PAIA Manual

Acronyms and Abbreviations

• DIO: Deputy Information Officer • IO: Information Officer • NTD: Nouveau-Tech Digital (Pty) Ltd • PAIA: Promotion of Access to Information Act 2 of 2000 • POPIA: Protection of Personal Information Act 4 of 2013 • Regulator: Information Regulator of South Africa

Purpose of This Manual

This Manual has been compiled to help members of the public: • Identify the categories of records held by NTD • Understand the process for requesting access to those records • Obtain the contact details of NTD's Information Officer • Understand how NTD processes personal information in line with POPIA, including the categories of data subjects and information involved • Identify the recipients to whom personal information may be disclosed • Understand whether personal information may be transferred outside South Africa • Learn about the security measures NTD has in place to protect personal information

Contact Details for Access to Information

Information Officer Name: Polly Govender Designation: CIO Telephone: 068 947 9034 Email: info@n-t-d.co.za Company Details Physical address: 54 Oxford Street, Durbanville, Cape Town, South Africa Postal address: Same as physical address Telephone: 068 947 9034 Email: info@n-t-d.co.za Website: [insert] All requests for access to records must be submitted in writing to the Information Officer.

The Information Regulator's Guide on PAIA

The Information Regulator has published a guide to help the public understand and exercise their rights under PAIA and POPIA. The guide explains: • The objectives of PAIA and POPIA • How to submit a request for access to a record • How to lodge a complaint with the Regulator • The remedies available under both Acts • The fees payable for requests • The duties of Information Officers and Deputy Information Officers The guide is available from the Information Regulator: Website: www.inforegulator.org.za Email: enquiries@inforegulator.org.za NTD's Information Officer can also provide assistance on request.

Records Available Without a Formal Request

The following records are freely available and do not require a PAIA request:

Records Held in Terms of Other Legislation

NTD keeps certain records as required by the following legislation:

Subjects and Categories of Records Held

Procedure for Requesting Access to Records

To request access to a record held by NTD: • Complete the prescribed PAIA request form (Form 2), available on the Information Regulator's website • Submit the completed form to the Information Officer at info@n-t-d.co.za • Provide enough detail to allow the record to be identified, specify the form of access you require, and indicate the right you are seeking to exercise or protect • Provide proof of identity, and proof of authority if you are submitting the request on behalf of someone else NTD will respond within 30 days of receiving a complete request. In certain circumstances permitted by PAIA, this period may be extended by a further 30 days, in which case you will be notified. Fees may apply as prescribed in the PAIA regulations. NTD will inform you of any fees payable before your request is processed.

Grounds for Refusal of Access

NTD may refuse access to a record on the grounds set out in Part 3, Chapter 4 of PAIA. These include, among others, where access would: • Unreasonably disclose personal information about a third party • Reveal commercial, financial, or technical information of NTD or a third party • Breach a duty of confidence owed to a third party • Endanger the safety of individuals or the security of property or systems • Disclose records that are legally privileged If access is refused, NTD will give written reasons for the decision.

Remedies

NTD does not have an internal appeal procedure. If you are not satisfied with a decision made in respect of your request, you may lodge a complaint with the Information Regulator or apply to a court with appropriate jurisdiction, within the timeframes set out in PAIA.

Processing of Personal Information

Purposes of Processing NTD processes personal information in order to: • Deliver and support our IT, cybersecurity, cloud, and connectivity services • Administer contracts and manage client relationships • Manage suppliers and service providers • Recruit and administer employees • Maintain financial and accounting records • Send marketing communications, where consent has been given or another lawful basis applies • Meet our legal and regulatory obligations • Protect our systems and prevent fraud Categories of Data Subjects and Personal Information • Employees: identity details, contact details, employment and payroll records, qualifications • Job applicants: CVs, qualifications, references, recruitment records • Clients: names, contact details, company details, contract information • Prospective clients: contact details, enquiry details, marketing preferences • Suppliers and service providers: business and contact details, banking details • Contractors and consultants: contact details, agreements, billing information • Website visitors: IP addresses, cookie data, usage and analytics information Recipients of Personal Information • Payroll and tax information: SARS, payroll service providers, financial institutions • Banking information: banks and payment processors • Employment verification: verification agencies, where required • IT and system data: authorised cloud, hosting, and technology providers • Compliance information: regulatory authorities, where required by law • Client service information: approved subcontractors and technology partners, where needed to deliver services Cross-Border Transfers of Personal Information NTD uses cloud-based platforms and service providers that may store or process personal information outside South Africa. This may include services such as cloud hosting, data backup, email and productivity tools, communications, cybersecurity, customer relationship management, and analytics. Any such transfers are made subject to appropriate contractual, technical, and organisational safeguards to ensure that personal information remains protected in line with POPIA. Security Measures NTD applies reasonable technical and organisational measures to protect personal information, including: • Access controls and user authentication • Multi-factor authentication, where applicable • Encryption of sensitive information • Endpoint protection and anti-malware tools • Firewalls and network security controls • Data backups and disaster recovery measures • Security monitoring and incident response procedures • Staff security awareness training • Security assessments of suppliers and third parties, where appropriate

Availability of This Manual

This Manual is available: • On NTD's website at [insert] • At NTD's offices during normal business hours • On written request to the Information Officer • To the Information Regulator, on request A reasonable fee may be charged for printed copies, in line with the PAIA regulations.

Updates to This Manual

NTD will review and update this Manual periodically to ensure it remains accurate and compliant with applicable laws. Issued by: Polly Govender Information Officer Nouveau-Tech Digital (Pty) Ltd