PAIA Manual

1 Introduction

This Information Manual is issued by Secure Net (Pty) Ltd (“the Company”) in terms of Section 51 of the Promotion of Access to Information Act 2 of 2000 and in compliance with the Protection of the Personal Information Act 4 of 2013 together with the regulations thereto, published under Government Notice R1383 in Government Gazette 42110 dated 14 December 2018.

2 Purpose of the paia act

The Promotion of Access to Information Act 2 of 2000 and Protection of the Personal Information Act 4 of 2013 aim to balance the right to privacy of a Data Subject against other rights, particularly the right of access to Information and by setting the minimum standard to be followed for the Processing of Information to be lawful.

The promotion of Access to Information Act, 2000 (the “Act”) gives third parties the right to approach private bodies and the government to request information held by them, which is required in the exercise and/or protection of any rights. On request, the private body or government is obliged to release such information unless the Act expressly states that the records containing such information may or must not be released. This manual informs requestors of procedural and other requirements that a request must meet as prescribed by the Act.

3 Purpose of the protection of personal information act, 2013

The purpose of the Protection of the Personal Information Act 4 of 2013 is to give effect to the constitutional right to privacy, by safeguarding Information when processed by the Company.

Through the scope of products and services that Secure Net renders, the company is by default involved in the collection, use and disclosure of certain aspects of personal information of clients, employees, suppliers and other stakeholders.

A person’s right to privacy entails having control over his/her personal information and therefore Secure Net is committed to effectively manage that information in accordance with POPIA’s provisions.

4 Purpose of this manual

This manual will assist members of the public to manage the Processing of their Information by providing:

a. details of the categories of Information that the Company holds;

b. how this Information is Processed by the Company;

c. the manner in which such Information may be accessed and grounds for refusal of access to such Information; and

d. the manner of objecting to the Processing of Information and requesting a correction of Information Processed by the Company.

When a member of the public interacts with the Company in person, by electronic communication or through the Company’s website, they agree to the terms and conditions set out in this Information Manual and the Company’s Privacy Policy. The Company reserves the right to update the terms of this Information Manual from time to time and to publish such updated Information Manual on its website. Any person may contact the Information Officer of the Company to obtain a copy of the most recent version of the Information Manual.

5 Policy application

This Policy will apply to:

– Secure Net as a company

– Any joint ventures or business organisations owned or controlled by Secure Net who receives and process personal information for or on behalf of Secure Net.

– Employees and contractors of Secure Net

– Personal information of external Customer and/or Suppliers processed and stored by Secure Net

– Personal Information of Employees

6 Key definitions and abbreviations

ABBREVIATION DEFINITION ICT Information Communication Technology PAIA The Promotion of Access to Information Act No. 2 of 2000 (as amended) PoPIA The Protection of Personal Information Act No. 4 of 2013 (as amended) ACRONYM OR WORD DEFINITION Data Subject Means the person to whom Information relates, for the purposes of this Information Manual this will include, but not be limited to, the customers, stakeholders, contractors, visitors, employees, suppliers and/or service providers of the Company Information Personal Information and Special Personal Information Information Manual This information manual issued by the Company, as may be amended from time to time Information Officer The Information Officer is responsible for ensuring the Company’s compliance with PoPIA.

Information Regulator The Information Regulator established in terms of section 39 of POPI whose purpose is, inter alia, to monitor and enforce compliance of Responsible Parties with POPI Personal Information Information relating to an identifiable, living, natural person, and where applicable, an identifiable, existing juristic person, including, but not limited to –

a. Information relating to the race, gender, sex, pregnancy, marital status, national, ethnic or social origin, colour, sexual orientation, age, physical or mental health, well-being, disability, religion, conscience, belief, culture, language and birth of the person;

b. Information relating to the education or the medical, financial, criminal or employment history of the person;

c. Any identifying numbers, symbol, email address, physical address, telephone number, location information, online identifier or other particular assignment to the person;

d. The biometric information of the person;

e. The personal opinions, views or preference of the person;

f. Correspondence sent by the person that is implicitly or explicitly of a private or confidential nature or further correspondence that would reveal the contents of the original correspondence;

g. The views or opinions of another individual about the person; and

h. The name of the person if it appears with another personal information relating to the person or if the disclosure of the name itself would reveal information about the person Process/ Processing Any operation or activity or any set of operations, whether or not by automatic means, concerning personal information, including –

a. The collection, receipt, recording, organisation, collation, storage, updating or modification, retrieval, alteration, consultation, or use;

b. Dissemination by means of transmission, distribution or making available in any other form; or

c. Merging, linking, as well as restriction, degradation, erasure or destruction of information PAIA Regulations The regulations to PAIA published under Government Notice R757 in Government Gazette 45057 dated 27 August 2021 POPI Regulations The regulations to POPI, published under Government Notice R1383 in Government Gazette 42110 dated 14 December 2018 Record Any recorded information –

a. Regardless of form or medium, including any of the following: I. Writing on any material;

II. Information produced, recorded or stored by means of any tape- recorder, computer equipment, whether hardware or software or both, or other device, and any material subsequently derived from information so produced, recorded or stored;

III. Label, marking or other writing that identifies or describes anything of which it forms part, or to which it is attached by any means; IV. Book, map, plan, graph or drawing;

V. Photograph, film, negative, tape or other device in which one or more visual images are embodies so as to be capable; with or without the aid of some other equipment, of being reproduced;

b. In the possession or under the control of a responsible party;

c. Whether or not it was created by a responsible party; and

d. Regardless of when it came into existence Responsible Party Any person or entity which Processes Information, for the purposes of this Information Manual the Responsible Party will be the Company

7 Information officer contact details

• Information Officer: Denvan Fynn
• Email: info@secure.net.za
• Telephone: +27 11 794 2576

8 Contact details for the company

• Name of entity: Secure Net (Pty) Ltd
• Registration number: 2023/107765/07
• Physical address: Block C, Second Floor, Sweet Thorn on Beyers Office Park, 61 Bosbok Road, Randpark Ridge, 2169
• Head of entity: Denvan Fynn
• Telephone: +27 11 794 2576
• Website: www.secure.net.za

9 Availability of the manual

9.1 This Information Manual may be accessed directly from the Company in the following manner:

9.1.1 this Information Manual is available for inspection, free of charge, at the offices of the Company, at the physical address detailed in clause 8 above;

9.1.2 copies of the Information Manual may be obtained, subject to payment of the prescribed fees, at the offices of the Company, at the physical address detailed in clause 8 above;

9.1.3 a copy of this Information Manual is available in an electronic format on request from the Information Officer, on the details in clause 7 above; or

9.1.4 this Information Manual is available on the Company’s website: https://www.secure.net.za/

9.2 This Information Manual may be made available to the Information Regulator upon request from the Information Regulator.

10 Guide on the use of paia in terms of section 10 of paia

10.1 A guide on how to use PAIA has been compiled by the Information Regulator in terms of section 10 of PAIA.

10.2 This guide is available in each of the official languages.

10.3 The guide may be accessed by requesting a copy through the following channels: Postal address: P.O Box 31533, Braamfontein, Johannesburg, 2017 Physical address: JD House, 27 Stiemens Street, Braamfontein, Johannesburg Telephone: 010 023 5200 E-mail: enquiries@inforegulator.org.za Website: https://inforegulator.org.za/paia/

11 Applicable legislation

11.1 The Company holds Information in accordance with the following legislation, including all regulations issued in terms of such legislation (the below is not an exhaustive list):

11.1.1 Basic Conditions of Employment Act 75 of 1997

11.1.2 Broad-Based Black Economic Empowerment Act No 53 of 2003

11.1.3 Business Continuity Management System ISO22301

11.1.4 Collective Investment Schemes Act 45 of 2002

11.1.5 Consumer Protection Act 68 of 2008

11.1.6 Companies Act 71 of 2008

11.1.7 Compensation for Occupational Injuries and Diseases Act 130 of 1993

11.1.8 Competition Act 89 of 1998

11.1.9 Constitution of the Republic of South Africa

11.1.10 Copyright Act 98 of 1978

11.1.11 Customs and Excise Amendment Act 32 of 2014

11.1.12 Debt Collection Act No of 1998

11.1.13 Electrical Installation Regulations GNR 242 of 6 March 2009

11.1.14 Electronic Communications and Transactions Act 25 of 2002

11.1.15 Employment Equity Act 55 of 1998

11.1.16 Financial Intelligence Centre Act 38 of 2001

11.1.17 Income Tax Act 58 of 1962

11.1.18 Labour Relations Act 66 of 1995

11.1.19 Ministry for Provincial & Local Government Disaster Management Act 2002

11.1.20 National Credit Act 34 of 2005

11.1.21 National Road Traffic Act 93 of 1996

11.1.22 Occupational Health and Safety Act 85 of 1993

11.1.23 Prevention of Organised Crime Act 121 of 1998

11.1.24 Promotion of Access of Information Act 2 of 2000

11.1.25 Protected Disclosures Act 26 of 2000

11.1.26 Protection of Personal Information Act 4 of 2013

11.1.27 Prevention and Combating Corrupt Activities Act 12 of 2004

11.1.28 Public Finance Management Act 1 of 1999

11.1.29 Regulation of Interception of Communications and Provision of Communication Related Information Act 70 of 2002

11.1.30 The King 4 Report of Governance of South Africa 2019

11.1.31 The Skills and Development At 97 of 1998

11.1.32 Unemployment Contributions Act 4 of 2002

11.1.33 Unemployment Insurance Act 63 of 2001

11.1.34 Value-added Tax Act 89 of 1991

11.2 Certain Information kept in terms of the above legislation is protected from disclosure in terms of such legislation, PAIA and POPI. Any disclosure of requested Information will be subject to the request procedure as detailed in clause 20 below and the grounds for refusal stipulated in clause 21 below.

12 Records automatically available to the public

The following records are automatically available to the public, without having to submit a formal request to access the information in terms of clause 20 below:

12.1 All publication and information made available on the website of the Company;

12.2 Booklets, brochures, newsletters and advertising material;

12.3 List of services and products provided by the Company;

12.4 Fees charged by the Company;

12.5 The standard terms and conditions of the Company;

12.6 Consent forms;

12.7 Information request forms; and

12.8 Objection or correction request forms.

13 Categories and types of records and information held by the

COMPANY

13.1 The following Information is or may be Processed by the Company, where deemed necessary :

13.1.1 Company records

• Company registration documents

• Company founding documents (including memorandum of incorporation and shareholders agreement)

• Minutes of meetings and resolutions (including shareholder and director meetings and resolutions)

• Share certificates and share register

• Insurance policy documents

13.1.2 Financial records

• Annual Financial Statements

• Tax Returns and other tax records (including but not limited to VAT and income tax returns, employee PAYE, SDL & UIF)

• Accounting Records

• Banking Records

• Bank Statements

• Invoices and statements

• Asset register

• Company Budget

13.1.3 Employee records

• Employment contracts

• Tax information

• Bank account details

• Contact details and physical and postal addresses

• Name, Identity number, gender and race

• Bank Account details

• Next of Kin Details

• Education Information

• Credit check and SAPS Clearance information

• Employment History

• Marital Status

• Medical aid information

• Leave records

• Records of disciplinary action

• Staff recruitment policies

• Provident Fund Records

• Salary Records

• SETA Training Records

• Training Records

• Workplace Skills Plan

• BBBEE Statistics

• Performance reviews

13.1.4 Administration & operational records

• General Housekeeping information

13.1.5 Legal matter

• All legal agreements/contracts (including but not limited to lease agreements, service provider agreement, non-disclosure agreements)

• Trademark applications

• Agreements relating to intellectual property

• Copyrights

• Material licenses, permits and authorizations

• Documents relating to any litigation, arbitration or investigation instituted by or against the Company.

13.1.6 Third party documents and records (including customers

AND SERVICE PROVIDERS)

• Name and Identity number

• Entity name and registration number

• Contact details and physical and postal address

• Consent forms

• Marital Status

• Biometric Data

• Credit Check Information

• Trust and company documents

• Trade References

• Insurance documents

• Financial and accounts information

• Research information

• Tax information

• Correspondence

• Any contracts / documents provided to the Company by the third party

• Any contracts entered into between the Company and the third party

• Data collected through technologies to track visitor activity on the Company’s website

13.2 The listing of the Information kept by the Company does not mean that all such Information is available to the public. Certain Information listed above is protected from disclosure in terms of legislation. Any disclosure of requested Information will be

subject to the request procedure as detailed in clause 20 below and the grounds for refusal stipulated in clause 21 below.

13.3 The Company will only collect and retain such Information of a Data Subject as is necessary for the continued operation and management of the Company and for the rendering of the services as provided by the Company.

13.4 Anyone whose Information is held by the Company or where a Data Subject has provided their written consent to the processing of their Information, the Data Subject has the right to submit a request to the Company to withdraw his or her consent or to object to the Processing of his or her Information on reasonable grounds. Such request must be submitted on prescribed Form 1 of the POPI Regulations, which is available on request from the Information Officer.

14 Purpose of the processing personal information kept by the

COMPANY

14.1 The Company may process the Information detailed in clause 13 above for the following purposes:

14.1.1 to comply with business and tax legislation;

14.1.2 for retention of records as required by any law, e.g. fraud and crime detection and prevention;

14.1.3 for retention of records required in terms of an agreement with a third party, i.e. service level agreement;

14.1.4 to render services to customers;

14.1.5 to conduct due diligence checks on employees, customers and service providers, e.g. credit checks, SAPS Clearance information check references;

14.1.6 to obtain professional advice, e.g. from legal counsel or auditors / accountants;

14.1.7 employee management;

14.1.8 facilitate the collection of fees for the services provided by the Company;

14.1.9 the storage of the personal information with external storage and record management companies;

14.1.10 marketing of products and services;

14.1.11 to inform customers of products and services;

14.1.12 track visitor activity on our website and at the physical address from which the Company conducts it business;

14.1.13 the storage of Information using a secure cloud-based storage solution;

14.1.14 to verify the accuracy, correctness, completeness of any information provided to the Company; and

14.1.15 any matter ancillary thereto.

15 Categories of recipients for processing the personal information

15.1 The Company may, subject to authorisation in terms of any applicable legislation, in terms of any contract or with the Data Subject’s consent, share relevant Information of the Data Subject with:

15.1.1 any statutory bodies, regulators or judicial commissions (i.e. the Information Regulator, any ombudsman etc.);

15.1.2 South African Revenue Services;

15.1.3 Company employees;

15.1.4 Shareholders;

15.1.5 service providers rendering accounting and auditing services;

15.1.6 service providers rendering IT, hosting and cyber security services;

15.1.7 Third-party verification services conducting security checks and credit bureaus;

15.1.8 legal counsel of the Company;

15.1.9 Insurance underwriters;

15.1.10 Banks and other financial institutions;

15.1.11 brokers, advisers, or intermediaries;

15.1.12 collection agencies;

15.1.13 a service provider rendering any service to the Company;

15.1.14 service providers who capture, organize and store data; and

15.1.15 a third party when required by law or authorized by court order.

15.2 The Information will be shared in compliance with the legal obligation of the Company to protect the integrity and confidentiality of the Data Subject’s Information and only to the extent absolutely necessary to achieve the purposes detailed in clause 14

15.3 The sharing of a Data Subject’s Information will be subject to the obligation of confidentiality by virtue of the position held by the person with whom the Information is shared or where such person’s position does not impose such an obligation of confidentiality, in terms of a declaration of secrecy which the Company shall secure with such person.

16 Actual or planned transborder flows of personal information

16.1 The Company will process and store Information in a manner which may result in the trans-border flow of a Data Subject’s Information outside of the Republic of South Africa for the purposes of, inter alia, cloud-based storage.

16.2 The Company shall only transfer the Information outside of the borders of the Republic of South Africa where:

16.2.1 the recipient is subject to law, binding corporate rules or a binding agreement secured by the Company, which provides the Data Subject’s Information with the same or a greater degree of protection than that provided by POPI;

16.2.2 the data subject has consented to the transfer;

16.2.3 the transfer is in terms of an agreement between the Company and the Data Subject or is done at the request of the Data Subject;

16.2.4 the transfer is necessary for the performance by the Company of contractual obligations with a third party, which contract was concluded in the interest of the Data Subject; OR

16.2.5 the transfer is for the benefit of the Data Subject and it is not reasonably practicable for the Company to obtain the Data Subject’s consent, but it is likely that the Data Subject would have consented to the transfer if they had the opportunity to consent.

17 Information security measures

17.1 Secure Net employs up-to-date technology to ensure the confidentiality, integrity and availability of the Personal Information under its care. Some measures include:

– Network Security Controls

– Virus & Malware protection

– Password Controls

– Disaster Recovery and Backup policy and measures

– Service Provider and OEM Agreements

– Software License Management

17.2 While the Company has taken such steps to protect the Data Subject’s Information, there is no method of data security and storage which is completely protected against data breaches. Should any data breach occur which involves the Information of a Data Subject, the Company will advise the Data Subject, the Information Regulator and relevant law enforcement agencies. The Company will provide the Data Subject with the necessary information and advice relating to the data breach and the steps that can be taken to mitigate the consequences of the data breach.

18 Retention of records

18.1 The Company retains Information in terms of legislation listed above for the relevant periods as provided in the applicable legislation.

18.2 All Information collected by the Company will only be kept for as long as the Company is required by law or contractual obligation, to keep such Information, whereafter the Information will be destroyed in accordance with the procedure as detailed in clause 19 below.

19 Destruction of private and confidential records

When destroying Information, the Company makes use of such methods which shall render the Information unintelligible and incapable of reconstruction, which could include the shredding or incineration of all documents containing Information.

20 Request to access information procedure

20.1 Request for access, change or removal of information can be made by email, addressed to the Information Officer at info@secure.net.za.

20.2 Any person has the right to request details of Information and records held by the Company and copies of such records and Information, subject to the grounds for refusal stipulated in clause 21 below.

20.3 To obtain access to Information held by the Company, the requester must complete Form 2 of the PAIA Regulations (“Request for Access to Record”) in full and submit the completed form to the Information Officer detailed above, together with proof of payment of the fee payable as prescribed in terms of PAIA. Forms are available on the Information Regulator Website. (https://inforegulator.org.za/popia)

20.4 The requester must complete the form and submit it with a payment of a request fee and a deposit if applicable. The prescribed form must be completed in such a way that the Information Officer can identify:

– The record/s requested

– The Identity of the requester

– What form of access is required and

– The postal address and email of the requester

20.5 If a requester is unable to complete the Information Request Form due to illiteracy or disability, the request may be made verbally to the Information Officer.

20.6 If the request is made on behalf of another person, proof must be submitted of the capacity in which the requester is making the request and their authority to do so.

20.7 Proper identification must be provided before any information will be disclosed. The Company may take further steps to confirm the authority and identity of the requester. Documents for Identity verification:

– Driver’s Licence

– Passport

– Identity Document

– Other official government documents to verify identity

20.8 The Information Officer will provide a response as soon as reasonably possible after receipt of the correctly completed Information Request Form, but by no later than 30 days after the request has been received, subject to clause 20.9 below.

20.9 The Information Officer may extend the 30 (thirty) day period contemplated in clause

20.8 above, by a further 30 (thirty) days on written notice to the requester, where:

20.9.1 the request is for a large number of records or requires a search through a large number of records and compliance with the original period would unreasonably interfere with the activities of the Company;

20.9.2 the request requires a search for records in, or collection thereof from, an office of the Company not situated in the same town or city as the office of the head that cannot reasonably be completed within the original period;

20.9.3 consultation among divisions of the Company or with another private body is necessary or desirable to decide upon the request that cannot reasonably be completed within the original period; and/or

20.9.4 the requester consents in writing to such extension.

20.10 If the Information Officer grants the request for access to Information, the Information Officer will advise the requester of the fees payable for access to the requested Information (if any) and the form in which access will be given.

20.11 The fees payable for access to information are prescribed in terms of PAIA and are detailed in clause 22 below.

20.12 The Information Officer may refuse a request on the grounds stipulated in clause 21 below. In the event that the Information Officer refuses a request for access to Information, the Information Officer shall provide the requester with written reasons for the refusal.

20.13 In the event that:

20.13.1 the Information Officer fails to respond within the 30 (thirty) day period or the extended period as contemplated in clause 20.8;

20.13.2 the requesters request is refused; or

20.13.3 the requester is dissatisfied with the access fee to be paid, the form of access granted, and / or the procedure for obtaining access, the requester may within 180 days of the expiry of the 30 day period, where the Information Officer has failed to respond, OR within 180 days of receipt by the requester of the notification of the decision of the Information Officer, submit a complaint to the Information Regulator or apply to any Magistrates’ Court having jurisdiction, for relief.

20.14 Where a requester has been granted access to Information, the requester may submit a request to the Information Officer to correct or delete such Information where the Information is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or was obtained unlawfully. Such request must be submitted on prescribed Form 2 of the POPI Regulations, which is available on request from the Information Officer.

21 Grounds for refusal to access to records- chapter 4 of paia

21.1 A request to access Information must be refused by the Company on the following grounds:

21.1.1 Mandatory protection of the privacy of a third party who is natural person;

21.1.2 Mandatory protection of the commercial information of a third party;

21.1.3 Mandatory protection of certain confidential information of a third party;

21.1.4 Mandatory protection of safety of individuals, and protection of property;

21.1.5 Mandatory protection of records privileged from production in legal proceedings;

21.1.6 Commercial information of a private body; and

21.1.7 Mandatory protection of research information of a third party, and protection of research information of a private body;

21.2 The Information Officer has the discretion to refuse access to Information on the following grounds:

21.2.1 the disclosure of such Information relating to a third party would prejudice the supply of similar information in the future;

21.2.2 where the record contains information around crime prevention, detection and prosecution of alleged offenders;

21.2.3 where the disclosure would unreasonably reveal consultative material obtained on account of deliberations over formulation of policy, exercise of power or performance of a duty; or

21.2.4 where the request is frivolous or vexatious.

22 Prescribed fees

Prescribed fees for access to Information of a private body as prescribed in the PAIA Regulations:

CATEGORY RAND 1. The request fee payable by a requester R140.00 2. The fee for reproduction of a record, is as follows:

a. For every photocopy of an A4-size page or part thereof R2.00

b. For every printed copy of an A4-size page or part thereof held on a computer or in electronic or machine-readable form R2.00

c. For a copy in a computer-readable form on

• flash drive provided by the requestor

• a compact disc provided by the requestor

• a compact disc provided by the Company to the requestor R40.00 R40.00 R60.00

d. For a transcription of visual images, for an A4-size page or part thereof:

Based on quote from service provider

e. For a copy of visual images: Based on quote from service provider

f. For transcription of an audio record, per A4-size page or part thereof: R24.00

g. For a copy of an audio record on:

• A flash drive provided by requestor

• a compact disc provided by the requestor

• a compact disc provided by the Company to the requestor R40.00 R40.00 R60.00

h. To search for and prepare the record for disclosure, R145.00 for each hour or part of an hour reasonably required for such search and preparation, excluding the first hour. This cost is not to exceed a total of R435.00.

i. Deposit where search exceeds 6 hours: One third of the amount per request as stated above.

j. Postage, e-mail or other electronic transfer: Actual expense incurred (if any).

23 Complaint to the information regulator

23.1 Any person has the right to submit a complaint to the Information Regulator regarding the alleged interference with the protection of Information of any person whose information is collected by the Company.

23.2 A complaint may be submitted to the Information Regulator through the following channels:

The Information Regulator (South Africa):

JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001 Email: POPIAComplaints@inforegulator.org.za Telephone: 010 023 5200