PAIA Manual

1 Definitions

2 Purpose of the PAIA Manual

This PAIA Manual is useful for the public to:

2.1 Check the categories of records held by a body which are available without a person having to submit a formal PAIA request.

2.2 Have a sufficient understanding of how to make a request for access to a record of the body, by providing a description of the subjects on which the body holds records and the categories of records held on each subject.

2.3 Know the description of the records of the body which are available in accordance with any other legislation.

2.4 Access all the relevant contact details of the IO and DIO who will assist the public with the records that they intend to access.

2.5 Know the description of the guide on how to use PAIA, as updated by the Regulator, and how to obtain access to it.

2.6 Know if the body will process personal information, the purpose of processing of personal information, and the description of the categories of data subjects and of the information or categories of information relating thereto.

2.7 Know the recipients or categories of recipients to whom the personal information may be supplied.

2.8 Know if the body has planned to transfer or process personal information outside of the Republic of South Africa and the recipients or categories of recipients to whom the personal information may be supplied.

2.9 Know whether the body has appropriate security measures to ensure the confidentiality, integrity and availability of the personal information which is to be processed.

3 Key Contact Details for Access to Information of the (BCE Foodservice Equipment)

4 Guide on How to Use PAIA and How to Obtain Access to the Guide

4.1 The Regulator has, in terms of section 10(1) of PAIA, as amended, updated and made available the revised guide on how to use PAIA ("guide"), in an easily comprehensible form and manner, as may reasonably be required by a person who wishes to exercise any right contemplated in PAIA and POPIA.

4.2 The guide is available in each of the official languages and in braille.

4.3 The aforesaid guide contains the description of:

• 4.3.1 The objects of PAIA and POPIA;
• 4.3.2 The postal and street address, phone and fax number and, if available, email address of:
  • 4.3.2.1 The IO of every public body, and
  • 4.3.2.2 Every DIO of every public and private body designated in terms of section 17(1) of PAIA and section 56 of POPIA¹;
• 4.3.3 The manner and form of a request for:
  • 4.3.3.1 Access to a record of a public body contemplated in section 11².
  • 4.3.3.2 Access to a record of a private body contemplated in section 50³.
  • 4.3.3.3 An internal appeal.
  • 4.3.3.4 A complaint to the Regulator.
  • 4.3.3.5 An application with a court against a decision by the IO of a public body, a decision on internal appeal or a decision by the Regulator or a decision of the head of a private body.
• 4.3.4 The provisions of sections 14⁴ and 51⁵ requiring a public body and private body, respectively, to compile a manual, and how to obtain access to a manual;
• 4.3.5 The provisions of sections 15⁶ and 52⁷ providing for the voluntary disclosure of categories of records by a public body and private body, respectively;
• 4.3.6 The notices issued in terms of sections 22⁸ and 54⁹ regarding fees to be paid in relation to requests for access;
• 4.3.7 The regulations made in terms of section 92¹⁰;
• 4.3.8 The assistance available from the IO of a public body in terms of PAIA and POPIA;
• 4.3.9 The assistance available from the Regulator in terms of PAIA and POPIA; and
• 4.3.10 All remedies in law available regarding an act or failure to act in respect of a right or duty conferred or imposed by PAIA and POPIA, including the manner of lodging.

4.4 Members of the public can inspect or make copies of the guide from the offices of the public and private bodies, including the office of the Regulator, during normal working hours.

4.5 The guide can also be obtained:

• 4.5.1 Upon request to the IO.
• 4.5.2 From the website of the Regulator (https://www.justice.gov.za/inforeg/).

4.6 A copy of the guide is also available in the following three official languages, for public inspection during normal office hours:

• 4.6.1 English.
• 4.6.2 Afrikaans.
• 4.6.3 Zulu.

5 Guide of Information Regulator

5.1 A guide to PAIA and how to access information in terms of PAIA has been published pursuant to section 10 of PAIA.

5.2 The guide contains information required by an individual who may wish to exercise their rights in terms of PAIA.

5.3 Should you wish to access the guide, you may request a copy from the IO by contacting him/her using the details specified above.

5.4 You may also inspect the guide at the company's offices during ordinary working hours.

5.5 You may also request a copy of the guide from the Information Regulator at the following details:

6 Latest Notices in terms of Section 52(2) of PAIA

At this stage, no notice(s) has/have been published on the categories of records that are available without having to request access to them in terms of PAIA.

7 Availability of Certain Records in terms of PAIA

7.1 Categories of records of the (BCE Foodservice Equipment) which are available without a person having to request access:

7.2 Description of the records/subjects of (BCE Foodservice Equipment) which are available in accordance with any other legislation:

7.3 The company holds and/or processes the following records for the purposes of PAIA and POPIA:

7.3.1 PAIA: PAIA Manual; PAIA guides; PAIA records; PAIA submission records; awareness training.

7.3.2 POPIA: Including, but not limited to, the following: IO Registration Certificate; data breach records; retention records; awareness training.

7.3.3 Further information which may be made available upon request.

7.4 The above-mentioned records may be requested; however, it should be noted that there is no guarantee that the request will be honoured. Each request will be evaluated in terms of PAIA and any other applicable legislation.

8 Request Process

8.1 An individual who wishes to place a request must comply with all the procedures laid down in PAIA.

8.2 The requester must complete Form 1 herein (Annexure B in terms of PAIA), which is attached hereto and submit it to the IO at the details specified herein.

8.3 The prescribed form as well as payment of a request fee and a deposit (if applicable) must be submitted to the IO at/via the postal or physical address, fax number or email address as is stated herein.

8.4 The prescribed form must be completed with enough particularity to enable the IO to determine:

• 8.4.1 The record(s) requested;
• 8.4.2 The identity of the requestor;
• 8.4.3 What form of access is required; and
• 8.4.4 The postal address or fax number of the requestor.

8.5 The requestor must state that the records are required for the requestor to exercise or protect a right, and clearly state what the nature of the right is so to be exercised or protected. An explanation of why the records are requested is required to exercise or protect the right.

8.6 The request for access will be dealt with within 30 (thirty) days from date of receipt, unless the requestor has set out special grounds that satisfies the IO that the request be dealt with sooner.

8.7 The period of 30 (thirty) days may be extended by not more than 30 (thirty) additional days, if the request is for a large quantity of information, or if the request requires a search for information held at another office of the company and the information cannot be reasonably obtained within 30 (thirty) days. The IO will notify the requestor in writing should an extension be necessary.

8.8 The IO must communicate a response to the request for access using Form 2 herein (Annexure E in terms of PAIA). This communication shall inform the requestor of:

• 8.8.1 The decision; and
• 8.8.2 Fees payable.

8.9 In the event that the IO is of the opinion that the searching and preparation of the record for disclosure would amount to more than six (6) hours, he/she shall inform the requestor to pay a deposit not exceeding one third of the amount payable.

8.10 Should the requestor have any difficulty with the form or the process laid out herein, the requestor should contact the IO for assistance.

8.11 An oral request can be made to the IO should the requestor be unable to complete the form due to illiteracy or a disability. The IO will then complete the form on behalf of the requestor and provide a copy of the form to the requestor.

8.12 Form 4 herein (Request for Correction or Deletion) is used by a data subject to request the correction of inaccurate, outdated, incomplete, irrelevant, or misleading personal information, and/or the deletion or destruction of personal information that is no longer necessary or unlawfully obtained, in accordance with Section 24(1) of POPIA. It ensures that responsible parties maintain accurate and lawful records of personal data.

8.13 Form 5 herein (Application for the Issue of a Code of Conduct) is used by an industry body, profession, or class of entities to apply for the issuance of a Code of Conduct under Section 61(1)(b) of POPIA. It allows industries to self-regulate how personal information is processed within their sector, in line with the conditions for lawful processing.

8.14 Form 6 herein (Request for Consent — Direct Marketing) enables a responsible party to formally request a data subject's consent to receive direct marketing communications via unsolicited electronic means (e.g., SMS, email), as required under Section 69(2) of POPIA. It ensures that individuals have control over whether and how they are marketed to.

8.15 Form 7 (Complaint Regarding Interference with Personal Information) allows a data subject or complainant to submit a complaint to the IR concerning unlawful interference with personal information; or a determination made by an adjudicator under POPIA. It provides an avenue for recourse and investigation in cases of non-compliance with data protection obligations.

9 Grounds for Refusal

The following are grounds upon which the company may, subject to the exceptions in chapter 4 of PAIA, refuse a request for access in accordance with chapter 4 of PAIA:

9.1 Mandatory protection of the privacy of a third party who is a natural person, including a deceased person, where such disclosure of personal information would be unreasonable.

9.2 Mandatory protection of the commercial information of a third party, if the records contain:

• 9.2.1 Trade secrets of that third party;
• 9.2.2 Financial, commercial, scientific or technical information of the third party, the disclosure of which could likely cause harm to the financial or commercial interests of that third party; and/or
• 9.2.3 Information disclosed in confidence by a third party to the company, the disclosure of which could put that third party at a disadvantage in contractual or other negotiations or prejudice the third party in commercial competition.

9.3 Mandatory protection of confidential information of third parties if it is protected in terms of any agreement.

9.4 Mandatory protection of the safety of individuals and the protection of property.

9.5 Mandatory protection of records that would be regarded as privileged in legal proceedings.

9.6 Protection of the commercial information of the company, which may include:

• 9.6.1 Trade secrets;
• 9.6.2 Financial/commercial, scientific or technical information, the disclosure of which could likely cause harm to the financial or commercial interests of the company;
• 9.6.3 Information which, if disclosed, could put the company at a disadvantage in contractual or other negotiations or prejudice the company in commercial competition; and/or
• 9.6.4 Computer programs which are owned by the company, and which are protected by copyright and intellectual property laws.

9.7 Research information of the company or a third party, if such disclosure would place the research or the researcher at a serious disadvantage.

9.8 Requests for records that are clearly frivolous or vexatious, or which involve an unreasonable diversion of resources.

10 Remedies Should a Request be Refused

10.1 If the company does not have an internal appeal procedure in light of a denial of a request, decisions made by the IO is final.

10.2 The requestor may in accordance with sections 56(3)(c) and 78 of PAIA, apply to a court for relief within 180 (one-hundred-and-eighty) days of notification of the decision for appropriate relief.

11 Fees

The following fees shall be payable upon request by a requestor:

12 Processing of Personal Information

12.1 The company processes personal information in accordance with the conditions for lawful processing as set out in the Protection of Personal Information Act, 4 of 2013 ("POPIA"). Personal information is processed only for legitimate business purposes, which may include (but are not limited to):

12.2 General description of information security measures to be implemented by the responsible party to ensure the confidentiality, integrity and availability of the information:

• 12.2.1 Employment-related purposes: Recruitment, administration of employment contracts, payroll, benefits, training, and compliance with labour laws.
• 12.2.2 Client and supplier management: Entering into and performing contracts, maintaining relationships, processing payments, and responding to queries or complaints.
• 12.2.3 Legal and compliance obligations: Compliance with statutory and regulatory requirements, record keeping, audits, and reporting.
• 12.2.4 Security and risk management: Protecting company property, monitoring access, preventing fraud, and ensuring the safety of staff, clients, and visitors.

12.3 Description of the categories of data subjects and of the information or categories of information relating thereto:

13 The Recipients or Categories of Recipients to whom the Personal Information may be Supplied

13.1 Personal information held by the company may be disseminated to third parties only when lawful and necessary for business, contractual, or regulatory purposes. Categories of personal information and possible recipients include (but are not limited to):

14 Planned Transborder Flows of Personal Information

14.1 The company may, where necessary and lawful, transfer or store personal information outside the Republic of South Africa. This could include, for example, the use of secure cloud-based service providers or international business partners. Where no transborder transfer is required, personal information will continue to be stored and processed within South Africa.

14.2 Any cross-border transfer of personal information will only take place in accordance with section 72 of POPIA, which requires that:

• 14.2.1 The recipient country, organisation, or international organisation is subject to a law, binding agreement, or corporate rules that provide an adequate level of protection; or
• 14.2.2 The transfer is necessary for the performance of a contract, with the consent of the data subject, or for another lawful reason recognised by POPIA.

15 Availability of the Manual

15.1 A copy of the manual is available:

• 15.1.1 On (https://www.bce.co.za/), or at any head office of (BCE Foodservice Equipment) for public inspection during normal business hours;
• 15.1.2 To any person upon request and upon the payment of a reasonable prescribed fee; and
• 15.1.3 To the Information Regulator upon request.

15.2 A fee for a copy of the manual, as contemplated in Annexure B of the Regulations, shall be payable per each A4-size photocopy made.

16 Objection to the Processing of Personal Information by a Data Subject

16.1 A data subject who wishes to object to the processing of personal information in terms of section 11(3)(a) or section 11(3)(b) of the Act, must submit the objection to a responsible party at any time during office hours of a responsible party and free of charge.

16.2 A data subject who wishes to object to the processing of personal information must do so on a form substantially similar to Form 3 herein, free of charge and reasonably accessible to a data subject by hand, fax, post, email, SMS, or WhatsApp and or in any manner expedient to a data subject in terms of section 11(3)(a) of the Act.

16.3 A responsible party must, when collecting personal information of a data subject, notify the data subject, in terms of section 18(1)(h)(iv) of the Act, of their right to object, as referred to in section 11(3) of the Act.

16.4 If an objection to the processing of personal information of a data subject is made telephonically, such an objection shall be electronically recorded by a responsible party and upon request, be made available to the data subject in any manner, including the transcription thereof.

17 Request for Correction/Deletion of Personal Information or Destruction/Deletion of Record of Personal Information

17.1 A data subject has the right, in terms of section 24 of the Act, to request, where necessary, the correction, destruction, or deletion of his, her or its personal information.

17.2 A data subject, who wishes to request a correction or deletion of his, her, or its personal information, as provided for in section 24(1)(a) of the Act, has the right to request correction or deletion of personal information at any time and free of charge, if the personal information is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or obtained unlawfully.

17.3 A data subject who wishes to request the destruction or deletion of a record of his, her, or its personal information in terms of section 24(1)(b) of the Act, has the right to request the destruction or deletion of a record of his, her or its personal information at any time and free of charge, if a responsible party is no longer authorised to retain such information in terms of section 14 of the Act.

17.4 A request for correction to or deletion of personal information, as referred to in sub-regulation 12.11.2 or a request for the destruction or deletion of a record of personal information, as referred to in sub-regulation 12.11.3 must be submitted to a responsible party on a form which is substantially similar to Form 4 herein (Form 2 in terms of PAIA) free of charge and reasonably accessible to a data subject by hand, fax, post, email, SMS, WhatsApp message or in any manner expedient to a data subject.

17.5 A request for a correction or deletion of personal information by telephonic means shall be recorded by a responsible party and such recording must, upon request, be made available to a data subject in any manner, including the transcription thereof which shall be free of charge.

17.6 A responsible party must, within 30 (thirty) days of receipt of the outcome of the request referred to in sub-regulation 12.11.2 or 12.11.3, notify a data subject, in writing, of the action taken as a result of the request.

18 Updating of the Manual

The head of (BCE Foodservice Equipment) will update this manual on a regular basis.