PAIA POLICY

Last updated: January 26, 2024

1. INTRODUCTION
2. COMPANY CONTACT DETAILS (SECTION 51(1)(a))
3. THE ACT
   1. GUIDE ON HOW TO USE PAIA
   2. GUIDE ON HOW TO USE POPIA
4. PROTECTION OF PERSONAL INFORMATION THAT IS PROCESSED BY KIBO
5. PURPOSE OF THE PROCESSING OF PERSONAL INFORMATION BY KIBO
6. CATEGORIES OF DATA SUBJECTS AND PERSONAL INFORMATION / SPECIAL PERSONAL INFORMATION RELATING THERETO:
7. APPLICABLE LEGISLATION (SECTION 51(1)(c))
8. KIBO RECORDS (SECTION 51(1)(b))
   1. COMPANY RECORD CLASSIFICATION KEY
   2. KIBO RECORDS AVAILABILITY
9. THE REQUEST PROCEDURES
   1. WHO MAY REQUEST INFORMATION
   2. FORM REQUEST (SECTION 53)
   3. PRESCRIBED FEE (SECTION 54)
10. FREE STRUCTURE
11. NOTIFICATION
12. GROUNDS FOR REFUSAL OF ACCESS TO RECORDS
13. APPEAL

1. INTRODUCTION

Kibo Computer Services (Proprietary) Limited (“Kibo”) is a company incorporated in terms of the Companies Act No. 71 of 2008, as amended, with registration number: 2006/012475/07. There is huge value in an organisation where employees have an understanding of their role, what is expected of them, and what the organisation is driving towards. We are a catalyst for this.

2. COMPANY CONTACT DETAILS (SECTION 51(1)(a))

3. THE ACT

The Promotion of Access to Information Act No. 2 of 2000 (“PAIA”) is South Africa’s access to information law and it enables people to gain access to information held by both public and private bodies. All organisations in South Africa must comply with it.

PAIA was enacted in accordance with Section 32 of the Constitution of the Republic of South Africa 1996, which provides that legislation must be enacted to give effect to the right of access to information held by the private sector or public bodies, if the record or Personal Information is required for the exercise or protection of any rights unless the Act expressly states that the records containing such information may or must not be released. The purpose of which is to promote transparency, accountability and effective governance of all public and private bodies.

This Promotion of Access to Information Manual (“PAIA Manual”) provides an outline of the type of records and the Personal Information Kibo holds and explains how to submit requests for access to these records in terms of PAIA. In addition, it explains how to access and/or object to Personal Information held by Kibo, and/or request the correction and/or deletion of the Personal Information in terms of Sections 23 and 24 of the Protection of Personal Information Act No. 4 of 2013 (“POPIA”).

A copy of this PAIA Manual can be requested from the Information Officer or Deputy Information Officer (see contact details above).

A copy of this PAIA Manual can be requested from the Information Officer or Deputy Information Officer (see contact details above).

4. PROTECTION OF PERSONAL INFORMATION THAT IS PROCESSED BY KIBO

Chapter 3 of POPIA provides for the minimum Conditions for lawful processing of Personal Information by Kibo. These Conditions may not be derogated from unless specific exclusions apply as outlined in POPIA.

Kibo requires Personal Information relating to both individual and juristic persons in order to carry out its business and organisational functions. The manner in which this information is processed and the purpose for which it is processed is determined by Kibo. Kibo is accordingly the Responsible Party for the purpose of POPIA and shall ensure that the Personal Information of a Data Subject:

1. is processed lawfully, fairly and transparently. This includes the provision of appropriate information to Data Subjects when their data is collected by Kibo, in the form of privacy or data collection notices. Kibo must also have a legal basis (for example, consent) to process Personal Information;
2. is processed only for the purposes for which it was collected;
3. will not be processed for a secondary purpose unless that processing is compatible with the original purpose;
4. is adequate, relevant and not excessive for the purposes for which it was collected;
5. is accurate and kept up to date;
6. will not be kept for longer than necessary;
7. is processed in accordance with integrity and confidentiality principles. This includes physical and organisational measures to ensure that Personal Information, in both physical and electronic form, are subject to an appropriate level of security when stored, used and communicated by Kibo, in order to protect against access and acquisition by unauthorised persons and accidental loss, destruction or damage;
8. is processed in accordance with the rights of Data Subjects, where applicable Data Subjects have the right to:
   1. be notified that their Personal Information is being collected by Kibo. The Data Subject also has the right to be notified in the event of a data breach;
   2. know whether Kibo holds Personal Information about them, and to access that information. Any request for information must be handled in accordance with the provisions of this PAIA Manual;
   3. request the correction or deletion of inaccurate, irrelevant, excessive, out of date, incomplete, misleading or unlawfully obtained Personal Information;
   4. object to Kibo’s use of their Personal Information and request the deletion of such Personal Information (deletion would be subject to Kibo’s record keeping requirements);
   5. object to the processing of Personal Information for purposes of direct marketing by means of unsolicited electronic communications; and
   6. complain to the Information Regulator regarding an alleged infringement of any of the rights protected under the POPI Act and to institute civil proceedings regarding the alleged non-compliance with the protection of his, her or its Personal Information.

5. PURPOSE OF THE PROCESSING OF PERSONAL INFORMATION BY KIBO

As outlined above, Personal Information may only be processed for a specific purpose. The purposes for which Kibo processes or will process Personal Information are as follows:

6. CATEGORIES OF DATA SUBJECTS AND PERSONAL INFORMATION / SPECIAL PERSONAL INFORMATION RELATING THERETO:

According to Section 1 of POPIA, a Data Subject may either be a natural or a juristic person. The table below sets out the various categories of Data Subjects that Kibo processes Personal Information on and the types of Personal Information relating thereto.

Cross-border flows of Personal Information:

Section 72 of POPIA provides that Personal Information may only be transferred out of the Republic of South Africa if the:

1. recipient country can offer such data an "adequate level" of protection. This means that its data privacy laws must be substantially similar to the Conditions for Lawful Processing as contained in POPIA; or
2. Data Subject consents to the transfer of their Personal Information; or
3. transfer is necessary for the performance of a contractual obligation between the Data Subject and the Responsible Party; or
4. transfer is necessary for the performance of a contractual obligation between the Responsible Party and a third party, in the interests of the Data Subject; or
5. transfer is for the benefit of the Data Subject, and it is not reasonably practicable to obtain the consent of the Data Subject, and if it were, the Data Subject, would in all likelihood provide such consent.

When making authorised disclosures or transfers of Personal Information in terms of section 72 of POPIA, Personal Data may be disclosed to recipients located in countries which do not offer a level of protection for those data as high as the level of protection as South Africa.

7. APPLICABLE LEGISLATION (SECTION 51(1)(c))

8. KIBO RECORDS (SECTION 51(1)(b))

9. THE REQUEST PROCEDURES

10. FREE STRUCTURE

11. NOTIFICATION

Kibo will within 30 (thirty) days of receipt of the request decide whether to grant or decline the request, may be extended for a further period of not more than 30 (thirty) days, if the request is for a large volume of information and the information cannot reasonably be obtained within the original 30 (thirty) day period. Kibo will notify the requester in writing should an extension be sought.

If the request for access to a record is successful, the requester will be notified of the following:

• The amount of the access fee payable gaining access to the record;
• An indication of the form in which the access will be granted; and
• Notice that the requester may lodge an application with a court against the payment of the access fee and the procedure, including the period for lodging the application.
• If the request for access to a record is not successful the requester will be notified of the following:
  • Adequate reasons for the refusal, and
  • That the requester may lodge an application with a court against the refusal of the request and the procedure, including the period for lodging the application.

13. APPEAL

If a requester is aggrieved by the refusal of the Information Officer to grant a request for a record, the requester may, within 30 (thirty) days of notification of the Information Officer’s decision, apply to court for appropriate relief.