PAIA & POPIA
Manual

1. Background to the Promotion of Access to Information Act

The Promotion of Access to Information Act, No. 2 of 2000 ("the Act" / "PAIA") was enacted on 3 February 2000, giving effect to the constitutional right of access to information held by the State and by another person where that information is required for the exercise or protection of any rights (section 32 of the Bill of Rights, Constitution of the Republic of South Africa, 1996). In terms of section 51 of the Act, all private bodies are required to compile an information manual ("PAIA Manual"). Where a request is made in terms of the Act, the body to whom the request is made is obliged to release the information, subject to applicable legislative and regulatory requirements and the grounds of refusal set out in the Act.

2. CINNIMON t/a BoldPiq

CINNIMON t/a BoldPiq (Reg 2015/193038/07) ("BoldPiq", "we", "our" or "us") provides website design, development, hosting and maintenance, AI booking assistants, and lead/CRM systems. This PAIA & POPIA Manual is available on our website: www.boldpiq.com

3. Purpose of the PAIA Manual

The purpose of PAIA is to promote the right of access to information, to foster a culture of transparency and accountability, and to empower people to exercise and protect their rights. Section 9 of the Act recognises that the right of access to information is not unlimited and is subject to justifiable limitations, including: the reasonable protection of privacy; commercial confidentiality; and effective, efficient and good governance — balanced against the rights contained in the Bill of Rights. This Manual complies with the guide contemplated in section 10 of the Act. The Information Regulator is responsible for regulating compliance with PAIA and the Protection of Personal Information Act, 4 of 2013 ("POPIA").

4. Contact Details of the Head of the Private Body [Section 51(1)(a)]

Head of the Private Body / Managing Director: Monique Erasmus Email: team@boldpiq.com Postal / physical address: available on request Website: www.boldpiq.com

5. The Information Officer [Section 51(1)(b)]

The head of a private body fulfils the function of Information Officer in terms of section 51. BoldPiq has appointed an Information Officer to assess requests for access to information and to oversee its functions under the Act, as well as the duties and responsibilities under section 55 of POPIA (after registration with the Information Regulator). Deputy Information Officers may be appointed where necessary (section 17 of PAIA / section 56 of POPIA). All requests for information must be addressed to the Information Officer. Information Officer: Monique Erasmus Email: team@boldpiq.com Physical / postal address: available on request

6. Guide of the South African Human Rights Commission [Section 51(1)(b)]

The Act grants a requester access to records of a private body where the record is required for the exercise or protection of any right. A guide on how to use the Act has been compiled by the South African Human Rights Commission (SAHRC) and is available from: The South African Human Rights Commission (PAIA Unit) Physical: 29 Princess of Wales Terrace, Cnr York and Andrew Street, Parktown Postal: Private Bag 2700, Houghton 2041 Telephone: +27 11 877 3600 Email: PAIA@sahrc.org.za Website: www.sahrc.org.za

7. Latest Notice in Terms of Section 52(2) [Section 51(1)(c)]

No notice has been published on the categories of records that are automatically available without a person having to request access in terms of section 52(2) of PAIA.

8. Subjects and Categories of Records Available on Request [Section 51(1)(e)]

BoldPiq holds records grouped according to the following subjects and categories ("Personnel" includes directors, permanent, temporary, part-time staff and contract workers): • Companies Act records — incorporation documents; Memorandum of Incorporation; registers of directors and shareholders; board and shareholder minutes; resolutions; share certificates and statutory registers. • Financial records — accounting records; annual financial statements; asset registers; bank statements and records; debtor/creditor statements and invoices; ledgers; tax returns. • Income tax records — PAYE; VAT; UIF; SDL; Workmen's Compensation; records of payments to SARS. • Personnel records — employment contracts; payroll/wage registers; leave, medical aid, pension fund and salary records; disciplinary and grievance records; training records; employment equity records. • Procurement — supplier, contractor and client agreements; standard terms; supplier lists; policies and procedures. • Sales — customer details; credit application information; information provided by third parties. • Marketing — advertising and promotional material. • Risk management & audit — audit reports; risk reports. • Safety, health & environmental — risk assessments; environmental management plans. • IT — usage and security policies; disaster recovery plans; hardware/asset registers; software licensing; system documentation. • Corporate social responsibility — records of funded organisations and CSR spend. Access to these records may be subject to the grounds of refusal set out in this Manual. Records that are confidential to a third party require that party's permission before access will be considered.

9. Records Available Without a Formal Request

Records of a public nature — typically those disclosed on the BoldPiq website and in its reports — may be accessed without submitting a formal application. Other non-confidential statutory records (for example those held at the CIPC and the Master's Office) may be accessed without a formal application, but an appointment to view such records must be arranged with the Information Officer.

10. Records Held in Terms of Other Legislation [Section 51(1)(d)]

Where applicable, BoldPiq retains records in terms of the legislation below. Unless disclosure is prohibited, records required to be made available under these Acts will be made available in accordance with the Act and applicable internal policies: Auditing Professions Act 26 of 2005; Basic Conditions of Employment Act 75 of 1997; Broad-Based Black Economic Empowerment Act; Business Act 71 of 1991; Companies Act 71 of 2008; Compensation for Occupational Injuries & Diseases Act 130 of 1993; Competition Act 71 of 2008; Constitution of the Republic of South Africa; Copyright Act 98 of 1978; Customs & Excise Act 91 of 1964; Electronic Communications Act 36 of 2005; Electronic Communications and Transactions Act 25 of 2002; Employment Equity Act 55 of 1998; Financial Intelligence Centre Act 38 of 2001; Identification Act 68 of 1997; Income Tax Act 58 of 1962; Intellectual Property Laws Amendment Act 38 of 1997; Labour Relations Act 66 of 1995; Long Term Insurance Act 52 of 1998; Occupational Health & Safety Act 85 of 1993; Pension Funds Act 24 of 1956; Prescription Act 68 of 1969; Prevention of Organised Crime Act 121 of 1998; Promotion of Access to Information Act 2 of 2000; Protection of Personal Information Act 4 of 2013; Regulation of Interception of Communications Act 70 of 2002; Skills Development Levies Act 9 of 1999; Short-term Insurance Act 53 of 1998; Trust Property Control Act 57 of 1988; Unemployment Insurance Contributions Act 4 of 2002; Unemployment Insurance Act 30 of 1966; Value Added Tax Act 89 of 1991. This list may not be exhaustive and will be updated as needed. If a requester believes a right of access exists under other legislation, they must indicate the legislative basis for the request.

11. Detail to Facilitate a Request for Access [Section 51(1)(e)]

A requester must comply with all procedural requirements of the Act, and must: • Complete the prescribed request form and submit it (with the request fee and any deposit, where applicable) to the Information Officer. • Provide sufficient information to identify the record(s) requested and the identity of the requester, and indicate the form of access required. • State the right to be exercised or protected and explain why the record is required to exercise or protect that right (section 53(2)(d)). • Provide proof of capacity where the request is made on behalf of another person (section 53(2)(f)). A request will be processed within 30 days unless special circumstances apply. A person unable to complete the form due to illiteracy or disability may make the request orally. The prescribed time periods do not commence until all required information and fees have been provided.

12. Refusal of Access to Records

BoldPiq may refuse a request for information. The main grounds for refusal include the mandatory protection of: • the privacy of a third party who is a natural or deceased person, or personal information protected under POPIA (section 63); • the commercial information of a third party — trade secrets, or financial/commercial/scientific/technical information whose disclosure could cause harm (section 64); • confidential information of third parties protected by agreement (section 65); • the safety of individuals and the protection of property (section 66); • records privileged in legal proceedings (section 67); and • BoldPiq's own commercial activities, trade secrets, and copyright-protected computer programs (sections 68–69). Requests that are clearly unnecessary, or which involve an unreasonable misallocation of resources, may be refused. Each request is assessed on its own merits. If a record cannot be found or does not exist, the Information Officer will notify the requester by affidavit or affirmation.

13. Remedies Available When a Request is Refused

Internal remedies: BoldPiq does not have an internal appeal procedure; the decision of the Information Officer is final at the internal level. External remedies: A requester dissatisfied with a refusal, or a third party dissatisfied with a decision to grant access, may within 30 days of notification apply to a court for relief. The courts with jurisdiction are the Constitutional Court, the High Court (or a court of similar status), and a Magistrate's Court designated by the Minister of Justice and presided over by a designated Magistrate.

14. Access to Records Held by BoldPiq

Records may be accessed only once the prerequisites for access have been met. There are two types of requester: • Personal requester — a requester seeking access to a record containing their own personal information. BoldPiq will provide such information, subject to the prescribed reproduction fee. • Other requester — a requester seeking access to information about third parties. BoldPiq will adhere to section 71, which requires the Information Officer to take reasonable steps to inform the relevant third party, who may make representations or, where required, give written consent for disclosure.

15. Prescribed Fees [Section 51(1)(f)]

The Act provides for two types of fees: • A request fee — an administration fee payable by all requesters except personal requesters, before the request is considered (not refundable). • An access fee — payable by all requesters where access is granted, covering the cost of searching for and preparing the record. The Information Officer may require a deposit where preparation will take more than the prescribed hours, and may withhold a record until fees are paid. Where a deposit is paid on a request that is later refused, the deposit is repaid.

16. Reproduction, Request, Access Fees and Deposits

Reproduction / access fees (per the PAIA Regulations): • A4 photocopy or part thereof — R1.10 • Printed copy of an A4 page or part thereof — R0.75 • Copy in computer-readable format (e.g. CD) — R70.00 • Transcription of visual images (per A4 page) — R40.00 • Copy of visual images — R60.00 • Transcription of an audio record (per A4 page) — R20.00 • Copy of an audio record — R30.00 (plus per-hour search time where applicable) Where a copy must be posted, the actual postal fee is payable. Request fee: R50.00 is payable up-front where access is sought to information about a person other than the requester. Deposit: where preparation will take more than six hours, a deposit equal to one third of the applicable access fee is payable. All fees are subject to change as permitted by the Act; requesters will be informed of any changes before payment.

17. Decision

BoldPiq will, within 30 days of receipt of a request, decide whether to grant or decline it and give notice (with reasons, if required). This period may be extended by a further period of not more than 30 days where the request is for a large volume of information or requires a search at another office. BoldPiq will notify the requester in writing should an extension be sought.

18. Protection of Personal Information Processed by BoldPiq (POPIA)

BoldPiq is a Responsible Party under POPIA and processes personal information relating to both natural and juristic persons in order to carry out its business. BoldPiq will ensure that personal information is: processed lawfully, fairly and transparently (with a legal basis such as consent); collected only for a specific purpose and not further processed incompatibly; adequate, relevant and not excessive; accurate and up to date; not kept longer than necessary; and processed securely with appropriate technical and organisational measures. Rights of Data Subjects — you have the right to: be notified that your information is collected (and of any data breach); know whether we hold information about you and to access it; request correction or deletion of inaccurate, irrelevant, excessive, out-of-date, incomplete or unlawfully obtained information; object to our use of your information and to direct marketing by unsolicited electronic communication; and complain to the Information Regulator and institute civil proceedings. Purposes of processing — for consumers and prospective consumers: performing agreements; managing accounts; communicating (including direct marketing, unless you opt out); market research and analysis; system testing; debt recovery; and regulatory compliance. For employees: recruitment, payroll, pension, medical aid, training and discipline. For vendors/suppliers: verification, managing the relationship, and payment of invoices. Categories of data subjects and information — employees (name, contact, ID, employment, banking, medical aid, pension, remuneration, performance, leave and training records); consumers and prospective consumers (name and contact details, address, demographic details, financial information, ID/passport number, and browsing/click patterns on our websites); and vendors/suppliers (name, contact, company and director information, banking and product/service information). Recipients — payment collectors and service providers; suppliers; payment systems; regulatory, governmental and tax authorities where we have a duty to share; financial institutions; operators; employees, contractors and agents. Cross-border transfers — personal information may be transferred outside South Africa (including to suppliers and data servers hosted abroad). In terms of section 72 of POPIA, transfers occur only where the recipient is subject to adequate protection, the data subject consents, the transfer is necessary for a contract, or the transfer is for the benefit of the data subject. We take reasonable steps to ensure such information is secured. Security measures — BoldPiq implements access control of persons and data, data media and memory control, user and transmission control, and organisational controls to protect personal information against unauthorised access, alteration, loss or destruction, and adapts these measures to technological developments. Objection / correction — a data subject may object to processing (section 11(3) of POPIA) or request correction or deletion of personal information (section 24(1)) using the prescribed forms (see Section 20).

19. Availability and Updating of the Manual

This PAIA & POPIA Manual is made available in terms of the PAIA Regulations and is available to view on the BoldPiq website (www.boldpiq.com) and at our premises by arrangement. BoldPiq will update this Manual at such intervals as may be deemed necessary.

20. Prescribed Forms (Appendices)

The following prescribed forms apply. The official forms are available on request from the Information Officer (team@boldpiq.com) or from the Information Regulator: • Form C — Request for Access to a Record of a Private Body (section 53(1) of PAIA, Regulation 10). • Objection to the Processing of Personal Information (section 11(3) of POPIA, Regulation 2). • Request for Correction or Deletion of Personal Information (section 24(1) of POPIA, Regulation 3). A separate Appendix sets out, for POPIA purposes, the purposes of processing, the categories of data subjects and personal information, the recipients of personal information, planned cross-border transfers, and the security measures implemented — summarised in Section 18 above.

External Resources

See also: Terms of Service · Privacy Policy · Data Processing Agreement · Refund Policy