PAIA MANUAL

This Manual has been prepared in accordance with Section 51 of PAIA and serves as Nu Skin’s public guide for requesting access to records held by the Company.

2.1 The categories of records held by Nu Skin that are automatically available without the need to submit a formal PAIA request.

2.2 The procedure to request access to records held by Nu Skin.

2.3 The categories of records held by Nu Skin.

2.4 The contact details of the Information Officer and Deputy Information Officer responsible for PAIA compliance.

2.5 How to obtain the Information Regulator’s PAIA Guide.

2.6 The categories of personal information processed by Nu Skin.

2.7 The purposes for which personal information is processed.

2.8 The categories of recipients to whom personal information may be disclosed.

2.9 Information regarding cross-border transfers of personal information.

2.10 The security safeguards implemented by Nu Skin to protect personal information.

3.1 Information Officer

Name: Elna De Moraes

Position: Director of Nu Skin Enterprises South Africa (PTY) Ltd

Telephone: +4531785871

Email: edmoraes@nuskin.com

3.2 Deputy Information Officer

Name: Fred Descloux

Position: Director, Privacy, Data Security and GRC

Telephone: +1 801-345-1000

Email: fdescloux@nuskin.com

3.3 General PAIA Contact

Email: southafricasupport@nuskin.com

3.4 Head Office

Company Name: Nu Skin Enterprises South Africa (Proprietary) Limited

Registered Address:

Ground & 1st Floor C/O Spaces

22 Magwa Crescent

Waterfall City

Midrand

Gauteng 1682

South Africa

Telephone: +27 87 550 3103

Email: southafricasupport@nuskin.com

Website: https://www.nuskin.com/

https://www.nuskin.com/en_ZA/home.html

4.1 The Information Regulator has compiled and published the official Guide on how to use PAIA. The Guide contains practical information explaining how persons may exercise their rights under both PAIA and POPIA.

4.2 The Guide is available in all official South African languages and in Braille.

4.3 The Guide contains information relating to:

• 4.3.1 The objectives of PAIA and POPIA.
• 4.3.2 The contact details of Information Officers and Deputy Information Officers.
• 4.3.3 The procedures for requesting access to records held by public and private bodies.
• 4.3.4 The assistance available from Information Officers.
• 4.3.5 The assistance available from the Information Regulator.
• 4.3.6 Available legal remedies under PAIA and POPIA.
• 4.3.7 The statutory obligation for private bodies to compile PAIA Manuals.
• 4.3.8 Categories of records that may be voluntarily disclosed.
• 4.3.9 Applicable request fees.
• 4.3.10 Relevant PAIA Regulations.

4.4 Copies of the Guide may be inspected during normal business hours at:

• the offices of the Information Regulator;
• Nu Skin’s South African office; and
• other locations designated by the Information Regulator.

4.5 The Guide may also be obtained:

4.5.1 Upon request to the Information Officer.

4.5.2 From the Information Regulator website (https://inforegulator.org.za)

4.6 Copies of the Guide are available in the following official language:

• English

Certain records are made available by Nu Skin without requiring a formal PAIA request, subject to applicable law and any reasonable administrative requirements.

Nu Skin maintains records in accordance with applicable South African legislation. Access to these records shall be subject to the applicable legislation and, where appropriate, PAIA.

Nu Skin maintains records necessary for the operation of its business, compliance with legal obligations, and the provision of products and services to customers and Brand Affiliates.

The records listed below are examples of the categories maintained by Nu Skin and should not be interpreted as an exhaustive inventory.

Access to Records

Records listed above may contain confidential, commercially sensitive, personal or legally privileged information.

Access to any record shall be considered in accordance with:

• PAIA;
• POPIA;
• other applicable South African legislation; and
• Nu Skin’s legal obligations to protect confidential and personal information.

The inclusion of a category of records in this Manual does not imply that every record is automatically available. Each request will be assessed on its own merits and in accordance with applicable law.

Nu Skin processes personal information in accordance with the Protection of Personal Information Act, No. 4 of 2013 (“POPIA”), applicable international data protection laws where relevant, and its internal privacy and information security policies.

8.1 Purpose of Processing Personal Information

Nu Skin processes personal information to support its business operations and to provide products and services to customers, Brand Affiliates, employees, suppliers and other stakeholders.

Depending on the nature of the relationship with the individual, personal information may be processed for one or more of the following purposes:

• Creating and administering customer and Brand Affiliate accounts;
• Processing product purchases, payments and deliveries;
• Managing customer relationships and providing customer support;
• Administering Brand Affiliate relationships, commissions and incentive programs;
• Responding to enquiries and exercising contractual obligations;
• Managing events, incentive trips and training programs;
• Processing employment applications and administering employment relationships;
• Conducting marketing activities where permitted by law;
• Managing product complaints, adverse events and regulatory obligations;
• Operating websites, mobile applications and digital services;
• Improving products, services and customer experience;
• Maintaining information security and preventing fraud;
• Complying with legal and regulatory obligations;
• Exercising or defending legal rights; and
• Any other lawful business purpose compatible with the original purpose for which the information was collected.

Personal information is processed only where an appropriate legal basis exists, including contractual necessity, legal obligation, legitimate interests, consent or other lawful grounds recognized under applicable legislation.

8.2 Description of the Categories of Data Subjects and Categories of Personal Information

Nu Skin processes personal information relating to the following categories of data subjects:

In limited circumstances, Nu Skin may process special personal information (including health-related information) where necessary to provide products or services, manage adverse events, fulfil legal obligations, or where explicit consent has been obtained, in accordance with applicable law.

8.3 Categories of Recipients to whom Personal Information may be Supplied

Depending on the processing activity and applicable law, personal information may be disclosed to:

• Other companies within the Nu Skin group;
• Brand Affiliates;
• Logistics, courier and fulfilment providers;
• Payment processors and financial institutions;
• Information technology and cloud service providers;
• Customer support service providers;
• Marketing, communications and event management providers;
• Professional advisers;
• Regulatory authorities;
• Healthcare professionals;
• Insurance providers;
• External consultants;
• Other third parties where disclosure is authorized by law or with the individual’s consent.

Nu Skin requires service providers processing personal information on its behalf to implement appropriate safeguards.

8.4 Planned Transborder Flows of Personal Information

As an international organization, Nu Skin may transfer personal information outside the Republic of South Africa where necessary for legitimate business operations.

Transfers may occur to:

• Other Nu Skin entities located in various jurisdictions;
• Global information technology infrastructure providers;
• Cloud hosting providers;
• Customer support platforms;
• Service providers assisting Nu Skin in delivering products and services;
• Other jurisdictions where Nu Skin conducts business.

Where personal information is transferred internationally, Nu Skin implements appropriate safeguards in accordance with POPIA and other applicable privacy laws. These safeguards may include:

• contractual safeguards;
• intra-group data protection arrangements;
• recognized international transfer mechanisms;
• security controls; and
• other legally recognized safeguards.

Further information regarding international transfers is available in Nu Skin’s Global Privacy Notice.

8.5 General Description of Information Security Measures

Nu Skin has implemented administrative, technical and physical safeguards designed to protect personal information against accidental or unlawful destruction, loss, alteration, unauthorized disclosure or access.

These safeguards include, where appropriate:

• Information security governance and policies;
• Role-based access controls;
• Identity and access management procedures;
• Authentication and password controls;
• Encryption of personal information during transmission and, where appropriate, at rest;
• Network security controls including firewalls and intrusion prevention technologies;
• Endpoint protection and malware prevention;
• Security monitoring and logging;
• Vulnerability management and patch management;
• Business continuity and disaster recovery processes;
• Secure software development and change management practices;
• Employee confidentiality obligations and privacy training;
• Vendor security assessments and contractual data protection obligations;
• Physical security controls at Nu Skin facilities; and
• Incident response and breach management procedures.

Access to personal information is granted only to authorized personnel with a legitimate business need to know.

Nu Skin regularly reviews and enhances its information security program to address evolving risks and regulatory requirements.

This PAIA Manual provides a high-level description of Nu Skin’s processing of personal information for purposes of compliance with PAIA and POPIA. For more detailed information regarding Nu Skin’s privacy practices, including specific processing activities, legal bases for processing, retention periods, data subject rights and international transfers, please refer to the current Global Privacy Notice available on the Company’s website.

9.1 A copy of this Manual is available:

• 9.1.1 On Nu Skin’s South African website: https://www.nuskin.com/en_ZA/home.html
• 9.1.2 At the registered office during normal business hours.
• 9.1.3 Upon request to the Information Officer.
• 9.1.4 To the Information Regulator upon request.

9.2 A fee for a copy of this Manual shall be payable only where permitted by applicable legislation.