PAIA Manual

Manual prepared in terms of section 51 of the Promotion of Access to Information Act 2 of 2000 (as amended), read with section 17 of the Protection of Personal Information Act 4 of 2013.

1. List of acronyms and abbreviations

2. Purpose of this manual

This manual tells any person how to request access to a record held by Kay Curzi Group, what records KCG holds, and how KCG processes personal information. Section 51 of PAIA requires every private body to compile and publish such a manual.

PAIA gives effect to section 32 of the Constitution, which grants everyone the right of access to any information held by the State, and to information held by another person that is required for the exercise or protection of any rights. A person who wants a record of KCG for that purpose may request it under PAIA, and KCG must deal with the request in the way this manual and the Act describe.

This manual also serves KCG's obligations under section 17 of POPIA by describing, in section 8 below, the purposes for which KCG processes personal information, the categories of data subjects and recipients, planned transborder flows and the security measures KCG applies.

The manual is intended to:

• Explain the rights of requesters under PAIA and how to exercise them
• Help requesters identify the records KCG holds and the subjects they relate to
• Set out the procedure, forms, fees and timelines for a request
• Describe the remedies available if a request is refused
• Record how KCG processes personal information, as required by POPIA

3. Key contact details for access to information

Requests for access to records of KCG, and any queries about this manual, go to the Information Officer. The head of a private body is by default its Information Officer under PAIA and POPIA; KCG's directors have designated Marc Manzi Kayumba to the role, and he is registered as such with the Information Regulator.

A requester may deliver a request by hand to the physical address, by post, or by email to the Information Officer. KCG will acknowledge receipt in writing.

4. Guide of the Information Regulator (section 10 of PAIA)

The Information Regulator has published a Guide, in each official language, on how to use PAIA. It explains the objects of the Act, the contact details of every Information Officer and Deputy Information Officer, the manner and form of a request, the remedies available, the fees payable and how to lodge a complaint. The Guide is available free of charge from the Regulator and on its website at www.inforegulator.org.za.

Any person may inspect or make copies of the Guide at the Regulator's office, and the Regulator's contact details above are the ones to use for a complaint about KCG's handling of a request.

5. Records available without a request (section 52(2) of PAIA)

KCG has not published a notice in terms of section 52(2) of PAIA, so no categories of record are automatically available in that sense. The records below are, however, freely available without a PAIA request:

6. Records available in terms of other legislation

Certain KCG records are available to the people entitled to them under the legislation that governs those records, without a PAIA request. Where another Act prescribes a procedure for access, that procedure applies. KCG holds records under, among others, the following Acts:

• Companies Act 71 of 2008
• Basic Conditions of Employment Act 75 of 1997
• Labour Relations Act 66 of 1995
• Employment Equity Act 55 of 1998
• Skills Development Act 97 of 1998 and Skills Development Levies Act 9 of 1999
• Unemployment Insurance Act 63 of 2001 and Unemployment Insurance Contributions Act 4 of 2002
• Compensation for Occupational Injuries and Diseases Act 130 of 1993
• Occupational Health and Safety Act 85 of 1993
• Income Tax Act 58 of 1962
• Value-Added Tax Act 89 of 1991
• Tax Administration Act 28 of 2011
• Customs and Excise Act 91 of 1964
• International Trade Administration Act 71 of 2002
• Exchange Control Regulations, 1961, issued under the Currency and Exchanges Act 9 of 1933
• Agricultural Product Standards Act 119 of 1990 and the Perishable Products Export Control Act 9 of 1983
• Foodstuffs, Cosmetics and Disinfectants Act 54 of 1972
• Consumer Protection Act 68 of 2008
• National Road Traffic Act 93 of 1996
• Financial Intelligence Centre Act 38 of 2001
• Electronic Communications and Transactions Act 25 of 2002
• Protection of Personal Information Act 4 of 2013
• Promotion of Access to Information Act 2 of 2000

This list is not exhaustive and does not create a right of access beyond what each Act provides.

7. Subjects on which KCG holds records, and the categories of records held

KCG imports, exports and distributes commodities and manages supply chains for manufacturers. Its records fall under the subjects below. Listing a category here does not mean access will be granted; every request is assessed under PAIA, and some records are protected by the grounds for refusal in section 9 of this manual.

8. Processing of personal information (section 51(1)(c)(v) of PAIA)

KCG processes personal information as a responsible party under POPIA. This section records the purposes, data subjects, categories of information, recipients, transborder flows and security measures required by PAIA and section 17 of POPIA.

8.1 Purposes of processing

• Concluding and performing contracts with customers, suppliers and service providers
• Arranging shipping, customs clearing, warehousing and delivery of goods
• Credit assessment, credit insurance and debt collection
• Invoicing, payment, accounting, audit and tax compliance
• Complying with customs, exchange control, food safety and other regulatory obligations
• Recruiting, employing and managing staff, including payroll and statutory contributions
• Managing KCG's premises, IT systems and security
• Marketing KCG's services to existing and prospective customers
• Handling enquiries, complaints and PAIA requests
• Establishing, exercising or defending legal claims

8.2 Data subjects and categories of personal information

8.3 Recipients of personal information

KCG shares personal information only where necessary for the purposes above, with: shipping lines, freight forwarders, clearing agents, warehouses and transporters; credit insurers, banks and payment providers; auditors, accountants, attorneys and other professional advisers; software and cloud providers that host KCG's systems; regulators and government bodies, including SARS, the South African Reserve Bank, customs authorities and the Information Regulator, where the law requires; and any person to whom KCG is obliged to disclose information by law or court order.

8.4 Planned transborder flows

KCG sources goods from suppliers outside South Africa and ships to customers in other countries. Personal information of the representatives of those counterparties, and of KCG staff dealing with them, is transferred to the countries where they are located, including Argentina, Brazil and Singapore, and to the shipping lines and forwarders that carry the goods. Some of KCG's IT systems are hosted by providers with servers outside South Africa. KCG transfers personal information across borders only where section 72 of POPIA permits it: the recipient is bound by law, binding corporate rules or a contract that provides protection substantially similar to POPIA, the data subject has consented, or the transfer is necessary for the performance of a contract with or in the interest of the data subject.

8.5 Security measures

KCG takes reasonable technical and organisational measures to secure the integrity and confidentiality of personal information, as section 19 of POPIA requires. These include:

• Access to systems on a need-to-know basis, controlled by individual user accounts and passwords
• Multi-factor authentication on cloud systems where available
• Encrypted connections to cloud-hosted accounting, email and operations platforms
• Regular backups of business systems
• Physical access control at KCG's premises and secure storage of paper records
• Confidentiality obligations in employment and service contracts
• Written agreements with operators that process personal information on KCG's behalf
• Procedures for identifying, containing and notifying security compromises under section 22 of POPIA
• Periodic review of these measures and of the personal information KCG holds

9. How to request access to a record of KCG

A requester must show that the record is required for the exercise or protection of a right (section 50 of PAIA). KCG will refuse a request where PAIA requires or permits it to, and will otherwise grant access within the time limits below.

9.1 Procedure

1. Complete the prescribed Form 2 (Annexure A). State the record requested in enough detail for KCG to identify it, the form of access wanted, the right being exercised or protected and why the record is required for it, and a postal address, fax number or email for KCG's reply.
2. A person requesting on behalf of someone else must state their capacity and attach proof of it (for example a power of attorney or company resolution).
3. Submit the form to the Information Officer by hand, post or email at the address in section 3, with the request fee of R100 (section 10). Personal requesters, who ask for records containing personal information about themselves, pay no request fee.
4. KCG acknowledges receipt and, where the request is incomplete, helps the requester to complete it.
5. Where access is granted, KCG issues Form 3 stating the access fee and any deposit payable. Access is given once the fees are paid.
6. A requester who cannot complete the form because of illiteracy or disability may make the request orally, and the Information Officer will complete the form on their behalf.

9.2 Time limits

A request that KCG does not answer within the period allowed is deemed refused (section 58).

9.3 Grounds on which KCG must or may refuse access

KCG must refuse access where disclosure would involve the unreasonable disclosure of personal information about a third party (section 63); reveal trade secrets or financial, commercial, scientific or technical information of a third party whose disclosure would likely cause that party harm, or information supplied in confidence by a third party (section 64); breach a duty of confidence owed to a third party (section 65); endanger the life or physical safety of a person (section 66); prejudice the security of property or a computer system (section 66); reveal information privileged from production in legal proceedings (section 67); or reveal KCG's own trade secrets, or its financial, commercial, scientific or technical information whose disclosure would likely cause KCG harm (section 68).

KCG may refuse a request that is manifestly frivolous or vexatious, or where the work involved would substantially and unreasonably divert its resources (section 70). KCG will nevertheless grant access where the public interest in disclosure clearly outweighs the harm, as section 70 provides, and will give access to any part of a record that can reasonably be severed from the part that must be refused (section 28).

9.4 Remedies

A requester, or a third party, aggrieved by KCG's decision may lodge a complaint with the Information Regulator on the prescribed Form 5 within 180 days of the decision. The Regulator may investigate, attempt to settle the matter, and issue an enforcement notice. A requester may also apply to a court in terms of section 78 of PAIA, after the Regulator's complaint procedure has been exhausted or within 180 days of the decision where the Regulator declines to investigate. A requester is not required to use KCG's internal processes before approaching the Regulator; private bodies have no internal appeal procedure under PAIA.

10. Fees

The fees below are those prescribed in Annexure B of the PAIA Regulations, 2021, as at the date of this manual. KCG charges only the prescribed fees and will update this section when the Regulations change. Fees are payable to KCG's bank account, details of which the Information Officer will supply with Form 3, or in cash at KCG's office.

Where search and preparation will exceed six hours, KCG may require a deposit of one third of the access fee before processing the request. A deposit is refunded if the request is refused. KCG will withhold a record until all fees are paid.

11. Availability and updating of this manual

This manual is available free of charge, in English, at:

• KCG's website, www.kaycurzigroup.com, under PAIA Manual in the site footer
• KCG's office at 173 Oxford Road, Rosebank, Johannesburg, for inspection during business hours
• The Information Officer, by email on request

A copy has been submitted to the Information Regulator. KCG will keep a register of all PAIA requests received and their outcomes, and will submit its annual report to the Regulator under section 83(4) of PAIA each year between 1 April and 30 June.

The Information Officer will review this manual at least once a year and update it whenever the details in it change, including a change of Information Officer, address, the categories of records held, or the prescribed fees.

Annexure A: Form 2 — Request for access to record of private body

(Section 53(1) of the Promotion of Access to Information Act, 2000; Regulation 7)

Download the request form from the Information Regulator's website, or request a copy from the Information Officer. The completed form, with the request fee, goes to the Information Officer at the address in section 3.

A. Particulars of private body: The Information Officer, Kay Curzi Group (Pty) Ltd, 173 Oxford Road, Rosebank, Johannesburg, 2196 · marckayumba@kaycurzigroup.com · +27 64 912 0366

B. Particulars of person requesting access to the record: full names and surname; identity number; postal address; telephone number; email address; capacity in which the request is made, when made on behalf of another person.

C. Particulars of person on whose behalf the request is made (if applicable): full names and surname; identity number.

D. Particulars of record: description of the record or relevant part of the record; reference number, if available; any further particulars that will help to identify it.

E. Fees: a request fee of R100 is payable before the request will be processed, unless the requester is asking for a record containing personal information about themselves. An access fee is payable for search, preparation, reproduction and postage, and will be stated in Form 3.

F. Form of access to record: copy of the record; inspection of the record; transcription of visual images or audio; copy in computer-readable form; printed copy of information held on computer. If a disability prevents you from using the form of access provided, state the disability and the form in which the record is required.

G. Particulars of right to be exercised or protected: indicate which right is to be exercised or protected, and explain why the record requested is required for the exercise or protection of that right.

H. Notice of decision: you will be notified in writing whether your request has been approved or refused. State how you would like to be informed (post or email) and the address to use.

The form must be signed and dated by the requester or the person on whose behalf the request is made.