What are your rights? Under POPIA you may request access to, correction or deletion of your personal information, and you may object to its processing. Learn more about your privacy rights.

How do you exercise your rights? Contact our Information Officer at rika@grapevine.co.za, or submit a data subject access request. We will consider and act on any request in accordance with applicable data protection law.

Want to learn more about what we do with any information we collect? Review the Privacy Policy in full.

TABLE OF CONTENTS

1. WHAT INFORMATION DO WE COLLECT?

Personal information you and others provide to us

In Short: We collect the personal information needed to set up your account and administer campaign bookings.

We collect personal information when your account is set up, when you use the platform, and when you contact us. Providing this information is required to use the platform. Without it, we cannot create your account or process bookings. The personal information we collect may include:

• names
• email addresses
• job titles
• passwords (stored only in hashed form)
• contact and authentication data (such as one-time login codes)
• employer, company and brand affiliations
• campaign booking requests and campaign information
• links or documents submitted for campaign coordination

Sensitive information. We do not process sensitive or special personal information.

All personal information that you provide to us must be true, complete and accurate, and you must notify us of any changes to it.

Information automatically collected

In Short: Some technical information, such as your IP address and browser and device characteristics, is collected automatically when you use the platform.

We automatically collect certain technical information when you visit, use or navigate the Services. It does not directly reveal your identity (like your name or contact details) but may include device and usage information such as your IP address, browser and device characteristics, operating system, language preferences, referring URLs, device name, country, information about how and when you use the Services, and other technical information. We need this information mainly to keep the Services secure and working, and for basic analytics and reporting.

We also use cookies and similar technologies. You can find out more in our Cookie Policy: https://woolworthsmedia.co.za/cookie-policy.

The information we collect includes:

• Log and usage data. Service-related, diagnostic, usage and performance information that our servers automatically record when you access or use the Services. It may include your IP address, device information, browser type and settings, date and time stamps, pages and files viewed, the actions you take (such as which features you use), and error reports.
• Device data. Information about the computer, phone, tablet or other device you use to access the Services, such as your IP address, device and application identifiers, browser type, hardware model, internet service provider, operating system and system configuration.

Information provided by others

In Short: Your employer or a Grapevine administrator may give us your account details when inviting you. We do not buy or receive information from marketing or data-broker sources.

The platform is by invitation only. Your name, email address, job title and company or brand affiliation may be supplied to us by your employer or by a Grapevine administrator in order to create your account. We do not collect information about you from marketing partners, data providers, public databases or social media, and we do not use your information for targeted advertising.

2. HOW DO WE PROCESS YOUR INFORMATION?

In Short: We process your information to give you access to the platform, administer bookings, keep the platform secure, communicate with you about your account, and comply with the law.

We process your personal information for the following purposes:

• Account and access administration. To create, authenticate and manage user accounts, and to allocate authorised users to the appropriate companies, brands and platform roles.
• Campaign booking administration. To manage media availability, campaign booking requests, approvals, related communications, activity records and audit history.
• To deliver the service. To provide the platform and the functions you request.
• To respond to enquiries and provide support. To answer your questions and resolve issues with the platform.
• To send service messages. To send you login codes, booking confirmations and approvals, notices about your account, and changes to our terms and policies. We do not send marketing.
• To protect our Services. To keep the platform safe and secure, including fraud monitoring and prevention.
• To understand usage. To measure how the platform is used, using basic anonymous analytics, so that we can maintain and improve it.
• To comply with our legal obligations. To comply with the law, respond to lawful requests, and establish, exercise or defend our legal rights.

Our legal basis. We process your information because it is necessary to provide the platform to you or your employer, to protect our legitimate business interests (such as security, audit and platform administration), and to comply with legal obligations. Where we rely on your consent for any purpose, you may withdraw it at any time.

3. WHEN AND WITH WHOM DO WE SHARE YOUR PERSONAL INFORMATION?

In Short: We do not sell your information or share it for marketing. What you can see, and what others can see about you, depends on your platform role.

Who can see what on the platform. Access is restricted by role. Brand users cannot see other brands' bookings or other users' personal information.

Service providers. We use service providers who process information on our behalf to host, secure and operate the platform. These are Lovable (hosting, database, authentication, analytics, and the email service that sends login codes and notifications), Cloudflare (domain name, security and content delivery services for our website), and Termly (the request form referred to in section 14). They may process your information only for these purposes. See section 11 for where this happens.

Legal disclosures. We may disclose information where the law requires it, or to establish, exercise or defend our legal rights.

Business transfers. We may share or transfer your information in connection with, or during negotiations of, any merger, sale of company assets, financing or acquisition of all or part of our business.

4. DO WE USE COOKIES AND OTHER TRACKING TECHNOLOGIES?

In Short: We use only the cookies and browser storage needed to run the platform, plus one basic anonymous analytics cookie. We do not use advertising cookies.

We use cookies and similar technologies to keep you signed in, protect the security of the platform and your account, remember your interface settings, keep a copy of some platform data relevant to your role (such as your bookings and notifications) on your device while you use the platform so that pages load quickly, and measure basic, anonymous traffic. We do not use advertising or cross-site tracking cookies, and we do not allow third parties to serve advertising on the platform.

Specific information about the cookies we use, and how you can manage them, is set out in our Cookie Policy: https://woolworthsmedia.co.za/cookie-policy.

5. HOW LONG DO WE KEEP YOUR INFORMATION?

In Short: We keep your information for as long as necessary for the purposes in this policy, and no longer than sixty (60) months after your account ends, unless the law requires otherwise.

We keep your personal information only as long as necessary for the purposes set out in this policy, unless a longer period is required or permitted by law (such as tax, accounting or other legal requirements). We keep booking, approval and audit records for this period so that we can deal with queries and disputes about campaigns. No purpose in this policy requires us to keep your personal information for longer than sixty (60) months after the termination of your account.

When we no longer have a legitimate need to process your personal information, we will delete or anonymise it. If this is not immediately possible (for example, because it is held in backup archives), we will securely store it and isolate it from further processing until deletion is possible.

6. HOW DO WE KEEP YOUR INFORMATION SAFE?

In Short: We protect your information with technical and organisational security measures.

We have implemented appropriate and reasonable technical and organisational measures to protect the personal information we process. These include:

• storing data in an isolated, managed database that is encrypted at rest and encrypted in transit (HTTPS/TLS);
• restricting access by verified user role, enforced at the server level, so users can access only the data their role permits;
• storing passwords only in salted, hashed form; and
• using one-time login codes that expire after 15 minutes.

However, no electronic transmission or storage technology can be guaranteed to be 100% secure, so we cannot promise that unauthorised third parties will never be able to defeat our safeguards. Please keep your login details confidential and access the Services from a secure device. If a security compromise affects your personal information, we will notify you and the Information Regulator as required by law.

7. DO WE COLLECT INFORMATION FROM MINORS?

In Short: No. The platform is for business users aged 18 and over.

The platform is for business users aged 18 and over. We do not knowingly process the personal information of children. If you believe a child's information has been provided to us, please contact rika@grapevine.co.za and we will take reasonable steps to delete it.

8. WHAT ARE YOUR PRIVACY RIGHTS?

In Short: You may review, change or terminate your account at any time by contacting us.

Withdrawing your consent: Where we rely on your consent to process your personal information, you have the right to withdraw it at any time by contacting us using the details in section 13. Withdrawal will not affect the lawfulness of processing done before it, or processing that relies on a lawful basis other than consent.

Account information

If you would like to review or change the information in your account, or terminate your account, please contact us using the contact information provided. On a request to terminate your account, we will deactivate or delete your account and information from our active databases. We may keep some information to prevent fraud, troubleshoot problems, assist with investigations, enforce our legal terms and comply with legal requirements.

Cookies and similar technologies: You can manage cookies through your browser settings. Rejecting or removing essential cookies will prevent the platform from working. For details, see our Cookie Policy: https://woolworthsmedia.co.za/cookie-policy.

If you have questions about your privacy rights, email our Information Officer at rika@grapevine.co.za.

9. CONTROLS FOR DO-NOT-TRACK FEATURES

Most web browsers and some mobile operating systems include a Do-Not-Track ('DNT') feature you can activate to signal that you do not want data about your online browsing monitored and collected. At this stage, no uniform technology standard for recognising and implementing DNT signals has been finalised. As such, we do not currently respond to DNT browser signals or any other mechanism that automatically communicates your choice not to be tracked online. Because we do not use advertising or cross-site tracking, we do not track you across other websites. If a standard for online tracking is adopted that we must follow, we will tell you in a revised version of this policy.

10. YOUR RIGHTS UNDER SOUTH AFRICAN LAW (POPIA)

In Short: POPIA gives you rights over your personal information, and you may complain to the Information Regulator.

Under the Protection of Personal Information Act you have the right to:

• ask us to confirm whether we hold personal information about you and to request access to it;
• ask us to correct or delete personal information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or unlawfully obtained;
• object, on reasonable grounds, to the processing of your personal information; and
• withdraw your consent where we rely on it.

To exercise these rights, contact our Information Officer, Rika Lynn, at rika@grapevine.co.za, or use the request form referred to in section 14.

If you are unsatisfied with how we handle a complaint about our processing of personal information, you can contact the Information Regulator (South Africa):

The Information Regulator (South Africa)
General enquiries: enquiries@inforegulator.org.za
Complaints (complete POPIA/PAIA form 5): PAIAComplaints@inforegulator.org.za & POPIAComplaints@inforegulator.org.za

11. CROSS-BORDER PROCESSING AND HOSTING

The platform's database, authentication service and persistent storage are hosted with Lovable Cloud on Amazon Web Services infrastructure in Ireland (eu-west-1). The platform's web pages are delivered through a global content delivery network, which includes servers in South Africa, and some of our other service providers operate or provide support from outside South Africa.

Where personal information is transferred outside South Africa, we take reasonable steps to ensure that the recipient is subject to a law, binding agreement, corporate rules or other safeguards that provide an adequate level of protection substantially similar to POPIA, or that another lawful basis for the transfer applies, in accordance with section 72 of POPIA. Personal information is transferred and processed only for the purposes described in this Privacy Policy.

12. DO WE MAKE UPDATES TO THIS POLICY?

In Short: Yes, we will update this policy as necessary to stay compliant with the law.

We may update this Privacy Policy from time to time. The updated version will be indicated by an updated 'Last updated' date at the top. If we make material changes, we may notify you by prominently posting a notice or by contacting you directly. We encourage you to review this policy regularly.

13. HOW CAN YOU CONTACT US ABOUT THIS POLICY?

If you have questions or comments about this policy, you may contact our Information Officer, Rika Lynn, at rika@grapevine.co.za, email info@grapevine.co.za, or contact us by post at:

Grapevine Media (Pty) Ltd.
73 Bowling Ave
Sandton, Gauteng 2057
South Africa

14. HOW CAN YOU REVIEW, UPDATE, OR DELETE THE DATA WE COLLECT FROM YOU?

You may request access to the personal information we hold about you, details about how we have processed it, correction of inaccuracies, or deletion of your personal information. You may also withdraw your consent where we rely on it. These rights may be limited in some circumstances by law. To make a request, email our Information Officer at rika@grapevine.co.za, or fill out and submit a data subject access request. We may need to verify your identity before acting on a request.