PAIA Manual

1. Introduction

This information manual ("Manual") provides an outline of the types of records held by Kaya Club (Pty) Ltd ("Kaya Club", "Company") and explains how one may submit requests for access to these records in terms of the Promotion of Access to Information Act 2 of 2000 ("PAIA", "Act").

This Manual has been prepared in accordance with section 51 of the Act, giving effect to everyone's constitutional right of having access to information held by private sector bodies (i.e. companies) or public bodies (i.e. Government institutions) where such access is needed for the exercise and/or protection of the requester's rights; this Manual aims to facilitate requests for access to the relevant or applicable records.

2. Definitions and Interpretation

Unless the context clearly indicates otherwise, the following terms shall have the meanings assigned to them hereunder:

• "Data Subject" means the person to whom Personal Information relates;
• "Information Officer" means the person(s) acting on behalf of Kaya Club, and discharging the duties and responsibilities assigned to the head of Kaya Club by the Act. The Information Officer is duly authorised to act as such, with such authorisation having been confirmed by the head of Kaya Club, in writing;
• "Information Regulator" means the Information Regulator established in terms of section 39 of POPIA;
• "Manual" means this manual published in compliance with section 51 of the Act;
• "PAIA" means the Promotion of Access to Information Act 2 of 2000, as amended from time to time;
• "Personal Information" shall have the meaning attributed to it in terms of POPIA;
• "POPIA" means the Protection of Personal Information Act 4 of 2013, as amended from time to time;
• "Record" means any recorded information, regardless of form or medium, which is in the possession or under the control of Kaya Club, irrespective of whether or not it was created by Kaya Club;
• "Request" means a request for access to a record held by Kaya Club;
• "Requester" means any person, including a public body or an official thereof, making a request for access to a record held by Kaya Club and includes any person acting on behalf of that person;
• "Responsible Party" means a public or private body or any other person which, alone or in conjunction with others, determines the purpose of and means of processing Personal Information;
• "SARS" means the South African Revenue Service; and
• "Kaya Club" means Kaya Club (Pty) Ltd as more fully described in the Overview, hereunder.

Unless a contrary intention clearly appears, words signifying:

• the singular includes the plural and vice versa;
• any one gender includes the other genders and vice versa; and
• natural persons include juristic persons.

Unless otherwise stated, terms defined in PAIA and POPIA shall have the same meaning in this Manual.

3. Overview of Kaya Club

Kaya Club (Pty) Ltd is a private company incorporated in terms of the company laws of South Africa, specialising in the luxury fashion subscription and handbag rental industry.

Kaya Club operates a members-only designer handbag club that offers customers access to a curated collection of authentic designer handbags. Through a monthly subscription model, members are able to select and receive luxury bags from Kaya Club's collection, enjoy periodic swaps of handbags, and benefit from delivery, pickup, and wear-and-tear coverage as part of their membership. The Company's service is designed to provide a flexible and accessible way for members to enjoy high-end fashion pieces without the cost and commitment of ownership.

4. Particulars in Terms of Section 51

4.1 Company Contact Details (section 51(1)(a))

4.2 Contact Details of Designated Information Officer (section 51(1)(a))

5. Guide to PAIA (Section 51(1)(b) read with Section 10)

In terms of PAIA, a requester may be granted access to records held by a private body. This access is subject to the records being required for the exercise or protection of any right. Should a public body lodge a complaint, in order to receive access, the public body must be acting in the public interest.

The Information Regulator has, in terms of section 10(1) of PAIA, as amended, updated and made available the revised Guide on how to use PAIA ("Guide"), in an easily comprehensible form and manner, as may reasonably be required by a person who wishes to exercise any right contemplated in PAIA and POPIA. The Guide is available in each of the official languages and in braille.

Requests for access to the Guide must be made on a form that corresponds substantially with Form 1 of Annexure 1 to this Manual, to the Information Regulator.

The aforesaid Guide contains the description of:

• the objects of PAIA and POPIA;
• the manner and form of a request for access to a record of a private body contemplated in section 50 of PAIA;
• the assistance available from the IO in terms of PAIA and POPIA;
• the assistance available from the Information Regulator in terms of PAIA and POPIA;
• all remedies in law available regarding an act or failure to act in respect of a right or duty conferred or imposed by PAIA and POPIA, including the manner of lodging:
  • an internal appeal;
  • a complaint to the Information Regulator; and
  • an application with a court against a decision on internal appeal or a decision by the Information Regulator or a decision of the head of a private body;
• the notices issued in terms of section 54 of PAIA regarding the fees to be paid in relation to requests for access; and
• the regulations made in terms of section 92 of PAIA.

Members of the public can inspect or make copies of the Guide from the offices of the Kaya Club, including the office of the Information Regulator, during normal business hours.

The Guide can also be obtained upon request to the Information Officer or from the Information Regulator:

6. Voluntary Disclosure and Automatic Availability (Section 51(1)(c))

Records that are automatically available to the public are:

• All records of Kaya Club lodged in terms of government requirements with various statutory bodies, including the Companies and Intellectual Property Commission (CIPC) and the Registrar of Deeds.
• All records in booklets, brochures, pamphlets, and magazines (if any) published by Kaya Club or any of its agents or representatives for distribution to the public relating Kaya Club services and/or products.
• All records on the Kaya Club website.

A requester may request a copy of a record referred to above and must be provided with such copy, upon payment of the fee for reproduction, as provided for in Items 2 to 8 of Annexure 2 to this Manual.

7. Records Available in Terms of Other Legislation (Section 51(1)(d))

Kaya Club is required to keep particular records, in terms of certain statutes. Insofar as may be applicable, Kaya Club keeps records of information to the extent required in terms of the following legislation, as amended, and codes of best business practice:

Information and records held by Kaya Club in terms of any of the abovementioned legislation will be made available in terms of the provisions of the relevant legislation, but without prejudice to the provisions of the Promotion of Access to Information Act. The above list is non-exhaustive.

8. Types of Records Held by Kaya Club (Section 51(1)(e))

Kaya Club maintains records on the following categories and subject matters. Please note that recording a category or subject matter in this Manual does not imply that a request for access to such records would be granted. All requests for access will be evaluated on a case by case basis in accordance with the provisions of PAIA. Please further note that the below listed records are not exhaustive.

8.1 Personnel Documents and Records

"Personnel" refers to any person who works for or provides services to or on behalf of Kaya Club and receives or is entitled to receive remuneration and any other person who assists in carrying out or conducting the business of Kaya Club. This includes, without limitation, directors (executive and non-executive), all permanent, temporary, and part-time staff (if any), and correspondents, as well as contract workers.

8.2 Client Related Records

A "client" refers to any natural or juristic entity that receives services from Kaya Club. These records include but are not limited to:

• records provided by clients in respect of their business and in terms of the contractual arrangements between Kaya Club and clients;
• records generated by or within Kaya Club related to its clients, including transactional records;
• records pertaining to third-party information provided by clients; or
• records provided by third parties in the course of doing business with Kaya Club.

8.3 Statutory / Corporate Records

• Minutes of executive and other decision-making operational bodies
• Documents of Incorporation
• Memorandum of Incorporation
• Minutes of Board of Directors' Meetings and Board sub-committee Meetings
• Share Registers and other Statutory Registers
• Statutory Registers
• Delegations of authority
• Other statutory documents of a legal and commercial nature

8.4 Other Kaya Club Records

• Documents relating to the operational, commercial and financial interests of Kaya Club
• Commercial and other legal contracts or agreements
• Client and other databases
• Information on existing and past litigation
• Trade Mark and Intellectual Property applications, certificates and information
• Administrative Information
• Licenses
• Human Resources Information
• Insurance Policies
• Marketing records
• Internal and external correspondence
• Disaster recovery plans
• Kaya Club services records
• Internal policies and procedures
• Records held by officials of Kaya Club

Where any of the above records contain Personal Information and a request is submitted, the provisions of PAIA as well as POPIA will apply accordingly. Take note that: "Personal information", as defined in POPIA means information relating to an identifiable, living, natural person, and where it is applicable, an identifiable, existing juristic person, including, but not limited to those categories as defined in section 1 of POPIA.

9. Other Information as May Be Prescribed (Section 51(1)(f))

Kaya Club may possess records pertaining to other parties, including without limitation contractors, suppliers, subsidiary/holding/sister companies, joint venture companies and service providers. Alternatively, such other companies may possess records that can be said to belong to Kaya Club.

These records include but are not limited to:

• Personnel, client or private records which are held by another party as opposed to the records held by Kaya Club.
• Records held by Kaya Club pertaining to other parties, including but not limited to financial, commercial, operational and legal records, contractual records, correspondence, records provided by the other party, and records provided by third parties about contractors/suppliers.

10. Processing of Personal Information

Personal Information will be Processed by Kaya Club in accordance with the Kaya Club Privacy Policy.

11. Information Regulator

Section 39 of POPIA establishes the Information Regulator and Section 40 identifies its functions. The Information Regulator is responsible for monitoring compliance with POPIA and PAIA and is tasked, amongst other powers, duties and functions, to handle complaints about the protection of Personal Information and access to information held by Kaya Club. For complaints or general enquiries contact the Information Regulator using the contact information under section 5 above.

12. Data Subject Participation and Information Officer Duties

This PAIA Manual as well as the Kaya Club Privacy Policy gives effect to Sections 23 and 55 of POPIA.

Section 23(1) of POPIA states that:

"A data subject, having provided adequate proof of identity, has the right to -

1. request a responsible party to confirm, free of charge, whether or not the responsible party holds personal information about the data subject;
2. request from a responsible party the record or a description of the personal information about the data subject held by the responsible party, including information about the identity of third parties, or categories of third parties, who have, or have had, access to the information -
   1. within a reasonable time;
   2. at a prescribed fee, if any;
   3. in a reasonable manner and format; and
   4. in a form that is generally understandable."

Section 55(1)(b) of POPIA confirms that one of the Information Officer's responsibilities is to deal with requests for information made to the body (Kaya Club). Address your (as Data Subject) request to the Information Officer at the address, telephone number or electronic mail addresses referred to at section 4.2 above.

Other Data Subject rights are confirmed under the Kaya Club Privacy Policy.

13. Steps to Consider Before Submitting a Request

Step 1: Applicability

Please note that section 7(1) of PAIA states that:

"This Act does not apply to a record of a public body or a private body if -

1. that record is requested for the purpose of criminal or civil proceedings;
2. so requested after the commencement of such criminal or civil proceedings, as the case may be; and
3. the production of or access to those records for the purpose referred to in paragraph (a) is provided for in any other law".

If section 7(1) applies, the requester may not bring a request in terms of this Act. The requester must use the rules and procedures for discovery of information of the relevant legal forum and proceedings that he/she is involved in.

Kaya Club reserves the right to claim all expenses and other damages incurred as a result of a requester submitting a request in contravention of section 7(1).

Step 2: Does the record exist?

The Act only applies to documents that are in existence at the time of receiving the request. The Act does not compel anyone to create a record which is not yet in existence at the time the request is made.

Step 3: Is the record in Kaya Club's possession?

The Act provides that the requested record must be in Kaya Club's possession or under its control. If the document is not in Kaya Club's possession, the requester must request the record from the party under whose possession or control it is.

14. Electronic Communication

The provisions of the Electronic Communications and Transactions Act (ECT Act) are applicable to all forms, records, documents or any information, which are electronically communicated. The ECT Act is especially important to businesses involved in electronic commerce.

The ECT Act introduced formal legal recognition of electronic commerce to South Africa. It provides for the facilitation and regulation of electronic communications and transactions, including issues related to electronic signatures, electronic evidence and computer crimes. Its primary objective is to facilitate and to provide legal certainty on e-commerce and electronic records.

15. Access: Procedure, Availability and Prescribed Fees

15.1 How to Request a Record (PAIA section 53)

1. Requests for access to records contemplated in section 53(1) of the Act, must be made on a form that corresponds substantially with Form 2 of Annexure 1 to this Manual, to the Information Officer.
2. The Information Officer must:
   1. assist a requester with any request with regards to a request for access to information; and
   2. if a request for access to information is made orally as a result of illiteracy or a disability of a requester, complete Form 2 of Annexure 1 to the Manual on behalf of the requester and provide a copy thereof to the requester, as contemplated in section 18(3) of the Act.
3. The request fee payable by every requester referred to in section 54(1) of the Act, is prescribed in Item 1 of Annexure 2 to the Manual.
4. Failure to make use of the prescribed form could result in your request being refused or delayed.
5. Should the Information Officer be of the opinion that fulfilment of the request will require more time than the prescribed hours, the requester will be informed to pay a deposit, of no more than a third of the above request fee. In the event that the request is denied, the deposit will be refunded to the requester.
6. The requester must provide sufficient detail on the request Form to enable the Information Officer to clearly identify:
   1. The record(s) requested.
   2. The requester (positive proof of identification).
   3. The format of access required:
      1. the postal address, email address and telephone number of the requester in the Republic; and
      2. if the requester wishes to be informed of the decision in any manner (in addition to written), the manner and particulars thereof.
7. Access is not automatic. The requester must therefore identify the right he/she is seeking to exercise or protect and provide an explanation as to why the requested record is required for the exercise or protection of that right.
8. If a request is made on behalf of a person, the requester must then submit proof, to the satisfaction of the Information Officer, of his/her authority to make the request. Failure to do so will result in the request being rejected.

15.2 Decision on Request (section 56)

1. The requester will be notified, within 30 (thirty) days, in the manner indicated by him/her of the outcome of his/her request, alternatively whether an extension not exceeding 30 (thirty) days is required to deal with the request.
2. If the request for access is granted, a further access fee must be paid for the search, preparation and reproduction of the records as well as for any time that has exceeded the prescribed hours to search and prepare the record for disclosure. Access will be withheld until the requester has made payment of the applicable fee(s).
3. If the request for access is refused, reasons for the refusal will be provided and the requester will be advised that he/she may lodge an application with a court against the refusal of the request, as well as the procedure for lodging the application.
4. The main grounds for refusal of a request relates to:
   • the unreasonable disclosure of Personal Information about a third party, including a deceased person (subject to section 63(2) of the Act);
   • disclosure that could reasonably be expected to endanger the life or physical safety of an individual;
   • the disclosure that would likely prejudice or impair, inter alia -
     1. the security of a building, structure or system, including but not limited to, a computer or communication system;
     2. a means of transport; or
     3. any other property;
   • mandatory protection of the privacy of a third party who is a natural person, which would involve unreasonable disclosure of Personal Information of that natural person;
   • mandatory protection of commercial information of a third party, if the record contains:
     1. trade secrets of that third party;
     2. financial, commercial, scientific, or technical information which disclosure could likely cause harm to the financial or commercial interest of that third party; or
     3. information disclosed in confidence by a third party to Kaya Club, if the disclosure could put that third party at a disadvantage in negotiations or commercial competition;
   • mandatory protection of confidential information of third parties if it is protected in terms of any agreement;
   • mandatory protection of the safety of individuals and the protection of property;
   • mandatory protection of records which would be regarded as privileged in legal proceedings;
   • commercial activities of Kaya Club, which may include:
     1. financial, commercial, legal or technical information which disclosure could likely cause harm to the financial or commercial interest of Kaya Club;
     2. information which, if disclosed could put Kaya Club at a disadvantage in negotiations or commercial competition;
     3. the research information of Kaya Club or a third party, if its disclosure would disclose the identity of Kaya Club, the researcher or the subject matter and would place the research at a serious disadvantage; or
     4. requests for information which is clearly frivolous or vexatious, or which involve unreasonable diversion of resources.
5. The requester may lodge an internal appeal or an application to court against the tender or payment of the request fee.

15.3 Information Officer Duties on Grant or Refusal

The Information Officer must, if a request for access to a record referred to under 15.1.1 to 15.1.3 above is granted or refused, inform the requester of:

1. his or her decision; and
2. the fees payable as provided for in Annexure 2 of the Manual: Provided that a request for a copy of the guide may not be refused.

15.4 Reproduction Charges

A person who requests:

1. a copy of a record contemplated under 6.1 above; or
2. access to a record as contemplated in 15.1.1 to 15.1.3 above of the Manual,

may be charged the fee for reproduction and postage as prescribed in Annexure 2 of the Manual, if the request is granted.

15.5 Deposit

If the search for the record in respect of which a request for access has been made, and the preparation of the record for disclosure, including any arrangement contemplated in section 29(2)(a) and (b)(i) and (ii)(aa) of the Act, would, in the opinion of the Information Officer, require more than 6 (six) hours for these purposes, the Information Officer must inform the requester to pay a deposit, which must not exceed one third of the amount payable, if the request is granted.

15.6 Search Fees

The fee for the search for and preparation of the record contemplated in section 29(2)(a) and (b)(i) or 54(2)(a) and (b)(i) of the Act is provided for in Item 9 of Annexure 2 to this Manual.

15.7 Records That Cannot Be Found

1. If all reasonable steps have been taken to find a requested record, and there are reasonable grounds to believe the record is in Kaya Club's possession but cannot be found or does not exist, Kaya Club's Information Officer will notify the requester, by way of affidavit or affirmation as prescribed by the Act, that it is not possible to give access to the requested record.
2. If, after notice is given as per 15.7.1 above, the record is found, the requester concerned must be given access to the record, unless access is refused on any of the refusal grounds provided for in the Act.

15.8 Remedies Available When a Request Is Refused

1. Kaya Club does not have an internal appeal procedure.
2. Any decision made by the Information Officer is final.
3. Should the requester not be satisfied, the requester should exercise the external remedies provided for in the Act.

15.9 Limitation of Liability

Kaya Club is relieved from liability and shall have no duty whatsoever in relation to:

• the integrity or accuracy of the information requested;
• any delay associated with the delivery except to comply with the procedures stipulated herein; and/or
• that the information requested will conform with the requirements of the requester except that it should correspond with the title and description provided by the requester.

16. Availability

This manual is available on the Kaya Club website, kayaclub.co.za, alternatively at Kaya Club offices as per paragraph 4.1 above, during office hours: 09:00 - 17:00, Monday to Friday, excluding Public Holidays and Weekends in the Republic of South Africa.

The fees payable in respect of access to records are attached as Annexure 2 below.

Annexure 1: Forms

Form 1 - Request for a Copy of the Guide [Regulation 3]

Form 2 - Request for Access to Record [Regulation 7]

Annexure 2: Fees