Privacy Policy

Pegasus Information Studio (Pty) Ltd, trading as Whole, is a company registered in South Africa (Reg. 2022/386552/07), with its registered office at 5 Kennington Close, Milnerton Rural, Parklands North, Cape Town, Western Cape, 7741, South Africa.

Pegasus Information Studio (Pty) Ltd is the responsible party (under POPIA) and data controller (under UK GDPR, where applicable) for your personal data.

Information Officer: Joël Samuel Kapepula, reachable at privacy@joinwhole.app.

If you have any questions about this policy or how we handle your data, contact us at privacy@joinwhole.app.

We collect information you provide directly, such as when you create an account, sign up to our waitlist, or contact us. This includes your name, email address, and any preferences you share with us.

When you use the Whole app, we collect data you log — including movement, nutrition, sleep, mood, and soul check-ins — to provide you with personalised insights and recommendations. Much of this data constitutes special personal information (health data) under POPIA section 26, and special category data under UK GDPR Article 9, which we process on the basis of your explicit consent (see Section 3).

We may also collect usage data such as app interactions and feature usage to improve our product.

Under the Protection of Personal Information Act, 2013 (POPIA) and, where applicable, the UK General Data Protection Regulation (UK GDPR), we rely on the following legal bases to process your personal data:

• Consent — for processing special personal information (health data) such as mood, nutrition, sleep, and soul check-ins. You provide this consent when you create your account and begin logging data. You may withdraw consent at any time by deleting your account or contacting us
• Contract — to provide the Whole service to you, manage your subscription, and deliver the features you have signed up for
• Legitimate interests — for product improvement, security, fraud prevention, and analytics, where these interests are not overridden by your rights
• Legal obligation — where we are required to retain or disclose data by law

We use your information to:

• Provide, operate, and improve the Whole app and services
• Personalise your experience and generate your wellness insights
• Send you product updates, newsletters (if you opt in), and service communications
• Respond to your enquiries and support requests
• Comply with our legal obligations

We do not sell your personal data to third parties.

Your data is stored securely using industry-standard encryption in transit and at rest. We use reputable cloud infrastructure providers and apply appropriate technical and organisational measures to protect your personal information.

Access to personal data is limited to those who need it to operate and improve our services.

The Whole app handles special personal information under POPIA section 26 and special category data under UK GDPR Article 9, including nutrition logs, sleep records, mood check-ins, movement data, and soul practices.

We process this data solely on the basis of your explicit consent, which you provide when you create your account and begin logging. You may withdraw this consent at any time by deleting your data or your account.

We use this data solely to power your personal insights and experience within the app. We do not share individual health data with third parties, advertisers, or insurers.

We are a South African company and may store or process your data in South Africa and other jurisdictions. Where your data is transferred outside South Africa, we ensure appropriate safeguards are in place in accordance with POPIA section 72 — including transferring data only to countries with equivalent data-protection laws or obtaining your consent.

If you are based in the United Kingdom or European Economic Area, we ensure that transfers outside those regions comply with UK GDPR and EU GDPR requirements, including the use of standard contractual clauses or equivalent transfer mechanisms approved by the relevant supervisory authority.

We use essential cookies to operate our website and app. We may use analytics cookies to understand how visitors use our site — you can opt out of these at any time via our cookie preferences.

We do not use advertising cookies or share cookie data with third-party advertisers.

Under POPIA, you have the right to:

• Access the personal information we hold about you (section 23)
• Correct inaccurate or incomplete data (section 24)
• Request deletion of your data (section 24)
• Object to the processing of your data (section 11(3))
• Data portability — receive your data in a machine-readable format

If you are based in the United Kingdom, you additionally have rights under UK GDPR, including the right to restrict processing and to withdraw consent at any time.

To exercise any of these rights, contact our Information Officer at privacy@joinwhole.app.

If you are not satisfied with how we handle your data, you have the right to lodge a complaint with: - The Information Regulator (South Africa): inforeg@justice.gov.za | https://inforegulator.org.za - The Information Commissioner’s Office (ICO, United Kingdom), if you are a UK data subject: https://ico.org.uk | 0303 123 1113

We retain your personal data for as long as your account is active or as needed to provide you with our services. If you delete your account, we will delete your personal data within 30 days, unless retention is required by law.

Whole may integrate with third-party services such as fitness trackers or wearable devices (e.g. Apple Health, Strava). When you connect these integrations, you authorise us to access and use the data from those services in accordance with this policy.

Each third-party service has its own privacy policy, which we encourage you to review.

Whole is not directed at children under 13. We do not knowingly collect personal information from children under 13. If we become aware that a child under 13 has provided us with personal information, we will take steps to delete it.

We may update this Privacy Policy from time to time. We will notify you of any significant changes by email or through the app. Your continued use of Whole after changes are posted constitutes your acceptance of the updated policy.

If you have questions about this Privacy Policy or how we handle your data, please contact us at:

Information Officer: Joël Samuel Kapepula Email: privacy@joinwhole.app Address: 5 Kennington Close, Milnerton Rural, Parklands North, Cape Town, Western Cape, 7741, South Africa Entity: Pegasus Information Studio (Pty) Ltd (Reg. 2022/386552/07)

You may also contact the Information Regulator (South Africa) at inforeg@justice.gov.za if you have concerns about how your data is being handled. If you are a UK data subject, you may contact the ICO at https://ico.org.uk.