Legal
PAIA & POPIA Manual
About this PAIA manual
This page contains the PAIA manual of CMR Meridian (Pty) Ltd, which also addresses the company's obligations under POPIA. It explains how to request access to records held by the company. Please read it together with our privacy policy, cookie policy and terms and conditions. For general questions, please contact us. Guidance on PAIA and POPIA is also available from the Information Regulator.
CMR MERIDIAN (PTY) LTD
REGISTRATION NUMBER: 2003/013518/07
(“CMR" or the "company")
PAIA AND POPIA MANUAL
Prepared and published in accordance with Section 51 of the Promotion of Access to Information Act 2 of 2000 ("PAIA'') and to address the requirements in terms of the Protection of Personal Information Act 4 of 2013 ("POPIA").
Introduction and purpose of manual The purpose of this manual is:
To facilitate the requests for access to records of the company as provided for in PAIA;
To serve as a manual for the company, as required in terms of Section 51 of PAIA, to promote the access to information;
To set out the responsibilities of the Information Officer whose responsibility it will be to ensure compliance with PAIA and POPIA; and
To provide and outline of the type of records and the personal information the company holds and explains how to submit requests for access to these records in terms of PAIA.
PAIA provides that a person may only request information in terms of the Act, if the information is required for the exercise or the protection of a right.
PAIA gives effect to Section 32 of the Constitution, which provides that everyone has the right to access information held by a private body or public body, if the record or personal information held is required to exercise of protect a right.
PAIA, provides that a person requesting information must be given access to any record of a private body, if that record is required for the exercise or the protection of a right. However, such request has to comply with the procedural requirements and PAIA makes provision for the refusal of access to records.
Document Revision
Contents
The Company and company details [Section 51(1)(a}] 2
PAIA [Section 51(1)(b)] 3
Applicable legislation [PAIA Section 51(1)(c)] 3
Schedule of records [Section 51(1)(d)] 4
Request for access to records s
Prescribed fees [PAIA Section 51(1)(f)] 6
Grounds for refusal of request 7
The Company and company details [Section 51(1)(a)]
CMR is a merchandising and sales service provider providing services such as brand expansion strategy, sales and merchandising execution, retail and wholesale management, project solutions and business information system.
Details:
|
|
|---|---|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Requests shall be made in accordance with the prescribed procedures, at the rates provided. The forms and tariff are dealt with in paragraph 8 hereto.
Availability of this Manual
A copy is published on our website and a copy can be requested from the Company by sending a request for a copy to the Information Officer by email (see contact details above).
This manual will also be available at the Company's registered office situated at Unit 10, Greenstone Hill Office Park, 24 Emerald Boulevard, 1609.
PAIA [Section 51(1)(b)l
The Act grants a requester access to records of a private body, if the record is required for the exercise or protection of any rights. If a public body lodges a request, the public body must be acting in the public interest.
Requests in terms of PAIA shall be made in accordance with the prescribed procedures, at the rates provided. The forms and tariff are dealt with in paragraphs 7 & 8 of this Manual.
Requesters are referred to the Guide in terms of Section 10 of PAIA which has been compiled by the South African Human Rights Commission, which will contain information for the purposes of exercising Constitutional Rights. The Guide is available from the SAHRC.
The PAIA guide is available in all official South African languages at no cost, and any person may request a copy of the guide. A copy of the guide may be obtained by contacting the South African Human Rights Commission at:
The South African Human Rights Commission
PAIA Unit - The Research and Documentation Department Private Bag X2700, Houghton, 2041
Telephone: +27 (0) 11 877 3600
Facsimile: +27 (0) 11 403 0625 Website: www.sahrc.org.za
Availability of guides to the PAIA and POPI Acts
4.1 In addition to the above, guides to PAIA and POPIA can be obtained from, and queries directed to:
The Information Regulator (South Africa)
33 Hoofd Street, Forum Ill, 3rd Floor Braampark
P.O Box 31533, Braamfontein, Johannesburg, 2017 Mr Marks Thibela
Chief Executive Officer
Tel No. +27 (0) 10 023 5200, Cell No. +27 (0) 82 746 4173
Complaints email: complaints.lR@justice.gov.za General enquiries email: inforeg@justice.gov.za Website: https://www.justice.gov.za/inforeg/
Applicable legislation [PAIA Section 51(1)(c)]
Where applicable to the Company's business and operations, information is also available in terms of certain provisions of applicable legislation, which include but are not limited to:
Basic Conditions of Employment Act 75 of 1997
Broad Based Black Economic Empowerment Act 53 of 2003
Companies Act 71 of 2008
Compensation for Occupational Injuries and Health Diseases Act 130 of 1993
Consumer Protection Act 68 of 2008
Disaster Management Act 57 of 2002
Electronic Communication and Transactions Act 25 of 2002
Income Tax Act 58 of 1962
Labour Relations Act 66 of 1995
National Credit Act 34 of 2005
Occupational Health & Safety Act 85 of 1993
Prevention and Combating of Corrupt Activities Act 12 of 2004
Promotion of Access of Information Act 2 of 2000
Protection of Personal Information Act 4 of 2013
Skills Development Act 97 of 1998
Skills Development Levies Act 9 of 1999
Unemployment Insurance Act 4 of 2002
Value Added Tax Act 89 of 1991
Schedule of records (Section 51(1)(d)]
The Company maintains certain records, which includes but are not limited to, the categories listed below.
Recording a category or document and/or record in this Manual does not imply that a request for access to such records would be successful. The accessibility of the documents and/or records may be subject to the grounds of refusal.
Employees and personnel:
Personal records (such as name, surname, ID, age, employee code, contact details, banking details, etc.)
Employment contracts
Employment policies and procedures
Internal evaluation and disciplinary records
Occupational Health and Safety
Training schedules and material
Personnel files (such as CV's, KPl's, payslips, IRP5's, etc.)
Company Secretarial:
Documents of Incorporation and registration documents
Share registers and other statutory reports
Board meeting minutes
Client and prospective client related records:
Client information (such as name, ID number, registration number, physical and registered address, postal address, tax number, VAT number, etc.)
Client financial records & other information (such as bank account details, financials, product and sales data, etc.)
Client contact details (such as telephone and cell phone number, fax number and email address)
Records generated by or within the Company pertaining to the client
Financial & Banking and Tax Records
Accounting records, books and documents
Interim and annual financial reports
Details of auditors
Bank facilities and account details
Bank statements
Tax return
PAYE records
Skills Development Levies records
Other records (Company related records):
Marketing records
Insurance records
Operational records
Databases
Information Technology
Internal correspondence
Statutory records
Internal Policies and Procedures
Supplier and/or service provider information and records
Request for access to records
In terms of Section 50 of PAIA, any person, who requires information for the exercise or protection of any rights, may request information from a private body.
The categories of records and/or information which are held by the Company are listed above. A requester will not automatically be allowed access to these records and access to records may be refused in accordance with the Act.
Form of request PAIA Section 51(1)(e)]:
The requester must comply with all the procedural requirements contained in PAIA and the request must be made on the correct form (Form C for private bodies can be found on www.justice.gov.za and/or www.sahrc.org.za).
The completed prescribed request form must be addressed to the Head of the Company and/or the Information Officer of the Company and delivered (hand-delivered, posted or sent via email), together with the proof of payment of a request fee and a deposit, if applicable.
Document Revision
I Version 1 Updated: 22 October 2021 Updated by: Duff Pretorius Attorneys
A requester needs to provide sufficient details, and the prescribed form needs to contain sufficient information, to enable the Company to identify:
The record(s) requested;
The identity of the requester (and if an agent is lodging the request, proof of capacity);
Which form of access is required, if the request is granted;
The postal address or fax number of the requester within South Africa;
If the requester wishes to be informed of the decision relating to the request for access in any manner (in addition to written) the manner and particulars thereof;
The right which the requester is seeking to exercise or protect with an explanation of the reason the record is required to exercise or protect the right.
The Company will not consider a request unless it is contained in the correct and prescribed Form C.
Procedure:
The Company will, within 30 days of receipt of the request, decide whether to grant or decline the request. Whatever decision is taken, the requester will be given notice of the decision in writing. If a request is refused, the notification will include the reasons for the refusal.
The 30-day notice period may be extended if the request is for a large number of information, it is necessary due to the nature of the request and the amount of time required to gather the requested information. The requester will however be given notice of the extension prior to the 30-day period's expiry.
The Company will not process a request until the prescribed fees have been paid. Where a decision to grant a request has been taken, the record will not be disclosed until the necessary fees have been paid in full.
Prescribed fees [PAIA Section 51(1)(f)]
Request Fee (not applicable to a personal requester)
The requester needs to pay the request fee as prescribed by the Minister for Justice and Constitutional Development, before the request will be processed.
This non-refundable fee is payable on submission of any request for access to any record. No fee is payable if the request is for personal records of the person requesting it.
Deposit (not applicable to a personal requester)
If the preparation of the record requested requires more than the prescribed hours (six), a deposit shall be paid (of not more than one third of the access fee which would be payable if the request were granted).
Access Fee
The requester needs to pay an access fee as prescribed by the Minister for Justice and Constitutional Development to enable the Company to recover the cost of processing a request and giving access to records in terms of the Act. The access fee is payable prior to being granted access to the records.
A request will not be processed until the prescribed fees have been paid and where a decision to grant a request has been taken, the record will not be disclosed until the necessary fees have been paid in full.
A requestor may lodge an application with a court against the tender and/or payment of the request fee and/or deposit.
Grounds for refusal of request
The request may be declined in accordance with one of the prescribed grounds in terms of the Act, namely:
Section 63 of PAIA stipulates that a request for access to a record must be refused if its disclosure would involve the unreasonable disclosure of personal information about a third party, including a deceased individual. However, Section 63(2) does provide exceptions to this.
Section 64 of PAIA states that a request must be refused if it relates to records containing third party information pertaining to:
Trade secrets;
Financial, commercial, scientific or technical information where disclosure would be likely to cause harm to the commercial or financial interests of that third party; or
Information, supplied in confidence by the third party, the disclosure of which could reasonably be expected to put the third party at a disadvantage in contractual or other negotiations, or prejudice the third party in commercial competition.
Section 65 of PAIA prohibits disclosure of information if such disclosure would constitute a breach of any duty of confidentiality owed to a third party in terms of an agreement.
In terms of Section 66 of PAIA, the Company must refuse disclosure of the record could reasonably be expected to compromise the safety of an individual or property.
Section 67 of PAIA mandates the refusal of a request if the record is privileged from production in legal
proceedings, unless the person entitled to the privilege has waived the privilege.
Section 68 of PAIA pertains to records containing information about the Company itself and may refuse access to a record if the record:
Contains trade secrets of the Company;.
Contains financial, commercial, scientific or technical information, the disclosure of which would be likely to cause harm to the commercial or financial interests of the Company;
Contains information which, if disclosed, could reasonably be expected to put the Company at a disadvantage in contractual or other negotiations, or prejudice the Company in commercial competition; or
Consists of a computer program owned by the Company.
Section 69 of PAIA prohibits the disclosure of information about research where disclosure is likely to expose the third party, the person conducting the research on behalf of the third party, or the subject matter of the research to serious disadvantage. Disclosure is discretionary if such research pertains to the Company itself.
Notwithstanding any of the above-mentioned provisions, Section 70 of PAIA provides that a record must be disclosed if its disclosure would:
Reveal evidence of a substantial contravention of or failure to comply with the law, imminent and serious public safety or environmental risk; and
If the public interest in the disclosure clearly outweighs the harm.
Remedies & Appeal
10.1 The Company does not have internal appeal procedures regarding PAIA requests. As such, the decision made by the duly authorised person is final. If a request is denied, the requestor is entitled to apply to a court with appropriate jurisdiction, or the Information Regulator, for relief.
Records that cannot be found or do not exist
11.1 If the Company has searched for a record and it is believed that the record either does not exist or cannot be found, the requester will be notified accordingly, which notification will include an explanation, provided by way of an affidavit or affirmation, of the steps that were taken to attempt to locate the record. This will include the steps that were taken to try and locate the record.
Records and information relating to a third party
If access is requested to a record that contains information about a third party, the Company must first contact such third party to inform him/her/it of the request to access the record and/ or information and enquire if the third party consents to the Company providing the requester access to the record and/ or information, as provided in Chapter 5 {Sections 71 to 73) - third party notification and intervention - of PAIA.
If the third party does not consent, the Company will request the third party to provide the Company with reasons why he/she/it does not consent to provide the requester access.
Upon receipt of the reasons for the support or denial of access, the Company's Information Officer will consider these in determining whether access should be granted, or not.
POPIA
Purpose of processing personal information
The Company processes personal information for the following purposes:
Complying with legal and statutory obligations in terms of applicable legislation;
Document Revision Version 1 Updated: 22 October 2021 Updated by: Duff Pretorius Attorneys
Staff administration, including management of employees;
Human resources purposes such as job applications and interviews with potential or prospective employees;
Keeping of accounts and records;
Obtaining information necessary to provide the contractually agreed services and/ or products to a customer;
Obtaining information necessary to provide clients with the service(s) contracted for and/or instructed to provide;
Marketing and advertising purposes;
Monitoring, maintaining and managing the Company's contractual obligations with and to clients, suppliers, service providers, employees, directors and other third parties;
Responding to enquiries and resolving complaints; and/or
To fulfil obligations (contractual or in terms of legislation) to clients.
Categories of Data Subjects
The Company may possess records relating to personal information of the following data subjects:
Clients (natural persons and/or juristic persons);
Service providers;
Suppliers;
Employees;
Directors;
Shareholders; and/or
Visitors to the Company's premises.
Types of personal information being processed by the Company may include:
Client's (juristic) details (such as name of entity, registration number, physical address, postal address, billing address, Tax related information, telephone number, email address, information of authorised representatives, etc.)
Employee and/ or director's details (such as name and surname, gender, age, national origin, email address, telephone number, education and qualification information, employment history, ID number, tax number, medical history, etc.)
Service providers'/ Suppliers' details (such as name of entity, registration number, physical address, postal address, telephone number, email address, information of authorised representatives, tax related information, etc.)
The Company may provide personal information to other recipients:
It is sometimes necessary for the Company to share personal information with other organisations and/ or recipients. Where necessary or required, the Company shares personal information with:
Employees and/ or directors and/ or shareholders of the Company;
Regulatory and statutory bodies and government;
Service providers and suppliers;
Representatives and/or joint venture partner(s) of the Company;
Document Revision
I Version 1 Updated: 22 October 2021 Updated by: Duff Pretorius Attorneys
Employment and recruitment agencies;
Banks or other financial institutions;
SARS;
Auditors;
CIPC.
Cross border flow of personal information
The Company may from time to time need to share personal information with third parties (suppliers and
/ or service providers) in other countries and transmit personal information transborder, which personal information may be stored in data servers hosted outside South Africa.
The Company will endeavour to ensure that these third parties make all reasonable efforts to secure the personal information.
General Description of Information Security Measures
The Company makes use of technology and safeguarding measures to ensure the protection of personal information, such as:
Organisational privacy policy;
Firewalls and Anti-Virus software and applications;
Physical access control;
Information Systems access control;
Physical security of devices;
Password protocols.
Data subject's rights and Data subject participation
In terms of Section 11(3) of POPIA the data subject has the right to objection to the processing of personal information in accordance with Form 1 of the Regulations.
In terms of Section 23(1) & (2) of POPIA the data subject has the right to request the Company to confirm, free of charge, whether the Company hold any personal information about the data subject. Section 23 of POPIA further gives the data subject the right to request from the Company the record or a description of the personal information about the data subject held by the Company, including information about the identity of all third parties, or categories of third parties, who have, or have had, access to the information.
Such request must be made to the Company, specifically the Information Officer, in writing and will be complied with within a reasonable time, at the prescribed fee (if any), in a reasonable manner and format and in a form that is generally understandable.
Under certain circumstances, and as prescribed in PAIA, the Company may or must refuse to disclose any information requested.
In terms of Section 24 the data subject has the right to request, where necessary, the correction, destruction or deletion of his/her/its personal information in accordance with Form 2 of the Regulations.
Section 25 of POPIA deals with the manner of access to personal information held by the Company and reads as follows: 'The provisions of sections 18 and 53 of the Promotion of Access to Information Act apply to requests made in terms of section 23 of this Act."
Section 53 of PAIA, which relates to the access to records of private bodies, state the following:
"Form of request
53(1) A request for access to a record of a private body must be made in the prescribed form to the private body concerned at its address, fax number or electronic mail address.
The form for a request for access prescribed for the purposes of subsection (1) must at least require the requester concerned-
to provide sufficient particulars to enable the head of the private body concerned to identify-
the record or records requested; and
the requester
to indicate which form of access is required;
to specify a postal address or fax number of the requester in the Republic;
to identify the right the requester is seeking to exercise or protect and provide an explanation of why the requested record is required for the exercise or protection of that right;
if, in addition to a written reply, the requester wishes to be informed of the decision on the request in any
other manner, to state that manner and the necessary particulars to be so informed; and
if the request is made on behalf of a person, to submit proof of the capacity in which the requester is making the request, to the reasonable satisfaction of the head."
Annexures
PAIA Form C: Request for Access to Record of Private Body PAIA Prescribed fees
POPIA Form 1: Objection to the Processing of Personal Information
POPIA Form 2: Request for Correction or Deletion of Personal Information
FORM1
OBJECTION TO THE PROCESSING OF PERSONAL INFORMATION IN TERMS OF SECTION 11(3) OF THE PROTECTION OF PERSONAL INFORMATION ACT, 2013 (ACT NO.
4OF 2013)
REGULATIONS RELATING TO THE PROTECTION OF PERSONAL INFORMATION, 2018
[Regulation 2]
Note:
Affidavits or other documentary evidence as applicable in support of the objection may be attached.
If the space provided for in this Form is inadequate, submit information as an Annexure to this Form and sign each page.
A Details of Data Subject
Complete as is applicable.
|
|
|---|---|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
C Reasons for objection in terms of Section 11(1)(d) to (f) (Please provide detailed reasons for the objection) |
|
Signed at .......................................... this ...................... day of ...........................20.......... .
Signature of data subject/designated person
FORM2
REQUEST FOR CORRECTION OR DELETION OF PERSONAL INFORMATION OR DESTROYING OR DELETION OF RECORD OF PERSONAL INFORMATION IN TERMS OF SECTION 24(1) OF THE PROTECTION OF PERSONAL INFORMATION ACT, 2013 (ACT 4 OF 2013)
REGULATIONS RELATING TO THE PROTECTION OF PERSONAL INFORMATION, 2018
(Regulation 3)
Note:
Affidavits or other documentary evidence as applicable in support of the objection may be attached.
If the space provided for in this Form is inadequate, submit information as an Annexure to this Form and sign each page.
Complete as applicable.
Mark the appropriate box with an "x". Request for:
|
|
|---|---|
|
1
C Information to be corrected / deleted / destructed / destroyed
D Reasons for *correction or deletion of the personal information about the data subject in terms of Secton 24(1)(a) which is in possession or under the control of the responsible party; and/or Reasons for *destruction or deletion of a record of personal information about the data subject in terms of Section 24(1)(b) which the responsible party is no longer authorised to retain.
(Please provide detailed reasons for the request)
Signed at on this day of 20
Signature of data subject/ designated person
J752
REPUBLIC OF SOUTH AFRICA
FORMC
REQUEST FOR ACCESS TO RECORD OF PRIVATE BODY
(Section 53(1) of the Promotion of Access to Information Act, 2000 (Act No. 2 of 2000)) [Regulation 10]
Particulars of private body
The Head:
Particulars of person requesting access to the record
Full names and surname:
Identity number:
Postal address:
Telephone number: (.........) .................. .................. Fax number: (.........) ....................................
E-mail address:
Capacity in which request is made, when made on behalf of another person:
Particulars of person on whose behalf request is made
This section must be completed ONLY if a request for information is made on behalf of another person.
Full names and surname: Identity number:
Particulars of record
Description of record or relevant part of the record:
Reference number, if available:
Any further particulars of record:
Fees
Reason for exemption from payment of fees:
Form of access to record
If you are prevented by a disability to read, view or listen to the record in the form of access provided for in 1 to 4 below, state your disability and indicate in which form the record is required.
|
||||||
|---|---|---|---|---|---|---|
|
|
|||||
|
||||||
|
|
|
||||
|
||||||
|
|
|||||
|
||||||
|
|
|
||||
|
|
|
|---|
Particulars of right to be exercised or protected
If the provided space is inadequate, please continue on a separate folio and attach it to this form.
The requester must sign all the additional folios.
Indicate which right is to be exercised or protected:
Explain why the record requested is required for the exercise or protection of the aforementioned right:
Notice of decision regarding request for access
You will be notified in writing whether your request has been approved/ denied. If you wish to be informed in another manner, please specify the manner and provide the necessary particulars to enable compliance with your request.
How would you prefer to be informed of the decision regarding your request for access to the record?
Signed at .................................................... this day............ of ....................................year ..........
SIGNATURE OF REQUESTER/
PERSON ON WHOSE BEHALF REQUEST IS MADE