The Pietermaritzburg & Midlands Chamber of Business

Registration Number: NPC 2002/026810/08

This manual has been prepared in terms of the section 51 of the Promotion of Access to Information Act 2/2000 and to address the requirements of the Protection of Personal Information Act 4/2014.

Date Compiled: 2001

Date Updated: 28 June 2021

1. Table of Contents

1. Definitions
   1. “Client” – refers to any natural or juristic person that received or receives services from the Company;
   2. “the Company” shall mean the Pietermaritzburg & Midlands Chamber of Business (PMCB)
   3. “Conditions for Lawful Processing” – the conditions for the lawful processing of Personal Information as fully set out in chapter 3 of POPI and in paragraph 11 of this Manual;
   4. “Data Subject” – as ascribed thereto in section 1 of POPI;
   5. “Information Officer” – the duly authorised Head as defined in section 1 of PAIA;
   6. “Manual” – this manual prepared in accordance with section 51 of PAIA and regulation 4(1) (d) of the POPI Regulations;
   7. “PAIA” – the Promotion of Access to Information Act 2 of 2000;
   8. “Personal Information” – as ascribed thereto in section 1 of POPI;
   9. “Personnel” – any person who works for, or provides services to or on behalf of the Company, and receives or is entitled to receive remuneration and any other person who assists in carrying out or conducting the business of the Company, which includes, without limitation, directors (executive and non-executive), all permanent, temporary and part-time staff as well as contract workers;
   10. “POPI” – the Protection of Personal Information Act 4 of 2013;
   11. “POPI Regulations”- the regulations promulgated in terms of section 112(2) of POPI;
   12. “Private Body” – as ascribed thereto in sections 1 of both PAIA and POPI;
   13. “Processing” – as ascribed thereto in section 1 of POPI;
   14. “Requestor” – as ascribed thereto in section 1 of PAIA;
   15. “Request for Access” – as ascribed thereto in section 1 of PAIA;
   16. “SAHRC” – the South African Human Rights Commission;
   17. Any other terms not described herein will have the meaning as ascribed to it in terms of PAIA or POPI.

2. Introduction
   1. For the purpose of POPI and PAIA, the Company is defined as a private body. In accordance with the Company’s obligations in terms of POPI and PAIA, the Company has produced this
   2. This manual sets out all information required by both PAIA and
   3. This manual also deals with how requests are to be made in terms of
   4. This manual also establishes how compliance with POPI is to be

3. Contact Details

Background information of the Company can be found at www.pmcb.org.za

4.                   Guider of SAHRC

1. A guide to PAIA has been published pursuant to section 10 of
2. The guide contains information required by an individual who may wish to exercise their rights in terms of PAIA.
3. Should you wish to access the guide you may contact the SAHRC at the following details:

PAIA UNIT

Postal Address: Private Bag 2700, Houghton, 2041. Telephone: (011) 877 3600

Facsimile: (011) 403 0625 Website: http://www.sahrc.orq.za Email: PAIA@sahrc.orq.za

5.                  Latest Notices in terms of section 52(2) of PAIA

At this stage no Notice(s) has/ have been published on the categories of records that are available without having to request access to them in terms of PAIA.

6.                   Availability and publication of certain records in terms of PAIA

1. The Company hold and/or process the following records for the purposes of PAIA and

2. Information is available in terms of the following legislation, if and where applicable):
   1. Basic Conditions of Employment Act, No. 75 of 1997
   2. Companies Act, 71 of 2008
   3. Compensation for Occupational Injuries and Diseases Act, 130 of 1993
   4. Competition Act, No. 89 of 1998
   5. Constitution of the Republic of South Africa Act, 108 of 1996
   6. Credit Agreement Act, 75 of 1980
   7. The Criminal Procedure Act, 51 of 1977
   8. Debt Collectors Act, 114 of 1998
   9. Deed Registries Act, 47 of 1937
   10. Employment Equity Act, 55 of 1998
   11. Financial Intelligence Centre Act, 38 of 2001
   12. Identification Act, 68 of 1997
   13. National Credit Act, 34 of 2005
   14. Insolvency Act, 24 of 1936
   15. Inspection of Financial Institutions Act, 18 of 1998
   16. The Labour Relations Act, 66 of 1995
   17. The Long Term Insurance Act, No. 52 of 1998
   18. Pension Funds Act, 24 of 1956
   19. Short Term Insurance Act, 53 of 1998
   20. Skills Development Levies Act, 9 of 1999
   21. Unemployment Insurance Act, 63 of 2001
   22. Unit Trust Control Act, 54 of 1981
   23. Value Added Tax Act, 89 of 1991
   24. Electronic Communication and Transactions Act, 25 of 2002
   25. Financial Advisory and Intermediary Service Act, 37 of 2002
   26. Patents, Designs and Copyright Merchandise Marks Act, 17 of 1941
   27. Income Tax Act, 58 of 1962
   28. Occupational Health and Safety Act 85 of 1993
   29. Co-operatives Act 14 of 2005
   30. Customs and Excise Act 91 of 1964
   31. Insider Trading Act 135 of 1998
   32. Prevention of Organised Crime Act 121 of 1998
   33. Road Transportation Act 74 of 1977
   34. Stock Exchanges Control Act 54 of 1995
   35. Transfer Duty Act No. 40 of 1949
   36. Machinery and Occupational Safety Amendment Act 181 of 1993
   37. National Payment Systems Act 78 of 1998
   38. National Water Act 36 of 1998
   39. Prescription Act 68 of 1969
   40. Trademark Act No. 194 of 1993
   41. Intellectual Property Laws Amendment Act No.38 of 1997
   42. Financial Markets Act No. 19 of 2012

7.                   Registers and Records

1. Inspection of the company registers and records pertaining to:
   1. Directors and officers
   2. Interests of directors
   3. Members
   4. Allotments
   5. Minutes of meetings of members

6. Licences and permits
7. Trademarks and relevant information
8. Annual Reports
9. Interim Reports

8.                   Subjects and Records held by the Company

1. Incorporation documents
   1. The Company’s registration forms

2. Secretarial records
   1. Minutes of the Annual General Meeting
   2. Memorandum of Incorporation
   3. Register or list of directors of the Company
   4. Minute books of internal resolutions of the Company
3. Power of attorney agreements and a list of persons authorised to bind the Company
4. Statutory registers of the Company
   
   3. Financial records of the Company
      1. Accounting records, books and documents of the Company
      2. Interim and annual financial reports of the Company
      3. Details of the auditors of the Company
      4. Auditors’ reports in respect of audits conducted on the Company
      5. Tax returns of the Company
      6. Other documents and agreements pertaining to tax
      7. Financial records of the Company
   4. Human resources / employment records
      1. List of employees
      2. Employee benefits
      3. Arbitration orders and agreements
      4. Attendance registers
      5. Any other information pertaining to employees of the Company
   5. Provident fund records
      1. Details pertaining to the provident fund
      2. Lists of employees who belong to the provident fund
      3. Financial records pertaining to the provident fund
   6. Insurance records
      1. Funeral insurance
      2. Group life & disability insurance
      3. Retirement insurance
   7. Immovable and movable property
      1. Asset register
      2. Title deeds of any land owned by the Company
   8. Agreements for the lease or sale of land and/or other immovable property
   9. Agreements for the lease of movable property by the Company
   10. Mortgage bonds, liens, notarial bonds or security interests on property
   11. Other agreements for the purchase, ordinary sale, conditional sale, or hire of assets
       
       8. Client agreements
          1. Supplier Agreements and/or trading credit
          2. Details of clients and correspondence
          3. Invoices, receipts, credit and debit notes
       9. Miscellaneous agreements of the Company
          1. Suretyship agreements
          2. Agreements for the trading activities of the Company
          3. Agency, management agreements
          4. Agreements with suppliers of the Company
          5. Agreements with clients of the Company
          6. Credit facilities and letters of credit

10. Correspondence
    1. Correspondence with clients of the Company
    2. Correspondence with other Stakeholders

9.                   Request Process

1. An individual who wishes to place a request must comply with all the procedures laid down in The requester must complete the prescribed form, which is attached hereto as Annexure “A”. The prescribed form must be submitted as well as payment of a request fee and a deposit, if applicable to the information officer at the postal or physical address, fax number or electronic mail as is stated herein.
2. The prescribed form must be completed with enough particularity to enable the information officer to determine:
   1. The record(s) requested;
   2. The identity of the requestor;
   3. What form of access is required; and
   4. The Postal address or fax number of the
3. The requestor must state that the records are required for the requestor to exercise or protect a right, and clearly state what the nature of the right is so to be exercised or protected. An explanation of why the records requested is required to exercise or protect the right.
4. The request for access will be dealt with within 30 days from date of receipt, unless the requestor has set out special grounds that satisfy the information officer that the request be dealt with sooner.
5. The period of 30 days may be extended by not more than 30 additional days, if the request is for a large quantity of information, or the request requires a search for information held at another office of the Company and the information cannot be reasonably obtained within 30 days. The information officer will notify the requestor in writing should an extension be
6. The requestor will be informed in writing whether access to the records have been granted or denied. If the requestor requires a reason for the decision, the request must be expressed in the prescribed form, the requestor must further state what particulars of the reasoning the requestor requires.
7. If a requestor has requested the records on another individual’s behalf, the requestor must submit proof of the capacity the requestor submits the request in, to the satisfaction of the information officer.
8. If the requestor is unable to complete the prescribed form due to illiteracy or disability, the requestor may request it orally from the information officer.

10.               Grounds for refusal

The following are grounds upon which the Company may, subject to the exceptions in Chapter 4 of PAIA, refuse a request for access in accordance with Chapter 4 of PAIA:

1. Mandatory protection of the privacy of a third party who is a natural person, including a deceased person, where such disclosure of Personal Information would be unreasonable;
2. Mandatory protection of the commercial information of a third party, if the records contain:

1. Trade secrets of that third party;
2. Financial, commercial, scientific or technical information of the third party, the disclosure of which could likely cause harm to the financial or commercial interests of that third party; and/or
3. Information disclosed in confidence by a third party to The Company, the disclosure of which could put that third party at a disadvantage in contractual or other negotiations or prejudice the third party in commercial competition;
   
   3. Mandatory protection of confidential information of third parties if it is protected in terms of any agreement;
   4. Mandatory protection of the safety of individuals and the protection of property;
   5. Mandatory protection of Records that would be regarded as privileged in legal proceedings;

6. Protection of the commercial information of the Company, which may include:

1. Trade secrets;
2. Financial/commercial, scientific or technical information, the disclosure of which could likely cause harm to the financial or commercial interests of the Company;
3. Information which, if disclosed, could put the Company at a disadvantage in contractual or other negotiations or prejudice the Company in commercial competition; and/or
4. Computer programs which are owned by the Company, and which are protected by copyright and intellectual property laws;
   
   7. Research information of the Company or a third party, if such disclosure would place the research or the researcher at a serious disadvantage; and
   8. Requests for Records that are clearly frivolous or vexatious, or which involve an unreasonable diversion of resources.

11.               Remedies should a request be refused

1. The Company does not have an internal appeal procedure in light of a denial of a request, decisions made by the information officer are final;
2. The requester may in accordance with sections 56(3) (c) and 78 of PAIA, apply to a court for relief within 180 days of notification of the decision for appropriate relief.

12.               Fees

1. The fee for a copy of the manual as contemplated in regulation 9(2)(c) is R1,10 for every photocopy of an A4-size page or part thereof.
2. The fees for reproduction referred to in regulation 11(1) are as follows:

1. For every photocopy of an A4-sized page or part thereof: R1,10
2. For every printed copy of an A4-sized page or part thereof held on a computer or in electronic or machine-readable form: R0,75
3. For a copy in a computer-readable form on:
   1. Compact disc R70,00
   2. For visual images:
      1. a transcription of visual images, for an A4-size page or part thereof 40,00
      2. For a copy of visual images R60,00
   3. For an audio record:
      1. For a transcription of an audio record, for an A4-size page or part thereof R20,00
      2. For a copy on an audio record R30,00
      3. The request fee payable by a requester, other than a personal requester, referred to in regulation 11(2) is R50,00.
      4. The access fees payable by a requester referred to in regulation 11(3) are as follows: Fees are:
   4. For every photocopy of an A4-size page or part thereof R1,10
   5. For every printed copy of an A4-size page or part thereof held on a computer or in electronic or machine-readable form R0,75
   6. For a copy in a computer-readable form on compact disc R70,00
   7. For a transcription of visual images:
      1. for an A4-sized page or part thereof R40,00
      2. For a copy of visual images R60,00
   8. For a transcription of an audio record:
      1. For an A4-size page or part thereof R20,00
      2. For a copy of an audio record R30,00
   9. To search for and prepare the record for disclosure, R30,00 for each hour or part of an hour reasonably required for such search and preparation.

For purposes of section 54(2) of the Act, the following applies:

1. Six hours as the hours to be exceeded before a deposit is payable; and
2. One third of the access fee is payable as a deposit by the
3. The actual postage is payable when a copy of a record must be posted to a

8

13.               POPI

1. Conditions fort lawful processing
   1. POPI has eight conditions for lawful processing and include:
      1. Accountability
      2. Processing limitation
      3. Purpose specification
      4. Further processing limitation
      5. Information quality
      6. Openness
      7. Security safeguards
      8. Data subject participation
   2. The Company is involved in the following types of processing:
      1. Collection
      2. Recording
      3. Organization
      4. Structuring
      5. Storage
      6. Adaptation or alteration
      7. Retrieval
      8. Consultation
      9. Use
      10. Disclosure by transmission
      11. Dissemination or otherwise making available
      12. Alignment or combination
      13. Restriction
      14. Erasure
      15. Destruction
   3. The Company processes information for the following purposes:
      1. to provide services to its Clients in accordance with terms agreed to by the Clients;
      2. to undertake activities related to the provision of services, such as
         1. to fulfil domestic legal, regulatory and compliance requirements
         2. to verify the identity of Customer representatives who contact the Company or may be contacted by The Company;
         3. for risk assessment, information security management, statistical, trend analysis and planning purposes;
         4. to monitor and record calls and electronic communications with the Client for quality, training, investigation and fraud prevention purposes;
         5. to enforce or defend the Company or the Company affiliates’ rights;
         6. to manage the Company’s relationship with its clients, which may include providing information to its clients and its clients affiliates about the Company’s and the Company affiliates’ products and services;
      3. the purposes related to any authorised disclosure made in terms of agreement, law or regulation;
      4. any additional purposes expressly authorised by The Company’s client;
      5. any additional purposes as may be notified to the Client or Data Subjects in any notice provided by the Company.
   4. The Company processes personal information for the following categories of Data Subjects:
      1. Juristic persons –
   5. Corporate clients (members)
   6. Suppliers
      
      2. Natural persons –
   7. Individuals
   8. Staff
   9. Clients
   10. Suppliers

9

3. The Company process the following categories personal information:

1. Client profile information;
2. Bank account details;
3. Payment information;
4. Client representatives;
5. Names;
6. Email Addresses;
7. Telephone numbers;
8. Facsimile numbers;
9. Physical addresses;
10. Tax numbers;
11. Identity Numbers;
    1. Passport Numbers
       
       4. Recipients of Personal Information:

The Company, the Company’s affiliates, their respective representatives

5. When making authorised disclosures or transfers of personal information in terms of Section 72 of POPI, personal information may be disclosed to recipients in countries that do not have the same level of protection for personal information as South Africa does.

6. The following Security measures are implemented by the Company:
   1. The Company implements numerous Security measures to protect personal information that is stored electronically and physically.
7. Confidential records are stored under lock and key;
8. Premises are protected by security systems linked to armed response;
9. Firewall and Office 365 is protected by Microsoft
   
   2. The Company have also implemented various policies & Procedures for additional
10. Acceptable Use Policy
11. Backup and Restore Policy
12. Change Management & Control Policy
13. Clean Desk Policy
14. Data First Touch Policy
15. Database Credentials Policy
16. Direct Marketing Policy
17. Disposal & Destruction Policy
18. Exceptions Policy
19. Incident-Improvement Register
20. Incidents & Non-Conformance Procedures
    1. Information Classification Policy
21. Information Security Incident Response
22. Information Security Policy
23. Internal Audit Procedure
24. Legislation Compliance Register
25. Minimum Access Policy
26. Mutual Non-Disclosure Agreement
27. Password Policy
28. Physical Security Policy
29. POPI and Privacy Policy
30. V. Removable Media Policy
31. Request for Policy-Procedure Exception
32. Risk Assessment Risk Treatment Policy
33. Security Incidence Response Plan
34. Server Policy
35. Social Media Policy

1. Technology Disposal Policy

2. The personal information that is stored physically is protected as follows:
   1. Where physical records of the data exist, such records will be stored in a secure area that can be ‘locked-away’ as to avoid a breach of the personal information.
   2. Such physical data records will be ‘locked-away’ and secured when not in use.
3. The Company may share personal information with third parties and in certain instances this may result in cross border flow of the personal information. The personal information will always be subject to protection, not less than the protection it is afforded under the Protection of Personal Information Act No.4 of 2013.
4. Objection to the processing of personal information by a data subject:

Section 11(3) of POPI and regulation 2 of the POPI regulations provides that a data subject may, at any time object to the processing of their personal information in the prescribed form attached to this manual as annexure “B”.

10. Request for correction or deletion of personal information:

Section 24 of POPI and regulation 3 of the POPI regulations provides that a data subject may request for their personal information to be corrected and/or deleted in the prescribed form attached hereto as annexure “C”.