This manual has been prepared in terms of the section 51 of the Promotion of Access to Information Act 2 of 2000 and to address the requirements of the Protection of Personal Information Act 4 of 2013.

Table of Contents

1. DEFINITIONS
2. INTRODUCTION
3. CONTACT DETAILS
4. GUIDE OF INFORMATION REGULATOR
5. LATEST NOTICES IN TERMS OF SECTION 52(2) OF PAIA
6. AVAILABILITY OF CERTAIN RECORDS IN TERMS OF PAIA
7. RECORDS AVAILABLE IN TERMS OF OTHER LEGISLATION
8. REQUEST PROCESS
9. GROUNDS FOR REFUSAL
10. REMEDIES SHOULD A REQUEST BE REFUSED
11. FEES
12. POPI

1. DEFINITIONS

Any other terms not described herein will have the meaning as ascribed to it in terms of PAIA or POPI.

2. INTRODUCTION

1. For the purpose of POPI and PAIA, the Company is defined as a private body. In accordance with the Company’s obligations in terms of POPI and PAIA, the Company has produced this manual.
2. This manual sets out all information required by both PAIA and POPI.
3. This manual also deals with how requests are to be made in terms of PAIA.
4. This manual also establishes how compliance with POPI is to be achieved.

3. CONTACT DETAILS

Background information of how the Company processes information can be found at: https://www.hcma.co.za/

4. GUIDE OF INFORMATION REGULATOR 

1. A guide to PAIA and how to access information in terms of PAIA has been published pursuant to section 10 of PAIA.
2. The guide contains information required by an individual who may wish to exercise their rights in terms of PAIA.
3. Should you wish to access the guide you may request a copy from the Information Officer by submitting ANNEXURE A, attached hereto, to the details specified above.
4. You may also inspect the guide at the Company’s offices during ordinary working hours.
5. You may also request a copy of the guide from Information Regulator at the following details:

Information Regulator:

Postal Address: P O Box 31533, Braamfontein, Johannesburg, 2017

Telephone: +27 (10) 023-5200

Website: www.justice.gov.za

Email: PAIAComplaince.IR@justice.gov.za

5. LATEST NOTICES IN TERMS OF SECTION 52(2) OF PAIA

1. At this stage no Notice(s) has/have been published on the categories of records that are available without having to request access to them in terms of PAIA.

6. AVAILABILITY OF CERTAIN RECORDS IN TERMS OF PAIA

1. The Company holds and/or process the following records for the purposes of PAIA and POPI.
2. The following records may be requested; however, it should be noted that there is no guarantee that the request will be honoured. Each request will be evaluated in terms of PAIA and any other applicable legislation.

Products and/or Services:

• All products and/or services are available freely on the Company’s website as set out above.

Human Resources:

• Employment Contracts
• Employee Benefits
• Personnel Records and Correspondence
• Training Records
• Internal Policies
• Information pertaining to share options, share incentives, bonus or profit-sharing agreements of each employee
• Pension and Provident Fund Records

Legal:

• Agreements with Clients
• Agreement with Suppliers
• Licenses and Permits 
• Power of Attorneys 
• Sale Agreements 
• Lease Agreements

Company Secretarial:

• Memorandum of Incorporation 
• Secretarial Records
• Tradename Registrations 
• Trademark Registrations
• Company Registration Documents 
• Statutory Registers 
• Minutes of Shareholder’s meetings 
• Minutes of Director’s meetings
• Register of Directors
• Share Certificates

Financial:

• Accounting Records
• Annual Reports 
• Interim Reports 
• Auditor Details and Reports
• Tax Returns
• Insurance Records

Client:

• Client Database
• Credit Applications 
• Correspondence with Clients 
• Documentation prepared for Clients. 
• Invoices, receipts, credit and debit notes

Marketing:

• Published Marketing Material

Miscellaneous:

• Internal Correspondence 
• Information Technology Records
• Trade secrets 
• Domain Name Registrations
• Website Information
• Asset Registers
• Title Deeds

7. RECORDS AVAILABLE IN TERMS OF OTHER LEGISLATION

1. Basic Conditions of Employment Act, No. 75 of 1997
2. Companies Act, No. 71 of 2008
3. Compensation for Occupational Injuries and Diseases Act, No. 130 of 1993
4. Competition Act, No. 89 of 1998
5. Consumer Protection Act, No. 68 of 2008
6. Customs and Excise Act No. 91 of 1964
7. Electronic Communication and Transactions Act, No. 25 of 2002
8. Employment Equity Act, No. 55 of 1998
9. Identification Act, No. 68 of 1997
10. Income Tax Act, No. 58 of 1962
11. Intellectual Property Laws Amendment Act No.38 of 1997
12. National Credit Act, No. 34 of 2005
13. National Payment Systems Act No. 78 of 1998
14. Occupational Health and Safety Act No. 85 of 1993
15. Patents, Designs and Copyright Merchandise Marks Act, No. 17 of 1941
16. Pension Funds Act, No. 24 of 1956
17. Promotion of Access to Information Act, No. 2 of 2000
18. Protection of Personal Information Act, No. 4 of 2013
19. Road Transportation Act No. 74 of 1977
20. Skills Development Levies Act, No. 9 of 1999
21. The Labour Relations Act, No. 66 of 1995
22. Trademark Act No. 194 of 1993
23. Unemployment Insurance Act, No. 63 of 2001
24. Value Added Tax Act, No. 89 of 1991

*Although we have used our best endeavours to supply a list of applicable legislation, it is possible that this list may be incomplete. Whenever it comes to our attention that existing or new legislation allows a Requester access on a basis other than as set out in PAIA, we shall update the list accordingly. If a Requester believes that a right of access to a record exists in terms of other legislation listed above or any other legislation, the Requester is required to indicate what legislative right the request is based on, to allow the Information Officer the opportunity of considering the request in light thereof.

8. REQUEST PROCESS

1. An individual who wishes to place a request must comply with all the procedures laid down in PAIA.
2. The requester must complete ANNEXURE B, which is attached hereto and submit it to the Information Officer at the details specified above.
3. The prescribed form must be submitted as well as payment of a request fee and a deposit, if applicable to the information officer at the postal or physical address, fax number or electronic mail as is stated herein.
4. The prescribed form must be completed with enough particularity to enable the information officer to determine:
   1. The record(s) requested;
   2. The identity of the requestor;
   3. What form of access is required; and
   4. The Postal address or fax number of the requestor.
5. The requestor must state that the records are required for the requestor to exercise or protect a right, and clearly state what the nature of the right is so to be exercised or protected. An explanation of why the records requested is required to exercise or protect the right.
6. The request for access will be dealt with within 30 days from date of receipt, unless the requestor has set out special grounds that satisfies the Information Officer that the request be dealt with sooner.
7. The period of 30 days may be extended by not more than 30 additional days, if the request is for a large quantity of information, or the request requires a search for information held at another office of the Company and the information cannot be reasonably obtained within 30 days. The information officer will notify the requestor in writing should an extension be necessary.
8. The Information Officer must communicate a response to the request for access using “Annexure E”, this communication shall inform the requestor of: 
   1. The decision;
   2. Fees payable in terms of paragraph 11.
9. In the event that the Information Officer is of the opinion that the searching and preparation of the record for disclosure would amount to more than 6 hours, he/she shall inform the requestor to pay a deposit not exceeding one third of the amount payable.
10. Should the requestor have any difficulty with the form or the process laid out herein, the requestor should contact the Information Officer for assistance.
11. An oral request can be made to the Information Officer should the requestor be unable to complete the form due to illiteracy or a disability. The Information Officer will complete the form on behalf of the requestor and provide a copy of the form to the requestor. 

9. GROUNDS FOR REFUSAL

1. The following are grounds upon which the Company may, subject to the exceptions in Chapter 4 of PAIA, refuse a request for access in accordance with Chapter 4 of PAIA:
   1. Mandatory protection of the privacy of a third party who is a natural person, including a deceased person, where such disclosure of Personal Information would be unreasonable.
   2. Mandatory protection of the commercial information of a third party, if the Records contain:
      1. Trade secrets of that third party;
      2. Financial, commercial, scientific or technical information of the third party, the disclosure of which could likely cause harm to the financial or commercial interests of that third party; and/or
      3. Information disclosed in confidence by a third party to The Company, the disclosure of which could put that third party at a disadvantage in contractual or other negotiations or prejudice the third party in commercial competition;
   3. Mandatory protection of confidential information of third parties if it is protected in terms of any agreement;
   4. Mandatory protection of the safety of individuals and the protection of property;
   5. Mandatory protection of Records that would be regarded as privileged in legal proceedings;
   6. Protection of the commercial information of the Company, which may include:
      1. Trade secrets;
      2. Financial/commercial, scientific or technical information, the disclosure of which could likely cause harm to the financial or commercial interests of the Company;
      3. Information which, if disclosed, could put the Company at a disadvantage in contractual or other negotiations or prejudice the Company in commercial competition; and/or
      4. Computer programs which are owned by the Company, and which are protected by copyright and intellectual property laws;
   7. Research information of the Company or a third party, if such disclosure would place the research or the researcher at a serious disadvantage; and
   8. Requests for Records that are clearly frivolous or vexatious, or which involve an unreasonable diversion of resources.

10. REMEDIES SHOULD A REQUEST BE REFUSED

1. The Company does not have an internal appeal procedure in light of a denial of a request, decisions made by the information officer is final.
2. The requestor may in accordance with sections 56(3) (c) and 78 of PAIA, apply to a court for relief within 180 days of notification of the decision for appropriate relief.

11. FEES

1. The following fees shall be payable upon request by a requestor:

12. POPI

1. Conditions fort lawful processing:
   1. POPI has eight conditions for lawful processing and includes:
      1. Accountability
      2. Processing limitation
      3. Purpose specification
      4. Further processing limitation
      5. Information quality
      6. Openness
      7. Security safeguards
      8. Data subject participation
   2. The Company is involved in the following types of processing:
      1. Collection
      2. Recording
      3. Organization
      4. Structuring
      5. Storage
      6. Adaptation or alteration
      7. Retrieval
      8. Consultation
      9. Use
      10. Disclosure by transmission
      11. Dissemination or otherwise making available
      12. Alignment or combination
      13. Restriction
      14. Erasure
      15. Destruction
   3. The Company processes information for the following purposes:
      1. To fulfil agreements in relation to its employees;
      2. to provide services to its Clients in accordance with terms agreed to 

by the Clients;

1. to undertake activities related to the provision of services, such as
   1. to fulfil domestic legal, regulatory and compliance requirements;
   2. to verify the identity of Customer representatives who contact the Company or may be contacted by The Company;
   3. for risk assessment, information security management, statistical, trend analysis and planning purposes;
   4. to monitor and record calls and electronic communications with the Client for quality, training, investigation and fraud prevention purposes;
   5. to enforce or defend the Company or the Company affiliates’ rights;

1. to manage the Company’s relationship with its clients, which may include providing information to its clients and its clients affiliates about the Company’s and the Company affiliates’ products and services;

1. the purposes related to any authorised disclosure made in terms of 

agreement, law or regulation;

1. any additional purposes expressly authorised by the Company’s 

client;

1. any additional purposes as may be notified to the Client or Data 

Subjects in any notice provided by the Company.

1. The Company processes personal information the following categories of Data Subjects:
   1. Juristic persons – 
      1. Corporate Clients
      2. Suppliers
   2. Natural persons –
      1. Individuals
      2. Staff
      3. Clients
      4. Suppliers
2. The Company process the following categories personal information:
   1. Client profile information;
   2. Bank account details;
   3. Payment information;
   4. Client representatives;
   5. Names;
   6. Email addresses;
   7. Telephone numbers;
   8. Facsimile numbers;
   9. Physical addresses;
   10. Tax numbers;
   11. Identity numbers;
   12. Passport numbers;
3. Recipients of Personal Information;
   1. The Company, the Company’s affiliates, their respective representatives.
4. When making authorised disclosures or transfers of personal information in terms of Section 72 of POPI, personal information may be disclosed to recipients in countries that do not have the same level of protection for personal information as South Africa does.
5. The following Security measures are implemented by the Company:
6. The Company implements numerous Security measures to protect personal information that is stored electronically and physically.
   1. The Company ensures that appropriate security measures are taken and updates these measures on a regular basis.

1. The Company have also implemented various policies for additional security for personal information stored both physically and electronically.

1. The personal information that is stored physically is protected as follows:
   1. Where physical records of the data exist, such records will be stored in a secure area that can be ‘locked-away’ as to avoid a breach of the personal information.
   2. Such physical data records will be ‘locked-away’ and secured when not in use.
2. The Company may share personal information with third parties and in certain instances this may result in cross border flow of the personal information. The personal information will always be subject to protection, not less than the protection it is afforded under the Protection of Personal Information Act No.4 of 2013.
3. Objection to the processing of personal information by a data subject:
   1. Section 11(3) of POPI and regulation 2 of the POPI regulations provides that a 

data subject may, at any time object to the processing of their personal information in the prescribed form attached to this manual as ANNEXURE “C”.

1. Request for correction or deletion of personal information:
   1. Section 24 of POPI and regulation 3 of the POPI regulations provides that a 

data subject may request for their personal information to be corrected and/or deleted in the prescribed form attached hereto as ANNEXURE “D”.

1. Regulation 8 of the POPI regulations provides for requests the outcomes of      

         requests and of fees payable in the prescribed form attached hereto as 

         ANNEXURE “E”.

SIGNATURE INFORMATION

OFFICER :

DATE :

ANNEXURE A

FORM 1

REQUEST FOR A COPY OF THE GUIDE

[Regulations 3]

TO: The Information Officer

I,

Hereby request the following copy(ies) of the Guide:

Manner of Collection (mark with “X”):

Signed at this day of 20 .

Signature of Requester

ANNEXURE B

FORM 2

REQUEST FOR ACCESS TO RECORD

[Regulations 7]

NOTE:

• Proof of identity must be attached by the requester.

• If requests made on behalf of another person, proof of such authorisation, must be attached to this form.

TO: The Information Officer

(Address)

E-mail Address:

Fax Number:

Mark with an ”X”

☐     Request is made in my own name ☐    Request is made on behalf of another person

You will be notified in writing whether your request has been approved or denied and if approved the costs relating to your request, if any.  Please indicate your preferred manner of correspondence:

Signed at this day of 20 .

Signature of Requester / Person on whose behalf request is made

FOR OFFICAL USE

Signature of Information Officer

ANNEXURE C

FORM 1

OBJECTION TO THE PROCESSING OF PERSONAL INFORMATION
IN TERMS OF SECTION 11(3) OF THE
PROTECTION OF PERSONAL INFORMATION ACT, 2013 (ACT NO. 4 OF 2013)

REGULATIONS RELATING TO THE PROTECTION OF PERSONAL INFORMATION, 2017
[Regulation 2(1)]

Note:

• Affidavits or other documentary evidence in support of the objection must be attached.

• If the space provided for in this Form is inadequate, submit information as an Annexure to this Form and sign each page.

Reference Number ________________

Signed at this day of 20 .

_____

Signature of Data Subject (Applicant) 

ANNEXURE D

FORM 2

REQUEST FOR CORRECTION OR DELETION OF PERSONAL INFORMATION OR DESTROYING OR DELETION OF RECORD OF PERSONAL INFORMATION IN TERMS OF SECTION 24(1) OF THE PROTECTION OF PERSONAL INFORMATION ACT, 2013 (ACT NO.4 OF 2013)

REGULATIONS RELATING TO THE PROTECTION OF PERSONAL INFORMATION, 2017

[Regulation 3(2)]

NOTE:

• Affidavits or other documentary evidence in support of the request must be attached.

• If the space provided for in this Form is inadequate, submit information as an Annexure to this Form and sign each page.

Reference Number ________________

Mark the appropriate box with an “x”

• Request For: 

Correction or deletion of personal information about the data subject which is in possession or under the control of the responsible party.

Destroying or deletion of a record of personal information about the data subject which is in possession or under the control of the responsible party and who is no longer authorized to retain the record of information. 

Signed at this day of 20 .

_____

Signature of Data Subject

ANNEXURE E

FORM 3

OUTCOME OF REQUEST AND OF FEES PAYABLE

[Regulation 8]

• If your request is granted – 

• Amount of the deposit, if any, is payable before your request is processed; and Requested record/ portion of the record will only be released once proof of full payment is received. 

• Please use the reference number hereunder in all future correspondence.

Reference number: __________________________

TO: _________________________________

_________________________________

_________________________________

_________________________________

Your request dated________________ refers 

• You Requested 

OR

• You Requested 

• To be Submitted 

Kindly note that your request has been:

Approved 

Denied, for the following reasons:

• Fees payable with regards to your request: 

• Deposit payable (if search exceeds six hours):

Yes

No

The amount must be paid into the following Bank account:

Signed at this day of 20  

Information officer