1. DEFINITIONS

• “Agreement” means a written agreement between Cre8work and a Third Party.
• “Client” means any prospective, new or existing Client of Cre8work and its subsidiaries.
• “Data Subject/s” for the purpose of this document include all living individuals and juristic persons about whom Cre8work holds Personal Information.
• “Device” and “Mobile Device” means tablets, mobile or cellular phones, smartphones, handheld computers, PDAs, and laptop or notebook computers, including any accompanying software or hardware.
• “Employee/s” means any person who works for or provides services to or on behalf of Cre8work and receives or is entitled to receive any remuneration and any other person who assists in carrying out or conducting the business of Cre8work. This includes partners, directors, all permanent, temporary and part-time Employees as well as consultants, independent consultants, agency workers and contract workers.
• “Cre8work” means Molaetsa Wa Botshelo Trading & Projects T/A Cre8work, wherever situated or operating (and irrespective of structure and/or legal nature/regime) that renders services or otherwise conducts business (wherever any such members may be located, including in countries which may not have data-protection laws similar to South Africa).
• “DSAR” A Data Subject Access Request is a request addressed to Cre8work that gives Data Subjects a right to access information/records about personal information and specialised personal information the organization is processing about them and to exercise that right easily at reasonable intervals, in order to be aware of, and verify the lawfulness of the processing.
• “Image/s”, “Photograph” and “video images” refer to any kind of image capture, still or moving, obtained by any photographic device including still image cameras, video cameras, webcams and photographic enabled mobile telephones, and any other type of image capture device not specified here, whether digital or not, using technology existent from time to time The Processing (including storage) of such images includes film negative, film positive (e.g. transparencies and slides, movies, etc.), photographic paper, digital media, magnetic tape and any other kind of storage method able to be used for the storage of images, still or moving, available now or in the future;
• “Information Officer & Deputy Information Officer” means the responsible person appointed as such by Cre8work in terms of section 56 of POPIA and who will have the ultimate responsibility to ensure that Cre8work complies with the provisions of POPIA.
• “PAIA” means the Promotion of Access to Information Act, 2000.
• “Personal Information” means information relating to an identifiable, living, natural person, and (where applicable) an identifiable, existing juristic person in particular by reference to an identification number or to one or more factors specific to physical, physiological, mental, economic, cultural or social identity, including the name, race, gender, marital status, address and identifying number of a person, symbol, e-mail address, physical address, telephone number, location information, online identifier or other particular assignment to the person, recruitment details, financial history and the like. It also includes opinions about individuals as well as facts and also applies to corporate contacts.
• “POPIA” mean the Protection of Personal Information Act, 2013, including any regulations and/or code of conduct made under that Act.
• “Processing” is any activity that involves use of Personal Information. It includes any operation or activity or any set of operations, whether or not by automatic means, concerning Personal Information, including:

• the collection, receipt, recording, organisation, collation, storage, updating or modification, retrieval, alteration, consultation or use.
• dissemination by means of transmission, distribution or making available in any other form; or
• merging, linking, as well as restriction, degradation, erasure or destruction of Personal Information.
  • “Information/ Record” means any recorded information:
• regardless of form or medium, including any of the following:
• Writing on any material.
• information produced, recorded or stored by means of any tape recorder, computer equipment, whether hardware or software or both, or other Device, and any material subsequently derived from information so produced, recorded or store.
• label, marking or other writing that identifies or describes anything of which it forms part, or to which it is attached by any means.
• book, map, plan, graph or drawing.
• photograph, film, negative, tape or other Device in which one or more visual Images are embodied so as to be capable, with or without the aid of some other equipment, of being reproduced.
• in the possession or under the control of a Responsible Party.
• whether or not it was created by a Responsible Party; and
• regardless of when it came into existence.
  • “Responsible party/parties” are the people who or organisations which determine the purposes for which, and the manner in which, any personal information is processed. They have a responsibility to establish practices and policies in line with POPIA. Cre8work is the responsible party of all personal information used in its business.
  • “Special Personal Information” includes personal information concerning the religious or philosophical beliefs, race or ethnic origin, trade union membership, political persuasion, health, sex life or biometric information of a data subject; or the criminal behaviour of a data subject to the extent that such information relates to the alleged commission by a data subject of any offence; or any proceedings in respect of any offence allegedly committed by a data subject or the disposal of such proceedings

2. BACKGROUND TO THE PROMOTION OF ACCESS TO INFORMATION ACT

On 9 March 2001, the Promotion of Access to Information Act. No.2 of 2000 (‘the Act”) became operative, giving effect to the section 32(2) Constitutional right of access to information.

One of the main requirements specified in terms of section 51 the Act, is the compilation of an information manual (“PAIA Manual”) by a private body that provides information on both the types and categories of records held.

This document serves as the company’s PAIA manual which was compiled in accordance with section 51 of PAIA as amended by POPIA, which gives effect to everyone’s constitutional right to privacy. POPIA promotes the protection of Personal Information processed by public and private bodies, including certain conditions so as to establish minimum requirements for the Processing of Personal Information. POPIA amends certain provisions of PAIA, balancing the need for access to information against the need to ensure the protection of Personal Information.

Where a request is made in terms of the Act, the body to whom the request is made is obliged to release the information, subject to applicable legislative and / or regulatory requirements, except where the Act expressly provides that the information may or must not be released. The Act sets out the relevant procedure to be adopted when requesting information from a Public or a Private Body.

3. MOLAETSA WA BOTSHELO TRADING & PROJECTS T/A CRE8WORK

Cre8work was founded in 2009 as a Human Resources Solutions company, which specialises in Human Resources services that assist organisations of all sizes in the management of legislative and other necessary processes such as Employment Equity, Skills Development and Health and Safety. Our service product range has since grown to include Recruitment and Selection, Training and Development and a complete Human Resource Management solution. We employ highly qualified staff and have partnerships with organisations in complementary fields of interest. Through these relationships, we have access to highly qualified resources which compliments the range and level of service we can offer our clients.

The scope of the manual is limited to the records held by the following entities:

Molaetsa Wa Botshelo Trading & Projects T/A Cre8work

4. AVAILABILITY OF THE MANUAL

A copy of this manual is available to the public for inspection on the Company’s website at www.cre8work.co.za or on request from the designated contact person referred to in this manual.

5. PURPOSE OF THE PAIA MANUAL

• is intended to ensure that Cre8work complies with the Act and to foster a culture of transparency and accountability within by giving effect to the rights of data subjects.
• Is to empower and educate data subjects so that they

• understand their rights in terms of the Act in order for them to exercise these rights
• have a sufficient understanding of how to make a request for access to a record of a responsible party, by providing a description of the subjects on which the responsible party holds records and the categories of records held on each subject
  • In addition, this PAIA Manual complies with the requirements of Section 10 of the Act and recognises that upon commencement of the Protection of Personal Information Act 4 of 2013, that the appointed Information Regulator will be responsible to regulate compliance with the Act and its Regulations by Public and Private Bodies.

6. CONTACT DETAILS OF THE INFORMATION AND DEPUTY INFORMATION OFFICER

• The Act prescribes the appointment of an Information Officer for public bodies where such Information Officer is responsible to, inter alia, assess request for access to information. The head of a private body fulfils such a function in terms of Section 51.
• The Information Officer appointed in terms of the Act also refers to the Information Officer as referred to in the Protection of Personal Information Act 4 of 2013. The Information Officer oversees the functions and responsibilities as required for in terms of both this Act as well as the duties and responsibilities in terms of section 55 of the Protection of Personal Information Act 4 of 2013 after registering with the Information Regulator.
• The Information Officer may appoint, where it is deemed necessary, Deputy Information Officers, as allowed in terms of section 17 of the Act as well as section 56 of the Protection of Personal Information Act 4 of 2013.
• Cre8work has appointed one Deputy Information Officer to ensure fulfilment of its obligations and responsibilities as prescribed in terms of Section 55 of the Protection of Personal Information Act 4 of 2013. All requests for information in terms of the Act must be addressed to the Deputy Information Officer.

6.5       Information Officer / CEO (SECTION 51(1)(A))

The responsibility for administration of, and compliance with the Act has been delegated to the Deputy Information Officer. Requests pursuant to the provisions of the Act should be directed as follows:

6.6       Deputy Information Officer (SECTION 17)

6.7       Access to information general contacts

6.8       Head Office

7. FOR REQUESTERS A GUIDE ON HOW TO USE PAIA AND POPIA

In terms of Section 110 of the Protection of Personal Information Act 4 of 2013, the functions of the Human Rights Commission have transferred to the Information Regulator.

The Section 10 Guide compiled by the Human Rights Commission has, in terms of section 10(1) of PAIA, been amended, updated and made available by the Information Regulator. This revised Guide contains information on understanding and how to use the PAIA (“Guide”) and POPIA (Record Access), including the objectives of the Act; particulars of every Public and Private Body; the manner and form for requests; contents of the Regulations promulgated under the Act all in an easily comprehensible form and manner, as may reasonably be required by a person who wishes to exercise any right contemplated in PAIA and POPIA.

The current Revised Guide compiled by the Information Regulator is available here: https://www.justice.gov.za/inforeg/docs/misc/PAIA-Guide-English_20210905.pdf and any enquiries regarding this Guide should be directed to:

8. AUTOMATIC DISCLOSURE SECTION 52(2) (IF ANY)

At this stage no notice(s) has/have been published on the categories of records that are automatically available without a person having to request access in terms of the Section 52(2) of PAIA.

9. SUBJECTS AND CATEGORIES OF RECORDS AVAILABLE ONLY ON REQUEST TO ACCESS IN TERMS OF THE ACT (SECTION 51(1) (e))

9.1       Information/Record available in terms of other Legislation *

Where applicable to its operations, Cre8work also retains records and documents in terms of the legislation below. Unless disclosure is prohibited in terms of legislation, regulations, contractual agreement or otherwise, records that are required to be made available in terms of these acts shall be made available for inspection by interested parties in terms of the requirements and conditions of the Act; the below mentioned legislation and applicable internal policies and procedures, should such interested parties be entitled to such information. A request to access must be done in accordance with the prescriptions of the Act.

LEGISLATION SCHEDULE

* Although we have used our best endeavours to supply a list of applicable legislation, it is possible that this list may be incomplete. Whenever it comes to our attention that existing or new legislation allows a Requester access on a basis other than as set out in PAIA, we shall update the list accordingly. If a Requester believes that a right of access to a record exists in terms of other legislation listed above or any other legislation, the Requester is required to indicate what legislative right the request is based on, to allow the Information Officer the opportunity of considering the request in light thereof.

9.2       Categories and Description of the Subjects of Information/Record held (available upon request)

Cre8work maintains information/Record on the categories and subject matters listed below. Please note that recording a category or subject matter in this Manual does not imply that a request for access to such information/record would be granted. All requests for access will be evaluated on a case-by-case basis in accordance with the provisions of PAIA and POPIA.

Please note further that many of the information/records held by Cre8work are those of Third Parties, such as Clients and Employees, and Cre8work takes the protection of Third-Party confidential information/records very seriously. In particular, where Cre8work acts as professional advisors to Clients, many of the information/records held are confidential and others are the property of the Client and not of Cre8work.

9.3       Accessibility Note

Please note that the accessibility of the Information or records may be subject to the grounds of refusal set out in this PAIA Manual and Data Subject Access Procedure. Amongst others, records deemed confidential on the part of a third party, will necessitate permission from the third party concerned, in addition to normal requirements, before Cre8work will consider access.

Please ensure that requests for such Records are carefully motivated

9.4       Information/Records available without a request to access in terms of the act

Information or Records of a public nature, typically those disclosed on the Cre8work website, may be accessed without the need to submit a formal application.

Other non-confidential records, such as statutory records maintained at CIPC, may also be accessed without the need to submit a formal application, however, please note that an appointment to view such records will still have to be made with the Information Officer.

10. PROCESSING OF PERSONAL INFORMATION

In terms of POPIA, the purpose for processing Personal Information must be specific. The purpose for which Cre8work processes Personal Information will depend on the nature of the Personal Information and the particular Data Subject. This purpose is ordinarily disclosed, explicitly or implicitly, at the time the Personal Information is collected.

Please refer to the various Cre8work Privacy Policies and Notices for further information.

10.1     Planned trans boarder flows of Personal Information

Where it is necessary, for the purposes of processing, to transfer personal information outside of South Africa, we will only do so in accordance with the provisions of POPIA and PAIA.

We anticipate that personal information may be transferred outside of South Africa for purposes of cloud storage, and where we do so, we will ensure that the necessary safeguards are in place to protect personal information. These countries may not have data protection laws which are similar to those of South Africa and in these instances Prior Authorisation will be sought from the Information Regulator.

10.2     A general description of information security measures to be implemented by Cre8work

Cre8work takes appropriate and reasonable technical and organisational security measures to ensure the confidentiality, integrity and availability of Personal and other Information and records in our possession.

These technical and organisational measures are designed to ensure that all Personal and other Information and records remains confidential and secure against unauthorised or unlawful Processing and against accidental loss, destruction, or damage.

For further information, please refer to the various Cre8work Privacy Policies and Notices for further information

11. ACCESS REQUEST PROCEDURE

It is important to note that the successful completion and submission of an access request form does not automatically allow the requester access to the requested record. An application to access a record is subject to certain limitations if the requested record falls within a certain category as specified with Part 3 and Chapter 4 of the Act.

11.1     Access to information/records

PAIA

If you are entitled to make a request for access to certain information/records under PAIA, the request procedure outlined below must be utilised.

POPIA

• POPIA provides that a Data Subject may, upon proof of identity, request Cre8work to confirm, free of charge, all the Personal and Special Personal Information it holds about the Data Subject and may request access to such information, including information about the identity of Third Parties who have or have had access to such information. If such a request for access is required, the request procedure outlined below must be utilised.
• POPIA provides that a Data Subject may object, at any time, to the Processing of Personal and Special Personal Information by Cre8work, on reasonable grounds relating to his/her particular situation, unless legislation provides for such Processing. If such a request is required, the DSAR procedure must be utilised.
• A Data Subject may also request Cre8work to correct or delete Personal and Special Personal Information about the Data Subject in its possession or under its control that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or obtained unlawfully; or destroy or delete information/records of Personal and Special Personal Information about the Data Subject that Cre8work is no longer authorised to retain in terms of POPIA’s retention, destruction and restriction of Records provisions. If such a request is required, the DSAR procedure must be utilised.

12. COMPLETION AND SUBMISSION OF ACCESS REQUEST FORM

In order to facilitate a timely response to requests for access, all requesters should take note of the following when completing the Access Request Form (attached to this manual):

• The Access Request Form must be completed in full.
• Proof of Identity is required to authenticate the identity of the requester. Therefore, in addition to the access form, requestors will be required to supply a copy of their identification document.
• Complete the form in BLOCK LETTERS and answer every question.
• If a question does not apply state N/A in response to that question.
• If there is nothing to disclose in reply to a particular question state “nil” in response to that question.
• If there is insufficient space on a printed form, additional information may be provided on an attached folio.
• When the use of an attached folio is required, precede each answer with the applicable title.

The complete Access Request Form together with a copy of the identity document must be submitted by e-mail and must be addressed to the Information Officer indicated above.

13. PRESCRIBED FEES

There are two categories of fees which are payable:

• The request fee is a form of administration fee to be paid by all requesters except personal or special personal information requesters, before the request is considered and is not refundable; An initial request fee of R50.00 (including VAT) is payable on submission
• The access fee is paid by all requesters in the event that a request for access is granted. This is calculated by taking into account reproduction costs, this fee is inclusive of costs involved by the private body in obtaining and preparing a record for delivery to the requester costs, search and preparation costs, as well as postal costs.
• The Information Officer shall withhold a record until the requester has paid the fees as indicated below.

14. PAYMENT OF FEES

Payment details can be obtained from the Information Officer as indicated above and can be made via Electronic Funds Transfer. Proof of payment must be supplied.

The access fee must be paid prior to access being given to the requested record.

If the request for access is successful, an access fee may be required for the search, reproduction and/or preparation of the record(s) and will be calculated based on the Prescribed Fees.

If a deposit has been paid in respect of a request for access which is refused, then the deposit will be re-paid to the requestor.

15. NOTIFICATION

The company will within 30 days of receipt of the request decide whether to grant or decline the request and give notice with reasons to that effect. The 30-day period within which the company has to decide whether to grant or refuse the request, may be extended for a further period of not more than 30 days, if the request is for a large volume of information and the information cannot be reasonably obtained within the original 30-day period. The company will notify the requester in writing should an extension be sought.

16. GROUND FOR REFUSAL OF ACCESS TO RECORDS

The main grounds for refusal of a request for information are:

• Mandatory protection of the privacy of a third party who is natural person, who would involve the unreasonable disclosure of personal information of that natural person.
• Mandatory protection of the commercial information of a third party, if the record contains
  • Trade secrets of that party
  • Financial, commercial, scientific, or technical information which disclosure could likely cause harm to the financial or commercial Interests of that party
  • Information disclosed in confidence
  • by a third party to the company if the disclosure could put that third party to a disadvantage in negotiations or commercial competition
• Mandatory protection of confidential information of third parties if it Is protected in terms of any agreement
• Mandatory protection of the safety of individuals and the protection of property.
• Mandatory protection of the safety of individuals and the protection of property.
• Mandatory protection of records which could be regarded as privileged in legal proceedings.
• The Commercial Activities of the company which may include:
  • Trade secrets of the company
  • Financial, commercial, scientific, or technical information which disclosure could likely cause harm to the financial or commercial interests of the company.

17. PROCESSING AND PROTECTION OF PERSONAL INFORMATION

We process the personal information of various categories of people for various purposes as set out in our CRE8WORK Data and Privacy Standard available here: www.cre8work.co.za/privacy-policy.

Annexure A

.