PAIA MANUAL — MR BANKS CAR DETAILING (PTY) LTD

Prepared in accordance with section 51 of the Promotion of Access to Information Act 2 of 2000, as amended, read with the Protection of Personal Information Act 4 of 2013 and the regulations published in respect of both Acts.

1. INTERPRETATION

In this Manual, unless the context indicates otherwise:

Words in the singular include the plural, and any gender includes the other genders.

2. PURPOSE OF THIS MANUAL

This Manual is published to: inform the public of the records held by Mr Banks and how they may be requested under PAIA; describe the records voluntarily available without a formal request; provide the contact details of the Information Officer; set out, as a section 51 manual must after the POPIA amendments, the personal information Mr Banks processes, the purposes, the categories of data subjects, the recipients, whether Mr Banks conducts trans-border flows, and the security measures applied; and explain how data subjects may exercise their POPIA rights.

3. AVAILABILITY OF THE MANUAL

A copy of this Manual is available: at https://mrbankscar.co.za/legal/paia-manual; by email request to the Information Officer at the address in section 4; for inspection at Mr Banks' address during business hours by prior appointment; and to the Regulator on request.

4. CONTACT DETAILS

4.1 Head of the Private Body and Information Officer

4.2 Mr Banks Car Detailing (Pty) Ltd

5. GUIDE ON HOW TO USE PAIA

The Information Regulator has, under section 10(1) of PAIA, published a Guide on how to use PAIA. It is available at www.inforegulator.org.za and on request to the Information Officer. The Guide describes the objects of PAIA and POPIA, how to make a request, the assistance available, and the remedies where access is refused.

6. RECORDS AVAILABLE WITHOUT A FORMAL REQUEST

The following are available without a formal PAIA request: information published at https://mrbankscar.co.za, including service descriptions, pricing where published, and contact details; this Manual; the Privacy Policy; the Website Terms and Conditions; and any other records the Information Officer determines may be released without a formal request.

7. SCHEDULE OF RECORDS HELD BY MR BANKS

In accordance with section 51(1)(b) of PAIA. Access is subject to the grounds for refusal in section 14 of this Manual.

7.1 Corporate and statutory records

• CIPC registration documents (Memorandum of Incorporation, CoR forms)
• Beneficial Ownership filings
• SARS registration and tax records
• Director resolutions

7.2 Customer records

• Customer details and contact information
• Vehicle records and photographs
• Bookings, appointments and service history
• Invoices, payments and payment proofs

7.3 Personnel records (where applicable)

• Employment and payroll records of any staff we employ

7.4 Financial and operational records

• Books of account (Companies Act 71 of 2008; Tax Administration Act 28 of 2011)
• Bank statements and transaction records
• Supplier and payee records and payment vouchers
• Service-provider contracts, including the agreement with our IT provider

7.5 Marketing, brand and website records

• Brand assets
• Website content and customer communications logs (including SMS records)

8. RECORDS HELD UNDER OTHER LEGISLATION

Mr Banks retains records as required by, among others: the Companies Act 71 of 2008; the Protection of Personal Information Act 4 of 2013 and the Promotion of Access to Information Act 2 of 2000; the Income Tax Act 58 of 1962 and the Tax Administration Act 28 of 2011; the Consumer Protection Act 68 of 2008; and the Electronic Communications and Transactions Act 25 of 2002. Where we employ staff, employment and related records are kept as the applicable labour and tax legislation requires. This list is not exhaustive.

9. PROCESSING OF PERSONAL INFORMATION (POPIA-INCORPORATED CONTENT)

Included in compliance with the POPIA-related content required of a section 51 manual. Fuller detail is in our Privacy Policy at https://mrbankscar.co.za/legal/privacy-policy.

9.1 Compliance with POPIA

Mr Banks processes personal information in accordance with the eight conditions for lawful processing in Chapter 3 of POPIA.

9.2 Capacity

Mr Banks is the Responsible Party for the personal information it processes. It uses Kopanong Platforms (Pty) Ltd as its Operator to build, host and maintain its business-management system, under a written agreement complying with section 21 of POPIA.

9.3 Purposes of processing

Booking and delivering car-wash and detailing services; invoicing and recording payments; communicating with customers; meeting tax and company-law obligations; information security and fraud prevention; and business administration and reporting.

9.4 Categories of data subjects

Customers and the persons named on bookings; any staff we employ; directors and authorised users of the system; suppliers and payees; and website visitors.

9.5 Recipients

Personal information may be disclosed to: our IT service provider (Kopanong) as Operator; sub-operators engaged by Kopanong on our behalf, by category (cloud hosting and database providers; email delivery providers; SMS delivery providers; image-processing providers; automated financial-document-processing providers); a payment processor if online payments are enabled (acting as a Responsible Party in its own right); professional advisors under confidentiality; and SARS, regulators, courts and law-enforcement agencies where required by law. A current list of named sub-operators is available on written request to the Information Officer.

9.6 Trans-border flow

Mr Banks, through its IT provider, processes some personal information on infrastructure outside South Africa (principally the European Union and the United States). It does so in compliance with section 72 of POPIA, supported by binding written agreements incorporating the European Commission Standard Contractual Clauses or equivalent safeguards, or where the transfer is necessary to perform the contract with the data subject.

9.7 Security measures

Mr Banks, with Kopanong as its Operator, applies the measures required by section 19 of POPIA, including encryption in transit and at rest, access through a trusted backend on the least-privilege principle, securely hashed credentials, audit logging, backups, and a breach-response procedure aligned with section 22 of POPIA.

10. HOW TO REQUEST ACCESS TO A RECORD

10.1 PAIA requests

A request must be made on the prescribed Form 02 (available from the Information Regulator) and submitted to the Information Officer at the details in section 4. The requester must provide sufficient particulars to identify the record, proof of identity, the right they seek to exercise or protect and why the record is required for it, the form of access required, and the prescribed fee where applicable.

10.2 POPIA requests by data subjects

A data subject may request confirmation of, and access to, their personal information (section 23 of POPIA); request correction or deletion of information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or unlawfully obtained (section 24); object to processing on reasonable grounds (section 11(3)); and withdraw consent where processing is based on consent.

11. APPLICABLE TIME-PERIODS

Mr Banks will respond to PAIA requests within 30 days of a complete request and payment of the prescribed fee, extendable once by up to a further 30 days in the circumstances in section 57 of PAIA. POPIA access requests under section 23 are answered within a reasonable time, and in any event within 30 days unless extended for good cause.

12. FEES

PAIA distinguishes a request fee (payable on submission before processing) and an access fee (payable when access is granted). Mr Banks applies the fees prescribed by the PAIA Regulations from time to time. The current prescribed fees are:

A person requesting their own personal information is not required to pay the request fee. POPIA confirmation of whether Mr Banks holds personal information about a data subject is free under section 23(2) of POPIA. Where access attracts a fee, Mr Banks provides a written estimate before proceeding.

13. OUTCOME OF A REQUEST

Mr Banks will notify the requester of its decision in writing. If granted, the notice states the access fee, the form of access, and the right to apply to court if dissatisfied. If refused, the notice states adequate reasons including the PAIA provisions relied on, and the right to lodge a complaint with the Information Regulator under section 77A of PAIA or to apply to court under section 78 of PAIA.

14. GROUNDS FOR REFUSAL

Under sections 62 to 69 of PAIA, Mr Banks may refuse access to protect: the privacy of a third party (s63); commercial information of a third party (s64); certain confidential information of a third party (s65); the safety of individuals and property (s66); records privileged in legal proceedings (s67); Mr Banks' own commercial information (s68); and research information (s69). A request must nonetheless be granted under section 70 where disclosure would reveal a substantial contravention of the law or an imminent serious public-safety risk and the public interest clearly outweighs the harm.

15. REMEDIES

A dissatisfied requester may lodge a complaint with the Information Regulator under section 77A of PAIA within 180 days, or apply to a competent court under section 78 of PAIA.

Information Regulator (South Africa) JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001 Email: PAIAComplaints@inforegulator.org.za

16. UPDATING THIS MANUAL

This Manual is reviewed at least annually and sooner on any material change to the records held, the Information Officer, or the applicable law.