PAIA Manual

Manual prepared in terms of section 51 of the Promotion of Access to Information Act 2 of 2000 ("PAIA"), read with the Protection of Personal Information Act 4 of 2013 ("POPIA") and the Regulations relating to the Promotion of Access to Information, 2021.

1. Definitions and abbreviations

2. Purpose of this manual

This manual:

• describes the records held by the Company and the subjects to which they relate;
• explains how to request access to a record and what it costs;
• sets out the grounds on which access may be refused;
• describes how the Company processes personal information, as required by POPIA; and
• informs requesters of the remedies available to them.

3. Company details and contact particulars

3.1 Information Officer

3.2 Deputy Information Officer

No Deputy Information Officer has been designated. All requests should be directed to the Information Officer.

4. Guide on how to use PAIA and POPIA

The Regulator has published a Guide, in terms of section 10 of PAIA, on how to use PAIA and POPIA. The Guide is available in each official language and in braille. It contains, among other things, the objects of PAIA and POPIA, the contact details of information officers, the manner and form of requests for access, the assistance available from the Regulator and the remedies available to requesters.

The Guide may be obtained:

• from the Regulator's website: inforegulator.org.za;
• by contacting the Regulator (see section 4.1); or
• by inspecting a copy at the Company's offices during normal working hours, or requesting a copy from the Information Officer (Form 1 of the PAIA Regulations, 2021, may be used).

4.1 Information Regulator contact details

5. Records automatically available

The following records are available without a formal PAIA request (section 52), subject to any reasonable copying charge:

• information published on the Company's website, including its Privacy Policy, Cookie Policy, Website Terms of Use, Disclaimer and this manual;
• marketing and information material that the Company has made publicly available.

No notice under section 52(2) has been published in the Government Gazette at the date of this manual.

6. Records available in terms of other legislation

The Company keeps records in accordance with legislation that applies to it, including:

• Companies Act 71 of 2008
• Consumer Protection Act 68 of 2008 (where applicable)
• Electronic Communications and Transactions Act 25 of 2002
• Financial Intelligence Centre Act 38 of 2001 (where applicable)
• Income Tax Act 58 of 1962
• Promotion of Access to Information Act 2 of 2000
• Protection of Personal Information Act 4 of 2013
• Tax Administration Act 28 of 2011
• Value-Added Tax Act 89 of 1991 (if the Company is registered for VAT)

The Company has no employees at the date of this manual. If employees are appointed, records kept under employment legislation (including the Basic Conditions of Employment Act 75 of 1997, the Labour Relations Act 66 of 1995 and the Unemployment Insurance Act 63 of 2001) will be added.

Records required by legislation to be available may be requested under that legislation or under this manual.

7. Subjects and categories of records held

The fact that a category of record is listed here does not mean that access to it will be granted. All requests are evaluated in terms of PAIA.

8. Processing of personal information (section 51(1)(c) of PAIA, read with POPIA)

8.1 Purpose of processing

The Company processes personal information to respond to enquiries; to onboard and manage referral partners; to receive consent-based introductions and pass them to licensed professionals; to pay agreed fees to partners; to keep records that demonstrate compliance; to protect its website and systems; to manage its business, contractors and suppliers; and to comply with the law.

8.2 Categories of data subjects and personal information

The Company does not intentionally process special personal information about referred persons and instructs partners not to share it.

8.3 Recipients of personal information

• Licensed professionals to whom a referred person has consented to be introduced
• Operators providing website hosting and statistics (Vercel Inc.), form email delivery (FormSubmit), bot protection (Cloudflare Inc.), email and document storage (Microsoft 365), and accounting services
• Auditors, legal and other professional advisers
• The South African Revenue Service, CIPC and other authorities where required by law

8.4 Planned transborder flows

Some operators (for example, website hosting and email delivery providers) may store or process personal information outside South Africa. Transfers take place only as permitted by section 72 of POPIA. The countries concerned are mainly the United States and member states of the European Union.

8.5 Security measures

The Company applies appropriate, reasonable technical and organisational measures to protect personal information, including encrypted website connections, access controls limited to authorised people, controlled channels for introductions, operator agreements requiring confidentiality and security, and procedures for identifying and responding to security compromises. Further measures include encryption of data in transit, encryption of stored data by the Company's hosting and email service providers, and security controls on the website that protect against common attacks and automated abuse.

9. How to request access to a record

1. Complete the prescribed form. Requests must be made on Form 2 (Request for Access to Record) of the PAIA Regulations, 2021, available from the Regulator's website or from the Information Officer.
2. Provide enough detail. The request must identify the record(s) sought and the requester, state the form of access required, give a postal address, email address or other contact details, and identify the right the requester seeks to exercise or protect and explain why the record is required to exercise or protect that right (section 53(2) of PAIA).
3. Requests on behalf of another person. Proof of the capacity in which the request is made must be provided.
4. Submit the request to the Information Officer by email or by hand at the address in section 3.1.
5. Pay the request fee, if applicable (see section 10). The request will not be processed until the request fee has been paid.

The Company will decide on a request within 30 days of receiving it and notify the requester using Form 3 (Outcome of request and of fees payable). The period may be extended once by up to 30 days in the circumstances set out in section 57 of PAIA, in which case the requester will be notified. If the Company does not respond within the required period, the request is regarded as refused (section 58).

A requester who needs help completing the form, including a requester with a disability, may ask the Information Officer for assistance.

10. Fees

Fees are prescribed in Annexure B to the PAIA Regulations, 2021.

• Personal requesters (requesting their own personal information) do not pay a request fee, but may be charged an access fee for reproduction.
• Other requesters pay a request fee before the request is processed, and an access fee if access is granted.
• If the search for and preparation of a record will take more than six hours, a deposit of one third of the access fee may be required.

Fee amounts are those published by the Information Regulator at the date of this manual. Payment details will be provided on request: please contact info@distributionpartners.co.za.

11. Grounds for refusal of access

The Company may, and in some cases must, refuse access to records on the grounds set out in Chapter 4 of Part 3 of PAIA, including where access would involve:

• the unreasonable disclosure of personal information about a third party, including a deceased person (section 63);
• commercial information of a third party, such as trade secrets or confidential financial, commercial or technical information (section 64);
• a breach of a duty of confidence owed to a third party (section 65);
• endangering the life or physical safety of a person, or the security of property (section 66);
• records privileged from production in legal proceedings (section 67);
• the Company's own trade secrets or confidential commercial, financial or technical information, or information that could prejudice it in negotiations or competition (section 68); or
• research information of the Company or a third party (section 69).

Access must nevertheless be granted where the public interest override in section 70 applies. Where a record contains information about a third party, the Company will follow the third-party notification procedure in sections 71 to 74 of PAIA.

12. Remedies

The Company does not have an internal appeal procedure. A requester or third party dissatisfied with a decision of the Information Officer may, within 180 days of being notified of the decision:

• lodge a complaint with the Information Regulator (section 77A of PAIA), using the Regulator's prescribed complaint form; or
• apply to a competent court for appropriate relief (sections 78 to 82 of PAIA).

13. Availability of this manual

This manual is available:

• on the Company's website, at www.distributionpartners.co.za/legal/paia-manual;
• at the Company's principal place of business for inspection during normal business hours; and
• on request to the Information Officer, subject to the prescribed copying fee.

14. Updating of this manual

The Head of the Company will review this manual regularly and update it when there are material changes to the Company's details, records or processing activities.