PAIA manual.

The headings of the clauses in this Manual are for the purpose of convenience and reference only and shall not be used in the interpretation of nor modify nor amplify the terms of this Manual nor any clause hereof. Unless a contrary intention clearly appears words importing:

The following words, unless otherwise defined, shall bear the same meaning as under PAIA and POPIA, as the case may be:

PAIA seeks to give effect to the constitutional right of access to information as contained in section 32 of the Constitution and to advance the values of transparency and accountability and establishes certain statutory rights of Requesters to access Records of a Private Body if:

POPIA seeks to give effect to the constitutional right to privacy as contained in section 14 of the Constitution and to safeguard Personal Information by regulating the manner in which it may be Processed by Private Bodies.

POPIA provides that Data Subjects have the right to have their Personal Information Processed in accordance with the conditions for the lawful Processing of Personal Information, which are set out in POPIA.

One of the requirements specified in PAIA is the compilation of an information manual that provides information including the types and categories of Records held by a Private Body, the procedures to access Records as well certain information relating to the Processing of Personal Information.

The Information Regulator has developed a PAIA Guide which is available at https://inforegulator.org.za/wp-content/uploads/2020/07/PAIA-Guide-English_20210905.pdf which Guide is a user-friendly and accessible tool for any person who wishes to exercise any right contemplated in PAIA as well as certain rights contained in POPIA. This Manual must be read in conjunction with the PAIA Guide on how to use PAIA. Members of the public may also inspect the Guide free of charge at the offices of the Company, or on payment of the prescribed fee, obtain a copy.

This Manual serves as the Company's information manual and provides reference to the manner to access Records held by the Company as well as the Personal Information Processed by the Company from time to time.

The purpose of this Manual is to:

This Manual is not exhaustive and a person seeking any Record and/or Personal Information or any other specified information from the Company must familiarise itself with the provisions of PAIA and/or POPIA before submitting a request to the Company.

Section 51 of PAIA requires Private Bodies to compile a Manual setting out the procedure and requirements to be adhered to in seeking to obtain access to Records held by that Private Body.

This Manual will, subject to clause 4 above, be updated as and when the need arises and as soon as any amendments have been finalised, the latest version of the Manual will be made public through the Company's website at www.simvida.co.za; alternatively on request from the Company’s Information Officer and Deputy Information Officer, whose details appear below.

Company Contact Details:

Information Officer:

Deputy Information Officer:

The Information Regulator is required, in terms of section 10 of PAIA, to compile a PAIA Guide containing information that may reasonably be required by a person who wishes to exercise any right contemplated in PAIA.

PAIA permits a Requester to request access to the Records of a Private Body if the Record is required for the exercise or protection of any rights.

Requests in terms of PAIA shall be made in accordance with the prescribed procedures at the rates stipulated.

PAIA provides that certain Records may automatically be made available. Should Records automatically be available, a formal request for such Records will not be necessary.

In terms of PAIA, Private Bodies are not obliged to make any Records automatically available. This means that a Private Body is not obliged to make such disclosure. If a Private Body chooses to make such voluntary disclosure, it may do so by giving notice thereof in terms of section 52(2) of PAIA.

At this stage the Company has not given notice of any categories of Records that are automatically available without a person having to request access in terms of PAIA.

PAIA provides that a person may request Records from a Private Body in terms thereof if that Record is required for the exercise or protection of a right.

When making a request, the Requester must:

A request for access to a Record must be made on the prescribed form (a copy of which is annexed as Schedule B) ("Request") delivered to the Information Officer at his address, or e-mail address as provided for in this Manual.

The Requester must provide sufficient detail in the Request to enable the Information Officer to identify:

If a Request is made by a Representative Requester, then the Representative Requester must submit proof of the capacity in which the Representative Requester is making the Request to the reasonable satisfaction of the Information Officer or Deputy Information Officer.

If an individual is unable to complete the prescribed form because of illiteracy or disability, such a person may make the request verbally to the Information Officer.

Any Request must be directed to the Information Officer or any other authorised persons.

The Request on the prescribed form must be delivered to the Company by hand, via mail or e-mail.

The Requester must pay the prescribed fee before any further processing of the Request can be effected/implemented.

Subsequent to a Request being made, the Information Officer, shall by notice require the Requester, to pay the prescribed request fee as determined by the Information Regulator from time to time, before further processing the Request.

A Requester whose Request has been granted must pay the applicable access fee for reproduction, search, preparation and for any time reasonably required in excess of the prescribed hours to search for and prepare the Record for disclosure including making arrangements to make it available in the request form.

The Company shall, within 30 (thirty) days of receipt of a request form, or such shorter period as may be reasonable in the circumstances, make a decision as to whether to grant or decline the Request and inform the Requester of its decision with adequate reasons for the refusal.

The 30 (thirty) day period within which the Company has to decide whether to grant or refuse the Request may be extended for a further period not exceeding 30 (thirty) days if the Request is for a large number of Records; the Request requires a search for or through a large number of Records; or the Request requires a search for Records held at other premises, as a result of which the required Records cannot reasonably be obtained within the initial 30 (thirty) day period.

The Company shall notify the Requester in writing should an extension of the prescribed period be required and the reasons for the extension.

The Company may or must refuse a Request on, amongst others, the grounds set out in Part 3, Chapter 4 of PAIA which grounds include (but are not limited to) the following:

The Company may approve a Request for access where the disclosure of the Record would reveal evidence of a substantial contravention of, or failure to comply with the law or imminent and serious public or environmental risk.

If the Company has searched for a Record and believes that the Record either does not exist or cannot be found, the Requester will be notified by way of an affidavit or written affirmation.

The affidavit or affirmation shall detail the steps which were taken to locate the requested Record.

In terms of the provisions of POPIA, the Company must take reasonably practicable steps to inform Data Subjects of the Personal Information being collected and the manner in which it Processes the Personal Information.

The type of Personal Information to be processed by the Company will depend on the purpose for which such Personal Information is Processed. The Company will only Process such Personal Information which it needs to fulfil the relevant purpose and as required by law.

The Company processes Personal Information for Users of the SIMVIDA platform, employees, consultants, service providers, and product suppliers.

The Company’s list of categories of Subjects, Data Subjects and the information or categories of information relating thereto appears in Schedule A annexed hereto.

executing and/or fulfilling its statutory obligations in terms of PAIA and/or POPIA;

executing and/or fulfilling its statutory obligations in terms of other applicable legislation;

executing and/or fulfilling its contractual obligations;

administering employees and potential employees;

keeping accounts and Records for business and statutory reporting obligations;

procurement processes; and

visitors to the Company's website and business premises.

The Company may supply the Personal Information of Data Subjects to service providers, who provide the following services:

The Company may supply the Personal Information of Data Subjects to:

The Company’s website www.simvida.com is hosted in the cloud by Amazon Web Services.

The Company may outsource the Processing of Personal Information to third party operators from time to time and in so doing transfer Personal Information outside the borders of South Africa, however this will at all times be subject to the relevant provisions of the POPI Act, and the person (both legal and natural) to whom the Personal Information is transferred shall be subject to a law, binding company rules, and/or binding agreements, which provide a suitable level of protection.

The cross border transfer of Personal Information may be done with the Data Subject's Consent. However, if it is not reasonably practicable to obtain the Data Subject's Consent, the Company will transfer the Personal Information if it will be for the Data Subject's benefit, and the Data Subject would have provided Consent, if it had been reasonably practicable to obtain the Consent.

The Company is obliged to provide adequate protection in respect of the Personal Information it Processes and to prevent unauthorised access, disclosure and use of any Personal Information.

The Company shall, on an on-going basis, review its security controls and related processes to ensure that the Personal Information of Data Subjects is secure and retained only for so long as is required or needed for Record-keeping purposes.

The Company's security policies and procedures include:

When the Company contracts with third parties in relation to the management of Personal Information, the Company imposes appropriate security, privacy and confidentiality obligations on them to ensure that the Personal Information under the Company's control will be kept secure at all times.

The Company will ensure that anyone to whom it discloses any Personal Information, agrees to treat that Personal Information with the same level of protection as the Company is obliged to treat it.

A Data Subject has the right to request the Company to confirm, free of charge, whether or not the Company holds Personal Information about the Data Subject.

Objection to the Processing of Personal Information by a Data Subject

Request for correction or deletion of Personal Information

The following categories of Records may be held by the Company and access may be granted to such Records upon proper request and payment of a fee in terms of PAIA and this Manual, unless the Company is entitled to refuse access to such Records, or the Records are exempted in terms of PAIA:

To facilitate the processing of your request, kindly complete and submit the form below to the e-mail address of the Information Officer or Deputy Information Officer indicated in clauses 8.2 and 8.3 above.

The Deputy Information Officer will notify the Requester that a request for access has been received and that the prescribed fee (if any) is payable prior to processing the request.

Once the request has been processed, the Deputy Information Officer will inform you of the outcome of your request and any additional fees that may fall due.

Take note that, as per clause 14 above, PAIA provides a number of grounds on which a request for access to information must be refused.

WHEN COMPLETING THE FORM BELOW PLEASE:

amount of the deposit, (if any), is payable before your Request is processed; and

requested Record/portion of the Record will only be released once proof of full payment is received.

You requested:

You requested:

To be submitted:

Fees payable with regards to your request:

Deposit payable (if search exceeds six hours):

Affidavits or other documentary evidence as applicable in support of the objection may be attached.

If the space provided for in this Form is inadequate, submit information as an Annexure to this Form and sign each page.

Complete as applicable.

Affidavits or other documentary evidence as applicable in support of the Request may be attached.

If the space provided for in this Form is inadequate, submit information as an Annexure to this Form and sign each page.

Complete as is applicable.

Correction or deletion of personal information about the Data Subject which is in possession or under the control of the Responsible Party.

Please select applicable reasons for the selected request:

Destruction or deletion of a Record of Personal Information about the Data Subject which is in the possession or under the control of the Responsible Party who is no longer authorised to retain the Record of information.