PAIA POPI Manual

MANUAL
in the context of SECTION 51 of the Promotion of Access to Information Act, 2 of 2000 (“PAIA”)
as amended by the Protection of Personal Information Act, 4 of 2013
(“POPIA”)

1. SCOPE OF THE MANUAL

1.1 This POPIA and PAIA Manual (the “Manual”) applies in respect of The Livekindly Company, Inc, and its subsidiaries and affiliates, including Fry Group Foods (Pty) Ltd. (“Livekindly”, “Company”, “we”, “our”).

2. MANUAL

2.1 This Manual has been prepared in compliance with section 51 of PAIA, as well as regulation 4(c) of POPIA, and is designed to:
2.1.1 provide the necessary information to facilitate access to records in accordance with the provisions of PAIA;
2.1.2 assist any natural or juristic person requesting access to a record that is under the control of Livekindly with the procedure to be followed, as contemplated in PAIA and/or POPIA;
2.1.3 provide notification to Data Subjects of the purpose for which Personal Information is processed, and the standards which Livekindly applies in complying with its obligations in terms of POPIA; and
2.1.4 to inform Data Subjects about how Livekindly Processes their Personal Information by, inter alia, collecting or collating, receiving, recording, storing, updating, distributing, erasing or destroying, disclosing and/or generally using the Data Subject’s Personal Information.
2.2 It may be amended from time to time, and such amendments will be published in accordance with law.
2.3 This is the POPIA and PAIA Manual referred to in the Terms of Use and Privacy Policy of Livekindly.
2.4 This Manual is available:
2.4.1 at the offices of Livekindly (at the address in section 3 below);
2.4.2 at the offices of the Information Regulator (at the address in section 4 below); and
2.4.3 on the Livekindly website (at the address in section 3 below).
2.5 Capitalised terms used in this Manual, will have the meaning assigned in POPIA and/or PAIA, unless it is clear from the context that is not intended.

3. INFORMATION OFFICER

PAIA prescribes the appointment of the Information Officer for both private and public bodies. The head of a private body is automatically the Information Officer unless that role is authorised to another person. The Information Officer has the responsibility to deal with any requests made in terms of PAIA and is also responsible for ensuring compliance with POPIA. Fry Family Food has opted to appoint an Information Officer.The responsibility for managing compliance with PAIA and POPIA and the related administration, have been delegated to the Information Officer. Requests for access to records should be directed to the Information Officer, as follows:Information Officer: Kieran Bauristhene
Physical Address: Fry Group Foods (Pty) Ltd, 8 Ficus Place, Mahogany Ridge, Westmead South Africa 3610 Westville, 3635, KwaZulu-Natal
Telephone Number: +27 31 700 3022
E-mail Address: privacy@thelivekindlyco.com

4. DESCRIPTION OF GUIDE IN TERMS OF SECTION 10 OF PAIA

4.1 The task of submitting a PAIA request can be certainly be daunting. In order to assist those
unfamiliar with PAIA requests, the South African Human Rights Commission (“the SAHRC”) has put together a guide (the “Guide”) that contains information to assist you in understanding how to exercise your rights under PAIA. The Guide is currently available in all the official languages of South Africa and is available for inspection by the public at:Physical address: The offices of the Human Rights Commission
Braampark Forum 3, 33 Hoofd Street, Braamfontein,
Telephone number: 011 877 3600
Website: www.sahrc.org.za.4.2 As regards the POPIA amendments to PAIA, the Information Regulator of South Africa is obliged to update and make available the existing Guide that has been compiled by the SAHRC containing such information as may reasonably be required by a person who wishes to exercise any right contemplated in POPIA and PAIA. The Guide is available at the offices of the Information Regulator:Physical Address JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001
Website: https://www.justice.gov.za/inforeg/
E-mail Address: inforeg@justice.gov.za or complaints.IR@justice.gov.za

5. AUTOMATIC DISCLOSURE

5.1 The purpose of PAIA is to make access to information easier for everyone. It does this by suggesting that entities, such as Fry Family Food, voluntarily compile categories of documents and information (records) that you may request, without having to go through the formal PAIA request process.
5.2. Information on the Fry Food Website is automatically available and does not need to be formally requested in terms of the PAIA request process. Fry Family Food materials such as brochures, press releases, publications and marketing material are also automatically available.

6. RECORDS AND LEGISLATION

6.1 Livekindly is a plant-based food company, which, inter alia, manufactures vegetarian meat alternatives with multiple operating divisions and storage facilities across South Africa.
6.2 Livekindly keeps the records required in order to comply with all legislation which may be applicable to its business operations from time to time, however, due to the large number of applicable laws, and the diversity of our business, the list below of categories of records and of legislation, are by no means exhaustive.
6.3 Categories of records:
Human Resources records
Secretarial Statutory records
Administrative records
Banking and Financial records
Health and safety data and records
Property records
Product records
Information technology records
Share registration records
Insurance records
Pension records
Patents and trademarks records
Promotions and competition records
Credit records
Legal records
Customer records
Service Provider/Supplier/Contractor records
Occupational Health & Safety records
Marketing Records
6.4 Legislation
Basic Conditions of Employment Act 75 of 1997
Companies Act 71 of 2008
Compensation for Occupational Injuries and Diseases Act 130 of 1993
Competition Act 89 of 1998
Constitution of the Republic of South Africa, 1996
Consumer Protection Act 68 of 2008
Electronic Communications and Transactions Act 25 of 2002
Compensation for Occupational Injuries and Diseases Act 130 of 1993
Employment Equity Act 55 of 1998
Income Tax Act 58 of 1962
Insolvency Act 24 of 1936
Labour Relations Act 66 of 1995
National Credit Act 34 of 2005
Occupational Health and Safety Act 85 of 1993
Pension Funds Act 24 of 1956
Skills Development Act 97 of 1998
Tax Administration Act 28 of 2011
Tax on Retirement Funds Act 38 of 1996
Unemployment Insurance Act 63 of 2001
Value Added Tax Act 89 of 1991
Regulation of Interception of Communications and Provision of Communication-Related Information Act 70 of 2002
6.5 The inclusion of any category of records, or any particular legislation should not be taken to mean that records falling within that category will be made available under PAIA.
In particular, certain grounds of refusal as set out in PAIA may be applicable to a request for such records.

7. REQUEST FOR ACCESS TO RECORDS

7.1 Form and fees:
7.1.1 A request for access to any record must be made using the form prescribed by PAIA, which must:
(a) be completed clearly and legibly;
(b) provide sufficient detail to enable the Information Officer to identify the record and the requester;
(c) include proof of the capacity in which the requester is making the request, if the request is made on behalf of a person;
(d) indicate the form of access which is required;
(e) provide a postal address or email address in South Africa;
(f) if the requester wishes to be informed of the decision on the request in a manner other than by written reply, provide the necessary particulars; and
(g) identify the right the requester is seeking to exercise or protect, and provide an explanation of why the requested record is required for the exercise or protection of that right.
7.1.2 The completed request form must be submitted to the Information Officer, using the contact details as provided in section 3 of this Information Manual, and must be accompanied by:
(a) a copy of the requester’s identify document;
(b) where the requester is acting on behalf of someone else, proof of the capacity in which the requester is making the request, to the reasonable satisfaction of the Information Officer; and
(c) proof of payment of the prescribed fee/s (payment details can be obtained from the Information Officer).
7.1.3 The most recent forms and fee structure prescribed under PAIA are available from the Government Gazette, or at the website of the Department of Justice and Constitutional Development:
https://www.justice.gov.za/paia/paia.htm and https://www.justice.gov.za/forms/form_paia.htm
7.2 Timelines
7.2.1 Once a valid request for access by a requester is received by the Information Officer, it will be granted or refused within thirty days, unless the request contains considerations that are of such a nature that an extension of the thirty day time limit is necessary, in which case you will be notified with reasons for the extension.
7.2.2 If the Information Officer fails to communicate a decision on a request, such a request is then deemed to have been refused.
7.2.3 If the request is granted, then you must pay a further access fee/s for the reproduction, search and preparation of the records for disclosure, as well as for any time that has exceeded the prescribed hours. As indicated above, the most recent forms and fee structure prescribed under PAIA are available from the Government Gazette, or at the website of the Department of Justice and Constitutional Development: https://www.justice.gov.za/paia/paia.htm and https://www.justice.gov.za/forms/form_paia.htm
7.3 Grounds for Refusal
7.3.1 A request for access by a Requestor must be refused by the Information Officer if:
(a) the disclosure would involve the unreasonable disclosure of personal information about a third party (natural person), including a deceased individual;
(b) the record contains (a) trade secrets of a third party, (b) financial, commercial, scientific or technical information, other than trade secrets, of a third party, the disclosure of which would be likely to cause harm to the commercial or financial interests of that third party, or (c) information supplied in confidence by a third party the disclosure of which could reasonably be expected to put that third party at a disadvantage in contractual or other negotiations; or to prejudice that third party in commercial competition;
(c) the disclosure of the record would constitute an action for breach of a duty of confidence owed to a third party in terms of an agreement;
(d) the disclosure could reasonably be expected to endanger the life or physical safety of an individual;
(e) the record is privileged from production in legal proceedings unless the person entitled to the privilege has waived the privilege; or
(f) the record contains information about research being or to be carried out by or on behalf of a third party, the disclosure of which would be likely to expose: (i) the third party; (ii) a person that is or will be carrying out the research on behalf of the third party; or (iii) the subject matter of the research, to serious disadvantage.
7.3.2 A request for access by a Requestor may be refused by the Information Officer if:(a) the disclosure would be likely to prejudice or impair: (a) the security of: (i) a building, structure or system, including, but not limited to, a computer or communication system; (ii) a means of transport; or (iii) any other property; or (b) methods, systems, plans or procedures for the protection of: (i) an individual in accordance with a witness protection scheme; (ii) the safety of the public, or any part of the public; or (iii) the security of property contemplated in subparagraph (a) (i), (ii) or (iii);
(b) the record: (a) contains trade secrets of Livekindly; (b) contains financial, commercial, scientific or technical information, other than trade secrets, the disclosure of which would be likely to cause harm to the commercial or financial interests of Livekindly; (c) contains information, the disclosure of which could reasonably be expected: (i) to put Livekindly at a disadvantage in contractual or other negotiations; or (ii) to prejudice Livekindly in commercial competition; or (d) is a computer program, as defined in section 1(1) of the Copyright Act No. 98 of 1978, owned by Livekindly, except insofar as it is required to give access to a record to which access is granted in terms of PAIA; or
(c) the record contains information about research being or to be carried out by or on behalf of Livekindly, the disclosure of which would be likely to expose: (a) Livekindly; (b) a person that is or will be carrying out the research on behalf of Livekindly; or (c) the subject matter of the research, to serious disadvantage.7.4 Remedies on Refusal of AccessIf you are not satisfied with the outcome of your request, you are entitled to approach the Information Regulator or apply to a court of competent jurisdiction to take the matter further. Livekindly does not have any internal appeal procedures that may be followed once a request to access information has been refused.

8. PROCESSING OF PERSONAL INFORMATION IN TERMS OF POPIA

8.1 This Manual applies to Personal Information collected by Livekindly in all aspects of the operation of its business. Livekindly will always collect Personal Information in a fair, lawful and reasonable manner to ensure that it protects the Data Subject’s privacy, and will Process the Personal Information based on legitimate grounds in a manner that does not adversely affect the Data Subject in question.
8.2 Lawful Processing of Personal Information
8.2.1 Where Livekindly is the Responsible Party, it will only Process a Data Subject’s Personal Information where:
(a) Processing is necessary to carry out the actions for conclusion or performance of a contract to which a Data Subject is party;
(b) Processing complies with an obligation imposed by law on Livekindly;
(c) Processing protects a legitimate interest of the Data Subject;
(d) Processing is necessary for pursuing the legitimate interests of Livekindly or of a third party to whom the information is supplied; and/or
(e) Consent of the Data Subject (or a competent person, where the Data Subject is a Child) is obtained.
8.2.2 Where Livekindly is relying on a Data Subject’s consent as the legal basis for Processing Personal Information, the Data Subject may withdraw his/her/its consent or may object to Livekindly Processing of the Personal Information at any time. However, this will not affect the lawfulness of any Processing carried out prior to the withdrawal of consent or any Processing justified by any other legal ground provided under POPIA.8.2.3 If the consent is withdrawn or if there is otherwise a justified objection against the use or the Processing of such Personal Information, Livekindly will ensure that the Personal Information is no longer Processed.8.3 Special Personal Information and Personal Information of Children8.3.1 Special Personal Information is sensitive Personal Information of a Data Subject and Livekindly acknowledges that it will generally not Process Special Personal Information unless:
(a) processing is carried out in accordance with the Data Subject’s consent;
(b) processing is necessary for the establishment, exercise or defence of a right or obligation in law;
(c) processing is for historical, statistical or research purposes, subject to stipulated safeguards;
(d) information has deliberately been made public by the Data Subject; or
(e) specific authorisation has been obtained in terms of POPIA.
8.3.2 Livekindly acknowledges that it may not Process any Personal Information concerning a Child and will only do so where it has obtained the consent of the parent or guardian of that Child or where it is permitted to do so in accordance with applicable laws.
8.4 Notification of the Purpose of the Processing of Personal Information:
8.4.1 Livekindly will Process Personal Information only in ways that are for, or compatible with, the purposes for which the data was collected, or that are subsequently authorised by the relevant natural or juristic person to whom Personal Information relates.
8.4.2 Livekindly will retain Personal Information only for as long as is necessary to accomplish Livekindly legitimate business purposes, or for as long as may be permitted or required by applicable law.
8.4.3 Livekindly coperates a central/shared services platform, in terms of which Livekindly Process Personal Information on behalf of other Livekindly, and to this end Personal Information will be shared between Livekindly from time to time in terms of the Data Processing Agreement concluded between them.
8.4.4 Livekindly processes the Personal Information it collects for following, non-exhaustive, purposes:
(a) providing its products or services to customers and where relevant, for purposes of doing appropriate customer onboarding and credit vetting, and this may include engaging third-party credit vetting agencies;
(b) order management, including billing, credit analysis, shipping, account maintenance, and internal administration and accounting for all commercial relationships; managing and analysing sales and demand; communications; business operations; Customer relationship management, invoicing, and collecting payment from customers, including engaging third party service providers to recover outstanding amounts;
(c) obtaining products or services from suppliers and service providers, and for purposes of onboarding such suppliers/service providers as approved vendors of Livekindly, including the vetting and verification thereof;
(d) the execution of payment processing functions, including receipt and payment of Livekindly suppliers’/service providers’ invoices;
(e) evaluating and procuring raw materials, other inputs and supplies to enable Livekindly to develop, manufacture, package, and deliver its products to its customers;
(f) allowing access to and use of Livekindly electronic and/or online systems and tools, including websites, and applications by any Data Subject, as well as monitoring such use;
(g) preventing, discovering and investigating violations of this Manual and other Livekindly policies and procedures, as well as investigating fraud, or other similar matters;
(h) to provide a service to Livekindly Group Members in terms of the central/shared services arrangements;
(i) for employment-related purposes such as recruiting staff, administering payroll, background checks, etc. For this purpose, Livekindly will also Process Personal Information of staff members of the Livekindly pursuant to the central/shared services arrangements;
(j) internal audit (i.e. ensuring that the appropriate internal controls are in place in order to mitigate the relevant risks, as well as to carry out any investigations where this is required), and other internal control activities relating to contracts; management with Customers, suppliers, vendors, subcontractors and business partners; compliance; reporting activities to fulfil finance and accounts requirements; risk management and corporate audits and assessments; internal investigations; legal filing and reporting; risk management and corporate audits and assessments;
(k) external audit;
(l) company secretarial, including communications with stakeholders and regulatory bodies. For these purposes, Livekindly will, from time to time, collect information relating to Data Subjects from third parties such as the Companies and Intellectual Property Commission, an agency of the Department of Trade and Industry in South Africa;
(m) any legal and other regulatory type proceedings;
(n) to respond to any correspondence that Livekindly customers, suppliers, service providers, and other third parties may send to Livekindly, including via email or by telephone;
(o) facilitate access to any of its premises;
(p) to contact the Data Subject for direct marketing purposes subject to the provisions of Section 9 below;
(q) in order to address consumer complaints in respect of Livekindly products and services;
(r) the implementation of promotional competitions;
(s) complying with and responding to regulatory requests and investigations;
(t) for such other purposes to which the Data Subject may consent from time to time; and
(u) for such other purposes as authorised in terms of any applicable law.
8.4.5 For any of these purposes Livekindly from time to time engages external service providers and, in so doing, shares Personal Information of the Data Subjects with such third parties.
8.5 Categories of Data Subjects and of the Personal Information relating thereto:
8.5.1 Data Subjects in respect of which Personal Information is Processed include customers, principals, suppliers, service providers, consultants, contractors, employees (and their dependents), job applicants, suppliers, service providers, consultants, and/or contractors of Livekindly.
8.5.2 Livekindly collects Personal Information directly from the Data Subject and/or in some cases from third parties, and where it collects from Third Parties will ensure that it does so lawfully.
8.5.3 Examples of third parties from whom Personal Information is collected include other Livekindly affiliates and subsidiaries; customers and/or principals when Livekindly handles Personal Information on their behalf, regulatory bodies; verification agencies; recruitment agencies; other entities providing goods and/or services to Livekindly; and where Livekindly makes use of publicly available sources of information.
8.6 In particular, Livekindly processes the following, non-exhaustive list, of personal information:
First name or initial, last name, entity name
Mail address or geographic location
E-mail address
Telephone number and/or fax number
Unique national, provincial or local identifiers (e.g. passport, tax ID number, ID number, registration number, masters reference number, CK number)
any other identifier that permits the physical or online contacting of a specific data subject (e.g. user ID, phone numbers, physical addresses)
Date of birth
Age
Gender
Physical characteristics, where relevant (e.g., height, weight, hair)
Full-face photographic images (and comparable images)
audio-visual or other media recordings
Marital status
Education and training
Bank account numbers
income related information
Device identifiers (such as serial numbers)
URLs and IP addresses
Vehicle identifiers (such as license plate number)
Family and/or dependant personal information
Conversations (voice recordings, transcripts, or messages)
Employment history
8.7 Recipients or categories of recipients to whom Personal Information may be supplied:
8.7.1 Livekindly may be required to disclose Personal Information in response to a court order, subpoena, civil discovery request, other legal process, or as otherwise required by law as per statutory authorities and/or the lawful order of any Court or any administrative or statutory commission, tribunal forum or body, South African Revenue Service, or the employee pension and provident funds.
8.7.2 Livekindly may disclose Personal Information when we believe disclosure is necessary to comply with the law or to protect the rights, property, or safety of Livekindly, our customers and principals, or others.
8.7.3 Livekindly will comply with POPIA before transferring Personal Information to a third party who is not a contractor of Livekindly. Before transferring Personal Information to a third party contractor, such as an authorised service provider, Livekindly will obtain assurances from the third party that it will Process Personal Information in a manner consistent with POPIA. Where Livekindly learns that a third party contractor is using or disclosing Personal Information in a manner contrary to POPIA, Livekindly will take reasonable steps to prevent such use or disclosure.
8.8 Planned Transborder Flows of Personal Information:
Livekindly may transfer Personal Information to other entities in its group outside of South Africa, as well as to a third party who is in a foreign country in order to administer certain services, and for storage purposes. In carrying out any cross-border transfers, Livekindly shall adhere to the provisions of POPIA.
8.9 Information Security Measures:
8.9.1 The security and confidentiality of Personal Information is important to Livekindly. We have implemented reasonable technical, administrative, and physical security measures to protect Personal Information from unauthorised access or disclosure and improper use. Livekindly may store your Personal Information in hardcopy format and/or in electronic format using Livekindly own secure on-site servers or other internally hosted technology. Your Personal Information may also be stored via cloud services or other technology, by third parties with whom Livekindly has contracted with, to support Livekindly business operations.
8.9.2 We are committed to ensuring that our security measures which protect your Personal Information are continuously reviewed and updated where necessary.
8.9.3 Livekindly third party service providers, including data storage and processing providers, may from time to time also have access to a Data Subject’s Personal Information in connection with purposes for which the Personal Information was initially collected to be Processed. Livekindly will ensure that such third party service providers employ at least the same level of security that Livekindly uses to protect your personal data.
8.10 Retention
8.10.1 In terms of POPIA, Livekindly will not retain personal information for a period longer than is necessary to achieve the purpose for which it was collected or processed. This prohibition will not apply in the following circumstances:
(a) where the retention of the record is required or authorised by law;
(b) Livekindly requires the record to fulfil its lawful functions or activities;
(c) retention of the record is required by a contract between the parties thereto;
(d) the data subject (or competent person, where the data subject is a child) has consented to such longer retention; or
(e) the record is retained for historical, research or statistical purposes provided safeguards are put in place to prevent use for any other purpose,
whereafter Livekindly will ensure that the Personal Information is deleted, destroyed or de-identified sufficiently so that a person cannot re-identify such Personal Information.

9. PERSONAL INFORMATION FOR DIRECT MARKETING PURPOSES

9.1 To the extent that Livekindly acts in its capacity as a Direct Marketer, it shall strive to observe, and comply with its obligations under POPIA when implementing principles and practices in relation to Direct Marketing.
9.2 Livekindly acknowledges that it may only use Personal Information to contact the Data Subject for purposes of Direct Marketing from time to time where it is permissible to do so.
9.3 It may use Personal Information to contact any Data Subject and/or market Livekindly products /services directly to the Data Subject(s) if the Data Subject is one of Livekindly existing customers, or the Data Subject has requested to receive marketing material from Livekindly, or Livekindly has the Data Subject’s consent to market its services directly to the Data Subject.
9.4 If the Data Subject is an existing client, Livekindly will only use its Personal Information if it has obtained the Personal Information through the provision of a product/ service to the Data Subject and only in relation to similar products/services to the ones Livekindly previously provided to the Data Subject.
9.5 Livekindly will ensure that a reasonable opportunity is given to the Data Subject to object to the use of their Personal Information for Livekindly marketing purposes when collecting the Personal Information, and on the occasion of each communication to the Data Subject for purposes of Direct Marketing. Requests to opt-out of marketing should be made via forms and links provided for that purpose in the marketing materials sent.

10. FAILURE TO PROVIDE PERSONAL INFORMATION

10.1 Should Livekindly need to collect Personal Information by law or under the terms of a contract or relationship that Livekindly may have with you, and you fail to provide the Personal Information when requested, we may be unable to perform the contract we have or are attempting to enter into with you.
10.2 In such a case, Livekindly may have to decline to provide or receive the relevant services or continue with the relationship, and you will be notified where this is the case.

11. ACCESS TO PERSONAL INFORMATION

11.1 POPIA read with the relevant provisions of PAIA confer on natural persons and where applicable, juristic persons whose Personal Information is processed, certain rights. These rights include:
11.1.1 A right of access:a Data Subject has the right to: (i) request a Responsible Party to confirm whether any Personal Information is held about the Data Subject; and/or (ii) request from a Responsible Party a description of the Personal Information held, and third parties who have or have had access to the Personal Information.
11.1.2 A right to request correction or deletion:a Data Subject may, in the prescribed form, request Livekindly to:(a) correct or delete Personal Information about the Data Subject in its possession or under its control that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or obtained unlawfully; or(b) destroy or delete a record of Personal Information about the Data Subject that Livekindly is no longer authorised to retain in terms of POPIA.
11.1.3 A right to object to processing:
any Data Subject that has previously consented to the Processing of its Personal Information has the right to withdraw consent and may do so by providing Livekindly with notice, in the prescribed form at the address in section 3 above. Furthermore, a Data Subject may object, on reasonable grounds, to the Processing of Personal Information relating to it.