PAIA Manual

Numeral Limited

Document Control

Document History

Information required under section 51 of PAIA

1. Acronyms & abbreviations

2. Purpose of the PAIA manual

The Promotion of Access to Information Act, 2 of 2000, gives effect to the right in section 32(1)(b) of the Constitution of access to any information held by private bodies that is required for the exercise or protection of any rights. The Act provides that a person requesting information must be given access to any record of a private body, if that record is required for the exercise or protection of a right. However, the right to access any information held by a private body may be limited to the extent that the limitations are reasonable and justifiable in an open and democratic society based on human dignity, equality and freedom as contemplated in Section 36 of the Constitution. This document informs requesters of procedural and other requirements which a request must meet as prescribed by the Act.

Numeral Limited is a public company incorporated in the Republic of Mauritius (registration number 098177 C1/GBL), with its primary listing on the Stock Exchange of Mauritius and a secondary listing on the AltX of the JSE. This manual is published in respect of records held by Numeral Limited in, or relating to its activities in, the Republic of South Africa, where it operates from Fintech Campus, Pretoria, and in respect of personal information it processes in South Africa, to which POPIA applies in terms of section 3(1)(b) of POPIA.

2.1. Availability

This document will be available on the website of Numeral Limited (https://numeral.co.za/), providing customers, clients and other external stakeholders with direct access to the manual.

2.2. This PAIA manual is useful for the public to

• To check the categories of records held by a body which are available without a person having to submit a formal PAIA request.
• To have sufficient understanding of how to make a request for access to a record of the body, by providing a description of the subjects on which the body holds records, and the categories of records held on each subject.
• To know the description of the records of the body which are available in accordance with any other legislation.
• To access all the relevant contact details of the Information Officer and Deputy Information Officer who will assist the public with the records they intend to access.
• To know the description of the guide on how to use PAIA, as updated by the Regulator and how to obtain access to it.
• To know if the body will process personal information, the purpose of processing personal information and the description of the categories of data subjects and of the information or categories of information relating thereto.
• To know the description of the categories of data subjects and of the information or categories of information relating thereto.
• To know the recipients or categories of recipients to whom the personal information may be supplied.
• To know if the body has planned to transfer or process personal information outside the Republic of South Africa and the recipients or categories of recipients to whom the personal information may be supplied.
• To know whether the body has appropriate security measures to ensure confidentiality, integrity and availability of the personal information which is to be processed.

3. Key contact details for access to information of Numeral Limited

Requests for access to records, and enquiries about this manual or the processing of personal information, should be addressed to the Information Officer of Numeral Limited at the details below.

4. Guide on how to use PAIA and how to obtain access to the guide

The Regulator has, in terms of section 10(1) of PAIA, as amended, updated and made available the revised Guide on how to use PAIA (“Guide”), in an easily comprehensible form and manner, as may reasonably be required by a person who wishes to exercise any right contemplated in PAIA and POPIA.

The Guide is available in each of the official languages and in braille.

The aforesaid Guide contains the description of:

• The objects of PAIA and POPIA

• The postal and street address, phone and electronic mail address of:

  • The Information Officer of every Private Body
  • Every Deputy Information Officer of every Private Body designated in terms of section 17(1) of PAIA¹ and section 56 of POPIA²
• The manner and form of a request for access to a record of a public body (section 11 of PAIA) and of a private body (section 50 of PAIA)
• The assistance available from the Information Officer of a public body and from the Regulator in terms of PAIA and POPIA
• All remedies in law available regarding an act or failure to act in respect of a right or duty conferred or imposed by PAIA and POPIA
• The provisions of sections 14 and 51 of PAIA requiring public and private bodies to compile a manual, and how to obtain access to a manual
• The provisions of sections 15 and 52 of PAIA providing for the voluntary disclosure of categories of records
• The notices issued in terms of sections 22 and 54 of PAIA regarding fees to be paid in relation to requests for access
• The regulations made in terms of section 92 of PAIA

4.1. The manner and form of a request

The manner and form of a request for access to a record of a public body is contemplated in section 11³ and for access to a record of a private body is contemplated in section 50⁴. The assistance available can be from the IO of a public body in terms of PAIA and POPIA or the assistance available from the Regulator in terms of PAIA and POPIA.

All remedies in law regarding an act or failure to act in respect of a right or duty conferred or imposed by PAIA and POPIA are available, including the manner of lodging –

• An internal appeal (applicable to public bodies only; there is no internal appeal against a decision of a private body such as Numeral Limited)
• A complaint to the Regulator
• An application with a court against a decision by the information officer of a public body, a decision on internal appeal or a decision by the Regulator or a decision of the head of a private body

The requester must complete Form 2 (Request for Access to Record) prescribed by the Regulations and submit it to the Information Officer of Numeral Limited, together with the prescribed request fee where applicable (see Annexure B). A personal requester, i.e. a person requesting a record containing their own personal information, does not pay the request fee. In terms of section 23 of POPIA, a data subject may also, free of charge and on adequate proof of identity, ask Numeral Limited to confirm whether it holds personal information about them.

The form must be submitted to the Information Officer of Numeral Limited at the e-mail address or either of the addresses set out in section 3.

4.2. How to obtain access to the guide

Members of the public can inspect or make copies of the Guide from the offices of Numeral Limited, from the Information Officer, during normal working hours.

The guide can also be obtained from the Regulator’s website or by contacting the Regulator:

A copy of the Guide is also available in the following two official languages, for public inspection during normal office hours:

5. Processing of personal information and POPIA

5.1. Purpose of processing personal information

We will collect the minimum required information from you, and we will process your personal information only for the purposes for which it was collected or as agreed with you. These purposes include (this list of processing purposes is non-exhaustive):

5.2. Description of data subjects and their respective categories including information in relation to those data subjects

The categories of data subjects in respect of whom Numeral Limited processes personal information and the nature or categories of the personal information being processed are summarized here below:

5.3. The recipients or categories of recipients to whom the personal information may be supplied in relation to those data subjects

The persons or categories of persons to whom Numeral Limited may supply personal information are summarised below:

5.4. The following company records are confirmed as either available on our website or available upon request

5.5. The following subjects and categories of records are held at the physical address of Numeral Limited

Personal information is held only for the purpose for which it was collected. A data subject may request the correction or deletion of their personal information in terms of section 24 of POPIA, unless Numeral Limited is required by law to retain it.

Numeral Limited concludes written agreements with operators (outsourced service providers) that process personal information on its behalf, requiring them to establish and maintain appropriate security safeguards, as required by sections 20 and 21 of POPIA.

5.6. Recipients to whom personal information will be supplied

Depending on the nature of the data, Numeral Limited may supply information or records to the following recipients:

5.7. Planned transborder flows of personal information

Numeral Limited is incorporated in Mauritius, and personal information collected in South Africa may therefore be transferred to and processed in Mauritius. Numeral Limited and the companies within its group may also, from time to time, transfer personal information across the borders of the Republic of South Africa. Such transfers will only take place where they are necessary for business operations, regulatory compliance, or where service providers or group companies are located in other jurisdictions.

Personal information may be transferred to and/or accessed in the following jurisdictions where the group has operations or related entities:

• Namibia
• Botswana
• Zimbabwe
• Mozambique
• Zambia
• Democratic Republic of Congo (DRC)
• Mauritius
• United Arab Emirates (UAE)

All such transfers will be carried out in accordance with section 72 of POPIA, which permits such transfers only where, among other things, the recipient is subject to a law, binding corporate rules or a binding agreement that provides an adequate level of protection, the data subject consents, or the transfer is necessary for the performance of a contract with the data subject, and, where applicable, the relevant data protection laws of the destination country. Numeral Limited ensures that adequate safeguards are implemented to protect the integrity, security, and confidentiality of personal information in the course of such transfers.

5.8. Grounds for refusal of access to records

In terms of Chapter 4 of Part 3 of PAIA, Numeral Limited must or may refuse a request for access on the following grounds:

1. Mandatory protection of the privacy of a third party who is a natural person (section 63)

Numeral Limited must refuse a request if disclosure would involve the unreasonable disclosure of personal information about a third party, including a deceased individual.

2. Mandatory protection of commercial information of a third party (section 64)

Numeral Limited must refuse a request if the record contains (a) trade secrets of a third party; (b) financial, commercial, scientific or technical information of a third party, other than trade secrets, the disclosure of which would be likely to cause harm to the commercial or financial interests of that third party; or (c) information supplied in confidence by a third party, the disclosure of which could reasonably be expected to put that third party at a disadvantage in contractual or other negotiations, or to prejudice it in commercial competition.

3. Mandatory protection of certain confidential information of a third party (section 65)

Numeral Limited must refuse a request if disclosure would constitute an action for breach of a duty of confidence owed to a third party in terms of an agreement.

4. Mandatory protection of the safety of individuals, and protection of property (section 66)

Numeral Limited must refuse a request if disclosure could reasonably be expected to endanger the life or physical safety of an individual. It may refuse a request if disclosure would be likely to prejudice or impair the security of a building, structure or system (including a computer or communication system), or the methods or systems used to protect individuals or property.

5. Mandatory protection of records privileged from production in legal proceedings (section 67)

Numeral Limited must refuse a request if the record is privileged from production in legal proceedings, unless the person entitled to the privilege has waived it.

6. Commercial information of Numeral Limited (section 68)

Numeral Limited may refuse a request if the record contains its trade secrets; financial, commercial, scientific or technical information the disclosure of which would be likely to cause harm to its commercial or financial interests; information the disclosure of which could reasonably be expected to put it at a disadvantage in negotiations or prejudice it in commercial competition; or a computer program owned by Numeral Limited.

7. Research information of a third party and of Numeral Limited (section 69)

Numeral Limited must refuse a request if the record contains information about research being or to be carried out by or on behalf of a third party, the disclosure of which would be likely to expose the third party, a person carrying out the research, or the subject matter of the research to serious disadvantage. It may refuse a request on the same basis for research by or on behalf of Numeral Limited.

Mandatory disclosure in the public interest (section 70)

Despite the grounds above, Numeral Limited must grant access to a record if its disclosure would reveal evidence of a substantial contravention of, or failure to comply with, the law, or an imminent and serious public safety or environmental risk, and the public interest in disclosure clearly outweighs the harm contemplated by the relevant ground.

5.9. Remedies available when Numeral Limited refuses a request for information

Numeral Limited will, within 30 days of receipt of a request, decide whether to grant or to decline that request and give notice with reasons. If no decision is given within this period, the request is deemed to have been refused (section 58 of PAIA).

6. Records required in terms of legislation

Records are kept in accordance with legislation applicable to Numeral Limited, which includes but is not limited to, the following –

Reference to the above-mentioned legislation shall include subsequent amendments

and secondary legislation to such legislation.

7. Availability of the manual

A copy of the manual is available:

• On our website https://numeral.co.za/
• At our Head Office for public inspection during normal business hours.
• To any person upon request and upon payment of a reasonable amount (the prescribed reproduction fee).
• To the Information Regulator upon request.

⁵The fees payable in respect of a request for access to a record of a private body are prescribed in Annexure B, Part III of the Regulations Relating to the Promotion of Access to Information, 2021 (GN R757 in GG 45057 of 27 August 2021), and are set out in Annexure B to this manual. Where a request fee is payable, the Information Officer will notify the requester in writing to pay it before processing the request (section 54(1) of PAIA).

No request fee is payable by a personal requester. This manual is available free of charge on the website; a printed copy may be obtained at the prescribed reproduction fee of R2.00 per A4 page or part thereof. The fee for searching for and preparing a record for disclosure is R145.00 for each hour or part of an hour, excluding the first hour, reasonably required, up to a maximum of R435.00.

For the purposes of Section 54(2) of the Act, the following applies:

• Six hours as the hours to be exceeded before a deposit is payable.
• One third of the access fee is payable as a deposit by the requester.
• The actual cost of postage, e-mail or other electronic transfer (if any) is payable.
• Fees are subject to amendment by the Minister by notice in the Government Gazette.

In terms of section 17 of POPIA, Numeral Limited, as a responsible party, maintains documentation of all processing operations under its responsibility, as referred to in section 51 of PAIA.

8. Amendments and proposed changes

This manual has been drafted and implemented according to legislation. The manual will be reviewed and amended according to legislation. The head of Numeral Limited will update this manual on a regular basis but no less than annually. Section 51(2) states that the head of a private body must on a regular basis update the manual referred to in subsection (1).

Section 51(3) states that the updated version thereof as referred to in subsection (2) must be made available—

1. on the web site, if any, of the private body;
2. at the principal place of business of the private body for public inspection during normal business hours;
3. to any person upon request and upon the payment of a reasonable amount; and
4. to the Information Regulator upon request.

9. Information security measures

Condition 7 of POPIA (security safeguards, sections 19 to 22) requires a responsible party to secure the integrity and confidentiality of personal information in its possession or under its control by taking appropriate, reasonable technical and organisational measures, and to notify the Regulator and affected data subjects of any security compromise. Numeral Limited takes extensive security measures to ensure the confidentiality, integrity and availability of personal information in our possession.

At Numeral Limited we have taken reasonable technical & organisational measures to implement, maintain, and prevent loss of, damage to, or unauthorized destruction of, or unlawful access to, personal information. Numeral Limited takes appropriate technical and organisational measures designed to ensure that personal data remains confidential and secure against unauthorized or unlawful processing and against accidental loss, destruction or damage.

Measures we have undertaken include:

• Technical safeguards: Implementing measures like encryption, firewalls, and intrusion detection systems.
• Physical safeguards: Protecting physical access to data storage and processing facilities.
• Organizational safeguards: Establishing policies, procedures, and training programs to ensure compliance. We require the use of strong passwords, multi-factor authentication, and regularly updating security software.

• Data Inventory: Regularly conducting a data inventory to identify and document all the personal information Numeral Limited processes.

Numeral Limited treats all personal information with the utmost confidentiality. Any personal information which comes to anyone in the organisation’s knowledge in the course of their duties and responsibilities, is handled appropriately during and after their employment.

As per Condition 5 of POPIA, Numeral Limited has taken steps to ensure that personal information records are complete, accurate and up to date. Data subjects may request access to their personal information held by Numeral Limited (section 23 of POPIA), request its correction or deletion (section 24 of POPIA, using Form 2 of the POPIA Regulations), or object to its processing (section 11(3) of POPIA, using Form 1 of the POPIA Regulations), by contacting the Information Officer at the details in section 3.

Annexure A – personal information that may be processed

Annexure B – fees payable in respect of private bodies