PAIA Manual

1. DEFINITIONS

2. INTRODUCTION

This Manual is compiled in accordance with the PAIA, which gives effect to Section 32 of the Constitution of the Republic of South Africa. Section 32 provides that everyone has the right of access to:

• any information held by the state; and
• any information held by another person that is required for the exercise or protection of any right.

The purpose of PAIA is to foster a culture of transparency and accountability within both public and private bodies by giving effect to this right and to actively promote a society in which the people of South Africa have effective access to information.

YWO (Pty) Ltd (“YWO”, “the Company”, “we”, or “us”) is a private company registered in the Republic of South Africa, authorised and regulated by the Financial Sector Conduct Authority (“FSCA”) under Financial Services Provider (“FSP”) licence No. 54357 in relation to the provision of intermediary services in connection with derivative products. The Company operates under the Financial Advisory and Intermediary Services Act 37 of 2002 (“FAIS”) as amended and in force from time to time.

For the purposes of PAIA and the POPIA, YWO is classified as a Private Body as defined in Section 1 of the Act.

This Manual has been prepared to comply with Section 51 of PAIA and the relevant provisions of POPIA and must be reviewed annually or whenever material changes occur in the Company’s structure or operations.

3. PURPOSE OF THIS MANUAL

This PAIA Manual is useful for the public to

3.1. check the categories of records held by a body which are available without a person having to submit a formal PAIA request;

3.2. have a sufficient understanding of how to make a request for access to a record of the body, by providing a description of the subjects on which the body holds records and the categories of records held on each subject;

3.3. know the description of the records of the body which are available in accordance with any other legislation;

3.4. access all the relevant contact details of the Information Officer and Deputy Information Officer who will assist the public with the records they intend to access;

3.5. know the description of the guide on how to use PAIA, as updated by the Regulator and how to obtain access to it;

3.6. know if the body will process personal information, the purpose of processing of personal information and the description of the categories of data subjects and of the information or categories of information relating thereto;

3.7. know the description of the categories of data subjects and of the information or categories of information relating thereto;

3.8. know the recipients or categories of recipients to whom the personal information may be supplied;

3.9. know if the body has planned to transfer or process personal information outside the Republic of South Africa and the recipients or categories of recipients to whom the personal information may be supplied;

3.10. know whether the body has appropriate security measures to ensure the confidentiality, integrity and availability of the personal information which is to be processed.

4. KEY CONTACT DETAILS FOR ACCESS TO INFORMATION OF THE COMPANY

Business Name YWO (PTY) LTD Incorporation number 2024/339763/07 FSP License 54357 Registered & Postal Address 29 First Avenue East, Parktown North, Johannesburg, Gauteng, 2193, South Africa Information Officer Priyesh Sathdav Deputy Information Officer Seth Michael Baring Pemberton Email address support@ywo.com

5. GUIDE ON HOW TO USE PAIA AND HOW TO OBTAIN ACCESS TO THE GUIDE

5.1. The Regulator has, in terms of section 10(1) of PAIA, as amended, updated and made available the revised Guide on how to use PAIA (“Guide”), in an easily comprehensible form and manner, as may reasonably be required by a person who wishes to exercise any right contemplated in PAIA and POPIA.

5.2. The Guide is available in each of the official languages and in braille.

5.3. The aforesaid Guide contains the description of-

5.3.1. the objects of PAIA and POPIA;

5.3.2. the postal and street address, phone and fax number and, if available, electronic mail address of-

• the Information Officer of every public body, and
• every Deputy Information Officer of every public and private body designated in terms of section 17(1) of PAIA and section 56 of POPIA;

5.3.3. the manner and form of a request for-

• access to a record of a public body contemplated in section 11 (1) of PAIA; and
• access to a record of a private body contemplated in section 50 (1) of PAIA;

5.3.4. the assistance available from the IO of a public body in terms of PAIA and POPIA;

5.3.5. the assistance available from the Regulator in terms of PAIA and POPIA;

5.3.6. all remedies in law available regarding an act or failure to act in respect of a right or duty conferred or imposed by PAIA and POPIA, including the manner of lodging-

• an internal appeal;
• a complaint to the Regulator; and
• an application with a court against a decision by the information officer of a public body, a decision on internal appeal or a decision by the Regulator or a decision of the head of a private body;

5.3.7. the provisions of sections 14(1) and 51 (1) of PAIA requiring a public body and private body, respectively, to compile a manual, and how to obtain access to a manual;

5.3.8. the provisions of sections 15(1) and 52(1) of PAIA providing for the voluntary disclosure of categories of records by a public body and private body, respectively;

5.3.9. the notices issued in terms of sections 22 (1) and 54 (1) of PAIA regarding fees to be paid in relation to requests for access; and

5.3.10. the regulations made in terms of section 92 (1) of PAIA.

5.4. Members of the public can inspect or make copies of the Guide from the offices of the public and private bodies, including the office of the Regulator, during normal working hours

5.5. The guide can also be obtained-

• Upon request to the Information Officer, using the prescribed “Form 01” available on the Regulator’s website under subsection “Forms” https://inforegulator.org.za/paia/ and
• Directly from the Regulator, through its website under subsection “Forms” https://inforegulator.org.za/paia/ using the “Form 01”

6. CATEGORIES OF RECORDS OF YWO WHICH ARE AVAILABLE WITHOUT A PERSON HAVING TO REQUEST ACCESS

How to Access These Records:

• Directly access it from the Company’s website: https://ywo-za.com/
• Or request a copy by email to: support@ywo.com

7. RECORDS AVAILABLE IN TERMS OF OTHER LEGISLATION

YWO is subject to and retains records in compliance with, among others, the following laws:

• Companies Act, 71 of 2008
• Financial Advisory and Intermediary Services Act, 37 of 2002
• Financial Sector Regulation Act, 9 of 2017
• Financial Intelligence Centre Act, 38 of 2001
• Protection of Personal Information Act, 4 of 2013
• Basic Conditions of Employment Act, 75 of 1997
• Labour Relations Act, 66 of 1995
• Employment Equity Act, 55 of 1998
• Occupational Health and Safety Act, 85 of 1993
• Income Tax Act, 58 of 1962
• Unemployment Insurance Act, 63 of 2001
• Value-Added Tax Act, 89 of 1991
• Compensation for Occupational Injuries and Diseases Act, 130 of 1993
• Skills Development Act, 97 of 1998
• Prevention of Organised Crime Act, 121 of 1998
• Electronic Communications and Transactions Act, 25 of 2002

Note: Although YWO has used its best endeavours to provide a comprehensive list of applicable legislation, this list may not be exhaustive. Whenever it comes to the Company’s attention that existing or new legislation allows a requester access to records on a basis other than PAIA, this Manual will be updated accordingly. Requesters must specify the legislative right relied upon to enable the Information Officer to consider the request in light thereof.

8. DESCRIPTION OF THE SUBJECTS ON WHICH YWO HOLDS RECORDS AND CATEGORIES OF RECORDS HELD ON EACH SUBJECT

In accordance with Section 51(1)(e) of the PAIA, the following subjects and categories of records are held by YWO. However, it should be noted that access to these records is not automatically guaranteed. Each request will be considered on its own merits and evaluated in accordance with the provisions of PAIA and any other applicable legislation.

9. PROCESSING OF PERSONAL INFORMATION

9.1. Purpose of Processing Personal Information

YWO processes personal information lawfully and in a manner that is reasonable, relevant, and not excessive. The Company processes personal information for purposes including:

• Website operation and analytics;
• Responding to enquiries;
• Distribution of newsletters (where consent is provided);
• Marketing activities permitted under law;
• Legal and compliance obligations.

Further details on processing are set out in the Company’s Privacy & Cookies Policy, available at https://ywo-za.com/

YWO does not process client identification, verification, onboarding, or trading information.

9.2. Description of the Categories of Data Subjects and of the Information Relating Thereto

9.3. Recipients or Categories of Recipients to whom Personal Information may be Supplied

The Company may disclose your Personal Information to the following categories of recipients, strictly on a need-to know basis and for legitimate business or legal purposes.

• Service providers and specialist advisers who have been contracted to provide administrative, legal, financial, tax, compliance, insurance, IT, analytics, marketing, research, cybersecurity or other professional services;
• Regulatory, statutory, law-enforcement or governmental authorities or bodies where disclosure is required by law or regulation;
• Third-party providers who support the operation of the Company’s website, systems and communication tools;
• Organisations involved in the provision of hosting, cloud storage, data analytics and traffic-monitoring services;
• Market research companies assisting the Company with analytics or service-evaluation activities;
• The Information Regulator or any supervisory authority as required under POPIA or other applicable legislation;
• Any party to whom disclosure is required to enforce or apply our terms, comply with contractual or legal obligations, or protect the rights, property or safety of the Company, its employees or the public;
• Any entity or advisor involved in a potential sale, transfer, restructuring or acquisition of all or a portion of the Company’s assets or business;
• Any third-party where you have provided consent for such disclosure;
• Anyone legally authorised by you

We endeavour to disclose to these third parties only the minimum Personal Information necessary for them to perform their contractual obligations to the Company and strictly on a need-to-know basis. All third-party service providers are prohibited from using or sharing Personal Information for any purpose other than providing services to the Company and are contractually bound by confidentiality and applicable data-protection obligations.

9.4. Planned Trans-Border Flows of Personal Information

Where Personal Information is transferred, stored, or processed outside the Republic of South Africa, the Company will ensure that such transfers comply with Section 72 of POPIA. The Company will only transfer Personal Information to third parties in foreign jurisdictions that provide an adequate level of data protection, or where appropriate contractual or other safeguards are in place.

Any cross-border transfer of Personal Information will be limited to what is necessary for lawful business functions, website hosting, analytics, or regulatory requirements. All such transfers are subject to suitable technical, contractual, and organisational safeguards to ensure that the Personal Information remains adequately protected at all times.

9.5. Information Security Measures

YWO implements reasonable and appropriate technical and organisational measures to ensure the confidentiality, integrity, and availability of personal information. These include, among others:

• Access-control and user-authentication systems;
• Firewalls, anti-virus, and anti-malware protection;
• Data-encryption and secure backup procedures;
• Restricted physical access to information systems;
• Regular monitoring, security testing, and staff training; and
• Incident-response and data-breach-notification processes.

10. PROCEDURE FOR REQUESTING ACCESS TO RECORDS

10.1. Who May Request Access

In terms of Section 50 of PAIA, a requester (natural or juristic person) is entitled to request access to any record of a private body if:

• The record is required for the exercise or protection of any right;
• The requester complies with the procedural requirements set out in PAIA; and
• Access is not refused on any ground listed in Chapter 4 of the Act.

10.2. How to Submit a Request

Requests for access must be made using the prescribed “Form 02” which can be found in the website of the Regulator under subsection “Forms” https://inforegulator.org.za/paia/ and addressed to the Information Officer. Requests may be submitted by hand delivery, post, or email to the contact details provided in Section 4 of this Manual.

10.3. Form and Content of the Request

The requester must:

• Clearly identify the record(s) requested;
• Indicate the form of access required (inspection, printed copy, email, etc.);
• Specify the postal address or email address for correspondence;
• State the right being exercised or protected and explain why the record is necessary for that purpose;
• Provide proof of identity (certified copy of an ID or company registration documents if applicable); and
• Pay the prescribed request fee (if applicable).

10.4. Response Time

The Company will respond within 30 calendar days from receipt of a properly completed request. If additional time is required due to the nature or volume of the request, an extension of up to another 30 days may be communicated in writing to the requester.

10.5. Notification of Decision The Information Officer will notify the requester in writing whether:

• The request has been granted (and any access fee payable); or
• The request has been refused (and reasons for refusal, including references to the relevant provisions of PAIA).

10.6. Grounds for Refusal

Requests may be lawfully refused on one or more of the following grounds, as set out in Sections 62–70 of PAIA:

• Protection of personal information of third parties;
• Protection of confidential commercial or financial information of third parties;
• Protection of trade secrets or intellectual property;
• Protection of the safety of individuals or property;
• Protection of records privileged from production in legal proceedings; or
• If the request is manifestly frivolous, vexatious, or involves unreasonable diversion of resources.

10.7. Third-Party Notification

Where a request involves information pertaining to a third party, the Company must notify the third party concerned in terms of Section 71 of PAIA, within 21 days after the request was received, giving them the opportunity to make representations as to whether the record should be disclosed.

11. FEES

Fees are payable in accordance with the Regulations Relating to the Promotion of Access to Information, 2021, as issued by the Minister of Justice and Correctional Services.

12. REMEDIES AVAILABLE IN CASE OF REFUSAL

If a request for access is refused or deemed refused (no response within the prescribed time), the requester may:

12.1. Lodge a Complaint Submit a complaint in writing to the Information Regulator in accordance with Section 77A of PAIA, using the prescribed complaint form available at inforegulator.org.za/complaints/

12.2. Apply to Court Alternatively, the requester may apply to a court of competent jurisdiction for relief under Section 78 of PAIA, after exhausting internal remedies.

All complaints and appeals must be submitted within 180 days of notification of the decision.

13. AVAILABILITY OF THE MANUAL

This Manual is available for inspection or download as follows:

• On the Company’s website: https://ywo-za.com/
• At the registered office of YWO during normal business hours; and
• Upon written request to the Information Officer via email or post.

Copies may be obtained in hard copy or electronic format. A nominal fee may apply for printed copies.

The Manual will be reviewed annually or whenever significant changes occur to ensure ongoing compliance with PAIA, POPIA, and other applicable legislation.