PAIA Manual Policy

This Manual is published in terms of Section 51 of the Promotion of Access to Information Act 2 of 2000 ("PAIA"). PAIA gives effect to the constitutional right of access to any information held by the State and any information that is held by another person and that is required for the exercise or protection of any rights.

This Manual also serves to provide information on how NexCT (Pty) Ltd ("NexCT") processes personal information, in compliance with the Protection of Personal Information Act 4 of 2013 ("POPIA").

The purpose of this Manual is to assist potential requesters in understanding the types of information we hold and the procedures for requesting access to that information.

Detail	Description
Company Name	NexCT (Pty) Ltd
Registration Number	2006/019670/07
Physical Address	Longkloof Studios, Darters Road, Gardens, Cape Town, 8001
Telephone Number	010 900 1290
Website	http://www.nexct.co
Information Officer	Wayne Kruger
Email address of Information Officer	Wayne@NexCT.co

The Information Regulator has compiled a guide in terms of Section 10 of PAIA that provides information on how to exercise your rights under PAIA. This guide is available in all official languages on the Information Regulator's website.

Any queries regarding this guide should be directed to:

The Information Regulator (South Africa)

• Website: https://inforegulator.org.za/
• Email: inforeg@justice.gov.za

The following categories of records are automatically available for inspection, purchase, or photocopying without the need to submit a formal PAIA request:

• Marketing and promotional materials freely available on our website.
• The current version of this PAIA Manual.
• Publicly available company information and press releases.
• Website Terms and Conditions, Privacy Policy, and Cookie Policy.

We hold records on the following subjects and in the following categories. Please note that access to these records is not automatic and must be requested in accordance with the procedure outlined in this manual.

Subject	Categories of Records
Client and Subscription Records	Service Level Agreements (SLAs), NexCT subscription contracts, online booking tool usage records, platform configuration and settings, payment records, client correspondence, and support tickets.
Financial Records	Annual financial statements, accounting records, tax records (VAT, PAYE), banking records, asset registers, invoices, and statements of account.
Human Resources	Employment contracts, employee personal information, payroll records, leave records, disciplinary records, performance management records, training records.
Supplier and Vendor Records	Contracts with third-party software vendors, hosting providers, payment gateways, supplier contact and banking details, statements of account.
Company Secretarial & Governance	Memorandum of Incorporation, company registration documents, share registers, minutes of meetings of directors and shareholders, compliance documents.
Information Technology & Platform	IT policies and procedures, network diagrams, security reports, software licenses, user access logs, data retention policies, and disaster recovery plans.

6.1 Purpose of Processing Personal Information (Section 51(1)(c)(i) of PAIA)

We process personal information for the following purposes:

• To provide and manage access to the online booking tool for our clients.
• To manage client subscriptions, process payments, and for general financial administration.
• To communicate with clients regarding their accounts, technical support, and platform updates.
• For human resources and employee administration purposes.
• To comply with our legal and regulatory obligations.
• For marketing and business development purposes, subject to obtaining the necessary consent.

6.2 Categories of Data Subjects and Information Processed (Section 51(1)(c)(ii) of PAIA)

Categories of Data Subjects	Personal Information that may be processed
Users of the Booking Tool	Full name, email address, identity number, passport number, job title, login credentials, IP address, usage data, and transaction details related to the services booked via the platform.
Corporate Client Contact Persons	Full name, job title, work contact details (email, phone number).
Our Employees	Full name, contact details, identity number, tax information, banking details, employment history, qualifications, benefits details, beneficiary information.
Supplier Contact Persons	Full name, job title, work contact details, banking details for payment purposes.

6.3 Recipients of Personal Information (Section 51(1)(c)(iii) of PAIA)

We may supply personal information to the following categories of recipients:

• Third-party service providers (e.g., hosting providers, payment gateways, email communication services).
• Partners involved in facilitating specific services booked or managed via the platform.
• Regulatory bodies (e.g., SARS, Department of Labour).
• Our professional advisors (e.g., auditors, legal counsel).
• Financial institutions.

6.4 Transborder Data Flows (Section 51(1)(c)(iv) of PAIA)

As a SaaS solution, NexCT uses global technology infrastructure (e.g., cloud hosting) which may result in the transfer of personal information to third-party providers located outside of the Republic of South Africa. We ensure that such transfers are conducted in compliance with Chapter 9 of POPIA, either to countries with adequate data protection laws or under the protection of a binding agreement (such as Standard Contractual Clauses) that upholds POPIA's principles.

6.5 General Description of Security Measures (Section 51(1)(c)(v) of PAIA)

We have implemented appropriate and reasonable technical and organizational security measures to protect the personal information we hold. These measures include, but are not limited to:

• Access Control: Logical and physical access controls to our premises and IT systems, including multi-factor authentication for sensitive systems.
• Encryption: Data encryption (at rest and in transit) for all sensitive information, including user authentication data.
• Network Security: Implementation of firewalls, intrusion detection systems, and regular vulnerability and penetration testing.
• Staff Training: Mandatory data protection and information security policies and training for all staff.
• Incident Response: A defined procedure for managing security incidents and data breaches.
• Agreements: Confidentiality agreements with employees and third-party operators (data processors).

To request access to a record, a requester must complete the prescribed Form 2 (Request for Access to Record), which is available on the Information Regulator's website or from our Information Officer.

The completed form, along with proof of identity and payment of the prescribed request fee, must be submitted to our Information Officer at the contact details provided in Section 2 of this manual.

We will notify the requester in writing within 30 days of receipt of a compliant request whether access has been granted or denied. This period may be extended once for a further 30 days under certain circumstances.

The following fees are payable for requesting and accessing records:

• Request Fee: A non-refundable request fee of R140.00 is payable by every requester, other than a personal requester (i.e., a person requesting records containing their own personal information).
• Access Fees: If the request is granted, an access fee will be charged for the search, preparation, and reproduction of the records. A schedule of these fees is available from our Information Officer.

This Manual is available for inspection at our offices during normal business hours and is also available on our website at www.nexct.co