PAIA Manual – Malfin SA (Pty) Ltd

1. Introduction

Malfin SA (Pty) Ltd (“Malfin SA”, “we”, “us”) is a private company that provides B-BBEE compliance and advisory services, Employment Equity compliance and reporting, Health & Safety compliance reviews, outsource solutions and skills development, and Youth Employment Service (Y.E.S.) programme support to South African businesses.

PAIA gives effect to the constitutional right of access to information held by private bodies where that information is required for the exercise or protection of any rights. This manual explains:

• how to request access to records held by Malfin SA;
• the categories of records we hold;
• the records that are automatically available;
• how we process personal information in terms of POPIA; and
• the grounds on which a request may be refused.

2. Company Details and Information Officer

The Information Officer is responsible for dealing with PAIA requests and for ensuring compliance with POPIA, assisted by the Deputy Information Officer. Both are registered with the Information Regulator.

3. Guide on How to Use PAIA

The Information Regulator has published a Guide on how to use PAIA and POPIA, as required by Section 10 of PAIA. The Guide contains information on the purpose of PAIA, how to make a request, the assistance available and the remedies available.

The Guide is available in all official languages:

• on the Information Regulator’s website: https://inforegulator.org.za
• on request from the Information Officer of Malfin SA (copies may be inspected at our offices during normal business hours); and
• from the Information Regulator:

4. Records Automatically Available (Section 52)

No notice in terms of Section 52(2) of PAIA has been published. The following records are, however, freely available without a formal request:

• information published on our website (https://malfinsa.co.za);
• marketing brochures and service descriptions;
• our PAIA Manual and Privacy Policy.

5. Records Available in Terms of Other Legislation

Malfin SA keeps records in accordance with the following legislation (as amended), where applicable:

• Basic Conditions of Employment Act, No. 75 of 1997
• Broad-Based Black Economic Empowerment Act, No. 53 of 2003, and the Codes of Good Practice
• Companies Act, No. 71 of 2008
• Compensation for Occupational Injuries and Diseases Act, No. 130 of 1993
• Consumer Protection Act, No. 68 of 2008
• Electronic Communications and Transactions Act, No. 25 of 2002
• Employment Equity Act, No. 55 of 1998
• Income Tax Act, No. 58 of 1962
• Labour Relations Act, No. 66 of 1995
• Occupational Health and Safety Act, No. 85 of 1993
• Promotion of Access to Information Act, No. 2 of 2000
• Protection of Personal Information Act, No. 4 of 2013
• Skills Development Act, No. 97 of 1998
• Skills Development Levies Act, No. 9 of 1999
• Tax Administration Act, No. 28 of 2011
• Unemployment Insurance Act, No. 63 of 2001
• Unemployment Insurance Contributions Act, No. 4 of 2002
• Value-Added Tax Act, No. 89 of 1991

Records held under this legislation are available only to the persons or entities specified in that legislation, or by request in terms of this manual.

6. Subjects and Categories of Records Held

The listing of a category does not mean that a request for those records will be granted. All requests are evaluated in terms of PAIA, including the grounds for refusal in Section 9 below.

7. Processing of Personal Information (POPIA)

7.1 Purpose of processing

We process personal information to:

• provide B-BBEE, Employment Equity, Health & Safety, skills development and Y.E.S. services to our clients;
• prepare clients for B-BBEE verification and statutory reporting;
• recruit, place and administer learners and youth candidates;
• employ and manage our staff;
• manage supplier and service-provider relationships;
• comply with legal, regulatory and tax obligations;
• respond to enquiries and market our services, with consent where required.

7.2 Categories of data subjects and personal information

Special personal information. B-BBEE and Employment Equity reporting requires race, gender and disability information. We process this only where permitted by POPIA, such as where it is required to comply with the B-BBEE Act and Employment Equity Act, or with the consent of the data subject.

7.3 Recipients of personal information

Personal information may be shared, on a need-to-know basis, with:

• SANAS-accredited B-BBEE verification agencies;
• the Department of Employment and Labour;
• the B-BBEE Commission and CIPC;
• the South African Revenue Service (SARS);
• Sector Education and Training Authorities (SETAs) and accredited training providers;
• the Youth Employment Service (Y.E.S.) programme and host employers;
• our auditors, legal advisers and professional advisers;
• IT, cloud and hosting service providers who act as operators on our behalf;
• law enforcement and regulators, where required by law.

7.4 Transborder flows of personal information

Some personal information may be stored on cloud servers outside South Africa (for example, our website, customer relationship management, email and document storage services). Such transfers take place only in accordance with Section 72 of POPIA, where the recipient is subject to laws, binding corporate rules or agreements providing adequate protection.

7.5 Security measures

Malfin SA takes appropriate, reasonable technical and organisational measures to protect personal information, including:

• password-protected and access-controlled systems and devices;
• restricting access to personal information to authorised staff;
• confidentiality clauses in employment and supplier agreements;
• written operator agreements with service providers that process personal information;
• antivirus, firewall and regular software updates;
• secure backups;
• secure storage and destruction of physical records;
• staff awareness of POPIA obligations.

7.6 Data subject rights

Data subjects may request access to, correction of or deletion of their personal information, and may object to its processing, by contacting the Information Officer. Complaints may be lodged with the Information Regulator (see Section 3).

8. How to Request Access to Records

1. Complete Form 2 – Request for Access to Record (PAIA Regulations, 2021), available on the Information Regulator’s website or from our Information Officer.
2. Submit the completed form to the Information Officer by email, post or hand delivery, using the details in Section 2.
3. Provide enough detail to identify the record(s) and the requester, state the form of access required, and indicate the right you seek to exercise or protect and why the record is required for that purpose.
4. If you are requesting on behalf of another person, provide proof of the capacity in which you are making the request.
5. Pay the prescribed request fee (see Section 10). Access will not be given until any applicable fees are paid.

We will respond within 30 days of receiving a complete request. This period may be extended once by up to a further 30 days in the circumstances set out in Section 57 of PAIA, in which case you will be notified. If we do not respond within the prescribed period, the request is regarded as refused (Section 58).

A requester who is unable to read or write, or who has a disability, may make the request orally, and the Information Officer will assist.

9. Grounds for Refusal of Access

Malfin SA may refuse access to records on the grounds set out in Chapter 4 of Part 3 of PAIA, including:

• protection of the privacy of a third party who is a natural person (Section 63);
• protection of commercial information of a third party (Section 64);
• protection of confidential information of a third party (Section 65);
• protection of the safety of individuals and protection of property (Section 66);
• records privileged from production in legal proceedings (Section 67);
• commercial information of Malfin SA, including trade secrets and financial, commercial or technical information that could harm our commercial interests (Section 68);
• protection of research information (Section 69).

Access must nevertheless be granted where disclosure would reveal evidence of a substantial contravention of the law or an imminent and serious public safety or environmental risk, and the public interest in disclosure clearly outweighs the harm (Section 70).

Requests that are manifestly frivolous or vexatious, or that would involve an unreasonable diversion of resources, may also be refused.

10. Fees

Fees are payable in accordance with the PAIA Regulations, 2021 (Annexure B). In summary:

A requester seeking their own personal information (“personal requester”) does not pay the request fee. If search and preparation will take more than six hours, a deposit of up to one third of the access fee may be required. Fees are subject to change by regulation.

11. Remedies

If you are not satisfied with a decision of the Information Officer, including a refusal, the fees charged, an extension or the form of access, you may within 180 days of notification of the decision:

• lodge a complaint with the Information Regulator using Form 5 (Section 77A of PAIA); or
• apply to a court with appropriate jurisdiction (Section 78 of PAIA).

Malfin SA does not have an internal appeal procedure.

12. Availability and Updating of this Manual

This manual is available:

• on our website at https://malfinsa.co.za/paia-manual;
• at our offices at 76 Wagenaar Street, Sebenza, Edenvale, 1609, for inspection during business hours, free of charge; and
• to the Information Regulator on request.

A copy may be requested from the Information Officer, subject to a fee for copies. This manual will be reviewed and updated regularly, and at least annually.