SA STUDENT MARKET PLACE: PAIA MANUAL

1. Purpose and Scope of this Manual

1.1. This Manual is prepared and published by Tengora (Pty) Ltd t/a SA Student Marketplace ("the Company", "we", "us" and "our"), to provide information to the public ("you" or "the requester") regarding the records held by the Company, and the procedure to be followed to request information from the Company.

1.2. This Manual must be read together with the Company's POPIA Privacy Policy and its Terms and Conditions of Use.

2. The Company

2.1. The Company conducts business in the technology, software and online services sector, and is the owner and operator of the SA Student Marketplace platform.

2.2. The particulars of the Company are as follows:

3. Information Officer

3.1. All requests in terms of PAIA, and all enquiries relating to this Manual or to the processing of personal information by the Company, must be addressed to the Information Officer:

4. Availability of this Manual

4.1. This Manual is available, free of charge:

• 4.1.1. on the Company's website at https://sastudentmarketplace.com;
• 4.1.2. at the Company's physical address, during ordinary business hours; and
• 4.1.3. on request to the Information Officer, by email.

5. The Information Regulator and Guide

5.1. The Information Regulator's contact particulars are:

5.2. The Information Regulator has, in terms of section 10 of PAIA, compiled a Guide to assist persons wishing to exercise rights under PAIA or POPIA. The Guide is available, free of charge and in each official language, on the Information Regulator's website.

6. Records automatically available

6.1. The following are made available by the Company without a request having to be made under PAIA:

• 6.1.1. the Company's POPIA Privacy Policy;
• 6.1.2. the Company's Terms and Conditions of Use;
• 6.1.3. this Manual; and
• 6.1.4. such other information as the Company may elect to publish from time to time.

7. Records held by the Company

7.1. The Company holds, where relevant to its business, records falling within the categories below. The inclusion of a category does not, of itself, mean that a request for access to a record will be granted; each request will be considered on its merits and against the grounds for refusal in Chapter 4 of Part 3 of PAIA.

7.2. Platform and user records:

• account, registration, profile and verification records;
• listing records and user-generated content;
• records of communications between users transmitted through the platform, where retained;
• transaction and Platform Fee records;
• records relating to the suspension, restriction or termination of accounts;
• support, query, complaint and dispute records; and
• cookie, technical, device, location, usage and analytics records.

7.3. Corporate, financial and tax records:

• the Memorandum of Incorporation, share register and statutory registers;
• records of directors, shareholders and beneficial owners;
• minutes of meetings and resolutions;
• accounting records, annual financial statements and management accounts;
• bank account records and records of Platform Fee receipts and disbursements; and
• income tax, value-added tax, pay-as-you-earn and other tax records.

7.4. Personnel and operational records, where applicable:

• employment contracts, contractor agreements and personnel files;
• payroll, leave, benefits, disciplinary and performance records;
• records relating to operators, service providers, suppliers, leases and insurance; and
• platform development, hosting, system logs and security records.

7.5. Marketing, legal, compliance and intellectual property records:

• marketing materials, user notifications and direct marketing records, including opt-in and opt-out preferences;
• compliance records and correspondence with regulators and law enforcement;
• internal policies, procedures and codes of practice;
• records relating to legal advice, contracts and disputes; and
• records relating to the platform's software, source code, trade marks, branding, databases and licensed material.

7.6. The recording of a category of record in this Manual does not, of itself, mean that a request for access to a record falling within that category will be granted. Each request will be considered on its own merits, and against the grounds for refusal set out in Chapter 4 of Part 3 of PAIA.

8. Applicable legislation

8.1. In addition to PAIA and POPIA, the records of the Company may be subject to the legislation listed below, in so far as applicable to its business from time to time:

• the Companies Act 71 of 2008;
• the Consumer Protection Act 68 of 2008;
• the Electronic Communications and Transactions Act 25 of 2002;
• the Cybercrimes Act 19 of 2020;
• the Copyright Act 98 of 1978 and the Trade Marks Act 194 of 1993;
• the Income Tax Act 58 of 1962, the Tax Administration Act 28 of 2011 and the Value-Added Tax Act 89 of 1991;
• the Financial Intelligence Centre Act 38 of 2001; and
• applicable employment legislation, including the Basic Conditions of Employment Act 75 of 1997, the Labour Relations Act 66 of 1995, the Employment Equity Act 55 of 1998, the Unemployment Insurance Act 63 of 2001 and the Compensation for Occupational Injuries and Diseases Act 130 of 1993.

8.2. Reference to legislation in this paragraph 8 does not, of itself, mean that records contemplated by that legislation are held by the Company.

9. Procedure for requesting access

9.1. A request for access to a record must be made on Form 2 (Request for Access to Record of Private Body) prescribed under the Regulations published in Government Gazette 45057 of 27 August 2021. Form 2 is available on the Information Regulator's website and from the Information Officer on request.

9.2. The completed Form 2 must be submitted to the Information Officer at the contact particulars set out in paragraph 3.

9.3. The requester must:

• 9.3.1. provide sufficient particulars to enable identification of the record and the requester;
• 9.3.2. indicate the form of access required;
• 9.3.3. specify a postal address, email address or facsimile number in the Republic for the response;
• 9.3.4. identify the right which the requester seeks to exercise or protect, and explain why the record is required for that purpose; and
• 9.3.5. if acting on behalf of another person, submit proof of authority to the satisfaction of the Information Officer.

9.4. A requester unable to make the request in writing because of illiteracy or disability may make the request orally. The Information Officer will, in accordance with section 53(2) of PAIA, reduce the request to writing on Form 2 and provide a copy to the requester.

9.5. The Information Officer may refuse a request on any of the grounds set out in Chapter 4 of Part 3 of PAIA, including those protecting the privacy and commercial information of third parties, the safety of persons and property, certain confidential information, legally privileged records and records relating to research.

10. Fees

10.1. The fees payable are those prescribed under PAIA from time to time, currently set out in the Regulations published in Government Gazette 45057 of 27 August 2021, as amended.

10.2. No request fee is payable for access to a record containing personal information about the requester. Every other requester must pay the prescribed request fee before the request is processed.

10.3. If the request is granted, an access fee is payable for the search, reproduction, preparation and postage of the record, calculated in accordance with the prescribed tariffs.

10.4. If the Information Officer is of the view that search and preparation will exceed six hours, a deposit of not more than one third of the access fee may be required.

10.5. No fee is payable for a request to correct personal information made in terms of POPIA.

11. Decision and notification

11.1. The Information Officer will, within 30 days of receipt of the request, decide whether to grant or refuse the request and notify the requester in writing on Form 3.

11.2. The 30-day period may be extended once, in the circumstances contemplated in section 57 of PAIA, by a further period of not more than 30 days.

11.3. Where the request is granted, the notification will state the access fee payable, the form of access and the procedure for accessing the record. Where the request is refused, the notification will state adequate reasons with reference to PAIA, the requester's rights of complaint and review, and the applicable procedure and time limits.

12. Remedies

12.1. A requester who is dissatisfied with the Information Officer's decision may:

• 12.1.1. lodge a complaint with the Information Regulator, on Form 5, in terms of section 77A of PAIA; or
• 12.1.2. apply to the High Court for appropriate relief in terms of section 78 of PAIA.

12.2. A complaint to the Information Regulator must be lodged within 180 days of the decision, unless the Information Regulator condones a longer period in terms of section 77B of PAIA.

12.3. The Company does not provide an internal appeal procedure, as PAIA does not require a private body to do so.

13. Forms

13.1. The relevant prescribed forms are:

• 13.1.1. Form 2: Request for Access to Record of Private Body;
• 13.1.2. Form 3: Outcome of Request and of Fees Payable; and
• 13.1.3. Form 5: Complaint to the Information Regulator.

13.2. The forms are available, free of charge, on the Information Regulator's website and from the Information Officer on request.

14. Updates to this Manual

14.1. This Manual will be updated when there is a material change to the records held by the Company, the Company's particulars, the Information Officer or the applicable law.

14.2. The latest version will be made available in the manner described in paragraph 4.