This PAIA Manual is useful for the public to-

1. check the categories of records held by 20fifty (PTY) Ltd (COMPANY) which are available without a person having to submit a formal PAIA request;
2. have a sufficient understanding of how to make a request for access to a record of COMPANY;
3. understand the description of the records of COMPANY which are available in accordance with any other law;
4. access all the relevant contact details of the Information Officer who will assist the public with the records they intend to access;
5. understand the description of the guide on how to use PAIA, as updated by the Information Regulator and how to obtain access to it;
6. understand if the COMPANY will process personal information, the purpose of processing of personal information and the description of the categories of data subjects and of the information or categories of information relating thereto;
7. understand the description of the categories of data subjects and of the information or categories of information relating thereto;
8. understand the recipients or categories of recipients to whom the personal information may be supplied;
9. understand if COMPANY has planned to transfer or process personal information outside the Republic of South Africa and the recipients or categories of recipients to whom the personal information may be supplied; and
10. understand whether COMPANY has appropriate security measures to ensure the confidentiality, integrity and availability of the personal information which is to be processed.

Company Contact Details

South African Information Regulator Contact Details

1. The Information Regulator has, in terms of section 10(1) of PAIA, as amended, updated and made available the revised guide on how to use PAIA (Guide), in an easily comprehensible form and manner, as may reasonably be required by a person who wishes to exercise any right contemplated in PAIA and Protection of Personal Information Act 4 of 2013 (POPIA).
2. Members of the public can inspect or make copies of the Guide from the offices of the public and private bodies, including the office of the Information Regulator, during normal working hours.
3. The Guide can also be obtained-
   • upon request to the Information Officer; and
   • from the website of the Information Regulator (https://inforegulator.org.za/paia-guidelines/).
4. A copy of the Guide is also available at our offices in the following official languages, for public inspection during normal office hours:
   • English
   • Zulu
5. You can access the Guide in the other official languages here.

1. Records of a public nature, typically those disclosed on the COMPANY’s website (https://20fifty.co) and in its various reports, may be accessed without the need to submit a formal application.
2. Other non-confidential records, such as statutory records maintained at CIPC and the Master’s Office, may be accessed without the need to submit a formal application, however, an appointment to view such records will still have to be made with the Information Officer.
3. The following categories of information are automatically available for inspection, purchase or photocopying:
   1. Brochures
   2. Press releases
   3. Publications;
   4. Various marketing and promotional materials

Where applicable, certain records held by the COMPANY are available in terms of different pieces of legislation (other than PAIA). The specific records which are available in terms of such legislation are set out therein and these records may in certain instances only be accessed by the persons specified in the relevant legislation. These pieces of legislation include (but may not be limited to):

• Administration of Estates Act 66 of 1965
• Arbitration Act 42 of 1965
• Basic Conditions of Employment Act 75 of 1997
• Broad Based Black Economic Empowerment Act 53 of 2003
• Close Corporations Act 69 of 1984
• Companies Act 71 of 2008
• Compensation for Occupational Injuries and Health Diseases Act 130 of 1993
• Constitution of South Africa Act 108 of 1996
• Criminal Procedure Act 51 of 1977
• Customs and Excise Act 91 of 1964
• Electronic Communications and Transactions Act 25 of 2002
• Employment Equity Act 55 of 1998
• Environment Conservation Act 73 of 1989
• Financial Markets Act 19 of 2012
• Hazardous Substances Act 15 of 1973
• Income Tax Act 58 of 1962
• Insolvency Act No. 24 of 1936
• Labour Relations Act 66 of 1995
• National Credit Act 34 of 2005
• National Environmental Management Act 107 of 1998
• National Environmental Management: Waste Act 59 of 2008
• National Water Act 36 of 1999
• Occupational Diseases in Mines and Works Act 78 of 1973
• Occupational Health & Safety Act 85 of 1993
• Pension Funds Act 24 of 1956
• Prevention and Combating of Corrupt Activities Act 12 of 2004
• Prevention of Organised Crime Act 14 of 1998
• Protected Disclosure Act 26 of 2000
• Promotion of Access of Information Act 2 of 2000
• Promotion of Equality and Prevention of Unfair Discrimination Act 4 of 2000
• Protection of Personal Information Act 4 of 2013
• Skills Development Act 97 of 1998
• Skills Development Levies Act 9 of 1999
• Stock Exchanges Control Act No 1 of 1985
• Stock Exchanges Control Amendment Act 54 of 1995 (and the rules and listing requirements of the JSE Securities Exchange authorised in terms thereof)
• Tax Administration Act 28 of 2011
• Trade Marks Act 194 of 1993
• Unemployment Contributions Act 4 of 2002
• Unemployment Insurance Act 63 of 2001
• Value Added Tax Act 89 of 1991

1. Purpose of Processing Personal Information

   COMPANY processes personal information in the ordinary course of its business, including, but not limited to, the following:

   • providing and improving our services and/or supplying our goods;
   • creating and managing client accounts;
   • managing commercial relationships with clients and suppliers;
   • to receive goods and/or services from suppliers;
   • recruitment;
   • managing employee relationships and performing employment contracts;
   • for security purposes;
   • to comply with legal obligations;
   • information analysis;
   • marketing our services / goods;
   • communication purposes; and
   • administering our website.

   For more information regarding the purposes we process personal information, please see our Privacy Policy located at https://20fifty.co/privacy-policy/ or for employees, please contact the Information Officer.

2. Description of the categories of Data Subjects, the information or categories of information relating thereto and categories of recipients

   Most commonly, COMPANY processes the following personal information of the following categories of data subjects:

   Customers

   Personal information that may be processed

   • Name and contact details
   • Company registration details and incorporation documents
   • Tax information
   • Key employee names, contact details, and date of birth
   • Teleconference and video conference call recordings
   • Additional information you choose to tell us

   Categories of recipients

   • Our suppliers and operators
   • Professional service providers
   • Other customers
   • Third Party verification, credit bureaus, debt collectors and background check agencies
   • Regulatory authorities and the courts
   • Persons or organisations in the context of a sale of our shares, assets or business
   Suppliers

   Personal information that may be processed

   • Name and contact details
   • Company registration details and incorporation documents
   • Physical and/or postal address
   • Director names, contact details and identification number/passport numbers and date of birth
   • Key employee names, contact details and identification number/passport numbers and date of birth
   • Financial and tax information
   • Teleconference and video conference call recordings
   • Additional information you choose to tell us

   Categories of recipients

   • Our suppliers and operators
   • Professional service providers
   • Our customers
   • Third Party verification, credit bureau and background check agencies
   • Regulatory authorities and the courts
   • Persons or organisations in the context of a sale of our shares, assets or business
   Employees & Independent Contractors

   Personal information that may be processed

   • Name and Contact Details
   • Medical information
   • Identity number and date of birth / ID and/or passport copies
   • Gender
   • Disability information
   • Employment history
   • Criminal records and credit history
   • Employment/Independent Contractor agreements
   • Performance records
   • Details of dependants, marital status and emergency contacts
   • Payroll, financial and tax records
   • Electronic access and communication records
   • Physical access records
   • Surveillance records
   • Health and safety records
   • Training records
   • Leave records
   • Device usage data including IP address, and online activity
   • Details of payments to third parties
   • Teleconference and video conference call recordings
   • Additional information you choose to tell us

   Categories of recipients

   • Our suppliers and operators
   • Professional service providers
   • Our customers
   • Third Party verification, credit bureau and background check agencies
   • Regulatory authorities and the courts, including the police
   • Persons or organisations in the context of a sale of our shares, assets or business
   Job Applicants

   Personal information that may be processed

   • Name and contacts details
   • Country of residence
   • Visa information
   • Educational background
   • Interview notes and assessment result
   • Employment history
   • Additional information you choose to tell us

   Categories of recipients

   • Our suppliers and operators
   • Professional service providers
   • Third Party verification, credit bureau and background check agencies
   • Regulatory authorities and the courts
   Persons who visit / work at our premises

   Personal information that may be processed

   • Names and contact details
   • CCTV Footage

   Categories of recipients

   • Professional service providers
   • Regulatory authorities and the courts
   Persons who contact us / subscribe to our newsletters / engage with us and visitors to our website and apps

   Personal information that may be processed

   • Name and contact details
   • Browser information (e.g., IP address, browser type and version, operating system, language), date and time of access, device information, traffic source, content your browse and your navigation around our applications
   • Your preferences
   • Additional information you choose to tell/share with us

   Categories of recipients

   • Professional service providers
   • Regulatory authorities and the courts

   Depending on the nature of the personal information, the Company may supply information or records with different categories of associated or third-party recipients, but we will always do so in applicable laws. Please refer to the COMPANY’S Privacy Policy located at https://20fifty.co/privacy-policy/ for further information.

3. Planned transborder flows of personal information

   While we generally store all of the personal information that we collect about you in the Republic of South Africa, it is possible that your personal information will be transmitted and hosted outside your region.

   We ensure that countries to which your information is being shared either have adequate laws in place or that we enter into contractual arrangements to ensure the protection of your personal information.

4. General description of Information Security Measures to be implemented by the responsible party to ensure the confidentiality, integrity and availability of the information

   We apply physical, technical and administrative measures to protect your personal information that is under our control from unauthorised access, collection, use, disclosure, copying, modification or disposal. All information you provide to us is stored on secure servers. We do not transfer your personal information outside of the country of your residence unless we are satisfied that there are sufficient safeguards in place to protect your personal information.

   We employ up to date technology to ensure the confidentiality, integrity and availability of the personal information under our care. Measures include, but are not limited to:

   • Virus protection software and update protocols.
   • Electronic and physical access control.
   • Secure setup of hardware and software making up the IT infrastructure.
   • Outsourced service providers who process personal information on behalf of us are contracted to implement security controls.
   • Policies and procedures are implemented to ensure the security of your information.

We have authorised and designated our Information Officer to deal with all matters relating to and our obligations under PAIA (and POPIA).

A requester must comply with all the procedural requirements contained in PAIA relating to the request for access to a record.

A request for access to records held by COMPANY in terms of section 50 of PAIA must be made on the form contained in the Regulations regarding the Promotion of Access to Information (Form 2).

The request must be made to COMPANY at the address or email address, specified in section 2 above.

A requester must provide sufficient detail on the prescribed form to allow COMPANY to identify the record or records which have been requested and the identity of the requester. If a request is made on behalf of another person or entity, the requester must submit details and proof of the capacity in which the requester is making the request, which must be reasonably satisfactory to COMPANY. The requester is also required to indicate the form of access to the relevant records that is required, and to provide his, her or its contact details in the Republic of South Africa.

A requester will receive a response to their request on the Form 3.

Depending on your request, we may be entitled to charge you certain fees. The fees which may be payable are prescribed and available on the Information Regulator website.

Before attending to your request, we will advise you of the total fees you will need to pay.

Section 11(3) of POPIA provides that a data subject may object, at any time, to the processing of personal information on reasonable grounds relating to his/her particular situation, unless legislation provides for such processing.

If you wish to object to the processing of any of your personal information, at any time, you must complete the prescribed form (available on the Regulator’s website) and submit it to the Information Officer at the postal or physical address, or electronic mail address set out above.

A data subject may also request the correction or delete of any personal information about the data subject that is in our possession or under our control that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or was obtained unlawfully; or may request that we destroy or delete a record of personal information about the data subject that we are no longer authorised to retain in terms of POPIA's retention and restriction of records provisions.

If you wish to request a correction or deletion of your personal information or the destruction or deletion of a record of your personal information, you must submit a request to the Information Officer on the prescribed form (available on the Regulator’s website) at the postal or physical address, or electronic mail address set out above.

1. A copy of the Manual is available-
   • on the COMPANY’s website;
   • head office of the COMPANY for public inspection during normal business hours;
   • to any person upon request and upon the payment of a reasonable prescribed fee; and
   • from the Information Regulator upon request.
2. A fee for a copy of the Manual shall be payable per each A4-size photocopy made.

The Information Officer of COMPANY will on a regular basis update this manual.