PAIA and POPIA Manual

This manual is published by Core Path Analytics (Pty) Ltd under section 51 of the Promotion of Access to Information Act 2 of 2000 ("PAIA") and includes the information required by the Protection of Personal Information Act 4 of 2013 ("POPIA"). It tells you what records we hold, how to request access to them, and how we process personal information.

1. Definitions

• "Core Path Analytics", "we" or "us" means Core Path Analytics (Pty) Ltd, registration number 2026/364044/07.
• "Data subject" means the person to whom personal information relates.
• "Information Officer" means the head of a private body as described in section 1 of PAIA and section 55 of POPIA.
• "Personal information" has the meaning given in section 1 of POPIA.
• "Record" means any recorded information, in any form, in our possession or under our control.
• "Regulator" means the Information Regulator established under section 39 of POPIA.
• "Requester" means any person, including a public body, making a request for access to a record.

2. Purpose of this manual

This manual helps you to:

1. check what categories of records we hold;
2. find out which records are available without a formal request;
3. understand how to make a request for access, and what it costs;
4. know who to contact for help;
5. understand what personal information we process, why, and how we protect it.

3. Contact details

3.1 Information Officer

Our owner, Andries Mashego, is our Information Officer. We have not appointed a Deputy Information Officer, so all requests go directly to him.

3.2 Company details

4. Guide from the Information Regulator

The Regulator has published a guide, in each official language, on how to use PAIA and POPIA (section 10 of PAIA). It explains the rights and remedies available and how to make a request. You can obtain it from the Regulator:

• Website: www.inforegulator.org.za
• Address: Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191
• Postal address: PO Box 31533, Braamfontein, Johannesburg, 2017
• Telephone: 010 023 5200 or toll-free 0800 017 160
• Email: enquiries@inforegulator.org.za

You may also inspect a copy of the guide at our office during business hours (Monday to Friday, 08:00 to 17:00), or ask us to email it to you.

5. Records available without a request

The following are freely available on our Website or on request, without following the PAIA process:

• information about our services and packages;
• our Privacy Policy, Cookie Policy, Terms and Conditions and this manual;
• our corporate profile and brochures.

No notice under section 52(2) of PAIA has been published by the Minister.

6. Records kept under other legislation

We keep records as required by the following laws, where applicable to our business:

• Basic Conditions of Employment Act 75 of 1997
• Broad-Based Black Economic Empowerment Act 53 of 2003
• Companies Act 71 of 2008
• Compensation for Occupational Injuries and Diseases Act 130 of 1993
• Consumer Protection Act 68 of 2008
• Electronic Communications and Transactions Act 25 of 2002
• Employment Equity Act 55 of 1998
• Income Tax Act 58 of 1962
• Labour Relations Act 66 of 1995
• Occupational Health and Safety Act 85 of 1993
• Protection of Personal Information Act 4 of 2013
• Skills Development Levies Act 9 of 1999
• Tax Administration Act 28 of 2011
• Unemployment Insurance Act 63 of 2001 and Unemployment Insurance Contributions Act 4 of 2002
• Value-Added Tax Act 89 of 1991

This list is not exhaustive. If you believe we hold a record under another law, you may still request it.

7. Categories of records we hold

Listing a category does not mean that every record in it will be released. Access may be refused on the grounds set out in Chapter 4 of Part 3 of PAIA, for example to protect the privacy of third parties, commercial information of a third party, confidential information or legally privileged records.

8. How to request access

1. Complete Form 2 (Request for Access to Record) prescribed under the PAIA Regulations, 2021. It is available on the Regulator's website, or we can email it to you.
2. Send the completed form to our Information Officer by email to info@corepathanalytics.co.za or by hand to our office.
3. Provide enough detail for us to identify the record and you as the requester, state the form of access you want, and say which right you are trying to exercise or protect and why the record is needed for it (section 53 of PAIA).
4. If you are requesting on behalf of someone else, include proof of your authority.
5. Pay the request fee, if it applies (see section 9 below).

We will decide on your request within 30 days of receiving it. We may extend this period once by up to 30 days if the request involves a large number of records or a search through records held elsewhere, and we will tell you why. If you are refused access, we will give you reasons, and you may apply to the Regulator or a court for relief.

9. Fees

The fees for private bodies are prescribed in Annexure B of the PAIA Regulations, 2021. We do not charge more than the prescribed amounts.

• Request fee: R140, payable by every requester other than a personal requester asking for their own personal information.
• Reproduction: R2.00 for each A4 page, or part of a page, photocopied or printed.
• Search and preparation: R145 per hour or part of an hour, reasonably required, up to a maximum of R435, as prescribed.
• Deposit: if the search and preparation will take more than six hours, we may ask for a deposit of one third of the access fee.
• Postage, email or other electronic transfer: the actual cost, if any.

The full and current fee schedule is available on the Regulator's website. Records may be withheld until the applicable fees have been paid. The fees above exclude VAT. If Core Path Analytics is registered for VAT at the time of your request, VAT will be added at the applicable rate.

10. Processing of personal information (POPIA)

10.1 Purposes of processing

We process personal information to respond to enquiries and quote requests; to deliver consulting, systems design, analytics, compliance, registration and design services; to submit registrations and filings to government bodies on clients' behalf; to manage our employees and suppliers; to meet our legal, tax and regulatory obligations; to keep our systems secure; and to market our services where the law allows.

10.2 Categories of data subjects and their personal information

10.3 Recipients of personal information

We share personal information only where necessary, with: government bodies such as the CIPC, SARS, the Department of Employment and Labour, the Department of Social Development, National Treasury and the CIDB, when acting on a client's instruction; our operators, including our website hosting and form-handling provider, business email provider and accounting software provider; professional advisers such as auditors and attorneys; and law enforcement or courts where required by law.

10.4 Planned cross-border transfers

Some of our operators, including our website hosting and form-handling provider, Netlify, Inc., store information outside South Africa, including in the United States. We only transfer personal information across borders where section 72 of POPIA allows it.

10.5 Security measures

We protect personal information with reasonable technical and organisational measures, including encrypted connections, access control based on need, password protection and multi-factor authentication where available, confidentiality obligations for staff and operators, secure disposal of records, and regular review of our safeguards. We will notify the Regulator and affected data subjects of any security compromise as required by section 22 of POPIA.

10.6 Objection and correction

Data subjects may object to processing using Form 1 and request correction or deletion using Form 2 of the POPIA Regulations, 2018. Send these to our Information Officer at info@corepathanalytics.co.za.

11. Complaints

If you are not satisfied with how we handled a request or your personal information, please contact our Information Officer first. You may also lodge a complaint with the Information Regulator using Form 5:

• PAIA complaints: PAIAComplaints@inforegulator.org.za
• POPIA complaints: POPIAComplaints@inforegulator.org.za

12. Availability and updates

This manual is available on our Website at www.corepathanalytics.co.za/paia-manual/ and at our office during business hours. We will update it whenever there is a material change to the information it contains.

Approved by: Andries Mashego, Chief Executive Officer and Information Officer, Core Path Analytics (Pty) Ltd