Confidentiality, Acceptable Use and Platform Terms Vigilix (Pty) Ltd Registration: 2026/706795/07 Version: 2026-10-13.v1 Effective date: 2026-10-13 Document SHA-256: 2b7c28ae669e42ad4edb8669bf9b040870ca960480399c031a17fed3fddcd180 Privacy Email: info@vigilix.co.za KEY TERMS - Use Vigilix only for an authorised, lawful investigation or approved operational purpose. Access permission does not itself establish a legal basis to investigate a person. - Keep restricted information confidential, including camera locations, plates, images, movements, watchlists, cases, screenshots and exports. Share only the minimum necessary with authorised recipients through approved channels. - Do not copy, clone, reverse engineer or redistribute the program or its protected designs and feature implementations, or use Vigilix's confidential technical knowledge to build or help someone build a competing product. Section 19 explains these restrictions and the exceptions required by law. - Results, alerts, correlations and machine-learning outputs can be wrong or incomplete. Corroborate them; they are investigative leads, not verdicts or authority to stop, detain or confront anyone. - Sections 24 to 26 address service limitations, responsibility for loss, a limited indemnity for deliberate or reckless misuse, and remedies. They preserve rights and liabilities that the law does not allow either party to exclude. - Acceptance is recorded for each login and registration. Lawful disclosures to advisers, courts, regulators and protected reporting remain permitted. You may decline and leave without entering the platform. 1. Who these Terms bind These Terms govern access to the Vigilix investigation platform, including its Argus application, related interfaces, reports and authorised integrations. The provider is Vigilix (Pty) Ltd, registration number 2026/706795/07 (Vigilix, we or us). You are the individual registering for or accessing an account. Your organisation means the customer or other organisation that authorises your access. You accept duties applying to your own conduct. You bind an organisation only to the extent you actually have authority. These Terms do not make an employee a guarantor for their employer or responsible for every other user's conduct. An organisation's separately agreed commercial and data-processing obligations remain its own. 2. Electronic acceptance and each login You must actively accept the version presented when registering and before each successful login. The complete notice is displayed for registration and when your verified account has not yet accepted the current version. Your acceptance is saved; later logins still require a fresh tick, with a link to the full Terms. You may open, read, print or save the complete Terms first. If you disagree, do not complete registration or login; contact your organisation about alternatives. Acceptance does not guarantee account approval or particular access permissions. Submitting the acceptance control electronically indicates your agreement. We retain a record identifying the account, agreement version, event and time, with associated security metadata. Such records are evidence that may be examined and challenged; these Terms do not declare them conclusive. Reaccepting an unchanged version confirms continuing duties. It does not purchase a service, renew a subscription, authorise payment or waive an existing claim. A previous acceptance does not replace acceptance for a later login. 3. Permitted purpose and authority Use the platform only for a lawful, defined investigation, security analysis or operational purpose approved by your organisation and within assigned permissions. Know the purpose and authority for each search, watchlist entry, monitoring instruction, export and disclosure. Record the reason where required by the platform or your organisation. The platform grants no policing, interception, enforcement or surveillance powers. It is an investigation aid, not an emergency-response service or source of court-certified evidence. Do not use a result alone to accuse, stop, detain, punish or confront anyone, deny a service or make another materially adverse decision. 4. Identity, access and account security Provide accurate registration information, use your assigned account and keep your role and organisation details current. Do not lend accounts, share passwords, exchange session cookies, impersonate another person or allow unauthorised session access. Use required authentication safeguards and promptly report suspected credential compromise. Protect devices and downloads with appropriate access controls, lock unattended screens and sign out when finished. Do not bypass tenant, source, role or export restrictions. Tell your administrator when your authority changes. Information exposed through an error or excessive permission is not authorised for use; stop and report it. 5. Information covered by confidentiality Confidential Information is non-public information obtained through the platform, its administration, support or your relationship with Vigilix that is marked confidential or reasonably understood to be confidential from its nature or context. Protection does not depend on a stamp, format or whether you memorised, copied or summarised it. It includes number plates and ANPR captures; images and vehicle attributes; dates, times, coordinates, movements and journeys; camera locations, coverage and source identities; Bluetooth or BLE identifiers and correlations; watchlists, vehicles of interest, tripwires and alerts; investigations, notes, rosters, contacts and operational plans; analytics, scores and model outputs; and their extracts, screenshots, recordings and reports. It also includes credentials, security weaknesses, configuration, architecture, code, unpublished documentation, business plans, pricing, customer and supplier information, and confidential material entrusted by others. Information about people is protected whether allegations are correct or not. A combination or analysis can remain confidential although individual facts are public. 6. Your non-disclosure and protection duties Use Confidential Information solely for the permitted purpose. Protect it with reasonable care appropriate to its sensitivity, and at least the care you apply to comparable information of your own. Restrict access to people needing it for the authorised task and follow lawful organisational security and retention instructions. Do not publish, sell, trade, leak or exploit it for personal benefit or an unrelated person's benefit. Do not discuss restricted investigations, source coverage or identifiable individuals in public places, public groups or channels accessible to unauthorised recipients. Prevent accidental disclosure through screen sharing, photographs of screens, copied links, notifications, printed pages or unattended devices. Report accidental disclosure promptly rather than concealing it. These duties continue after your role, subscription or account ends as described in section 23. 7. Sharing for authorised work Share information only where the recipient, purpose, information and channel are authorised and disclosure is lawful. Confirm recipients, disclose only what is necessary, preserve relevant uncertainty and source restrictions, and apply appropriate confidentiality protections. Permission to view does not automatically permit export or distribution. Your organisation must approve disclosure outside its authorised working group, subject to section 9. A police, security-company, insurer, customer or partner affiliation does not alone establish entitlement. Where required, verify the requester's identity and authority and record the disclosure. 8. Information outside the confidentiality restriction The contractual confidentiality restriction excludes information you can reasonably demonstrate was already lawfully known to you without a confidentiality duty, became public without a breach by you or someone acting for you, was received lawfully from an unrestricted source, or was independently developed without Confidential Information. An exception covers only the information actually meeting it. It does not release confidential combinations, another person's rights, privacy duties, intellectual-property restrictions or access limits. Public availability does not by itself permit any further use of personal information. 9. Legal obligations, advice and protected reporting Nothing prevents disclosure required or permitted by applicable law, compliance with a valid court order or regulatory demand, a protected disclosure, a lawful report of suspected wrongdoing, or cooperation with a competent regulator or law-enforcement body. You may obtain confidential advice from a lawyer or professional adviser bound by appropriate duties. Vigilix's prior permission is not required. Advance notice or internal reporting is not required where prohibited by law or where it could prejudice a protected report, investigation or legal rights. Vigilix will not treat a legally protected disclosure as a breach. For compulsory disclosure, where lawful and practical without undermining these protections, notify the affected information owner and disclose only what is required. Seek confidential handling where available. This does not require obstruction, concealment of wrongdoing or disobedience of a lawful demand. 10. Exports, screenshots and external tools Make copies, downloads, screenshots, recordings and printed reports only where necessary and authorised. Use approved storage, limit recipients and retention, and preserve warnings, timestamps and provenance. Do not strip access markings or present an edited extract as an unmodified original. Do not upload restricted information into public AI assistants, model-training services, personal cloud storage, public repositories, social media or unapproved messaging groups. External tools require approval of their purpose, recipients, retention, security and international transfers; a paid account alone is not approval. Protect links, tokens and exported files after your session ends. Revoke or report unintended sharing promptly where possible. Copies remain subject to these Terms and the originating organisation's lawful restrictions. 11. Prohibited conduct Do not conduct curiosity searches, stalking, harassment, intimidation, blackmail, unlawful discrimination, retaliation, commercial prospecting, doxxing or monitoring of personal acquaintances without a legitimate authorised purpose. Do not knowingly enter false allegations or use a watchlist to punish someone. Do not scrape or harvest beyond authorised functions, probe vulnerabilities without written authorisation, defeat controls, introduce malware, disrupt service, evade quotas or reconstruct another customer's information. Do not copy proprietary software or reverse engineer it except where expressly authorised or permitted by a non-excludable legal right. 12. Lawful handling of personal information Treat identifiable vehicle movements, images, device identifiers and investigation information as potentially personal information. Limit collection, searching, linking, retention and disclosure to what is relevant and proportionate. Escalate uncertainty about an investigation's authority before continuing. Your acceptance is not consent on behalf of people appearing in the platform. It cannot legalise unlawful collection, replace required notices or authorisations, or remove rights under the Protection of Personal Information Act, 2013 (POPIA). Additional restrictions can apply to criminal allegations, children and other sensitive information. Follow lawful processing instructions, correction procedures and retention schedules. Do not transfer information across borders or appoint another processor without required approval and safeguards. Report inaccurate or improperly obtained information rather than treating it as established fact. 13. Organisational and provider responsibilities The party determining a processing purpose and means remains responsible under applicable law. Vigilix's role may differ between account administration and customer investigation data. These Terms do not override the actual arrangement or transfer all statutory responsibility to individual users. Where Vigilix acts as an organisation's operator, the required written processing arrangements must address instructions, safeguards, incidents and assistance. These individual-use Terms do not replace that agreement. Vigilix and your organisation retain their own lawful processing and security duties. 14. Results, alerts and machine-learning limitations Captures can contain OCR errors, ambiguous images, incomplete coverage, incorrect clocks, delayed or duplicate reports and missing data. A plate does not conclusively identify a vehicle or driver. A reported attribute is a capture observation; a learned profile or correlation is a separate inference. Co-presence, shared routes, BLE associations, anomaly indicators and machine-learning outputs require review. They do not establish identity, ownership, association, wrongdoing or intent. No sightings does not prove absence, and an alert is not a verified emergency or instruction to intervene. Review underlying records, timing, sources and alternative explanations; corroborate material conclusions and preserve uncertainty. Do not make legally or similarly significant decisions solely from automated outputs. Intended evidential use requires independent verification and applicable legal process; the platform does not certify admissibility or chain of custody. 15. Information you contribute Submit only information you may lawfully provide. Distinguish observations, reports, allegations and conclusions; retain relevant sources and times and correct material mistakes promptly. Do not upload unlawful material, unnecessary personal information, malicious files or another person's confidential content without authority. You authorise Vigilix to host and process submissions to provide, secure and support the agreed service and fulfil lawful obligations within applicable processing arrangements. This is not an unrestricted licence to sell investigation data or use it for unrelated public model training. 16. Suspected incidents and cooperation Immediately report suspected unauthorised access, lost devices, exposed credentials, misdirected exports or other security compromises to the designated Vigilix security or privacy contact and your organisation's incident contact. Act on reasonable suspicion; do not await complete proof. Use a secure channel and disclose only necessary details. Stop unsafe activity, preserve relevant records and follow lawful containment instructions. Do not erase logs, destroy material under a legal hold, make false statements or investigate intrusively outside your authority. Cooperate reasonably with incident handling and correction. Internal reporting does not replace statutory notification duties. Responsible parties and operators must fulfil their respective duties. You remain free to contact a regulator or make a protected report independently. 17. Account, acceptance and security records Vigilix processes account, authentication and acceptance records to administer access, fulfil the access agreement, protect the service, document agreement and investigate misuse or disputes. Acceptance records include your account or submitted registration identity, email, workspace, the exact accepted document and version, acceptance time, login or registration channel, request-associated IP address and browser user-agent. Registration details remain unverified until account authentication. These records are necessary to provide controlled access; without them registration or login cannot be completed. Do not send passwords in support messages. Authorised personnel, approved service providers and your organisation's authorised administrators may access relevant records for these purposes; disclosures to authorities require a lawful basis. Access is limited by role and purpose. These Terms do not authorise unrestricted monitoring of your device or unrelated private activity. Account, acceptance and security records must be retained only for justified lawful periods needed for access administration, security, proof of agreement, legal obligations or disputes, with restricted access during lawful holds. Requests about access, correction, deletion, retention or recipients may be directed to the Information Officer at info@vigilix.co.za. Any international transfer must meet applicable legal safeguards. Acceptance is not consent to unrelated marketing or processing that has no lawful basis. These account notices do not replace the separate duties of parties collecting or using investigation data under sections 12 and 13. 18. Questions, corrections and privacy rights Contact Vigilix's published privacy contact to request access or correction, object to processing, or ask about deletion or retention. Requests are assessed under applicable law, including identity verification and legitimate retention or access restrictions. Deletion is not promised where a legal obligation or justified hold requires retention. You may complain directly to the Information Regulator of South Africa through inforegulator.org.za. Internal discussion is not a prerequisite to statutory complaints, urgent relief or protected reporting. Refer third-party requests through the appropriate privacy process without exposing others' information. 19. Intellectual property, no copying and no cloning Vigilix and its licensors retain their respective intellectual-property rights in the platform, source and object code, original interface and screen designs, graphics, branding, documentation and proprietary feature implementations. Non-public architecture, algorithms, workflows, specifications and technical know-how are also protected as Confidential Information where they meet section 5. Access gives you limited permission for authorised use while your access remains valid; it transfers no ownership or right to exploit these materials independently. Except for ordinary authorised use, Vigilix's prior written authorisation or a non-excludable legal right, you must not reproduce, copy, clone, modify, translate, adapt, distribute, sell, license, sublicense, rent, publish or create derivative works from the program, its code or its protected interface, designs or feature implementations. You must not decompile, disassemble, reverse engineer or attempt to extract source code or non-public technical information. Ordinary authorised use includes necessary browser operation and permitted investigation exports; it does not authorise copying the product. You must not use your access, Confidential Information or copied or extracted platform material to replicate Vigilix's protected designs or feature implementations, reproduce its confidential workflows, algorithms or architecture, or develop a competing or substitute product using those materials. You must not commission, assist or enable another person to do so. This includes supplying copied screens, recordings, documentation, specifications, code samples or AI prompts containing protected material or Confidential Information for that purpose, even if the resulting product uses different branding or rewritten code. Do not remove copyright, trade-mark or other proprietary notices, claim ownership of Vigilix's work, register its protected branding as your own or imply Vigilix endorses your conclusions or services. Customer and source information remains subject to its owners' rights and applicable law. These Terms do not declare ownership of people's personal information or override source restrictions. No licence permits onward sale, publication or creation of competing datasets from restricted information. These restrictions protect original expression, existing intellectual-property rights and lawfully held confidential knowledge. They do not assert exclusive ownership of generic ideas, publicly known functionality, general skills or genuinely independent development that does not copy protected material or misuse Confidential Information. Applicable third-party licence rights, non-excludable legal rights and the lawful-disclosure protections in section 9 remain available. 20. Sources and integrations Camera feeds, telecommunications, maps, messaging and external data may come from other organisations and have delays, omissions or separate conditions. Use integrations only with necessary authority and approved destinations. Verify recipient groups and devices before enabling forwarding or alerts. External availability and outputs are not wholly within Vigilix's control. Vigilix retains responsibility for its own obligations and representations. Report incorrect destinations or unexpected disclosures immediately. 21. Availability and service changes Maintenance, incidents, upstream failures and technical limits may interrupt service or delay data. Unless a written service agreement provides otherwise, these Terms promise no continuous availability, complete coverage, response time or recovery of every record. Maintain independent operational and emergency arrangements. Vigilix may reasonably change the service for security and maintenance. Material commercial commitments remain governed by the customer agreement and mandatory law. Report faults through approved support; do not attempt unauthorised repairs or assume a quiet feed means no relevant event occurred. 22. Restriction, suspension and termination Vigilix or your authorised administrator may restrict access where reasonably necessary for a security risk, suspected material misuse, loss of authorisation, legal requirement or the end of the service arrangement. Immediate restriction may contain an urgent risk; it is not a finding of guilt. Where lawful and practical, you will receive reasons and a way to challenge an error through the published contact. Protected legal rights are not grounds for retaliation. Suspension does not automatically forfeit statutory remedies, accrued rights or applicable refund rights. 23. Ending access, copies and continuing duties When authority ends or you receive a lawful return or deletion instruction, stop access and return or securely delete copies under your control, subject to retention requirements and legal holds. Confirm completion honestly if reasonably requested. Identify copies that cannot lawfully be deleted and restrict their use. Confidentiality continues while information remains confidential; trade secrets remain protected while secret, and personal information remains subject to privacy duties while held or processed. Termination does not erase accrued claims or permit disclosure of retained material. Lawful disclosure exceptions continue. 24. Service limitations and responsibility for loss Read this section with the highlighted notice. Sections 14, 20 and 21 require verification of important outputs rather than reliance on guaranteed accuracy, safety or uninterrupted service. They do not excuse Vigilix from care, obligations or remedies required by law or the service agreement. Each party remains responsible for loss for which it is legally liable. Breach, causation, foreseeability, mitigation and contribution follow applicable law. These Terms impose no fixed damages penalty, automatic recovery of all losses or general monetary liability cap. Nothing excludes or limits liability for fraud, wilful misconduct, gross negligence or any liability or consumer right that cannot lawfully be excluded. You do not assume responsibility for Vigilix's unlawful conduct. Separate customer agreements may allocate commercial risks only to the extent lawful. 25. Limited indemnity for deliberate or reckless misuse To the extent lawful, you must reimburse Vigilix for reasonable, proven third-party damages and reasonable defence costs directly caused by your deliberate or reckless unauthorised disclosure, unlawful platform use or knowing infringement of another person's rights. This applies only to your contribution, excluding loss caused by others for which you are not legally responsible. Vigilix must give reasonably prompt claim notice, information and an opportunity to participate in the defence, and reasonably mitigate loss. No settlement may impose an admission, non-monetary obligation or unreasonable payment without your agreement. Liability remains subject to judicial determination or agreed settlement and mandatory protections. 26. Enforcement and proportionate remedies Unauthorised disclosure may cause harm not easily repaired by money alone. Vigilix or an affected rights holder may seek an interdict, damages or other relief from a competent court. Relief depends on legal requirements and the court's decision; acceptance creates no automatic entitlement to an order. Reasonable access controls, investigation and preservation may protect the service. Legal costs are recoverable only by lawful agreement or applicable award. These Terms create no automatic criminal liability, private fine, right to seize devices or right to silence lawful complaints. 27. Commercial agreements and future versions Fees, duration, renewal, cancellation, service levels and organisation-level processing commitments belong in the written customer agreement. Login acceptance does not introduce charges or replace mandatory rights. A specific signed agreement prevails over an inconsistent general provision here; applicable law always prevails. Vigilix may present an identified updated version for future affirmative acceptance. Material changes should be identified. A new version does not retrospectively authorise misuse, remove accrued claims or change separate commercial commitments without a lawful basis. If you decline, access may remain unavailable while you discuss arrangements with your organisation or Vigilix. Existing confidentiality duties continue, and applicable cancellation and other rights remain available. 28. Governing law, notices and interpretation South African law governs, subject to mandatory protections applicable to a person or transaction. Disputes may go before a court with competent jurisdiction. There is no compulsory private arbitration or restriction on approaching regulators or seeking urgent relief. Privacy requests and security concerns may be directed to the Information Officer at info@vigilix.co.za. Use your organisation's established support channel for service matters. Formal legal notices and service of process must use a delivery method permitted by applicable law or the relevant signed agreement. Keep your contact details current. Receipt and legal effect follow applicable law; a notice is not automatically received simply because it was sent. An unenforceable provision is severed or limited only as law permits, preserving mandatory protections and the essential bargain. Non-enforcement once does not waive future rights. No provision grants authority over third-party information beyond authority actually held, or overrides section 9. ACCEPTANCE I agree to Vigilix's confidentiality, acceptable use and platform terms.