Privacy Policy

Exco Capital (Pty) Ltd (“Exco Capital”, “we”, “us” or “our”) respects privacy and is committed to processing personal information lawfully, reasonably, transparently and securely.

This Privacy Policy explains how we collect, use, store, share and protect personal information when you:

1. visit www.excocapital.com or another Exco Capital-controlled website;
2. contact or communicate with Exco Capital;
3. register an account or submit an enquiry;
4. join an investor, capital-partner, Facilitator, Professional Associate or other participation list;
5. participate in an Exco Capital programme, engagement or Opportunity Search;
6. use TOM1 or an Exco Capital-related platform;
7. provide company, commercial or professional information to us; or
8. otherwise interact with Exco Capital and its authorised representatives.

This Privacy Policy should be read together with our Terms of Use and Service, any TOM1 participation terms, engagement letter, non-disclosure agreement, consent form or other agreement applicable to a specific relationship.

For personal information for which Exco Capital determines the purpose and means of processing, the responsible party is:

Exco Capital (Pty) Ltd
Thornhill Office Park
84 Bekker Road
Johannesburg
South Africa

Email: exco@excocapital.com
WhatsApp: +27 61 732 7041
Website: www.excocapital.com

Information Officer: G Botha
Email: support@excocapital.com
Telephone: +27 61 732 7041

Privacy and personal-information requests may be submitted through the contact details above.

This Privacy Policy applies where Exco Capital acts as the responsible party in relation to personal information.

In some circumstances:

1. Exco Capital may process information on behalf of another organisation under a contract or mandate;
2. a Facilitator, Professional Associate, ecosystem partner, investor, service provider or participating company may act as a separate responsible party;
3. two or more parties may independently determine how information is processed; or
4. a separate platform may operate under its own privacy policy.

Where another organisation is independently responsible for processing your information, you should also review that organisation’s privacy policy.

For purposes of this Privacy Policy:

“Personal information” means information relating to an identifiable living natural person and, where applicable under South African law, an identifiable existing juristic person.

“Processing” includes collecting, receiving, recording, organising, storing, updating, retrieving, using, analysing, sharing, distributing, combining, restricting, deleting or destroying information.

“Responsible party” means the person or organisation that determines the purpose and means of processing personal information.

“Operator” means a third party that processes personal information for a responsible party under a contract or mandate without acting under that party’s direct authority.

“Data subject” means the person or organisation to whom personal information relates.

“TOM1” means Exco Capital’s Human–AI Opportunity Discovery System and Targeted Opportunity Matching and Monitoring platform.

“Opportunity Search” means the structured client-facing process through which a company participates in TOM1-enabled Opportunity Discovery.

The information we collect depends on your relationship and interaction with Exco Capital.

This may include:

1. full name;
2. initials;
3. identity or passport information where required;
4. date of birth;
5. nationality;
6. signature;
7. photographs or profile images; and
8. identity-verification information.

We ordinarily collect identity-document information only where reasonably required for contracting, due diligence, compliance or a transaction.

This may include:

1. email address;
2. telephone and WhatsApp number;
3. business address;
4. postal address;
5. country or region;
6. social-media or professional-profile details; and
7. preferred communication channel.

This may include:

1. job title and role;
2. employer or organisation;
3. professional qualifications;
4. business experience;
5. areas of expertise;
6. industry and sector;
7. professional memberships;
8. curriculum vitae or biography;
9. directorships;
10. interests and professional preferences; and
11. information relevant to participation as a Facilitator, Professional Associate or ecosystem partner.

Because Exco Capital and TOM1 focus on opportunity discovery and deal origination, we may collect structured information about companies, including:

1. company name, registration information and ownership;
2. business description and operating model;
3. products, services and capabilities;
4. markets, customers, channels and geographic reach;
5. strategic intent and growth priorities;
6. market access that a company can provide or seeks;
7. assets, infrastructure and available capacity;
8. capabilities that are available or required;
9. constraints, challenges and business needs;
10. partnership, acquisition, investment or funding interests;
11. commercial opportunities sought or offered;
12. management and governance information;
13. company contacts and decision-makers;
14. intellectual-property information;
15. financial and performance information; and
16. information required to assess or structure an opportunity.

Some company information may constitute personal information of directors, shareholders, employees, representatives, beneficial owners or other identifiable persons.

Where relevant to a service, investment enquiry, due-diligence process or transaction, we may collect:

1. financial statements;
2. budgets and forecasts;
3. funding requirements;
4. valuation information;
5. capital structure;
6. shareholder information;
7. investment preferences;
8. source-of-funds information;
9. bank details;
10. tax information;
11. transaction history;
12. proposed transaction terms; and
13. payment and invoicing information.

Banking, financial and transaction information will ordinarily be requested only where necessary for a defined purpose.

If you join an investor or capital-partner list or engage with a potential investment opportunity, we may collect:

1. investment interests;
2. preferred sectors and geographies;
3. indicative investment range;
4. investment experience;
5. risk and return preferences;
6. professional-investor or institutional status;
7. suitability or eligibility information;
8. due-diligence and compliance information;
9. proof of identity and address;
10. source-of-funds or source-of-wealth information; and
11. records of opportunities presented or considered.

Joining a list does not automatically mean that all of this information will be collected.

We may collect:

1. emails, messages and correspondence;
2. meeting notes;
3. telephone or video-call records;
4. recordings or transcripts where notice or consent has been provided;
5. forms, surveys and questionnaire responses;
6. event registrations and attendance;
7. support requests;
8. feedback;
9. agreed permissions and restrictions; and
10. records of introductions, discussions and decisions.

When you use our websites or digital platforms, we may automatically collect:

1. internet protocol address;
2. browser and device type;
3. operating system;
4. approximate location based on technical information;
5. pages visited;
6. date and time of access;
7. referring website;
8. account and login activity;
9. cookie or similar technology identifiers;
10. Website interactions; and
11. system, performance and security logs.

This may include:

1. communication preferences;
2. topics, programmes or opportunities of interest;
3. event and newsletter preferences;
4. marketing consent records;
5. unsubscribe records; and
6. interaction with communications.

Where reasonably necessary, we may collect information relating to:

1. identity verification;
2. beneficial ownership;
3. sanctions and watchlists;
4. politically exposed persons;
5. fraud prevention;
6. conflicts of interest;
7. litigation or insolvency;
8. regulatory standing;
9. professional licences; and
10. legal or compliance risk.

We will process this information only where there is an appropriate legal or legitimate basis.

Exco Capital does not ordinarily seek to collect special personal information unless it is necessary and lawful.

Special personal information may include information concerning:

1. race or ethnic origin;
2. religious or philosophical beliefs;
3. political persuasion;
4. trade-union membership;
5. health or sex life;
6. biometric information; or
7. alleged or actual criminal behaviour.

Where such information is required for a lawful purpose, we will apply appropriate safeguards and obtain authorisation or consent where required.

You should not provide special personal information unless Exco Capital has specifically requested it and explained why it is needed.

We may collect personal information:

This may occur when you:

1. complete a form;
2. create an account;
3. participate in an Opportunity Search;
4. provide company information;
5. contact us by email, telephone, WhatsApp or another channel;
6. attend a meeting, event or programme;
7. submit an investment or participation enquiry;
8. enter into an agreement with us; or
9. provide information during due diligence or transaction structuring.

An employer, company, director, shareholder, colleague, adviser or authorised representative may provide information about you where relevant to a legitimate business interaction.

Facilitators and Professional Associates may collect or submit information while assisting with onboarding, Opportunity Search, validation, structuring or execution.

They must act within their authority and applicable information-sharing permissions.

We may receive information from companies, investors, funders, strategic partners, advisers and other parties participating in or assessing a potential opportunity.

We may collect information from lawful public sources, including:

1. company websites;
2. professional profiles;
3. corporate and regulatory registers;
4. news publications;
5. industry directories;
6. public reports;
7. conference materials;
8. research databases; and
9. other publicly accessible business sources.

We may receive information from:

1. website and platform providers;
2. cloud and hosting providers;
3. identity and due-diligence providers;
4. payment providers;
5. analytics providers;
6. professional advisers;
7. database or research providers; and
8. other authorised operators or service providers.

Websites and platforms may collect technical, usage and interaction data using cookies, logs, analytics tools and similar technologies.

We may process personal information for the following purposes.

We use contact and communication information to:

1. respond to requests;
2. arrange meetings;
3. provide information;
4. assess whether Exco Capital can assist; and
5. maintain a record of the interaction.

We may process information to:

1. onboard clients and participants;
2. administer accounts;
3. deliver programmes or professional services;
4. manage projects;
5. issue invoices and process payments;
6. provide support;
7. manage contracts; and
8. maintain service records.

We may use structured company information, stated strategic intent, commercial information and other authorised inputs to:

1. identify patterns and adjacencies;
2. generate opportunity hypotheses;
3. identify potential matches;
4. compare available and required capabilities;
5. identify possible market, partnership, investment, acquisition or capital pathways;
6. monitor relevant changes; and
7. prioritise opportunities for human review.

We may process and share authorised information to:

1. assess strategic fit;
2. establish whether there is mutual intent;
3. test commercial logic;
4. contact relevant parties;
5. facilitate preliminary engagement;
6. contextualise system-generated outputs; and
7. determine whether an opportunity should progress.

We may process information to:

1. align stakeholders;
2. assess economics and commercial design;
3. design governance or transaction structures;
4. assess operational and execution requirements;
5. prepare investment or transaction materials;
6. support due diligence;
7. consider funding and capital pathways; and
8. convert a validated opportunity into an executable or investable outcome.

We may process information to:

1. assess potential investments;
2. evaluate companies and management teams;
3. conduct due diligence;
4. comply with legal and regulatory obligations;
5. communicate with investors and capital partners;
6. prepare or administer transactions;
7. maintain shareholder or investment records; and
8. manage portfolio interests.

We may process information to:

1. assess applications and qualifications;
2. allocate opportunities or assignments;
3. administer agreements;
4. facilitate collaboration;
5. manage participation economics;
6. maintain professional records;
7. assess conflicts of interest;
8. monitor quality and compliance; and
9. communicate programme and operational information.

We may process information to:

1. improve system functionality;
2. test and refine discovery logic;
3. analyse usage and performance;
4. improve data quality;
5. develop new services;
6. train internal processes and authorised personnel;
7. create aggregated insights; and
8. improve user experience.

Where reasonably possible, we will use aggregated, anonymised or de-identified information for system development and analysis.

We may communicate:

1. service and account notices;
2. programme information;
3. relevant opportunities;
4. event invitations;
5. newsletters;
6. company updates;
7. investor or partner information; and
8. information relating to Exco Capital, TOM1 or related initiatives.

Marketing communications will be sent only where permitted by law, and recipients may opt out of non-essential communications.

We may process information to:

1. secure systems and information;
2. prevent fraud or misuse;
3. establish or defend legal rights;
4. manage disputes;
5. enforce agreements;
6. protect confidential information and intellectual property;
7. manage reputational and operational risk; and
8. maintain appropriate business records.

We may process or disclose information to:

1. comply with applicable law;
2. respond to lawful requests from courts, regulators or authorities;
3. meet tax, accounting and corporate-governance obligations;
4. conduct required compliance checks;
5. investigate suspected unlawful conduct; and
6. maintain records for legally required periods.

Depending on the circumstances, we may process information because:

1. you have consented;
2. processing is necessary to conclude or perform a contract;
3. processing is required by law;
4. processing protects a legitimate interest of the data subject;
5. processing is necessary for the proper performance of a public-law duty; or
6. processing is necessary to pursue the legitimate interests of Exco Capital or a third party, provided those interests do not unjustifiably override your rights.

We will not rely on consent where another more appropriate lawful basis applies.

Where processing is based on consent, you may withdraw that consent. Withdrawal will not invalidate processing that occurred lawfully before withdrawal.

TOM1 uses structured information, analytical methods, algorithms and artificial-intelligence-supported tools to generate opportunity hypotheses and identify potential relationships between organisations.

TOM1 may process information concerning:

1. company characteristics;
2. strategic intent;
3. products and services;
4. market access;
5. available or required capabilities;
6. assets and capacity;
7. constraints and needs;
8. transaction and investment interests;
9. geography and sector; and
10. other authorised opportunity-discovery inputs.

TOM1 outputs are not final decisions. They are inputs for further human assessment.

Potential opportunities may be reviewed by authorised Exco Capital personnel, Facilitators, Professional Associates or relevant participating parties before an introduction or transaction proceeds.

Exco Capital does not intend to make decisions that produce legal or similarly significant effects about an individual solely through automated processing without appropriate human involvement, unless such processing is lawful and adequate safeguards are implemented.

Exco Capital recognises that company and commercial information may have different levels of sensitivity.

Participants may be asked to indicate whether information is:

1. available for internal opportunity-discovery use;
2. available to an assigned Facilitator;
3. available to relevant Professional Associates;
4. shareable in anonymised or summarised form;
5. shareable with a named potential counterparty;
6. subject to prior approval before disclosure; or
7. confidential and restricted.

We will endeavour to apply recorded permissions and confidentiality settings.

However, participants remain responsible for:

1. clearly marking restricted information;
2. not submitting information they are unauthorised to provide;
3. entering into a non-disclosure agreement before disclosing highly sensitive information; and
4. reviewing information authorised for disclosure before material transactions or negotiations.

We do not sell personal information.

We may share personal information with the following categories of recipients where necessary and lawful.

Information may be accessed by authorised directors, employees, contractors or representatives who require it for their duties.

Assigned Facilitators may receive information necessary to:

1. onboard a participant;
2. capture or clarify company information;
3. facilitate an Opportunity Search;
4. validate a potential opportunity; or
5. facilitate an authorised introduction.

Professional Associates may receive information necessary to assess, structure or support an opportunity, subject to appropriate confidentiality and contractual obligations.

With appropriate authority or where otherwise lawful, we may share relevant information with:

1. companies;
2. strategic partners;
3. customers or suppliers;
4. investors;
5. funders;
6. acquirers;
7. sellers;
8. joint-venture partners;
9. professional advisers; or
10. other potential participants in an opportunity.

We will ordinarily seek to limit disclosures to information reasonably required for the relevant stage of engagement.

Information concerning a company or transaction may be shared with potential investors, funders or capital partners where the company has authorised the disclosure or another lawful basis exists.

We may appoint service providers to assist with:

1. website hosting;
2. cloud storage;
3. platform operation;
4. communications;
5. customer relationship management;
6. analytics;
7. payment processing;
8. document management;
9. cybersecurity;
10. identity verification;
11. due diligence;
12. accounting;
13. legal and professional services; and
14. other operational functions.

Operators that process personal information on our behalf should be contractually required to protect it, maintain appropriate security and process it only as authorised.

Information may be disclosed as part of:

1. a proposed investment in Exco Capital;
2. a merger or acquisition;
3. a sale or transfer of a business or asset;
4. a restructuring;
5. due diligence; or
6. another corporate transaction.

Appropriate confidentiality and data-protection safeguards should be applied.

We may disclose information where required or permitted by law, including to:

1. courts;
2. law-enforcement authorities;
3. regulators;
4. tax authorities;
5. government bodies;
6. auditors;
7. legal advisers; and
8. persons involved in establishing, exercising or defending legal rights.

Facilitators and Professional Associates may process personal information in different legal capacities depending on the engagement.

They may act:

1. as an operator processing information under Exco Capital’s instructions;
2. as an independent responsible party providing a distinct professional service; or
3. under another arrangement defined by contract and applicable law.

Where a Facilitator or Professional Associate acts independently, that person or organisation is responsible for its own privacy compliance.

Exco Capital expects authorised participants to:

1. use information only for an authorised purpose;
2. respect recorded permissions;
3. maintain confidentiality;
4. implement reasonable security;
5. avoid unauthorised downloads or disclosure;
6. report suspected security compromises promptly; and
7. comply with applicable data-protection law.

Exco Capital operates and collaborates internationally. Personal information may therefore be accessed from or transferred to countries outside South Africa.

We will not rely solely on a general statement of consent to justify all foreign transfers.

Where personal information is transferred outside South Africa, we will seek to ensure that an appropriate legal basis and safeguard applies, which may include:

1. the recipient being subject to a law that provides an adequate level of protection;
2. binding corporate rules;
3. a binding agreement requiring substantially similar protection;
4. your informed consent to the particular transfer;
5. the transfer being necessary for the performance of a contract with you;
6. the transfer being necessary to implement pre-contractual measures requested by you;
7. the transfer being necessary for a contract concluded in your interests; or
8. another ground permitted by applicable law.

Foreign recipients may include cloud providers, software providers, advisers, investors, counterparties, ecosystem partners or other service providers.

The laws of a recipient country may differ from South African law. We will take reasonable steps to select appropriate recipients and safeguards.

We aim to keep personal information accurate, complete and reasonably current.

You should notify us when information changes or is incorrect.

Where information has been supplied by a third party or obtained from a public source, we may ask you to verify it before relying on it for a material decision or transaction.

We retain personal information only for as long as reasonably necessary for the purpose for which it was collected, subject to legal, contractual, regulatory, evidential and operational requirements.

Retention periods may depend on:

1. the nature of the relationship;
2. whether an opportunity or transaction remains active;
3. contractual limitation periods;
4. tax and accounting obligations;
5. corporate and investment record requirements;
6. dispute or litigation risk;
7. consent and communication preferences;
8. the sensitivity of the information; and
9. whether information can be anonymised.

When information is no longer required, we may delete, destroy, anonymise or de-identify it, subject to lawful retention requirements.

Unsuccessful enquiries or inactive opportunity records may be retained for a reasonable period where necessary to maintain an audit trail, manage future engagement or protect legal interests.

We use reasonable technical and organisational safeguards intended to protect personal information against:

1. loss;
2. damage;
3. unauthorised destruction;
4. unlawful access;
5. unauthorised disclosure;
6. misuse; and
7. alteration.

Measures may include:

1. access controls;
2. authentication;
3. confidentiality obligations;
4. secure hosting;
5. backups;
6. encryption where appropriate;
7. logging and monitoring;
8. security updates;
9. operator agreements;
10. staff and participant awareness; and
11. incident-response procedures.

No internet transmission, cloud service or information system is entirely secure. We cannot guarantee absolute security.

You are responsible for protecting your own devices, passwords, account credentials and copies of information.

Where there are reasonable grounds to believe that personal information has been accessed or acquired by an unauthorised person, Exco Capital will assess and respond to the incident in accordance with applicable law.

This may include:

1. containing and investigating the incident;
2. taking steps to reduce harm;
3. notifying the Information Regulator where required;
4. notifying affected data subjects where required;
5. requiring action from an operator or service provider; and
6. improving safeguards.

You should report a suspected compromise relating to Exco Capital information promptly to:

Email: exco@excocapital.com

Subject to applicable law and any lawful limitations, you may have the right to:

1. ask whether Exco Capital holds personal information about you;
2. request access to your personal information;
3. request correction or updating of inaccurate information;
4. request deletion or destruction where Exco Capital is no longer authorised to retain information;
5. object to processing on reasonable grounds;
6. object to direct marketing;
7. withdraw consent where processing is based on consent;
8. request information about third parties who have had access to your information;
9. complain to Exco Capital;
10. complain to the Information Regulator; and
11. exercise rights relating to certain automated decisions.

Rights are not absolute. We may decline or limit a request where permitted or required by law, including where information must be retained for legal, contractual, evidential or legitimate purposes.

Requests should be sent to:

Information Officer: [Insert name]
Email: [Insert Information Officer email]

Alternatively:

Email: exco@excocapital.com

We may ask you to provide sufficient information to:

1. verify your identity;
2. locate the relevant records;
3. understand the request; and
4. protect information relating to other persons.

We will respond within the period required by applicable law.

An access fee may apply where legally permitted.

We may send electronic communications about Exco Capital, TOM1, programmes, events, opportunities or related services where:

1. you have consented;
2. you are an existing customer and the communication is lawfully permitted;
3. another lawful basis applies; or
4. the communication is not unsolicited direct marketing.

You may opt out of non-essential marketing communications at any time by:

1. using the unsubscribe facility provided;
2. replying with an opt-out request; or
3. contacting Exco Capital.

Opting out of marketing will not prevent us from sending necessary administrative, contractual, security or transaction-related communications.

We will not require you to pay a fee to opt out.

Our websites may use cookies and similar technologies to:

1. enable essential site functionality;
2. maintain account sessions;
3. remember preferences;
4. improve performance;
5. understand Website usage;
6. measure traffic;
7. support security; and
8. improve content and user experience.

Cookies may be:

Essential cookies, which are required for Website operation or security.

Functional cookies, which remember choices and preferences.

Analytics cookies, which help us understand aggregated Website usage.

Third-party cookies, which may be placed by authorised service providers.

Where required, non-essential cookies will be used subject to appropriate notice or consent.

You can control cookies through the Website cookie tool or browser settings. Disabling cookies may affect Website functionality.

The Website should maintain a separate, accessible cookie notice identifying material cookie categories and providers.

Our websites or communications may link to:

1. TOM1;
2. BDASA;
3. Professional Associates;
4. ecosystem partners;
5. service providers;
6. social-media platforms;
7. payment providers; or
8. other external websites.

External parties control their own websites and privacy practices. This Privacy Policy does not govern processing independently performed by them.

You should review the relevant third-party privacy policy before providing information.

Exco Capital’s websites and commercial services are not directed at children under 18.

We do not knowingly seek to collect personal information from children through the general Website.

Where a programme or legitimate engagement involves a child, information will be processed only where lawful and with appropriate authorisation, consent and safeguards.

If you believe that a child’s personal information has been submitted without lawful authority, contact us so that we can assess and address the matter.

Not all confidential company information constitutes personal information. However, Exco Capital applies confidentiality and access controls to sensitive commercial information under applicable agreements, permissions and internal procedures.

Before submitting trade secrets, intellectual property, unpublished financial information, proposed transaction terms or similarly sensitive material, the parties should consider entering into an appropriate non-disclosure agreement.

This Privacy Policy does not replace contractual confidentiality obligations.

We may aggregate, anonymise or de-identify information so that it no longer identifies a person or organisation.

Such information may be used for:

1. market analysis;
2. benchmarks;
3. system improvement;
4. research;
5. trend identification;
6. opportunity-discovery methodology;
7. internal reporting; and
8. strategic insight.

We will take reasonable steps not to intentionally re-identify properly anonymised information unless legally permitted and necessary.

We may update this Privacy Policy to reflect changes in:

1. Exco Capital’s business model;
2. TOM1 and related technology;
3. services and programmes;
4. legal or regulatory requirements;
5. service providers;
6. international operations; or
7. information-security practices.

The latest version will be published on the Website with its effective date.

Where a change materially affects how we process existing information, we may provide additional notice or obtain consent where required.

Privacy complaints should first be submitted to Exco Capital:

Information Officer: Gerrit Botha
Email: support@excocapital.com

Alternatively:

Email: exco@excocapital.com

We will investigate complaints and respond as reasonably and legally required.

You may also lodge a complaint with the South African Information Regulator.

Information Regulator South Africa
JD House
27 Stiemens Street
Braamfontein
Johannesburg
2001

Website: www.inforegulator.org.za

Requests for access to records under the Promotion of Access to Information Act should be made in accordance with Exco Capital’s PAIA Manual and the applicable prescribed procedure. Exco Capital makes available its PAIA Manual, Information Officer details, prescribed request forms and other records required by applicable law.:

Questions about this Privacy Policy or Exco Capital’s processing of personal information may be directed to:

Exco Capital (Pty) Ltd
Thornhill Office Park
84 Bekker Road
Johannesburg
South Africa

Email: exco@excocapital.com
WhatsApp: +27 61 732 7041
Website: www.excocapital.com

 Effective date: 18 July 2026