POPIA Notice

Effective: 1 July 2021  ·  Last reviewed: April 2026

Musth Capital (Pty) Ltd (trading as Tusker) is the Responsible Party for the personal information it processes in the course of its business. This notice sets out how we comply with the Protection of Personal Information Act, 2013 (“POPIA” or “the Act”), who to contact about your personal information, and what rights you can exercise as a data subject.

1. Who we are

2. Information Officer

In line with section 55 of POPIA, Tusker’s registered Information Officer is a director of Musth Capital (Pty) Ltd. All formal access requests, objections to processing, complaints, or queries under POPIA should be addressed to:

3. What personal information we process

We process the categories of personal information described in the Privacy Policy: contact details, demographic details, financial and employment information provided by you or your authorised representatives, and technical information such as IP address, browser type and usage data. Where a mandate is concluded, we process the additional personal information reasonably necessary to execute and administer the mandate and meet our regulatory reporting obligations under FAIS and related legislation.

4. Why we process your personal information

We process personal information for the following lawful purposes:

• To respond to an enquiry or provide information you have requested (including the Ownership Guide, ROI Calculator output, and scheduled calls).
• To assess suitability and perform the due diligence required to enter into a discretionary investment mandate.
• To execute, administer and report on a mandate on behalf of a client or beneficiary group.
• To comply with our obligations under applicable law, including FAIS, FICA, the Companies Act, the Income Tax Act and the B-BBEE Codes of Good Practice.
• To send periodic communications that you have opted in to receive, which you can unsubscribe from at any time.

5. Lawful basis for processing

We rely on one or more of the lawful bases in section 11 of POPIA:

• Consent — for example, when you submit an enquiry form, download the Ownership Guide, or subscribe to the newsletter.
• Performance of a contract — when we act under a signed mandate.
• Compliance with a legal obligation — for example, FICA client-verification requirements and statutory record-keeping.
• Legitimate interest — where necessary for the proper conduct of our business and not overridden by your rights.

6. How we handle your information — the eight POPIA conditions

Our handling of personal information is designed around the eight conditions for lawful processing set out in Chapter 3 of POPIA: accountability, processing limitation, purpose specification, further processing limitation, information quality, openness, security safeguards, and data subject participation. In practice this means:

• We only collect what we need for the purpose we have told you about.
• We do not use your information for an incompatible new purpose without a fresh lawful basis.
• We keep our records reasonably accurate and up to date, and correct them on request.
• We apply technical and organisational safeguards appropriate to the sensitivity of the information, including access controls and encrypted storage for client data.
• We do not sell personal information to third parties.

7. Who we share information with

Personal information may be shared with:

• Operators — service providers (hosting, email, CRM, B-BBEE verification agencies, banks and custodians) who process information on our instruction under written operator agreements.
• Regulators and authorities — where we are legally required to do so, including the FSCA, SARS, the FIC, B-BBEE verification agencies and, where applicable, the Information Regulator.
• Professional advisors — our legal, audit and compliance advisors under duties of confidentiality.

We do not publish client names, nor do we share client information with unrelated parties for marketing purposes.

8. Cross-border transfers

Some operators we use (for example, cloud-based email and CRM providers) process data outside South Africa. Where that happens, we rely on the transfer grounds permitted by section 72 of POPIA, including adequate-protection regimes, binding contractual undertakings, or the data subject’s consent.

9. How long we keep your information

We retain personal information for as long as needed to fulfil the purpose for which it was collected, or for as long as we are required to retain it by law (for example, FAIS, FICA and tax record-keeping obligations typically require retention for five years after the end of the relationship). After that, we delete or de-identify the information.

10. Your rights as a data subject

Under POPIA you have the right to:

• Be notified that your information is being processed.
• Request access to your personal information, free of charge for a reasonable first request.
• Request correction, deletion or destruction of personal information that is inaccurate, irrelevant, excessive, out of date or obtained unlawfully.
• Object to processing on reasonable grounds, including for direct marketing, at any time.
• Not be subject to a decision based solely on automated processing that has a legal or similarly significant effect on you.
• Submit a complaint to the Information Regulator.

11. How to make a request or complaint

To exercise any right above, email the Information Officer at info@tusker.co.za. We will acknowledge your request within five business days and respond substantively within the timeframes required by POPIA. For a formal access request, we will send you the prescribed Form 2 under the Promotion of Access to Information Act (PAIA).

If you are not satisfied with our response, you may lodge a complaint with the Information Regulator:

12. Changes to this notice

We may update this notice from time to time. The “Last reviewed” date at the top of the page indicates the most recent material change. We encourage you to revisit this page periodically.

Sincerely,
Musth Capital (Pty) Ltd — trading as Tusker