CONFIDENTIALITY OF COMPANY INFORMATION POLICY

CNBM International South Africa (Pty) Ltd

1. Purpose

CNBM International South Africa (Pty) Ltd (“CNBM South Africa”, “CNBM”, “we”, “us” or “our”) recognises the importance of protecting confidential, proprietary and commercially sensitive information shared during business dealings.

The purpose of this Confidentiality of Company Information Policy (“Policy”) is to establish the conditions under which confidential information disclosed by CNBM South Africa to a customer, buyer, distributor, supplier, contractor or other business partner may be used, protected and disclosed.

This Policy is intended to safeguard CNBM South Africa’s commercial interests, intellectual property, technical information, supplier relationships and other confidential business information.

Where this Policy is incorporated into or accepted as part of a quotation, purchase order, supply agreement, distribution agreement or other written contract, it will apply in accordance with that agreement and applicable law.

2. Definitions

For purposes of this Policy:

2.1. Confidential Information means any non-public, proprietary or commercially sensitive information disclosed by or on behalf of CNBM South Africa to a recipient in connection with a business relationship or proposed transaction, whether disclosed orally, in writing, electronically, visually, through demonstrations or by any other means.

2.2. Disclosing Party means CNBM South Africa or any person authorised to disclose Confidential Information on its behalf.

2.3. Receiving Party means the customer, buyer, distributor, supplier, contractor, business partner or other entity or person receiving Confidential Information from CNBM South Africa.

2.4. Representatives means the Receiving Party’s directors, officers, employees, professional advisers, consultants and contractors who require access to Confidential Information for an authorised purpose.

2.5. Authorised Purpose means evaluating, negotiating, establishing or performing a legitimate business relationship or transaction with CNBM South Africa, as agreed between the parties.

3. Scope of Confidential Information

Confidential Information may include, but is not limited to:

3.1. Commercial and Financial Information

Product pricing, quotations, discount structures, margins and negotiated commercial terms.
Sales forecasts, financial information, business plans and budgets.
Customer lists, prospective customer information and sales opportunities.
Business strategies, marketing plans and market research.
Commercial negotiations and proposed or concluded transaction terms.

3.2. Technical and Product Information

Product specifications, technical documentation and non-public product information.
System designs, drawings, engineering information and technical proposals.
Product testing, diagnostic results and non-public performance data.
Technical processes, methods, know-how and trade secrets.
Non-public information relating to solar modules, inverters, battery storage systems and other energy solutions supplied or proposed by CNBM South Africa.

3.3. Supplier and Manufacturer Relationships

Non-public information about manufacturers, suppliers and business partners.
Procurement arrangements, supplier terms and sourcing strategies.
Non-public distribution arrangements, supply-chain information and commercial agreements.
Manufacturer pricing, rebates, negotiated discounts and other commercially sensitive arrangements.

3.4. Operational and Business Information

Internal procedures, operational processes and systems.
Non-public employee, organisational and management information.
Internal reports, correspondence, presentations and business records.
Information relating to planned projects, expansion, partnerships and business development.

3.5. Intellectual Property and Proprietary Materials

Trade secrets, proprietary methods, designs and processes.
Non-public software, systems, documentation and materials.
Unpublished product or business developments.
Other information identified as confidential or which a reasonable business recipient would understand to be confidential given its nature and the circumstances of disclosure.

Information does not need to be individually marked “Confidential” or “Proprietary” to qualify as Confidential Information where its nature or the circumstances reasonably indicate that it should be protected.

4. Exclusions from Confidential Information

Information will not be treated as Confidential Information to the extent that the Receiving Party can demonstrate that it:

4.1. Is or becomes publicly available through no breach of this Policy, contractual duty or other legal obligation by the Receiving Party or its Representatives.

4.2. Was lawfully known to the Receiving Party before disclosure by CNBM South Africa and was not subject to a confidentiality obligation.

4.3. Is lawfully received from an independent third party who is entitled to disclose it and is not under an obligation to keep it confidential.

4.4. Is independently developed by the Receiving Party without using or relying on CNBM South Africa’s Confidential Information.

4.5. Is expressly identified by CNBM South Africa in writing as information that may be disclosed or used without confidentiality restrictions.

The Receiving Party bears the responsibility of establishing that an exclusion applies where reasonably necessary to resolve a dispute concerning the status of information.

Information will not qualify for an exclusion merely because individual elements are publicly available if the particular combination or arrangement of those elements remains confidential.

5. Confidentiality Obligations

The Receiving Party agrees, where this Policy applies to its relationship with CNBM South Africa, to:

5.1. Protect Confidential Information. Maintain the confidentiality of all Confidential Information and apply reasonable safeguards to prevent unauthorised access, use, copying, loss or disclosure.

5.2. Use information only for the Authorised Purpose. Not use Confidential Information for personal gain, an unrelated commercial purpose, competitive advantage or any other purpose outside the scope agreed with CNBM South Africa.

5.3. Restrict access. Limit access to Representatives who reasonably need the information for the Authorised Purpose.

5.4. Prevent unauthorised disclosure. Not publish, distribute, sell, license, transfer or otherwise disclose Confidential Information to an unauthorised person without CNBM South Africa’s prior written consent, except where disclosure is permitted under this Policy or required by law.

5.5. Protect copies and records. Take reasonable steps to secure documents, files, emails, storage devices and other records containing Confidential Information.

5.6. Avoid unauthorised duplication or modification. Not reproduce, alter, reverse engineer or otherwise use confidential materials beyond what is reasonably necessary for the Authorised Purpose or expressly permitted in writing, subject to applicable law.

5.7. Maintain reasonable security. Apply at least the same degree of care used to protect its own information of similar sensitivity, and in no event less than a reasonable standard of care.

6. Disclosure to Representatives

The Receiving Party may disclose Confidential Information to its Representatives only where such access is reasonably necessary for the Authorised Purpose.

Before providing access, the Receiving Party must ensure that the relevant Representatives are subject to appropriate confidentiality obligations through a written agreement, professional duty or other legally enforceable obligation.

The Receiving Party must inform its Representatives of the confidential nature of the information and ensure that they handle it in accordance with the applicable obligations.

The Receiving Party remains responsible for ensuring compliance by its Representatives to the extent provided for under the applicable agreement and law.

Disclosure to a Representative does not authorise that person to use Confidential Information for an unrelated purpose or disclose it to another party.

7. Disclosure Required by Law

Nothing in this Policy prevents the Receiving Party from disclosing Confidential Information where disclosure is required by applicable law, a court order or a lawful request from a competent regulatory or governmental authority.

Where legally permitted and reasonably practicable, the Receiving Party should:

Notify CNBM South Africa in writing before making the disclosure.
Provide reasonable details about the nature and scope of the required disclosure.
Cooperate, where appropriate, with reasonable efforts to seek confidential treatment or limit the disclosure.
Disclose only the information that is legally required.

This section does not require a party to breach a legal obligation, obstruct a lawful investigation or delay a disclosure that must be made immediately.

8. Third-Party Information

CNBM South Africa may receive confidential information from manufacturers, suppliers, customers, distributors and other business partners.

Where such information is disclosed to the Receiving Party, the Receiving Party must protect it in accordance with this Policy and any additional restrictions communicated at the time of disclosure.

The Receiving Party must not assume that information may be shared with other customers, manufacturers, distributors or suppliers merely because it was received during ordinary business dealings.

Any further disclosure must be authorised by CNBM South Africa or otherwise permitted under the applicable agreement and law.

9. Personal Information and Data Protection

Where Confidential Information includes personal information, the parties must handle that information in accordance with applicable data protection laws, including the Protection of Personal Information Act 4 of 2013 (“POPIA”), where applicable.

The Receiving Party must:

Use personal information only for an authorised and lawful purpose.
Limit access to persons who require it for that purpose.
Apply appropriate technical and organisational safeguards.
Not disclose personal information to unauthorised parties.
Notify CNBM South Africa promptly if it becomes aware of a suspected or actual unauthorised access, loss or disclosure involving personal information received from CNBM South Africa.
Comply with any applicable obligations concerning retention, deletion, security and lawful processing.

Where the parties process personal information on each other’s behalf, they must enter into any additional agreement required by applicable law.

Personal information must not be transferred across borders or made available to overseas recipients except where the transfer is authorised and complies with applicable legal requirements.

This section supplements CNBM South Africa’s Privacy Policy and does not replace any separate data-processing agreement that may be required.

10. Security Incidents and Unauthorised Disclosure

The Receiving Party must notify CNBM South Africa in writing as soon as reasonably practicable after becoming aware of any actual or reasonably suspected:

Unauthorised access to Confidential Information.
Loss, theft or misplacement of records or devices containing Confidential Information.
Unauthorised copying, use or disclosure.
Security incident that may compromise Confidential Information.
Breach of confidentiality obligations by the Receiving Party or its Representatives.

The notification should include the known circumstances, the categories of information affected and any containment measures taken, to the extent this information is reasonably available.

The Receiving Party must take reasonable steps to contain the incident, prevent further unauthorised disclosure, preserve relevant evidence and cooperate with reasonable investigative or remedial measures.

Where personal information is involved, the parties must separately comply with any applicable statutory notification requirements.

11. Ownership and Intellectual Property

All Confidential Information remains the property of CNBM South Africa or the relevant third-party owner.

Disclosure of Confidential Information does not grant the Receiving Party any ownership rights, intellectual property rights, licence or other interest in the information, except for the limited right to use it for the Authorised Purpose.

No patent, copyright, trademark, design, trade secret or other intellectual property licence is granted by implication.

The Receiving Party must not register, claim ownership of or commercially exploit CNBM South Africa’s intellectual property based on access to Confidential Information.

Any permitted use of CNBM South Africa’s name, trademarks, logos, product images or other brand assets must comply with the relevant written authorisation or agreement.

12. Return or Destruction of Confidential Information

Upon written request from CNBM South Africa, or when the relevant business purpose has ended, the Receiving Party must, within a reasonable period and subject to applicable law:

Return Confidential Information in its possession or control; or
Securely destroy or permanently delete it, as instructed by CNBM South Africa.

Where requested, the Receiving Party should confirm in writing that it has completed the return or destruction.

This obligation does not require the deletion of information that must be retained under applicable law, a legitimate regulatory requirement or a binding record-retention obligation. It also does not require the removal of routine backup copies that cannot reasonably be deleted immediately, provided that retained information remains protected and is not restored or used except as necessary for legitimate technical, legal or compliance purposes.

Any retained Confidential Information remains subject to the applicable confidentiality obligations for as long as it is retained.

13. Duration of Confidentiality Obligations

Unless a separate written agreement specifies otherwise, the confidentiality obligations under this Policy apply from the time Confidential Information is disclosed and continue for five years after the last disclosure.

Information that qualifies as a trade secret or remains protected under applicable law must continue to be protected for as long as it retains that protected status, subject to applicable law.

The expiry or termination of a business relationship does not automatically release the Receiving Party from confidentiality obligations that remain in force.

Any longer period or additional obligation set out in a signed agreement will apply in accordance with that agreement.

14. Breach and Remedies

Unauthorised use or disclosure of Confidential Information may cause commercial, financial, reputational or other harm to CNBM South Africa or a third-party owner.

Where a breach occurs, CNBM South Africa may pursue remedies available under the applicable agreement and South African law. Depending on the circumstances, these may include:

Requiring the cessation of unauthorised use or disclosure.
Requesting the return or destruction of Confidential Information.
Seeking an interdict or other appropriate court order.
Claiming damages where legally recoverable.
Exercising any other lawful contractual or legal remedy.

The availability of a remedy will depend on the facts, the applicable agreement and legal requirements. Nothing in this Policy creates automatic liability for losses that are not legally recoverable or excludes any defence or right available under law.

15. No Transfer of Commercial Rights

Unless expressly agreed in writing, this Policy does not:

Require CNBM South Africa to disclose any particular information.
Require either party to enter into or continue a business relationship.
Guarantee the accuracy or completeness of information disclosed for preliminary discussion.
Replace a quotation, purchase order, distribution agreement, supply agreement, warranty or other commercial contract.
Alter the agreed price, payment terms, delivery conditions or other terms of a separate transaction.

Any binding commercial commitments must be recorded in the relevant agreement or other authorised written document.

16. Relationship with Other Agreements

Where a confidentiality or non-disclosure agreement has been separately signed between CNBM South Africa and the Receiving Party, the terms of that agreement will govern the matters it expressly covers.

Where this Policy conflicts with a separately signed agreement, the conflict will be resolved according to the agreement’s terms and applicable law.

Nothing in this Policy overrides mandatory legal obligations.

17. Amendments

CNBM South Africa may review this Policy periodically and revise it to reflect changes in its business operations, information security practices or applicable legal requirements.

Where this Policy forms part of a signed agreement or accepted commercial terms, any amendment affecting the parties’ contractual rights must be made in accordance with the amendment provisions of that agreement and applicable law.

The current version and its effective date should be maintained in CNBM South Africa’s relevant policy records.

18. Governing Law

This Policy is governed by the laws of the Republic of South Africa, subject to any mandatory legal requirements that apply.

Any dispute arising from this Policy will be dealt with in accordance with the applicable agreement and the jurisdictional rules of South African law.

19. Company Details and Contact