PAIA Manual & POPIA Privacy Notice

Email Address	letsmove@valorcargo.co.za
Website	valorcargo.co.za
Information Officer	Anke Mostert
Information Officer email	letsmove@valorcargo.co.za
Effective date	2 November 2026
Review date	2 November 2027 (or earlier if required)
Version	Version 1.2 – approved 2 November 2026

Company: Crowned With Purpose (Pty) Ltd T/A Valor Cargo
Document owner: Information Officer
Approval status: Approved for publication
Approved by: Anke Mostert – Director and registered Information Officer
Approval date: 2 November 2026
Contact number: 076 421 6354
Email: letsmove@valorcargo.co.za
Website: valorcargo.co.za

1. INTRODUCTION AND PURPOSE

1.1 This Manual has been prepared by Crowned With Purpose (Pty) Ltd T/A Valor Cargo ("the Company"), a private body operating in the transport brokerage and logistics sector in the Republic of South Africa.

1.2 The purpose of this Manual is to promote transparency, facilitate access to records held by the Company in accordance with the Promotion of Access to Information Act 2 of 2000 ("PAIA"), and explain how the Company collects, processes, stores, uses, protects and, where legally permitted, discloses personal information in accordance with the Protection of Personal Information Act 4 of 2013 ("POPIA").

1.3 The Company acts as a transport broker/intermediary and facilitates and administers transport arrangements between customers requiring the movement of goods and independent transporters, carriers, subcontractors or other logistics service providers. The Company does not itself undertake the physical carriage of goods unless its actual contractual arrangements provide otherwise. It may facilitate arrangements for carriers undertaking domestic or cross-border loads.

1.4 The Company is currently operated solely by its Director, Anke Mostert, and has no employees. It may process commercial, operational, financial, contractual and personal information relating to customers, suppliers, independent transporters and their drivers, representatives, consignees and other stakeholders.

1.5 This Manual is intended to:

a. inform members of the public of the categories of records held by the Company;

b. explain how a person may request access to records;

c. identify records that may be accessed without a formal PAIA request;

d. describe the purposes and categories of personal information processed by the Company;

e. explain the rights of data subjects under POPIA;

f. outline the security measures and internal procedures adopted to protect information; and

g. identify the person responsible for administering requests and overseeing compliance.

1.6 This Manual must be read together with the Company's applicable privacy notices, employment policies, contractual terms, records-retention procedures, information-security policies and other relevant compliance documents.

2. LEGISLATIVE FRAMEWORK

The Company has regard, where applicable, to the following legislation:

2.1 Promotion of Access to Information Act 2 of 2000, as amended.

2.2 Protection of Personal Information Act 4 of 2013.

2.3 Regulations issued under PAIA and POPIA.

2.4 Companies Act 71 of 2008.

2.5 Electronic Communications and Transactions Act 25 of 2002.

2.6 Consumer Protection Act 68 of 2008, where applicable.

2.7 National Road Traffic Act 93 of 1996, to the extent relevant to the Company's activities and records.

2.8 Labour Relations Act 66 of 1995 and Basic Conditions of Employment Act 75 of 1997, in respect of employment-related records.

2.9 Employment Equity Act 55 of 1998, where applicable.

2.10 Occupational Health and Safety Act 85 of 1993, where applicable.

2.11 Value-Added Tax Act 89 of 1991 and other applicable tax legislation.

2.12 Any other legislation applicable to the Company's operations, contractual relationships, financial records, transport arrangements or information-processing activities.

The inclusion of legislation in this list does not mean that every provision applies to every activity undertaken by the Company.

3. DEFINITIONS

For purposes of this Manual:

3.1 “Company” means Crowned With Purpose (Pty) Ltd T/A Valor Cargo.

3.2 "Data subject" means the person to whom personal information relates.

3.3 "Information Officer" means the person designated and registered, where required, to perform the relevant statutory functions under PAIA and POPIA.

3.4 "Operator" means a person or organisation that processes personal information for the Company under a contract or mandate, without being under the direct authority of the Company, as contemplated by POPIA.

3.5 "Personal information" means information relating to an identifiable, living natural person and, where applicable, an identifiable existing juristic person, as defined in POPIA.

3.6 "Processing" includes the collection, receipt, recording, organisation, storage, retrieval, use, transmission, disclosure, restriction, erasure or destruction of personal information.

3.7 "Requester" means a person seeking access to a record under PAIA.

3.8 "Record" means recorded information in the possession or under the control of the Company, regardless of form or medium.

3.9 "Responsible party" means the public or private body or other person that determines the purpose of and means for processing personal information, as defined in POPIA.

3.10 "Special personal information" means information falling within the special categories regulated by POPIA, such as religious or philosophical beliefs, race or ethnic origin, trade-union membership, political persuasion, health or sex life, biometric information, and criminal behaviour information, subject to the Act's definitions and exceptions.

4. COMPANY DETAILS AND INFORMATION OFFICER

4.1 The Company's details are set out on the cover page of this Manual.

4.2 The Information Officer is responsible for overseeing the administration of PAIA requests and promoting compliance with POPIA.

4.3 The Information Officer's responsibilities include:

a. encouraging compliance with the conditions for lawful processing of personal information;

b. facilitating and responding to requests for access to records;

c. developing, implementing and monitoring an appropriate privacy compliance framework;

d. ensuring that appropriate measures are taken to identify and mitigate risks to personal information;

e. maintaining and making available this Manual;

f. maintaining appropriate privacy and information-security practices for the Director and any authorised contractors or service providers;

g. assisting with complaints and investigations by the Information Regulator; and

h. ensuring that the Company maintains appropriate procedures for the handling of personal information security compromises.

4.4 The Company's Information Officer, Anke Mostert, has been registered with the Information Regulator and the Company confirms that a registration certificate has been received.

4.5 The Company has not designated a Deputy Information Officer. The need for any Deputy Information Officer will be reconsidered if the Company's size, structure or operational requirements change.

Deputy Information Officer: None appointed. The Company is currently operated solely by its Director, Anke Mostert, and has no employees. The Information Officer remains the contact person for PAIA and POPIA matters.

Information Officer / Director: Anke Mostert
Email: letsmove@valorcargo.co.za
Telephone: 076 421 6354

5. GUIDE ON HOW TO USE PAIA

5.1 The Information Regulator has published a guide explaining how to exercise rights of access to information under PAIA.

5.2 The guide is available from the Information Regulator's official website:

https://inforegulator.org.za/

5.3 A requester may consult the guide to understand the rights and procedures available under PAIA and may contact the Information Officer for assistance in identifying the appropriate procedure for requesting access to a Company record.

5.4 The Company will use the applicable prescribed request forms and procedures in force at the time a request is submitted.

6. CATEGORIES OF RECORDS HELD BY THE COMPANY

The Company may hold the following categories of records. The extent to which a particular record exists will depend on the Company's actual operations and contractual arrangements.

6.1 Corporate and statutory records

a. Company registration documents and constitutional records.

b. Records of directors and authorised representatives.

c. Shareholder and governance records, where applicable.

d. Statutory filings and regulatory correspondence.

e. Company policies, procedures and internal governance documents.

f. Licences, registrations, permits and compliance records, where applicable.

6.2 Financial and accounting records

a. Annual financial statements and management accounts.

b. General ledgers, journals and accounting records.

c. Customer invoices, credit notes and statements.

d. Supplier and transporter invoices.

e. Proofs of payment and banking-related records.

f. Tax returns, VAT records and supporting documentation.

g. Records of amounts received from customers and paid to transporters.

h. Debtor, creditor and reconciliation records.

i. Records relating to disputes, claims and outstanding payments.

6.3 Customer and commercial records

a. Customer applications and onboarding records.

b. Customer identification and verification information, where required.

c. Customer contracts, service-level agreements and terms of business.

d. Quotations, rate confirmations and freight pricing records.

e. Customer correspondence, instructions and complaints.

f. Credit applications and credit-control records.

g. Records of shipment bookings and transport orders.

h. Records of customer-specific service requirements.

i. Records of claims, losses, damage and disputes.

j. Records of customer representatives and authorised contacts.

6.4 Transporter, carrier and subcontractor records

a. Transporter and carrier onboarding documents.

b. Contracts, service-level agreements and operating terms.

c. Business registration, tax and banking details.

d. Verification of licences, permits, insurance and other documents where required.

e. Vehicle and fleet details supplied for transport arrangements.

f. Driver names and contact details.

g. Rate confirmations, allocations and dispatch instructions.

h. Transporter invoices and payment records.

i. Service-performance, delivery and compliance records.

j. Claims, incidents, complaints and dispute records.

6.5 Shipment and logistics records

a. Booking confirmations and transport orders.

b. Collection and delivery instructions.

c. Collection addresses, delivery addresses and consignee details.

d. Consignment notes, waybills and other applicable transport documents.

e. Goods descriptions, quantities and shipment references.

f. Collection and delivery dates and times.

g. Proofs of collection and delivery.

h. Delivery acknowledgements and exception reports.

i. Vehicle and driver allocation records.

j. Tracking information and location updates, where used.

k. Records of delays, route deviations, failed deliveries and rescheduling.

l. Records of loss, damage, shortages, theft or other incidents.

m. Photographs, signatures and supporting documents received in connection with a shipment.

n. Records of communications between customers, the Company and transporters.

6.6 Employment records (if applicable in future)

a. Recruitment applications and CVs, if recruitment takes place.

b. Employment contracts and amendments, if the Company employs staff.

c. Payroll and remuneration records, if applicable.

d. Leave, attendance and performance records, if applicable.

e. Disciplinary and grievance records, if applicable.

f. Training and competency records, if applicable.

g. Employment-related tax and statutory documentation, if applicable. The Company currently has no employees.

h. Occupational health and safety records, where applicable.

i. Records of access rights to Company systems and information.

j. Other employment records required by applicable legislation.

Access to confidential employment and personnel records will be restricted in accordance with applicable law.

6.7 Legal, claims and dispute records

a. Contracts and legal correspondence.

b. Records of threatened or pending litigation.

c. Insurance claims and related documentation.

d. Records of loss, damage, theft and delivery disputes.

e. Debt-collection records and payment disputes.

f. Correspondence with attorneys, insurers, investigators and other authorised parties.

g. Records required for the establishment, exercise or defence of legal claims.

6.8 Information technology and communications records

a. Business emails and electronic correspondence.

b. Records held in the Company's transport-management, accounting, CRM or other software systems.

c. Access logs and security records.

d. Business telephone and messaging records, where retained.

e. Records of system permissions, backups and security incidents.

f. Website enquiry records and online forms, if applicable.

g. Records held by authorised cloud-service providers and other technology operators.

6.9 Records held under other legislation

Depending on the Company’s activities and the legal requirements applicable to its role as a transport broker/intermediary, these may include: (a) company registration, governance and statutory records under company legislation; (b) accounting records, invoices, VAT records and supporting tax documents under applicable tax legislation; (c) employment and payroll records only if employees are engaged and such records are required; and (d) relevant consignment, load, carrier, customer, insurance, claims, permit, vehicle or driver-related records to the extent required by applicable transport, road-traffic, safety, insurance, contractual or other legal obligations. The Company does not suggest that every category listed necessarily applies to it or that it holds every such record.

The existence of a statutory recordkeeping obligation does not automatically entitle every person to access that record. Access remains subject to PAIA, applicable legislation and any relevant grounds for refusal. Records are described by category only; the Company will assess whether a particular record exists and whether it may lawfully be disclosed when a request is received.

7. RECORDS AVAILABLE WITHOUT A FORMAL PAIA REQUEST

7.1 The following information may ordinarily be made available without a formal PAIA request, subject to confidentiality, verification and applicable law:

a. General company and service information published on the Company's website.

b. General contact information and business operating details.

c. Publicly available brochures, service descriptions and marketing material.

d. Published terms and conditions.

e. This PAIA and POPIA Manual.

f. Privacy notices and other policies intended for public access.

g. Information that the Company is legally required to make publicly available.

7.2 A customer, transporter or other contracting party may receive records relating to its own transactions through ordinary business channels, subject to identity verification, contractual terms and the rights of other parties.

7.3 The Company may make additional categories of records automatically available by publishing a notice or maintaining an accessible records list.

7.4 No person is entitled to another party's confidential commercial information, personal information or legally privileged records merely because the Company holds such information.

7.5 Section 52(2) notice: The Company does not currently rely on a separate formal notice issued under section 52(2) of PAIA. Section 7 of this Manual identifies the information the Company may ordinarily make available without a formal PAIA request. This description is not itself represented as a separate section 52(2) notice. If the Company later issues such a notice, it will update this Manual and make the notice available as required by law.

8. PROCEDURE FOR REQUESTING ACCESS TO RECORDS

8.1 Submission of a request

8.1.1 A requester seeking access to a record under PAIA must submit a request to the Information Officer using the prescribed form applicable to a request for access to records of a private body.

8.1.2 The request should be sent to:

Information Officer: Anke Mostert
Capacity: Director and registered Information Officer
Registration: Registered with the Information Regulator; registration certificate received
Email: letsmove@valorcargo.co.za
Telephone: 076 421 6354
Fax: Not applicable – the Company does not maintain a fax number
Postal address: TO BE INSERTED BY THE COMPANY (same as physical address)
Physical address: TO BE INSERTED BY THE COMPANY

8.1.3 The request must describe the record requested with sufficient detail to enable the Company to identify it.

8.1.4 The requester must provide the required particulars, indicate the form of access sought and provide any further information required by the applicable prescribed form.

8.1.5 Where the requester is acting on behalf of another person, appropriate proof of authority may be required.

8.1.6 The Company may request clarification where the request is unclear or insufficiently specific. The Company will not use clarification procedures to unlawfully obstruct access to records.

8.2 Proof of identity

8.2.1 The Company may take reasonable steps to verify the identity and authority of a requester, particularly where the records contain personal information, confidential commercial information or information relating to another person.

8.2.2 Any identity documentation supplied will itself be handled in accordance with POPIA and will not be used for unrelated purposes.

8.3 Processing and decision

8.3.1 The Company will assess each request in accordance with PAIA and the applicable regulations.

8.3.2 The Company will consider whether:

a. the requested record exists and is held by, or under the control of, the Company;

b. the request complies with the applicable procedural requirements;

c. the requester has a right of access under PAIA;

d. access would disclose personal information or confidential information concerning another person;

e. a mandatory or discretionary ground for refusal applies; and

f. partial access can lawfully be provided by redacting protected information.

8.3.3 The Company will notify the requester of its decision within the statutory period, ordinarily 30 days after receipt of a compliant request, subject to any lawful extension or other applicable statutory provision.

8.3.4 Where the prescribed procedure permits an extension, the Company will notify the requester of the extension and the reasons for it within the required period.

8.3.5 If access is granted, the Company will communicate the arrangements for inspection, copying or other lawful access and any applicable fees.

8.4 Grounds on which access may be refused

Access may be refused where a ground recognised by PAIA applies, including, where relevant:

a. protection of personal information of a third party;

b. protection of certain confidential information of a third party;

c. protection of commercial information, trade secrets or financial information where the statutory requirements for refusal are met;

d. protection of confidential information supplied in confidence where disclosure would be likely to cause the harm contemplated by PAIA;

e. protection of the Company's commercial activities where the statutory requirements are met;

f. protection of legally privileged records;

g. protection of the safety of individuals or property, where applicable;

h. protection of records relating to research where the relevant statutory requirements are met; or

i. any other applicable ground for refusal provided for in PAIA.

The Company will not refuse access merely because a record is inconvenient, commercially sensitive in a general sense, or potentially embarrassing. The statutory requirements for the applicable ground of refusal must be considered.

8.5 Third-party consultation and partial access

8.5.1 Where PAIA requires consultation with a third party, the Company will follow the applicable statutory procedure.

8.5.2 Where only part of a record is protected from disclosure, the Company will consider whether the remainder can reasonably and lawfully be disclosed after redaction.

8.6 Remedies following refusal

8.6.1 A requester who is dissatisfied with a decision may pursue the remedies available under PAIA, including lodging a complaint with the Information Regulator or approaching a court of competent jurisdiction, as applicable.

8.6.2 The Company will communicate the decision and applicable reasons in accordance with the prescribed procedure.

8.6.3 No internal appeal will be assumed to be available against a private body's decision unless a particular legal provision expressly provides for it.

9. FEES

9.1 Fees may be payable for access to records where permitted by PAIA and the applicable regulations.

9.2 Applicable fees may include prescribed request fees, search and preparation fees, copying fees or other permitted access charges, depending on the nature of the request and the applicable legal requirements.

9.3 The Company will communicate any applicable fees and payment arrangements in accordance with the prescribed procedure.

9.4 Any deposit, fee waiver or exemption will be dealt with in accordance with the applicable law.

9.5 No fee will be imposed merely as a penalty for making a request.

10. POPIA: CATEGORIES OF DATA SUBJECTS AND PERSONAL INFORMATION

The Company may process personal information relating to the following categories of data subjects.

10.1 Customers and prospective customers

Information may include:

a. Names, surnames and contact details.

b. Business contact details and job titles.

c. Company and registration details.

d. Billing and delivery addresses.

e. Customer account and transaction information.

f. Contractual instructions, quotations and correspondence.

g. Shipment and consignment information.

h. Payment, invoice and credit-control information.

i. Complaint, claims and dispute records.

j. Identification and verification information where lawfully required.

10.2 Transporters, carriers and subcontractors

Information may include:

a. Names and business contact details.

b. Company registration and tax information.

c. Banking and payment details.

d. Contractual and pricing information.

e. Vehicle and fleet details associated with identified individuals or businesses.

f. Driver allocation and delivery information.

g. Relevant licence, permit and insurance verification records.

h. Service-performance and incident records.

i. Communications and contractual dispute information.

10.3 Drivers, consignees and other delivery-related individuals

Information may include:

a. Names and contact details.

b. Driver, vehicle and shipment references.

c. Collection and delivery addresses.

d. Delivery dates, times and tracking information.

e. Signatures, photographs and proof-of-delivery information.

f. Identification or licence information where necessary and lawful.

g. Incident, loss or damage reports.

h. Location information generated or supplied in connection with a transport service.

10.4 Employees and job applicants (if applicable in future)

Information may include:

a. Identification and contact details.

b. CVs, qualifications and employment history.

c. Payroll, tax and banking information.

d. Leave, attendance and performance records, if applicable.

e. Disciplinary and grievance records, if applicable.

f. Training and competency information.

g. Health or other special personal information only where lawfully justified and appropriately protected.

10.5 Suppliers, professional advisers and other business contacts

Information may include:

a. Names and business contact details.

b. Business roles and correspondence.

c. Contract and payment records.

d. Professional credentials where relevant.

e. Records of services provided, instructions and disputes.

10.6 Website visitors and electronic communications users

Where applicable, information may include:

a. Names and contact details submitted through forms.

b. Email and enquiry content.

c. Technical information, such as IP addresses and access logs, where collected.

d. Cookie or analytics information where the website uses such technologies.

e. Marketing preferences and consent records.

11. PURPOSES FOR PROCESSING PERSONAL INFORMATION

The Company processes personal information only for purposes that are lawful, specific and related to its business or other lawful functions.

These purposes may include:

11.1 Receiving, assessing and fulfilling transport and logistics enquiries.

11.2 Establishing and managing customer and transporter relationships.

11.3 Obtaining quotations and arranging transport services.

11.4 Allocating transporters and drivers to shipments.

11.5 Coordinating collections, deliveries and delivery confirmations.

11.6 Communicating shipment instructions, status updates, delays and exceptions.

11.7 Managing transport orders, consignment records and proof of delivery.

11.8 Administering invoices, payments, reconciliations, credit control and tax obligations.

11.9 Verifying business details, credentials, licences, permits and insurance where reasonably necessary and lawful.

11.10 Investigating or resolving complaints, claims, loss, damage, theft, non-delivery and contractual disputes.

11.11 Complying with legal and regulatory obligations.

11.12 Recruiting, employing, remunerating and managing employees, if the Company employs staff in future.

11.13 Maintaining information security, preventing fraud and investigating suspected misconduct.

11.14 Establishing, exercising or defending legal rights and claims.

11.15 Maintaining business records and conducting legitimate operational reporting.

11.16 Sending service-related communications and, where permitted, marketing communications.

11.17 Maintaining and improving service quality, operational performance and customer experience.

11.18 Any other purpose compatible with the original purpose of collection or otherwise permitted by POPIA.

12. LAWFUL BASIS AND CONDITIONS FOR PROCESSING

12.1 The Company will process personal information in accordance with the eight conditions for lawful processing in POPIA.

12.2 These conditions include:

a. Accountability.

b. Processing limitation.

c. Purpose specification.

d. Further processing limitation.

e. Information quality.

f. Openness.

g. Security safeguards.

h. Data subject participation.

12.3 Depending on the circumstances, processing may be justified because:

a. the data subject has consented to the processing;

b. processing is necessary to perform a contract to which the data subject is a party or to take steps at the request of the data subject before entering into a contract;

c. processing complies with an obligation imposed by law;

d. processing protects a legitimate interest of the data subject;

e. processing is necessary for the proper performance of a public-law duty by a public body, where applicable; or

f. processing is necessary for pursuing the legitimate interests of the Company or a third party to whom the information is supplied, subject to the requirements of POPIA.

12.4 Consent will not be treated as the automatic or exclusive legal basis for all processing. The Company will identify and document an appropriate lawful basis for each relevant processing activity.

12.5 Where the Company relies on consent, the consent must meet applicable legal requirements and may be withdrawn, subject to lawful consequences and any other applicable basis for continued processing.

13. COLLECTION OF PERSONAL INFORMATION

13.1 Personal information may be collected directly from the relevant individual or from a lawful third-party source.

13.2 Sources may include:

a. Customers and their authorised representatives.

b. Transporters and carriers.

c. Drivers and delivery personnel.

d. Consignees and receiving personnel.

e. Employers or business principals acting lawfully.

f. Publicly available business registers or verification services.

g. Contracting parties, professional advisers and insurers.

h. Transport-management, accounting and customer-management systems.

i. Other sources permitted by law.

13.3 Where required by POPIA, the Company will take reasonably practicable steps to inform the data subject about the collection, the purpose, the responsible party, the relevant recipients and the data subject's applicable rights.

13.4 Where personal information is obtained from someone other than the data subject, the Company will comply with applicable notification requirements, subject to lawful exceptions.

13.5 The Company will endeavour to collect only information that is adequate, relevant and not excessive in relation to the purpose for which it is processed.

13.6 The Company will take reasonable steps to maintain information that is accurate, complete, not misleading and updated where necessary for the purpose of processing.

14. DISCLOSURE AND RECIPIENTS OF PERSONAL INFORMATION

14.1 Personal information may be disclosed to the following categories of recipients where disclosure is necessary, lawful and proportionate:

a. Customers and their authorised representatives.

b. Transporters, carriers and subcontractors responsible for a collection or delivery.

c. Drivers and delivery personnel who require information to perform the transport service.

d. Consignees and authorised receiving personnel.

e. Warehousing, distribution and logistics service providers, where applicable.

f. Payment processors, banks and accounting service providers.

g. Insurers, claims administrators and loss adjusters.

h. Attorneys, auditors, accountants and other professional advisers.

i. IT service providers, cloud-hosting providers and software vendors acting as operators.

j. Government departments, law-enforcement authorities, courts and regulators where disclosure is legally required or otherwise lawful.

k. Other recipients authorised by the data subject or permitted under POPIA.

14.2 Disclosure will be limited to information reasonably necessary for the relevant purpose.

14.3 For example, a transporter may receive a collection address, delivery address, shipment reference, goods-handling instructions and consignee contact details where required to execute a transport order.

14.4 The Company will not disclose customer lists, transporter pricing, confidential commercial information or personal information to unauthorised parties merely because they request it.

14.5 Where an operator processes personal information on behalf of the Company, the Company will enter into a written agreement requiring the operator to maintain appropriate security measures and confidentiality, as required by POPIA.

15. CROSS-BORDER TRANSFERS

15.1 The Company will determine whether its operations involve transferring personal information outside the Republic of South Africa.

15.2 Cross-border transfers may arise where the Company:

a. facilitates, in its capacity as broker, transport arrangements for independent carriers undertaking international loads;

b. uses email, website-hosting, cloud-storage, accounting, video-conferencing and messaging providers that may store or access personal information outside South Africa;

c. shares shipment information with an overseas customer, transporter, consignee or logistics provider; or

d. uses international support or administrative services that access personal information.

15.3 Where a cross-border transfer occurs, the Company will ensure that the requirements of section 72 of POPIA are satisfied.

15.4 Depending on the circumstances, a transfer may be permitted where the recipient is subject to an adequate level of protection, an applicable binding agreement or other legally recognised safeguard, or where a statutory exception applies.

15.5 The Company will not assume that a transfer is lawful merely because it is operationally convenient or necessary under a commercial arrangement.

15.6 The Company’s current cross-border position is as follows:

The Company uses Netlify in connection with website hosting and GoDaddy in connection with its domain and email arrangements. Netlify's published Privacy Statement states that personal data may be transferred to and stored outside the country where it was collected. GoDaddy's published Global Privacy Notice states that it transfers personal data internationally and uses service providers, including Amazon Web Services, for storage. These published notices describe the providers' general practices; they do not establish the precise location of information held for the Company's particular accounts.

• The Company primarily uses independent carriers based in South Africa. Those carriers may undertake transport on routes that cross international borders; the Company itself acts as a broker/intermediary and does not undertake the physical carriage. From time to time, the Company may engage a foreign-based carrier or logistics provider in a neighbouring African country, although this is not its preferred or usual arrangement. Where necessary to arrange or administer a load, the Company may disclose relevant customer, consignor, consignee, driver, contact, collection, delivery and shipment information to an authorised carrier, agent, consignee or logistics provider. Use of a South African-based carrier on an international route does not, by itself, establish that personal information has been transferred outside South Africa; the actual recipient and disclosure must be considered.

• The Company also uses Xero for accounting, Google Drive for cloud storage, and WhatsApp, Google Meet, Microsoft Teams and Zoom for business communications and meetings. Xero states that personal information may be transferred to and processed in countries including Australia, New Zealand and the United States. Google states that information may be processed on servers outside the user’s country. WhatsApp states that information may be transferred, stored or processed in the United States and other countries where Meta companies, partners, service providers or data centres operate. Microsoft explains that Microsoft 365 data location depends on the tenant’s default geography and service configuration; South Africa is among the geographies for which certain Microsoft 365 data-residency commitments may be available to eligible tenants. Zoom’s published materials describe international transfers and processing by affiliates or subprocessors. The precise countries, service entities, account-specific data locations and support-access locations for the Company’s individual accounts cannot be established from general public privacy notices and may depend on the product, account settings, tenant geography and service terms. The Company therefore does not represent that its information is stored in any particular country. Where a transfer of personal information outside South Africa takes place, the Company will ensure that an applicable condition in section 72 of POPIA is met.

15.7 The Company's identified technology and communication providers are Netlify, GoDaddy, Xero, Google Drive, WhatsApp, Google Meet, Microsoft Teams and Zoom. The Company will have regard to the privacy notices, service terms and data-processing terms published by each provider, as applicable. Where a provider processes personal information on the Company's behalf as an operator, the Company will take reasonable steps to ensure that the written-contract and security requirements of section 21 of POPIA are met. The Company's use of a provider's standard contractual terms or data-processing addendum will be assessed according to the service and account actually used; this Manual does not claim that a separately negotiated agreement exists where that has not been established.

16. SECURITY SAFEGUARDS

16.1 The Company recognises its obligation to protect the confidentiality, integrity and availability of personal information.

16.2 The Company will take appropriate, reasonable technical and organisational measures to prevent the loss of, damage to or unauthorised destruction of personal information and unlawful access to or processing of such information.

16.3 Measures may include, where appropriate to the Company's actual systems and risk profile:

a. Role-based access controls and restrictions on access to confidential records.

b. Strong passwords and multi-factor authentication where available and appropriate.

c. Secure electronic storage and controlled access to physical files.

d. Appropriate encryption for information in transit and, where suitable, information at rest.

e. Anti-malware protection, software updates and system security monitoring.

f. Regular backups and appropriate recovery procedures.

g. Secure transmission of shipment, customer and payment information.

h. Confidentiality obligations for the Director, independent carriers, contractors and service providers, as applicable.

i. Written operator agreements where required.

j. Appropriate awareness and secure information-handling practices for the Director and any authorised contractors or service providers.

k. Secure disposal or destruction of records when retention is no longer required.

l. Periodic review of access permissions, risks and safeguards.

16.4 Access to personal information will be restricted to authorised persons who require it for legitimate business purposes.

16.5 The Director and any authorised contractors or service providers may not disclose, copy, download, retain or use personal information for unauthorised purposes.

16.6 The Company will periodically assess reasonably foreseeable internal and external risks and review the effectiveness of its safeguards.

16.7 The Company will select, apply and periodically review security measures that are reasonable and appropriate to the nature of the personal information processed, the purposes of processing and the risks to data subjects. The examples in clause 16.3 describe measures that may be used where appropriate; they are not a representation that every listed technical control is active on every system.

17. SECURITY COMPROMISES AND DATA BREACHES

17.1 A security compromise includes an incident where there are reasonable grounds to believe that personal information has been accessed or acquired by an unauthorised person, or has otherwise been compromised.

17.2 The Director and any authorised contractors, carriers or operators must report suspected or actual security compromises to the Information Officer immediately.

17.3 The Company will, as appropriate:

a. Contain the incident and prevent further unauthorised access.

b. Secure affected systems and records.

c. Preserve relevant evidence and incident logs.

d. Assess the categories and volume of information affected.

e. Identify the data subjects and potential consequences.

f. Take reasonable steps to mitigate harm.

g. Record the incident and corrective actions.

h. Notify relevant service providers, insurers or authorities where appropriate.

17.4 In accordance with section 22 of POPIA, the Company will notify the Information Regulator and affected data subjects as soon as reasonably possible after discovery of a security compromise, subject to the statutory requirements and any lawful direction affecting notification.

17.5 Notification must not be unnecessarily delayed while the Company investigates the full extent of the incident.

17.6 Where an operator processes personal information for the Company, the operator must notify the Company immediately if it has reasonable grounds to believe that personal information has been accessed or acquired by an unauthorised person.

17.7 The Company will maintain an incident register recording the date, nature, impact, response and outcome of each material information-security incident.

18. RETENTION AND DESTRUCTION OF RECORDS

18.1 The Company will not retain personal information for longer than is necessary to achieve the purpose for which it was collected or subsequently processed, unless retention is required or authorised by law, reasonably required for a lawful purpose, necessary for a contract, or otherwise permitted by POPIA. Where another law prescribes a retention period, that requirement will be followed.

18.2 Records may need to be retained for:

a. Tax, accounting and financial reporting purposes.

b. Contract administration and payment reconciliation.

c. Transport claims, insurance and dispute resolution.

d. Employment and statutory recordkeeping obligations.

e. Compliance with applicable transport or other legislation.

f. Establishing, exercising or defending legal claims.

g. Other purposes permitted or required by law.

18.3 The Company will maintain a records-retention schedule specifying relevant categories of records, the applicable statutory or operational retention rule, responsible personnel and approved disposal methods. Tax records will be retained for the applicable period under tax legislation, generally at least five years, subject to statutory exceptions and longer periods where an audit, investigation or dispute is pending. Specific company records must be retained for the periods prescribed by the Companies Act and other applicable legislation; this does not create a blanket period for every record.

18.4 Records subject to pending litigation, a legal hold, an unresolved claim, an investigation or another lawful preservation obligation will not be destroyed merely because an ordinary retention period has expired.

18.5 When personal information is no longer authorised to be retained, the Company will destroy, delete or de-identify it in a manner that prevents reconstruction in an intelligible form, subject to any applicable legal requirements.

18.6 The Company will not retain personal information indefinitely merely because electronic storage is inexpensive.

19. RIGHTS OF DATA SUBJECTS

Subject to POPIA and other applicable laws, data subjects may exercise the following rights.

19.1 Access

A data subject may request confirmation of whether the Company holds personal information about them and request access to such information in accordance with the applicable legal procedure.

19.2 Correction or deletion

A data subject may request that the Company correct or delete personal information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or obtained unlawfully, or that the Company destroy or delete information it is no longer authorised to retain.

The Company will assess the request against the applicable legal requirements and may need to retain certain records where required by law or necessary for a lawful purpose.

19.3 Objection

A data subject may object to certain processing in the circumstances provided for in POPIA, including where processing is based on specified grounds under section 11(3), or object to direct marketing by electronic communications in accordance with section 69.

19.4 Withdrawal of consent

Where processing is based on consent, a data subject may withdraw that consent, subject to applicable legal requirements and the consequences of withdrawal.

19.5 Complaints

A data subject may lodge a complaint with the Information Regulator if they believe that their rights under POPIA or PAIA have been infringed.

19.6 Direct marketing

The Company will comply with the requirements of POPIA concerning unsolicited electronic direct marketing, including the applicable consent requirements and restrictions on repeated approaches to obtain consent.

19.7 Requests by third parties

Where a person seeks to exercise rights on behalf of another data subject, the Company may require reasonable proof of identity, authority or legal capacity.

20. SPECIAL PERSONAL INFORMATION AND CHILDREN'S INFORMATION

20.1 The Company does not intend to collect special personal information or children's personal information unless it is necessary for a lawful and defined purpose.

20.2 Where such information is processed, the Company will assess whether the processing is permitted under POPIA, including whether an applicable authorisation, exception or other legal basis exists.

20.3 Access to such information will be restricted and additional safeguards will be applied where appropriate.

20.4 The Company will not use sensitive personal information for unrelated purposes or disclose it to unauthorised parties.

21. CONFIDENTIALITY OF BUSINESS AND CARRIER INFORMATION

21.1 The Director and any authorised contractors, independent carriers and service providers must preserve the confidentiality of customer, transporter, driver, consignee and Company information, to the extent applicable to their role and contractual obligations.

21.2 Personal information may only be accessed and used to the extent necessary to perform authorised duties.

21.3 Persons authorised to access Company information may not:

a. Use personal information for private purposes.

b. Share passwords or permit unauthorised access to Company systems.

c. Send confidential information to unauthorised email addresses or personal accounts.

d. Retain copies of records after their authority to do so has ended, unless retention is authorised.

e. Disclose transport rates, customer lists, banking details, delivery information or other confidential information to unauthorised persons.

21.4 Breaches of confidentiality or information-security requirements may result in appropriate contractual, civil or other lawful action.

22. OPERATORS AND THIRD-PARTY SERVICE PROVIDERS

22.1 The Company may engage third-party service providers to process information on its behalf.

22.2 Such providers may include software vendors, cloud-hosting providers, accounting service providers, payment processors, document-storage providers and other service providers.

22.3 Where a service provider qualifies as an operator under POPIA, the Company will take reasonable steps to ensure that an appropriate written agreement is in place.

22.4 The agreement will address confidentiality, security safeguards, authorised processing, incident reporting and other relevant obligations.

22.5 The Company will take reasonable steps to assess the suitability of service providers that have access to personal information.

22.6 The use of a third-party system does not automatically relieve the Company of its responsibilities as a responsible party.

23. DIRECT MARKETING AND CUSTOMER COMMUNICATIONS

23.1 The Company may send communications relating to existing transport orders, service delivery, quotations, invoices, account administration and other legitimate business activities.

23.2 Where the Company engages in direct marketing by electronic communication, it will comply with section 69 of POPIA and other applicable legal requirements.

23.3 The Company will not assume that the existence of a business relationship automatically permits every form of electronic marketing.

23.4 Where required, the Company will obtain consent in the prescribed circumstances, respect objections and maintain appropriate records of consent and opt-out requests.

23.5 Marketing communications must identify the sender and provide an appropriate means of requesting that further marketing communications cease, where required by law.

24. COMPLAINTS AND PRIVACY ENQUIRIES

24.1 A person wishing to raise a privacy concern or exercise a right under POPIA may contact the Information Officer using the contact details in this Manual.

24.2 The complaint or request should, where possible, include:

a. The complainant's name and contact details.

b. A description of the relevant information or processing activity.

c. The nature of the concern or request.

d. Relevant dates, references or supporting documentation.

e. The remedy or action requested.

24.3 The Company will acknowledge and assess the matter, conduct reasonable enquiries and respond within the applicable legal period or a reasonable period where no specific period is prescribed.

24.4 The Company will maintain a record of material privacy complaints, requests, investigations and corrective measures.

24.5 If the complainant remains dissatisfied, they may approach the Information Regulator or pursue another remedy available under applicable law.

25. INFORMATION REGULATOR CONTACT DETAILS

The Information Regulator is responsible for overseeing compliance with POPIA and PAIA.

Official website: https://inforegulator.org.za/

eServices portal: https://eservices.inforegulator.org.za/

Current contact details, complaint procedures and prescribed forms are published on the Information Regulator's official website and should be consulted when a request or complaint is made.

26. AVAILABILITY OF THIS MANUAL

26.1 This Manual will be made available in accordance with section 51 of PAIA and other applicable requirements.

26.2 Availability arrangements include:

a. Publication on the Company's website, if the Company has a website.

b. Inspection at the Company's principal place of business during normal business hours.

c. Provision to a person upon request, subject to any lawful and reasonable charge for a physical copy.

d. Provision to the Information Regulator upon request.

26.3 An electronic copy may be supplied by email where reasonably practicable.

26.4 The Company will review and update the Manual regularly and whenever a material change to its contact details, records, processing activities or compliance arrangements makes an update necessary.

27. MONITORING AND REVIEW

27.1 The Information Officer will coordinate the review of this Manual and the Company's related privacy procedures.

27.2 The review should consider:

a. Changes to applicable legislation and regulatory guidance.

b. Changes to the Company's business model or services.

c. New categories of personal information or data subjects.

d. Changes in software, operators, hosting arrangements or cross-border transfers.

e. Information-security incidents and audit findings.

f. Complaints, requests and recurring compliance issues.

g. The effectiveness of training, retention and access-control procedures.

27.3 Material amendments must be approved by the authorised Company representative and recorded in the document-control section.

ANNEXURE: PERSONAL INFORMATION PROCESSING REGISTER

This register summarises the principal categories of personal information processed in the Company’s current operations. It should be reviewed and updated when processing activities or service providers change.

Processing activity	Personal information	Purpose	Recipients	Retention
Customer onboarding	Contact and business details	Establish customer relationship	Director; relevant service providers	Relationship duration, then only as needed for legal, contractual or dispute purposes.
Transport booking	Booking, collection and delivery details	Arrange and administer transport	Assigned carrier; relevant customer contacts	Transaction duration, then as needed for contract administration, delivery queries, claims or legal duties.
Driver allocation	Driver, vehicle and contact details	Coordinate collection and delivery	Assigned carrier; relevant customer contacts	As needed for transport, safety, claims or legal requirements.
Proof of delivery	Recipient details, signature, delivery time and supporting records	Confirm delivery; resolve queries and claims	Customer; assigned carrier; claims personnel	As needed to verify delivery, resolve claims or meet legal obligations.
Invoicing and payments	Invoice, banking and transaction details	Financial administration; statutory compliance	Banks; accountants; tax authorities where applicable	Applicable statutory tax-record period (generally at least five years), longer if legally required.
Claims and incidents	Incident reports, photographs and correspondence	Investigate and resolve claims	Insurers; legal advisers; authorised parties	Until finalised, then as needed for insurance, claims, disputes or legal duties.
Human resources	No employee information currently processed; recruitment/employment data only if staff are engaged in future	Not currently applicable	Not currently applicable	If applicable in future, periods required by labour, tax and other laws.
IT and communications	Account data, access logs and business correspondence	Security, administration and service delivery	Director; relevant providers (Netlify, GoDaddy, Xero, Google Drive, WhatsApp, Google Meet, Microsoft Teams and Zoom)	As needed for security, operations, service delivery, legal duties or disputes.