PAIA & POPIA Manual

For the purposes of PAIA and POPIA, Evolv is defined as a Private Body. In accordance with its obligations in terms of PAIA and POPIA, Evolv has produced this Manual.

This Manual sets out all information required by both PAIA and POPIA.

This Manual also deals with how requests are to be made in terms of PAIA.

This Manual further establishes how compliance with POPIA is to be achieved.

A guide to PAIA, and to how information may be accessed in terms of PAIA, has been published pursuant to section 10 of PAIA.

The guide contains the information required by an individual who may wish to exercise their rights in terms of PAIA.

Should you wish to access the guide, you may request a copy from the Information Officer by submitting Annexure A to the details specified above.

You may also inspect the guide at the offices of Evolv during ordinary working hours.

You may also request a copy of the guide from the Information Regulator at the details set out below.

At this stage, no notice has been published on the categories of records that are available without a person having to request access to them in terms of PAIA.

Evolv holds and processes the records set out below for the purposes of PAIA and POPIA.

These records may be requested; however, there is no guarantee that a request will be honoured. Each request will be evaluated in terms of PAIA and any other applicable legislation.

A person who wishes to make a request must comply with all the procedures laid down in PAIA.

The requester must complete Annexure B and submit it to the Information Officer at the details specified above.

The prescribed form must be submitted, together with payment of a request fee and a deposit where applicable, to the Information Officer at the postal or physical address or electronic mail address stated herein.

The prescribed form must be completed with sufficient particularity to enable the Information Officer to determine:

• the record or records requested;
• the identity of the requester;
• the form of access required; and
• the postal address, email address or fax number of the requester.

The requester must state that the records are required in order to exercise or protect a right, clearly state the nature of the right to be exercised or protected, and explain why the records requested are required to exercise or protect that right.

The request for access will be dealt with within 30 days from the date of receipt, unless the requester has set out special grounds that satisfy the Information Officer that the request should be dealt with sooner.

The period of 30 days may be extended by not more than 30 additional days if the request is for a large quantity of information, or if the request requires a search for information held at another office of Evolv and the information cannot reasonably be obtained within 30 days. The Information Officer will notify the requester in writing should an extension be necessary.

The Information Officer must communicate a response to the request for access using Annexure E. This communication will inform the requester of:

• the decision; and
• the fees payable in terms of paragraph 11.

In the event that the Information Officer is of the opinion that the search for, and preparation of, the record for disclosure would amount to more than six hours, the Information Officer will require the requester to pay a deposit not exceeding one third of the amount payable.

Should the requester have any difficulty with the form or the process laid out herein, the requester should contact the Information Officer for assistance.

An oral request may be made to the Information Officer should the requester be unable to complete the form due to illiteracy or a disability. The Information Officer will complete the form on behalf of the requester and provide a copy of the completed form to the requester.

Mandatory protection of the privacy of a third party who is a natural person, including a deceased person, where such disclosure of Personal Information would be unreasonable.

Mandatory protection of the commercial information of a third party, if the records contain:

• trade secrets of that third party;
• financial, commercial, scientific or technical information of the third party, the disclosure of which could likely cause harm to the financial or commercial interests of that third party; and/or
• information disclosed in confidence by a third party to Evolv, the disclosure of which could put that third party at a disadvantage in contractual or other negotiations, or prejudice the third party in commercial competition.

Mandatory protection of confidential information of third parties, if it is protected in terms of any agreement.

Mandatory protection of the safety of individuals and the protection of property.

Mandatory protection of records that would be regarded as privileged in legal proceedings.

Protection of the commercial information of Evolv, which may include:

• trade secrets;
• financial, commercial, scientific or technical information, the disclosure of which could likely cause harm to the financial or commercial interests of Evolv;
• information which, if disclosed, could put Evolv at a disadvantage in contractual or other negotiations, or prejudice Evolv in commercial competition; and/or
• computer programs owned by Evolv and protected by copyright and intellectual property laws.

Research information of Evolv or a third party, if such disclosure would place the research or the researcher at a serious disadvantage.

Requests for records that are clearly frivolous or vexatious, or which involve an unreasonable diversion of resources.

Evolv does not have an internal appeal procedure in respect of the denial of a request. The decision of the Information Officer is final.

The requester may, in accordance with sections 56(3)(c) and 78 of PAIA, apply to a court for appropriate relief within 180 days of notification of the decision.

Conditions for lawful processing. POPIA prescribes eight conditions for the lawful processing of Personal Information:

• Accountability
• Information quality
• Processing limitation
• Openness
• Purpose specification
• Security safeguards
• Further processing limitation
• Data subject participation

Types of processing. Evolv is involved in the following types of processing:

• Collection
• Adaptation or alteration
• Dissemination or otherwise making available
• Recording
• Retrieval
• Alignment or combination
• Organisation
• Consultation
• Restriction
• Structuring
• Use
• Erasure
• Storage
• Disclosure by transmission
• Destruction

Purposes of processing. Evolv processes Personal Information for the following purposes:

• to fulfil agreements in relation to its employees;
• to provide services to its Clients in accordance with the terms agreed to by the Clients;
• to undertake activities related to the provision of services, including to fulfil domestic legal, regulatory and compliance requirements;
• to verify the identity of Client representatives who contact Evolv, or who may be contacted by Evolv;
• for risk assessment, information security management, statistical, trend analysis and planning purposes;
• to monitor and record calls and electronic communications with the Client for quality, training, investigation and fraud prevention purposes;
• to enforce or defend the rights of Evolv or its affiliates;
• to manage the relationship of Evolv with its Clients, which may include providing information to Clients and their affiliates about the products and services of Evolv and its affiliates;
• purposes related to any authorised disclosure made in terms of an agreement, law or regulation;
• any additional purposes expressly authorised by a Client of Evolv; and
• any additional purposes as may be notified to the Client or Data Subjects in any notice provided by Evolv.

Categories of Data Subjects. Evolv processes the Personal Information of the following categories of Data Subjects:

Categories of Personal Information. Evolv processes the following categories of Personal Information:

• Client profile information
• Names
• Physical addresses
• Bank account details
• Email addresses
• Tax numbers
• Payment information
• Telephone numbers
• Identity numbers
• Client representatives
• Facsimile numbers
• Passport numbers

Recipients of Personal Information: Evolv, its affiliates and their respective representatives.

Cross-border transfers. When making authorised disclosures or transfers of Personal Information in terms of section 72 of POPIA, Personal Information may be disclosed to recipients in countries that do not have the same level of protection for Personal Information as South Africa. Evolv may share Personal Information with third parties, and in certain instances this may result in a cross-border flow of Personal Information. Such Personal Information will always be subject to protection no less than the protection afforded to it under POPIA.

Security measures. The following security measures are implemented by Evolv:

• Evolv implements numerous security measures to protect Personal Information that is stored electronically and physically.
• Evolv ensures that appropriate security measures are taken, and updates these measures on a regular basis.
• Evolv has implemented various policies for the additional security of Personal Information stored both physically and electronically.
• Where physical records exist, such records are stored in a secure area that can be locked away, so as to avoid a breach of the Personal Information.
• Such physical records are locked away and secured when not in use.

Objection to processing. Section 11(3) of POPIA and regulation 2 of the POPIA Regulations provide that a Data Subject may, at any time, object to the processing of their Personal Information in the prescribed form attached to this Manual as Annexure C.

Correction or deletion. Section 24 of POPIA and regulation 3 of the POPIA Regulations provide that a Data Subject may request that their Personal Information be corrected or deleted in the prescribed form attached hereto as Annexure D.