Information Manual

In terms of Section 51 of The Promotion of Access to Information

Act, No. 2 of 2000, (“PAIA”), and Section 18 of The Protection of

Personal Information Act, No. 4 of 2013, (“POPI”) compiled for:

DOUGH GETTERS (PTY) LTD

with Registration Number 2017/332953/07
("the Private Body")

1.1 This Information Manual is published in terms of section 51 of the Promotion of Access to

Information Act, No. 2 of 2000 (“PAIA”), as amended by the Protection of Personal Information

Act, No. 4 of 2013, (“POPI Act”) as well as section 18 of the POPI Act.

1.2 PAIA gives effect to the provisions of Section 32 of the Constitution, which provides for the right

of access to information held by the State and to information held by another person that is

required for the exercise and/or protection of any right.

1.3 The POPI Act gives effect to the provisions of, inter alia, Section 14 of the Constitution, which

provides for the right to privacy of all persons.

1.4 The information provided in this manual includes:

1.4.1 contact details of the Head, as defined in PAIA, of the Private Body;

1.4.2 a description of the guide referred to in section 10 of PAIA, (which is a guide which

was produced by the Human Rights Commission and after 1 July 2021 shall be made

available and amended, from time to time, by the Information Regulator defined in

POPI) dealing with access to information;

1.4.3 a description of the records of the Private Body which are available in terms of any

legislation other than the PAIA;

1.4.4 a description of the subjects on which the Private Body holds records and the

categories of records held on each subject;

1.4.5 a description of the subjects on which the Private Body holds personal information

and the categories of personal information held on each subject;

1.4.6 the purpose of processing personal information;

1.4.7 the recipients to whom the personal information may be supplied;

1.4.8 planned transborder flows of information (if applicable);

1.4.9 a general description of the security measures in place to ensure the confidentiality,

integrity, and availability of the information to be processed;



Information Manual in terms of Section 51 of The Promotion of Access to Information Act, No 2 of 2000 and Section 18 of

The Protection of Personal Information Act, No. 4 Of 2013

1.4.10 sufficient information so as to facilitate a request for access to a record of the Private

Body;

1.4.11 a privacy and POPIA policy.

1.5 The reference to any information in addition to that specifically required in terms of section 51

of PAIA and section 18 of the POPI Act does not create any right or entitlement (contractual or

otherwise) to receive such information, other than in terms of PAIA and the POPI Act.

1.6 The main aim of this manual is to:

1.6.1 disclose the types of records held by the Private Body and to facilitate the requests

for access to records of the Private Body, as permitted by PAIA (dealt with in Part A

hereof);

1.6.2 make data subjects aware of the type and source of information being collected, the

purpose of collecting and processing such information and related matters(dealt with

in Part B hereof).



This manual may be updated from time to time and shall be made available on the Private Body’s

website and/or at its principal place of business, to any person on request, subject to the

payment of a reasonable fee and to the Information Regulator.

2.1 In this document, clause headings are for convenience and shall not be used in its interpretation

unless the context clearly indicates a contrary intention:

2.2 An expression which denotes -

2.2.1 any gender includes the other genders;

2.2.2 a natural person includes an artificial or juristic person and vice versa;

2.2.3 the singular includes the plural and vice versa;

2.3 The following expressions shall bear the meanings assigned to them below and similar

expressions bear corresponding meanings:

2.3.1 "data subject" means the person to whom personal information relates;

2.3.2 "Personal Information" means information relating to an identifiable living, natural person,

and where it is applicable, an identifiable existing juristic person;

2.3.3 "this document" or "this manual" means this information manual, together with all of its

annexures, as amended from time to time;

2.3.4 "the Private Body" means the private body to which this manual applies with their details as

they appear on the front page of this manual;

2.3.5 "requester" means a person or entity requesting access to a record that is under the control

of the Private Body.

2.4 Any reference to any statute, regulation or other legislation shall be a reference to that statute,

regulation or other legislation as at the signature date, and as amended or substituted from time

to time;

2.5 If any provision in a definition is a substantive provision conferring a right or imposing an

obligation on any party then, notwithstanding that it is only in a definition, effect shall be given

to that provision as if it were a substantive provision in the body of this manual;

2.6 Where any term is defined within a particular clause other than this, that term shall bear the

meaning ascribed to it in that clause wherever it is used in this manual;

2.7 Where any number of days is to be calculated from a particular day, such number shall be

calculated as excluding such particular day and commencing on the next day. If the last day of

such number so calculated falls on a day which is not a business day, the last day shall be deemed

to be the next succeeding business day;

2.8 Any reference to days (other than a reference to business days), months or years shall be a

reference to calendar days, months or years, as the case may be or as is otherwise defined in

any legislation;

2.9 The use of the word "including" followed by a specific example/s shall not be construed as

limiting the meaning of the general wording preceding it and the eiusdem generis rule shall not

be applied in the interpretation of such general wording or such specific example/s;

2.10 Insofar as there is a conflict in the interpretation of or application of this manual and PAIA or the

POPI Act, PAIA or the POPI Act shall prevail;

2.11 This manual does not purpot to be exhaustive of or comprehensively deal with every procedure

provided for in PAIA or all rights listed under the POPI Act. The reader relying on any provisions

of this Manual is advised to familiarise his/her/itself with the provisions of PAIA and the POPI

Act.

3.1 Head and deputy Information Officer, (defined in POPIA), of the Private Body: Willem Haarhoff.

3.1.1 Postal Address of Head of the Private Body: 162 Mitchell Street, Bergsig, George, 6529.

3.1.2 Street Address of Head of the Private Body: 162 Mitchell Street, Bergsig, George, 6529.

3.1.3 Telephone Number of Head of the Private Body: 076 440 0832.

3.1.4 Email of Head of the Private Body: willem@doughgetters.co.za.

3.2 Information Officer, (defined in POPIA), of the Private Body: Michiel Heyns Claassen

3.2.1 Postal Address: 162 Mitchell Street, Bergsig, George, 6529.

3.2.2 Street Address: 162 Mitchell Street, Bergsig, George, 6529.

3.2.3 Telephone Number: 082 472 1527.

3.2.4 Email: michiel@doughgetters.co.za.

3.3 The Act stipulates the following general responsibilities of the Information Officer: (1) to

encourage compliance with POPIA, (2) dealing with requests made to the Private Body in relation

to POPIA, (for instance, requests from Data Subjects to update or view their Personal

Information), (3) working with the Regulator in relation to investigations, (4) otherwise ensuring

compliance with POPIA, (5) as may be prescribed (i.e. keep an eye on the Regulator’s website).



3.4 Information Officers need to be registered with the Regulator before taking up their duties.

PART A: PROMOTION OF ACCESS TO

INFORMATION

4.2 The contact details of the HRC are as follows:

4.2.1 Postal address: Private Bag 2700, Houghton, 2041

4.2.2 Telephone: +27 11 484 8300

4.2.3 Telefax: +27 11 484 0582

4.2.4 Website: www.sahrc.org.za

4.2.5 Email: paia@sahrc.org.za

4.3 The guide is also available electronically at

https://www.sahrc.org.za/home/21/files/Section%2010%20guide%202014.pdf

4.4 With effect from 1 July 2021, the Information Regulator, (“IR”) must update and make available

the existing guide that had previously been compiled by the HRC containing information in an

easily comprehensible form and manner as may reasonable be required by a person who wishes

to exercise any right contemplated in PAIA and POPI.

4.5 The contact details of the IR are as follows:

4.5.1 Physical address: Braampark, Forum 3, 33 Hoof Street, Braampark, Johannesburg, 2017

4.5.2 Postal Address: P.O Box, 31533

4.5.3 Telephone: +27 10 023 5200

4.5.4 Telefax: +27 86 500 3351

4.5.5 Website: www.justice.gov.za/inforeg/contact.html

4.5.6 Email: inforeg@justice.gov.za.

5.1 Some of the records held by the Private Body are available in terms of legislation other than PAIA

or POPI, which legislation is listed below. Records that must be made available in terms of these

Acts shall be made available in terms of the requirements of PAIA and this manual. That

legislation includes:

5.1.1 The Companies Act, No. 71 Of 2008

5.1.2 Income Tax Act, No. 58 Of 1962

5.1.3 Value Added Tax Act, No. 89 Of 1991

5.1.4 Labour Relations Act, No. 66 Of 1995

5.1.5 Basic Conditions of Employment Act, No. 75 Of 1997

5.1.6 Skills Development Levies Act, No. 9 Of 1999

5.1.7 Unemployment Insurance Act, No. 63 Of 2001

5.1.8 Any Other Industry Applicable Legislation.

6.1 The Private Body holds various records. The subjects on which the Private Body holds records

and the categories of records held by the Private Body are reproduced in the tables below.

6.2 The listing of a category or subject matter in this manual does not guarantee access to such

records. All requests for access will be evaluated on a case-by-case basis in accordance with the

provisions of PAIA and other applicable legislation. A request for records shall be made in the

prescribed form set out later in this manual under the heading “FORM OF REQUEST FOR RECORDS”.

7.1 A request for records shall be accompanied by adequate proof of identity of the applicant, (such

as a certified copy of his/her identity document), and made using the prescribed form, a copy of

which is attached hereto and marked annexure "A" ("the prescribed form"). The prescribed form

is also available from the website of the Human Rights Commission at https://www.sahrc.org.za,

or the website of the Department of Justice and Constitutional Development at

https://www.doj.gov.za and as may be advised by the Information Regulator on or after 1 July

2021.

7.2 The prescribed form shall be submitted to the Private Body Head named in clause 3 hereof.

7.3 The above procedure shall apply if the requester is requesting information for personal use

and/or on behalf of another person, even if such other person is a permanent employee of the

Private Body.

7.4 The Head of the Private Body shall as soon as reasonably possible, and within 30 (thirty) days

after the request has been received, decide whether or not to grant such request.

7.5 The requester will be notified of the decision of the Head of the Private Body or the General

Manager in the manner indicated by the requester.

7.6 After access is granted, actual access to the record requested will be given as soon as reasonably

possible.

7.7 If the request for access is refused, the Head of the Private Body or the General Manager shall

advise the requester in writing of the refusal. The notice of refusal shall state:

7.7.1 adequate reasons for the refusal; and

7.7.2 that the requester may lodge an appeal with a court of competent jurisdiction against

the refusal of the request (including the period) for lodging such an appeal.

7.8 If the Head of the Private Body or the General Manager fails to respond within 30 (thirty) days

after a request has been received, it is deemed, in terms of section 58 read together with section

56(1) of PAIA, that the Head of the Private Body or the General Manager has refused the request

8.1 The following applies to requests (other than personal requests):



8.1.1 A requestor is required to pay the prescribed fees (R50.00) before a request will be

processed;

8.1.2 If the preparation of the record requested requires more than the prescribed 6 (six)

hours, a deposit shall be paid (of not more than one third of the access fee which

would be payable if the request were granted);

8.1.3 A requestor may lodge an application with a court against the tender/payment of the

request fee and/or deposit;

8.2 Records may be withheld until the fees have been paid.

8.3 The fee structure shall be available by way of regulations published from time to time.

8.4 In addition to the request fee, the following reproduction fees are prescribed by the Minister in

respect of private bodies such as the Private Body:

8.5 The request fee payable by a requester, other than a personal requester, referred to in

regulation 11(2) is R50,00.

8.6 For purposes of section 54(2) of the Act, the following applies:

8.6.1 Six hours as the hours to be exceeded before a deposit is payable; and

8.6.2 one third of the access fee is payable as a deposit by the requester.



8.7 The actual postage is payable when a copy of a record must be posted to a requester.

PART A: PROMOTION OF ACCESS TO

INFORMATION

INTRODUCTION

9.1 In South Africa, the right to privacy is protected in terms of the common law and section 14 of

the 1996 Constitution. As with all rights in the Bill of Rights, none are absolute, and can be limited

in terms of laws of general application. While the Constitution provides for, among other rights,

the right to privacy, the extent of the right to privacy may be limited by application of laws such

as the Promotion of Access to Information Act, 2 of 2000 and the Regulation of Interception of

Communications and Provision of Communication-related Information Act, 70 of 2002 (RICA).

9.2 POPI requires all South African organisations which handle personal information, to comply with

several important principles regarding privacy, disclosure, and trans-border flows of personal

information to other countries. POPI places responsibilities on the Private Body to process

personal information that it holds, in a fair and proper manner. The processing of such

information includes the collection, organising, storage, disclosure, transmission and use of

personal information.

9.3 The Private Body processes certain personal information, as defined in the POPI Act, (“Personal

Information”) relating to several data subjects, from time to time. A data subject is the person,

(natural or juristic), to whom Personal Information relates and from whom the Private Body

collects and processes information.



9.4 A description of the data subjects, (individuals and juristic persons), the information relating

thereto, the purpose of processing that information and the recipients of that Personal

Information is reproduced in the tables below.

DATA SUBJECTS AND PURPOSE FOR PROCESSING PERSONAL INFORMATION:

9.5 The Private Body may collect and process the above data subjects’ Personal Information as

defined in POPI and set out in the tables above and otherwise. The type of information will also

depend on the nature of the relationship with the data subject and the purpose for which the

information is collected and used.

9.6 The purpose of collecting the information set out in the tables above is set out therein. Personal

Information will be processed for those purposes and other lawful purposes only, even though

not set out above.

9.7 Whenever possible, the Private Body will inform the relevant data subject what information they

are required to provide to the Private Body and what information is optional.



9.8 Where Personal Information is collected in terms of specific legislation, the Private Body will

inform the data subject in terms of which legislation that data is collected.

LAWFUL BASIS OF COLLECTING PERSONAL INFORMATION

9.9 The Private Body needs to adhere to POPIA and protect personal information efficiently by

adhering to the principles of POPIA governing the lawful basis of collecting personal information

such as:

9.9.1 Purpose Limitation - Personal data may only be used for the specific purpose for

which it has been initially collected. Subsequent use for other purposes must be

compatible with this primary purpose.

9.9.2 Proportionality - Processing of personal data may not be excessive in relation to the

objective pursued by the Private Body. Data may be collected only to the extent

required.

9.9.3 Direct Collection - Personal data must generally be collected directly from the data

subject.

9.9.4 Transparency - The data subject must be aware what personal data is processed for

which purpose and who is responsible for it.

9.9.5 Data Quality - Personal data must be collected correctly. Appropriate measures must

be taken so that irrelevant or incomplete data is corrected or deleted.

9.9.6 Security - Appropriate technical and organizational measures must be taken to protect

personal data against unauthorized access, accidental loss or destruction and other

forms of unlawful processing. Data may be accessible only by persons who have a

“need to know”.

9.9.7 Deletion - Personal Data that is no longer required must be deleted. The period of

time data after which data is to be deleted shall be defined and the actual deletion

must be ensured. In line with the provisions of 14(1)(d) of POPIA our Data Subjects

hereby consent to the indefinite storage and retention of all Personal Information

which shall be deleted on request, unless otherwise provided by Legislation.

PROCESSING OF PERSONAL INFORMATION

9.10 Personal Information may only be processed if certain conditions are met which are listed below:

9.10.1 The data subject consents to the processing – consent is obtained directly from the

data subject;

9.10.2 The Personal Information is subject to a contract concluded between the parties or

such information is in the public domain;

9.10.3 Processing complies with an obligation imposed by law;

9.10.4 Processing protects a legitimate interest of clients and, employees so that the Private

Body can respond to their needs on a timeous basis and provide them with a beneficial

service;

9.10.5 Processing protects a legitimate interest of suppliers so that the Private Body can

provide them with business opportunities on a timeous basis and relevant

information;

9.10.6 Processing protects a legitimate interest of Employees to enable the Private Body to

provide them with the necessary services and protection.

9.11 We will not, without data subjects’ express consent use their Personal Information for any

purpose, other than:

specifically:

9.11.1 as set out in the abovementioned tables;

generally:

9.11.2 in relation to the provision of any goods and services to a data subject;

9.11.3 to inform the data subject of new services or products or special offers (unless they

have opted out from receiving marketing material from us);

9.11.4 to improve our product and/or service selection and their experience; or

9.11.5 to disclose their Personal Information to any third party as set out below:

9.11.5.1 to our employees and/or third party service providers who assist us to

interact with data subjects, their personal and contact information

being essential in order to assist us to communicate with the data

subjects properly and efficiently and facilitate the provision of services

9.11.5.2 to law enforcement, government officials, fraud detection agencies or

other third parties when we believe in good faith that the disclosure of

Personal Information is necessary to prevent physical harm or financial

loss, to report or support the investigation into suspected illegal

activity;

9.11.5.3 to our service providers (under contract with us) who help with parts of

our business operations (fraud prevention, marketing, technology

services etc). However, these service providers may only use data

subjects information in connection with the services they perform for

us and not for their own benefit;

9.11.5.4 to any third-party seller for purposes of sending data subjects an invoice

for any goods purchased from such third-party seller, which disclosed

information will be limited to data subjects’ email addresses;

9.12 We are entitled to use or disclose data subjects’ Personal Information if such use or disclosure is

required to comply with any applicable law, subpoena, order of court or legal process served on

us, or to protect and defend our rights or property.

9.13 Data subjects’ privacy is important to us and we will therefore not sell, rent or provide their

Personal Information to unauthorised third parties for their independent use, without their

consent.

9.14 We will not process personal information:

9.14.1 concerning the religious or philosophical beliefs, race or ethnic origin, trade union

membership, political persuasion, health or sex life or biometric information of a

data subject; or

9.14.2 the criminal behaviour of a data subject except to the extent that such information

relates to i) the alleged commission by a data subject of any offence; or ii) any

proceedings in respect of any offence allegedly committed by a data subject or the

disposal of such proceedings.

9.15 In line with our obligations in terms of section 22 of the POPI Act, where there are reasonable

grounds to believe that Personal Information has been accessed or acquired by any unauthorised

person, we will notify the Information Regulator and the data subject, where possible and follow

our procedures set out in our data breach policy.

9.16 When data subjects provide a rating or review of our services and/or goods, they consent to us

using that rating or review as we deem fit, including without limitation, on our website, in

newsletters or other marketing material. The name that will appear next to that rating or review

is their first name, as they would have provided. We will not display their surname, nor any of

their contact details, with a rating or review.

9.17 We will:

9.17.1 treat data subjects’ Personal Information as strictly confidential, save where we are

entitled to share it as set out in this section;

9.17.2 take appropriate technical and organisational measures to ensure that data subjects’

Personal Information is kept secure and is protected against unauthorised or

unlawful processing, accidental loss, destruction or damage, alteration, disclosure or

access;

9.17.3 provide data subjects with access to their Personal Information to view and/or

update personal details;

9.17.4 promptly notify data subjects if we become aware of any unauthorised use,

disclosure or processing of their Personal Information;

9.17.5 provide data subjects with reasonable evidence of our compliance with our

obligations under this section on reasonable notice and request; and

9.17.6 Information in our possession or control, save for that which we are legally obliged

to retain.

9.18 Given the nature of the information we retain, we will retain data subjects’ Personal Information

longer than the period for which it was originally needed, and in this regard our client’s hereby

consent to such longer retention.

9.19 Whilst we will do all things reasonably necessary to protect data subjects’ rights of privacy, we

cannot guarantee or accept any liability whatsoever for unauthorised or unlawful disclosures of

data subjects’ Personal Information, whilst in our possession, made by third parties who are not

subject to our direct control, unless such disclosure is because of our gross negligence.

9.20 In addition to the above, we may automatically gather non-personal information about Data

Subjects, such as the type of internet browser they use or the website from which they accessed

our website. We may also compile aggregated data based on their interactions with our site,

such as the products or services they express interest in. This information cannot be used to

identify them and is solely intended to help us improve the effectiveness of our website.

Occasionally, we may share this non-personal or aggregated data with third parties for purposes

related to our website.

9.21 Our website may use cookies from time to time, which are small text files stored on the Data

Subject’s computer by their browser. Cookies often contain a unique identifier, allowing us to

recognize their specific browser and improve their experience.

9.22 They help us remember users and simplify navigation. Data Subjects can disable cookies through

their browser settings or delete existing ones, but please note that some website features may

not function properly if cookies are turned off.

ACCESS AND CORRECTION OF PERSONAL INFORMATION

9.23 Data Subjects have the right to access the Personal Information the Private Body holds about

them.

9.24 Data subjects also have the right to request the Private Body to update, correct or delete their

Personal Information on reasonable grounds.

9.25 Once a data subject objects to the processing of their Personal Information, the Private Body

may no longer process that Personal Information.

9.26 Where a data subject objects to the processing of their Personal Information it may affect the

validity of any and all other agreements between the parties where such processing is a material

requirement in such agreements.

9.27 The Private Body will take all reasonable steps to confirm the data subject’s identity before

providing details of their Personal Information or making changes to their Personal Information.

9.28 Data subjects have the right to object to the processing of their Personal Information.

9.29 In the event a data subject requires confirmation regarding the existence of the Personal

Information processed by the Private Body or believes that the Personal Information processed

by the Private Body requires rectification, the data subject is entitled to utilise the processes and

procedures set out in section A of this manual to request access to the records of the Private

Body set out in section 18(1)(h)(iii).

COMPLAINTS

9.30 Whilst we will do all things reasonably necessary to protect data subjects’ rights of privacy, we

cannot guarantee or accept any liability whatsoever for unauthorised or unlawful disclosures of

data subjects’ Personal Information, whilst in our possession, made by third parties who are not

subject to our direct control, unless such disclosure is as a result of our gross negligence.

9.31 Should a data subject believe that we have used their Personal Information contrary to this

Manual and the provisions of the POPI Act, the data subject should first attempt to resolve any

concerns with us. If the data subject is not satisfied, they have the right to lodge a complaint

with the Information Regulator (which address can be found herein below), established in terms

of the POPI Act.



The Information Regulator (South Africa)

SALU Building

316 Thabo Sehume Street

Pretoria

0004

10.1 The Private Body may from time to time need to transfer authorised Personal Information to

another country for storage purposes or for the rendering of services by a foreign third-party

service provider or otherwise. We will ensure that any person that we pass data subjects’

Personal Information to agrees to treat their information with the same level of protection as

we are obliged to in terms of section 72 of the POPI Act.

11.1 The security measures implemented by the Private Body to ensure the confidentiality, integrity

and availability of Personal Information, are listed and described below:

The Private Body may update this manual every six months or from time to time as it may deem

necessary.