PAIA Manual

NUMERAL XII (Pty) Ltd · Registration number 2021/748540/07
Prepared in terms of section 51 of the Promotion of Access to Information Act 2 of 2000 and the Protection of Personal Information Act 4 of 2013
Version V1/2025 · July 2025 · Reviewed annually · Approved by the Information Officer

1. Acronyms and abbreviations

2. Purpose of this manual

PAIA gives effect to the right, in section 32(1)(b) of the Constitution, of access to any information held by a private body that is required for the exercise or protection of any rights. A person requesting information must be given access to a record of a private body if that record is required for the exercise or protection of a right. This right may, however, be limited to the extent that the limitations are reasonable and justifiable in an open and democratic society based on human dignity, equality and freedom, as contemplated in section 36 of the Constitution.

This manual is published by NUMERAL XII (Pty) Ltd, a private company incorporated in the Republic, in terms of section 51 of PAIA. It sets out the procedural and other requirements that a request must meet.

2.1 This manual will help you to:

• check the categories of records we hold that are available without a formal PAIA request;
• understand how to request access to a record, by describing the subjects on which we hold records and the categories of records held on each subject;
• see which of our records are available in terms of other legislation;
• find the contact details of our Information Officer and Deputy Information Officer, who will assist you with your request;
• find out about the Regulator’s Guide on how to use PAIA and how to obtain it;
• understand whether we process personal information, why we process it, and the categories of data subjects and information concerned;
• know the recipients, or categories of recipients, to whom personal information may be supplied;
• know whether we plan to transfer or process personal information outside the Republic, and to whom; and
• understand the security measures we have in place to protect the confidentiality, integrity and availability of personal information.

3. Contact details

4. How to request access to a record

4.1 Making a request

Complete Form 2 (Request for Access to Record), prescribed by the Regulations, and submit it to the Information Officer at the postal, physical or e-mail address in section 3, together with the request fee where applicable (see Annexure B).

• A personal requester, i.e. a person requesting a record containing their own personal information, does not pay the request fee.
• In terms of section 23 of POPIA, a data subject may, free of charge and on adequate proof of identity, ask us to confirm whether we hold personal information about them.
• If you are a client or member under any of our product offerings, you may contact our call centre on 087 012 5291 to access your information.

Your request must:

• provide enough detail for the Information Officer or Deputy Information Officer to identify the record(s) requested and to identify you;
• state the form of access required;
• give a postal address, fax number or e-mail address in the Republic;
• identify the right you are seeking to exercise or protect, and explain why the record is required for the exercise or protection of that right;
• state any other manner in which you wish to be informed of the decision, with the necessary particulars; and
• if made on behalf of another person, include proof of the capacity in which you are making the request, to the reasonable satisfaction of the Information Officer.

The Information Officer will notify you of any prescribed fee before processing your request further. If the request is granted, an access fee is payable for reproducing the record and for the time reasonably required to search for and prepare it (see Annexure B). If you are unable to complete the form, you may make the request orally and the Information Officer will assist you.

4.2 The Regulator’s Guide on how to use PAIA

In terms of section 10(1) of PAIA, the Regulator has updated and made available a revised Guide on how to use PAIA (the “Guide”), in an easily comprehensible form, for any person who wishes to exercise a right under PAIA or POPIA. The Guide is available in each of the official languages and in braille. It describes:

• the objects of PAIA and POPIA;
• the postal and street address, telephone number and e-mail address of the Information Officer of every private body, and of every Deputy Information Officer designated in terms of section 17(1) of PAIA and section 56 of POPIA;
• the manner and form of a request for access to a record of a public body (section 11 of PAIA) and of a private body (section 50 of PAIA);
• the assistance available from the Information Officer of a public body and from the Regulator in terms of PAIA and POPIA;
• all remedies in law regarding an act or failure to act in respect of a right or duty conferred or imposed by PAIA and POPIA;
• the provisions of sections 14 and 51 of PAIA requiring public and private bodies to compile a manual, and how to obtain access to a manual;
• the provisions of sections 15 and 52 of PAIA providing for the voluntary disclosure of categories of records;
• the notices issued in terms of sections 22 and 54 of PAIA regarding fees for requests for access; and
• the regulations made in terms of section 92 of PAIA.

You may inspect or copy the Guide at our head office during normal working hours, through the Information Officer. It is available there in English and Afrikaans. You can also obtain it from the Regulator:

5. Records held by NUMERAL XII

5.1 Records available on our website or on request

5.2 Records held at our head office

5.3 Records kept in terms of legislation

We keep records in accordance with the legislation applicable to us, including but not limited to:

References to legislation include subsequent amendments and secondary legislation.

6. Processing of personal information

6.1 Definitions (section 1 of POPIA)

Data subject means the person to whom personal information relates.

Person means a natural person or a juristic person.

Personal information means information relating to an identifiable, living, natural person and, where applicable, an identifiable, existing juristic person, including, but not limited to:

1. information relating to the race, gender, sex, pregnancy, marital status, national, ethnic or social origin, colour, sexual orientation, age, physical or mental health, well-being, disability, religion, conscience, belief, culture, language and birth of the person;
2. information relating to the education or the medical, financial, criminal or employment history of the person;
3. any identifying number, symbol, e-mail address, physical address, telephone number, location information, online identifier or other particular assignment to the person;
4. the biometric information of the person;
5. the personal opinions, views or preferences of the person;
6. correspondence sent by the person that is implicitly or explicitly of a private or confidential nature, or further correspondence that would reveal the contents of the original correspondence;
7. the views or opinions of another individual about the person; and
8. the name of the person if it appears with other personal information relating to the person or if the disclosure of the name itself would reveal information about the person.

Processing means any operation or activity, or any set of operations, whether or not by automatic means, concerning personal information, including:

1. the collection, receipt, recording, organisation, collation, storage, updating or modification, retrieval, alteration, consultation or use;
2. dissemination by means of transmission, distribution or making available in any other form; or
3. merging, linking, as well as restriction, degradation, erasure or destruction of information.

6.2 Purpose of processing

We collect the minimum information required and process personal information only for the purposes for which it was collected or as agreed with you. These purposes include, but are not limited to:

• providing our advice, services and products, helping you take out or maintain financial products, carrying out transactions you have requested, and maintaining our contractual relationship;
• conducting ITC checks to assess your or your company’s creditworthiness;
• assisting you with queries about your financial product;
• confirming your identity, or verifying that you are an authorised user, for security purposes;
• audit and record-keeping;
• maintaining and updating our database of clients and potential clients;
• protecting our rights in any litigation;
• informing you of changes to our website, Privacy Notice or other matters relevant to you;
• complying with our legal, regulatory and tax obligations, and with lawful requests from regulators, courts and other authorities;
• managing the employment relationship with our employees, including recruitment, payroll, benefits and statutory reporting; and
• managing our relationships with suppliers and service providers, including onboarding, payment and contract management.

6.3 Categories of data subjects and personal information

A fuller list of the types of personal information we may process is set out in Annexure A.

6.4 Recipients of personal information

Depending on the nature of the information, we may also supply personal information to:

• statutory oversight bodies, regulators and judicial commissions of enquiry requesting it;
• any court, administrative or judicial forum, arbitration, statutory commission or ombud requesting it or requiring discovery under the applicable rules (e.g. the Competition Commission in terms of the Competition Act 89 of 1998);
• a person who requires it to provide a service or product to the data subject;
• the South African Revenue Service and other government or regulatory authorities, where required by law;
• companies within the NUMERAL XII group, for legitimate business purposes;
• operators that process personal information on our behalf, such as IT, cloud-hosting, payroll and professional service providers, subject to written agreements in terms of section 21 of POPIA;
• banks and payment service providers, to process payments;
• third parties contracted to retain data on our behalf (e.g. archiving services);
• internal and external auditing and accounting bodies; and
• anyone who successfully applies for access in terms of PAIA.

6.5 Planned transborder flows of personal information

NUMERAL XII and its group companies may, from time to time, transfer personal information outside the Republic where necessary for business operations or regulatory compliance, or where service providers or group companies are located in other jurisdictions. Personal information may be transferred to or accessed in the following jurisdictions where the group has operations or related entities:

• Namibia
• Botswana
• Zimbabwe
• Mozambique
• Zambia
• Democratic Republic of the Congo
• Mauritius
• United Arab Emirates

All such transfers take place in accordance with section 72 of POPIA, which permits them only where, among other things, the recipient is subject to a law, binding corporate rules or a binding agreement that provides an adequate level of protection, the data subject consents, or the transfer is necessary for the performance of a contract with the data subject, and, where applicable, in accordance with the data protection laws of the destination country. We implement adequate safeguards to protect the integrity, security and confidentiality of personal information during such transfers.

6.6 Information security measures

Condition 7 of POPIA (security safeguards, sections 19 to 22) requires a responsible party to secure the integrity and confidentiality of personal information in its possession or under its control by taking appropriate, reasonable technical and organisational measures, and to notify the Regulator and affected data subjects of any security compromise.

We have taken reasonable technical and organisational measures to keep personal information confidential and secure, and to prevent its loss, damage, unauthorised destruction, unlawful access or unlawful processing. These include:

• Technical safeguards: encryption, firewalls and intrusion detection systems.
• Physical safeguards: protecting physical access to data storage and processing facilities.
• Organisational safeguards: policies, procedures and training to ensure compliance, including strong passwords, multi-factor authentication and regular security updates.
• Data inventory: regularly identifying and documenting all personal information we process.

We conclude written agreements with operators that process personal information on our behalf, requiring them to establish and maintain appropriate security safeguards, as required by sections 20 and 21 of POPIA. Anyone in our organisation who obtains personal information in the course of their duties must handle it confidentially, during and after their employment. In terms of section 17 of POPIA, we maintain documentation of all processing operations under our responsibility.

6.7 Your rights as a data subject

In line with Condition 5 of POPIA, we take steps to keep personal information complete, accurate and up to date. Personal information is held only for the purpose for which it was collected. You may:

• request access to your personal information (section 23 of POPIA);
• request its correction or deletion, unless we are required by law to retain it (section 24 of POPIA, using Form 2 of the POPIA Regulations); and
• object to its processing (section 11(3) of POPIA, using Form 1 of the POPIA Regulations).

To do so, contact the Information Officer using the details in section 3.

7. Grounds for refusal of access

In terms of Chapter 4 of Part 3 of PAIA, we must or may refuse a request for access on the following grounds:

1. Protection of the privacy of a third party who is a natural person (section 63). We must refuse a request if disclosure would involve the unreasonable disclosure of personal information about a third party, including a deceased individual.
2. Protection of commercial information of a third party (section 64). We must refuse a request if the record contains (a) a third party’s trade secrets; (b) a third party’s financial, commercial, scientific or technical information, other than trade secrets, the disclosure of which would be likely to harm its commercial or financial interests; or (c) information supplied in confidence by a third party, the disclosure of which could reasonably be expected to put it at a disadvantage in contractual or other negotiations, or prejudice it in commercial competition.
3. Protection of certain confidential information of a third party (section 65). We must refuse a request if disclosure would constitute an action for breach of a duty of confidence owed to a third party in terms of an agreement.
4. Protection of the safety of individuals and protection of property (section 66). We must refuse a request if disclosure could reasonably be expected to endanger the life or physical safety of an individual. We may refuse a request if disclosure would be likely to prejudice or impair the security of a building, structure or system (including a computer or communication system), or the methods or systems used to protect individuals or property.
5. Protection of records privileged from production in legal proceedings (section 67). We must refuse a request if the record is privileged from production in legal proceedings, unless the person entitled to the privilege has waived it.
6. Commercial information of NUMERAL XII (section 68). We may refuse a request if the record contains our trade secrets; financial, commercial, scientific or technical information the disclosure of which would be likely to harm our commercial or financial interests; information the disclosure of which could reasonably be expected to put us at a disadvantage in negotiations or prejudice us in commercial competition; or a computer program we own.
7. Research information of a third party and of NUMERAL XII (section 69). We must refuse a request if the record contains information about research being, or to be, carried out by or on behalf of a third party, the disclosure of which would be likely to expose the third party, a person carrying out the research, or the subject matter of the research to serious disadvantage. We may refuse a request on the same basis for research by or on behalf of NUMERAL XII.

Mandatory disclosure in the public interest (section 70). Despite the grounds above, we must grant access to a record if its disclosure would reveal evidence of a substantial contravention of, or failure to comply with, the law, or an imminent and serious public safety or environmental risk, and the public interest in disclosure clearly outweighs the harm contemplated by the relevant ground.

8. Timelines and remedies

We will decide whether to grant or refuse a request within 30 days of receiving it and will notify you of our decision, with reasons. If no decision is given within this period, the request is deemed to have been refused (section 58 of PAIA).

We may extend the 30-day period once, by no more than a further 30 days, if the request is for a large number of records or requires a search for records held at another location, and the information cannot reasonably be obtained within the original period. We will notify you in writing of any extension.

There is no internal appeal against a decision of a private body. If you are a requester or third party aggrieved by our decision (for example, a refusal of access, a decision on fees, or an extension of the time period), you may, within 180 days of the decision:

• submit a complaint to the Information Regulator in terms of section 77A of PAIA; or
• apply to a court for appropriate relief in terms of section 78 of PAIA.

9. Availability of this manual and fees

This manual is available:

• on our website, https://numeral.co.za/, free of charge;
• at our head office for public inspection during normal business hours;
• to any person on request, on payment of the prescribed reproduction fee of R2.00 per A4 page or part thereof; and
• to the Information Regulator on request.

The fees payable for a request for access to a record of a private body are prescribed in Annexure B, Part III of the Regulations and are set out in Annexure B to this manual. Where a request fee is payable, the Information Officer will notify you in writing to pay it before your request is processed (section 54(1) of PAIA). No request fee is payable by a personal requester.

For the purposes of section 54(2) of PAIA:

• a deposit is payable where the search for and preparation of a record is expected to exceed six hours;
• the deposit is one third of the access fee;
• the actual cost of postage, e-mail or other electronic transfer (if any) is payable; and
• fees may be amended by the Minister by notice in the Government Gazette.

10. Amendments

This manual has been drafted in accordance with PAIA and POPIA. In terms of section 51(2) of PAIA, the head of NUMERAL XII will review and update it regularly, and at least annually. In terms of section 51(3), the updated version will be made available on our website, at our principal place of business for public inspection during normal business hours, to any person on request and on payment of a reasonable amount, and to the Information Regulator on request.

Annexure A: Personal information that may be processed

• First name, last name and full name
• Identity number, passport number and birth certificate number
• Date of birth and age
• Gender
• Nationality
• Photographs
• Marital status
• Education records, including grades and evaluations
• Home or residential address, home postal address, e-mail address, and home telephone and fax numbers
• Personal mobile number
• Business e-mail address, postal address, and telephone, mobile and fax numbers
• Children under 18: first name, last name, birth information, identity number and home address
• Bank account numbers and credit or debit card numbers
• Details of financial transactions or account information (e.g. account balances, payment history, overdraft history and card purchase information)
• Professional licences, licence numbers and professional memberships
• Income, salary, service fees and other compensation
• User identification and/or employee number assigned by an employer
• Employment history, performance evaluations and disciplinary actions
• Employer or taxpayer identification number
• Digitised or other electronic signatures
• Background checks
• Telecommunications identifiers: Calling Line Identification (CLI), Dialled Number Identifier (DNI), International Mobile Subscriber Identity (IMSI), International Mobile Equipment Identity (IMEI) and Mobile Station International Subscriber Directory Number (MSISDN)
• Data that is or has been de-identified or masked
• Data shared or received across South African borders (see section 6.5)
• Personal information of European citizens governed by the EU General Data Protection Regulation

Annexure B: Fees payable to private bodies

Annexure B, Part III of the Regulations Relating to the Promotion of Access to Information, 2021.