PAIA Manual

Prepared under section 51 of the Promotion of Access to Information Act 2 of 2000 (PAIA), as amended by the Protection of Personal Information Act 4 of 2013 (POPIA)

Version: 1.0 | Adopted on: 26 October 2026 | Next review: one year after adoption, or sooner if anything below changes.

1. Purpose of this manual

PAIA gives everyone a right of access to records held by a private body when the record is required to exercise or protect a right (PAIA section 50). Section 51 requires every private body to publish a manual explaining what records it holds and how to ask for them. The exemption for small private bodies ended on 31 December 2021, so this company must have one.

This manual also contains the information about how we process personal information that section 51(1)(c) of PAIA (inserted by POPIA) requires.

2. Contact details of the company and its head (section 51(1)(a))

Information Officer

The head of a private company is its Information Officer (PAIA section 1 and POPIA section 55).

Deputy Information Officer(s): None appointed

3. The Information Regulator's Guide (section 51(1)(b)(i))

Section 10 of PAIA requires the Information Regulator to publish a Guide on how to use PAIA and POPIA to get access to records. The Guide is available on the Regulator's website, https://inforegulator.org.za, and at the Regulator's offices. A copy may also be inspected at our shop at 202 Marine Drive, Ramsgate, during office hours.

The Information Regulator (South Africa)

4. Records available without a request (section 51(1)(b)(ii) and section 52)

The following may be read free without a PAIA request:

• product, price and service information on our website and in the shop;
• our terms of sale, returns and warranty policy, delivery policy and privacy policy (available on request, and on our website once published); and
• this manual.

If you ask for a printed copy, the reproduction fee in section 9 applies. No notice under section 52(2) has been published.

5. Records held under other legislation (section 51(1)(b)(iii))

We keep records as required by, among others:

• Companies Act 71 of 2008
• Income Tax Act 58 of 1962
• Tax Administration Act 28 of 2011
• Value-Added Tax Act 89 of 1991
• Consumer Protection Act 68 of 2008
• Electronic Communications and Transactions Act 25 of 2002
• Protection of Personal Information Act 4 of 2013
• Second-Hand Goods Act 6 of 2009 (we buy used laptops only with proof of ownership)
• Basic Conditions of Employment Act 75 of 1997; Labour Relations Act 66 of 1995; Employment Equity Act 55 of 1998; Unemployment Insurance Act 63 of 2001 and Unemployment Insurance Contributions Act 4 of 2002; Skills Development Levies Act 9 of 1999; Compensation for Occupational Injuries and Diseases Act 130 of 1993; Occupational Health and Safety Act 85 of 1993

6. Subjects and categories of records held (section 51(1)(b)(iv))

Listing a category does not mean access will be given. The grounds for refusal in section 10 still apply, and many of these records contain other people's personal information.

7. Processing of personal information (section 51(1)(c), inserted by POPIA)

7.1 Purpose of processing

We process personal information to:

• sell and deliver goods, and handle returns, refunds and warranty claims;
• receive, assess, quote, repair and return customers' devices;
• issue tax invoices, collect payment and keep the records that VAT, tax and company laws require;
• answer enquiries and keep in touch about an order or repair;
• send marketing only to people who agreed to it, or to customers about our own similar

products (POPIA section 69);

• keep the register required by the Second-Hand Goods Act when we buy a used laptop;
• keep the shop and customers' goods secure; and
• manage employees.

7.2 Categories of data subjects and their personal information

7.3 Recipients or categories of recipients

We do not sell personal information. We share it only with:

• manufacturers, distributors and suppliers, for warranty claims and repairs, when needed;
• courier companies, for deliveries;
• our business systems and service providers:;
• our accountant or auditor an external accountant; and
• SARS, the South African Police Service (for the Second-Hand Goods Act register, if it applies), courts and other authorities where the law requires it.

7.4 Planned transfers of personal information across borders

If the company uses UBOSS, its records are stored on servers in Germany (covered by the European Union's General Data Protection Regulation). Some providers, such as WhatsApp (Meta), Google or Microsoft email, process information in the United States or elsewhere. We transfer personal information outside South Africa only as POPIA section 72 allows: to recipients bound by law, binding corporate rules or an agreement that gives protection substantially similar to POPIA, or with consent, or where the transfer is needed to perform the contract with the person.

7.5 Description of information security measures

We have reasonable measures in place to protect personal information (POPIA section 19), including:

• records kept in password-protected business systems, with access only for staff who need it;
• devices and paper records kept in a locked shop;

-;

• not accessing or copying data on customers' devices beyond what the repair needs;
• card payments handled by the payment provider, without card numbers being stored by us;
• written terms with service providers who process personal information for us; and
• notice to the Information Regulator and affected people after a breach, as POPIA section 22 requires.

8. How to request access to a record

1. Use Form 2. Complete Form 2 (Request for Access to Record) of the Regulations Relating to the Promotion of Access to Information, 2021. It is available from the Information Regulator's website or from our Information Officer on request.
2. Send it to the Information Officer by email to info@unlimitedits.co.za, or by hand or post to 202 Marine Drive, Ramsgate, KwaZulu-Natal, 4285.
3. Give enough detail to identify the record and you, the form of access you want, the language you prefer, and, if you ask for someone else, proof that you may.
4. Show the right. Say which right you want to exercise or protect, and why the record is needed for it (section 50).
5. Pay the request fee (section 9) unless you are asking for your own personal information.

We decide within 30 days of a complete request (section 56), and may extend once by up to 30 days under section 57, in writing. No answer in time counts as a refusal (section 58). If a record concerns a third party, we must notify them first (section 71).

You may also ask what personal information we hold about you, and ask us to correct or delete it, under POPIA sections 23 and 24, by writing to the Information Officer.

9. Fees

Fees are those prescribed for private bodies in Annexure B of the Regulations Relating to the Promotion of Access to Information, 2021 (GN R.757 of 27 August 2021). They are:

The request fee is payable before we process the request. Payment details: by EFT; we send our bank details with the fee notice.

10. Grounds for refusing access

We must or may refuse access on the grounds in PAIA sections 63 to 69, including a third party's personal information (s63), a third party's commercial information (s64), confidential information (s65), safety of people and property (s66), legal privilege (s67), our own commercial information (s68) and research information (s69). Under section 70 we must still give access where the public interest in disclosing a serious breach of the law or a serious public safety or environmental risk clearly outweighs the harm.

11. Remedies if a request is refused

There is no internal appeal. You may complain to the Information Regulator under section 77A, at PAIAComplaints@inforegulator.org.za, or apply to court under section 78, within 180 days of our decision.

12. Updating and availability of this manual

We review this manual at least once a year. It is available free:

• on our website https://unlimitedits.co.za/paia-manual;
• at our shop, 202 Marine Drive, Ramsgate, during office hours; and
• from the Information Officer.

Adopted by: Willem van Greunen, director and Information Officer

Date: 26 October 2026

This manual is not legal advice.