MANUAL PREPARED IN ACCORDANCE WITH SECTION 51 OF THE PROMOTION OF ACCESS TO INFORMATION ACT 2 OF 2000 AND THE PROTECTION OF PERSONAL INFORMATION ACT 4 OF 2013

Date: 02/09/2026

Version: 1.0

GENERAL

1. DEFINITIONS

Terms and words which are not defined in this Manual shall bear the meanings ascribed to such terms in the SA Information Legislation. The following words and expressions shall bear the meanings assigned to them below and cognate words and expressions bear corresponding meanings -

1. "Constitution" - the Constitution of the Republic of South Africa, 1996;

1.2 "Data Subject" - as defined in POPIA;

1.3 "Employee" - a current or former employee (temporary or permanent and irrespective of contract type), partner, worker, intern, consultant, individual / independent contractor, and / or director;

1.4 "External Parties" - service providers, customers, requesters in terms of PAIA, Data Subjects enacting their rights in terms of POPIA, other complainants and enquirers, job applicants, premises visitors and information technology ("IT") users, excluding Employees;

1.5 "External Privacy Notice" - the privacy notice provided to External Parties in terms of which they are notified of the processing of their Personal Information;

1.6 "Guide" - the guide initially published by the South African Human Rights Commission and updated by the Regulator in terms of section 10 of PAIA;

1.7 "AllWage", "we", "us" or "our" - AllWage Proprietary Limited, a private company with limited liability incorporated in accordance with the laws of South Africa, with registration number (2018/531527/07);

1.8 "Internal Privacy Notice" - the privacy notice provided to Employees in terms of which they are notified of the processing of their Personal Information and the terms thereof;

1.9 "Information Officer" - AllWage's information officer whose details appear at 8.1;

1.10 "Manual" - this manual, prepared in accordance with section 51 of PAIA, as updated or amended from time to time;

1.11 "PAIA" - the Promotion of Access to Information Act No 2 of 2000 and its regulations, as amended from time to time;

1.12 "person" or "entity" - includes any natural or juristic person, association, business, close corporation, company, concern, enterprise, firm, partnership, joint venture, trust, undertaking, voluntary association, body corporate, and any similar entity, in any jurisdiction;

1.13 "Personal Information" - any information relating to a natural or juristic person which identifies or can be used to identify such person, excluding completely anonymous information;

1.14 "POPIA" - the Protection of Personal Information Act No 4 of 2013 and its regulations, as amended from time to time;

1.15 "process" - any operation or activity or any set of operations concerning Personal Information as defined in POPIA and including the collection, storage and distribution of Personal Information, and "processing" and "processed" should be construed accordingly;

1.16 "SA Information Legislation" - collectively, POPIA and PAIA;

1.17 "South Africa" - the Republic of South Africa;

1.18 "Regulator" - the Information Regulator established in terms of POPIA;

1.19 "Security Compromise" - where an unauthorised person accesses or acquires your Personal Information; and

1.20 "you" – includes a Requester or Data Subject, as the context may indicate, and "your" should be construed accordingly.

2. STRUCTURE OF THIS MANUAL

2.1 Part A deals with general matters.

2.2 Part B deals with records.

2.3 Part C deals with POPIA and Personal Information.

2.4 Part D deals with access to records in terms of PAIA.

3. INTRODUCTION

3.1 The Constitution of the Republic of South Africa, 1996, ("the Constitution") entrenches the fundamental right to information, by providing a statutory right of access, on request, to any record held by the state and private bodies.

3.2 This manual is published pursuant to section 51 of the Promotion of Access to Information Act 2 of 2000 ("PAIA") which was promulgated in order to nurture an ethos which promotes transparency, accountability and effective governance of all private and public bodies. PAIA gives effect to section 32 of the Constitution which provides for the right of access to information in a manner that affords persons a means/platform to obtain the records of private and public bodies as promptly and as efficiently as reasonably possible to endorse, including but not limited to, mechanisms and procedures that empower and educate all persons.

3.3 PAIA establishes the following statutory rights of requesters to any record of a private body if –

3.3.1 that record is required for the exercise or protection of any of his or her rights;

3.3.2 that requester complies with all the procedural requirements; and

3.3.3 access is not refused in terms of any ground referred to in PAIA.

3.4 PAIA requires organisations to compile a manual as a guide to requesters of information. The Manual also serves to indicate the types of records held by AllWage and the availability of such records from AllWage.

3.5 In addition, this manual explains how to access, or object to, or request correction or deletion of, personal information held by AllWage, in terms of sections 23, 24 and 25 of the Protection of Personal Information Act 4 of 2013 (“POPIA”), and the Regulations Relating to the Protection of Personal Information, 2017 (“POPIA Regulations”).

3.6 AllWage, as a responsible party as defined in section 1 of POPIA, is empowered in terms of the provisions of PAIA to provide access to information to a requester, while having the responsibility of ensuring that the fundamental conditions relating to the lawful processing of information in terms of POPIA, in relation to both juristic and natural persons, are adhered to.

3.7 AllWage can process information to meet its duties in terms of PAIA, and as provided for in terms of section 11 of POPIA.

3.8 This manual is not exhaustive of, nor does it comprehensively deal with, every procedure provided for in PAIA. Requestors are advised to familiarise themselves with the provisions of PAIA and POPIA before making any requests to AllWage in terms of these Acts. However, in terms of section 19 of PAIA, and Regulations 2 and 3 of the POPIA, AllWage will provide such assistance as is required in completing the necessary forms, by parties applying for access to information or personal information.

3.9 AllWage makes no representation and gives no undertaking or warranty that the information in this manual or any information provided by it to a requestor is complete or accurate, or that such information is fit for any purpose. All users of any such information use such information entirely at their own risk, and AllWage will not be liable for any loss, expense, liability or claims, howsoever arising, resulting from the use of this manual or of any information provided by AllWage or from any error therein.

4. AVAILABILITY OF THE ALLWAGE MANUAL AND ENTRY POINT FOR ACCESS

4.1 This Manual is available in electronic and hard copy in English. The hard copy is available at the address indicated at paragraph 8.1. The electronic version of this Manual is available on our website at the following hyperlink: https://www.allwage.com/paia-manual

4.2 AllWage endorses the spirit of PAIA and believes that this Manual will assist requesters in exercising their rights.

4.3 In summary, the manual provides information on the –

4.3.1 contact details of the Information Officer;

4.3.2 structure and functions of AllWage;

4.3.3 subjects and categories of records that are held by AllWage;

4.3.4 procedure that needs to be followed;

4.3.5 criteria that has to be met by a requester to request access to a record; and

4.3.6 the processing activities of AllWage in terms of POPIA.

5. UPDATING OF THIS MANUAL

5.1 This Manual will be reviewed when necessary, but at least once per year.¹ The Manual will be updated from time to time.

5.2 We will upload an updated version of this Manual on our website. It is your responsibility to ensure that you are familiar with this Manual and that you check the website to make sure that you are referring to the latest version.

5.3 The last date of update and version number is indicated on the cover page.

6. WHO MAY REQUEST INFORMATION?

6.1 PAIA provides that a requester is only entitled to access a record if the record is required for the exercise or protection of a right. Only requests for access to a record, where the requester has satisfied the Information Officer that the record is required to exercise or protect a right, and that those requests are made in accordance with both PAIA and where applicable POPIA, will be considered.

6.2 A requester may act in different capacities in making a request for a record. This will influence the amount to be charged when a request has been lodged.

6.3 Requesters may fall into one of the following categories –

6.3.1 a personal requester who requests confirmation on whether or not AllWage holds personal information about him/herself;

6.3.2 a personal requester who requests a record about him/herself, or requests to have a record relating to him/herself corrected or deleted;

6.3.3 an agent requester who requests a record on behalf of someone else;

6.3.4 a third party requester who requests a record about someone else; and

6.3.5 a public body, who may request a record if –

6.3.5.1 it fulfils the requirements of procedural compliance;

6.3.5.2 the record is required for the exercise or protection of a right; and

6.3.5.3 no grounds for refusal exist in PAIA.

7. OVERVIEW OF ALLWAGE

7.1 Scope

This manual has been prepared in respect of AllWage, a private company with limited liability, duly incorporated in South Africa and will serve to provide reference regarding the records held by AllWage at its principal place of business and operations.

7.2 AllWage Company Profile

AllWage's operations are at 5th Floor, Bloukrans Building, Lynnwood Bridge, Pretoria, Gauteng, 0081, South Africa, and it provides an integrated ecosystem for time and attendance, WhatsApp-based workforce communication, document management, and payroll in South Africa’s wage‑intensive sectors, replacing paper and spreadsheets with a single system that automates accurate hours, payslips, bank files and statutory submissions (including PAYE, UIF and SDL) and supports BCEA-aligned compliance and industry reporting.

8. INFORMATION OFFICER, DEPUTY INFORMATION OFFICER AND CONTACT DETAILS OF allwage

8.1 The board of AllWage has delegated its powers to an Information Officer as set out below, and as required in terms of PAIA and POPIA. The Information Officer shall handle all requests on AllWage's behalf and ensure that the requirements of PAIA are administered in a fair, objective and unbiased manner.

8.2 Should you wish to enact any right in terms of SA Information Legislation, or otherwise have any other records or information processing related query, please contact our Information Officer.

9. GUIDE BY THE REGULATOR AND THE REGULATOR'S DETAILS²

9.1 The Regulator has, in terms of section 10(1) of PAIA, as amended, updated and made available the revised Guide on how to use PAIA (“Guide”), in an easily comprehensible form and manner, as may reasonably be required by a person who wishes to exercise any right contemplated in PAIA and POPIA

9.2 You can access the Guide at https://www.justice.gov.za/inforeg/ or by request to the Information Officer.

9.3 A copy of the Guide is also available in the following two official languages, for public inspection during normal office hours - English and Afrikaans.

9.4 The Information Regulators contact details are as follows -

Physical address: Woodmead North Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191

Email address: enquiries@inforegulator.org.za

Website: www.inforegulator.org.za

Toll Free: +27 80 001 7160

RECORDS

10. AUTOMATICALLY AVAILABLE RECORDS³

10.1 The following records are automatically available on our website and it is therefore not necessary to apply for access thereto in terms of PAIA:

10.2 AllWage has exercised its discretion not to publish any section 52 notice.

10.3 Where you are our Employee, your records can be requested through the appropriate human resources channels. Please feel free to contact our Information Officer if you require guidance in this regard.

11. RECORDS AVAILABLE IN ACCORDANCE WITH other legislation⁴

Records are kept in accordance with legislation as is applicable to AllWage, which may include (but is not limited to) the following legislation:

12. dESCRIPTION OF THE TYPES OF RECORDS / SUBJECTS OF INFORMATION WHICH WE HOLD⁵

The following table contains a description of the types of records / subjects of information which AllWage holds, and the categories of records held on each subject:

PERSONAL INFORMATION

13. INTRODUCTION

13.1 PAIA requires that this Manual describes the processing of Personal Information that we do.⁶

13.2 We process Personal Information in compliance with POPIA and the eight conditions for lawful processing contained therein.

13.3 A fuller description of how we process Personal Information is contained in our -

13.3.1 Internal Privacy Notice, in relation to Employees; and

13.3.2 External Privacy Notice, in relation to external Data Subjects.

13.4 This Manual should be read with the Internal Privacy Notice and External Privacy Notice, whichever is applicable. AllWage acts as a Responsible Party for its own employee and customer account information, and as an Operator when processing customers’ employee information on their behalf for time and attendance, payroll and related services. The customer is the Responsible Party for that processing.

14. THE PURPOSE OF THE PROCESSING THAT WE DO⁷

14.1 AllWage processes Personal Information for the following purposes -

14.1.1 to validate your identity;

14.1.2 to deal with requests you send us and respond to your queries;

14.1.3 to maintain your account;

14.1.4 to comply with our legal and regulatory obligations, for example, transaction reporting under rules imposed by a finance regulatory authority;

14.1.5 to offer services to clients; and

14.1.6 to manage our business in an efficient and proper manner, including the management of our financial position, our resources, the risks to which we are exposed and the way in which we arrange our internal operations. More specifically, this includes for -

14.1.6.1 purposes related to our human resources function;

14.1.6.2 the drafting of agreements with third parties;

14.1.6.3 company secretarial administration; and

14.1.6.4 the preparation of financial statements.

14.2 Where we process your Personal Information, we do so in accordance with POPIA. The most common legal bases we rely on are:

14.2.1 Consent - you have told us you are happy for us to process your personal information for a specific purpose.

14.2.2 Legitimate Interests - the processing is necessary for us to conduct our business, but not where our interests are overridden by your interests or rights.

14.2.3 Performance of a contract - we must process your personal information in order to comply with our obligations.

14.2.4 Although less common, there may be circumstances when other legal bases are appropriate:

14.2.4.1 Data Subject legitimate interest - the processing of your personal information is necessary to protect you or in your legitimate interest.

14.2.4.2 Legal obligation - we are required to process your personal information by law.

15. CATEGORIES OF DATA SUBJECTS AND TYPES OF PERSONAL INFORMATION⁸

15.1 We process Personal Information relating to a variety of Data Subjects and types of Personal Information as follows:

16. Disclosure of Personal Information⁹

16.1 Where we share your Personal Information, we will take all reasonable and practicable measures to ensure that the third party who we have shared your Personal Information with will treat it with the same level of confidentiality and security as is required by us and that the information will be used solely for the purpose for which it was disclosed for. Where necessary, we have agreements in place with third parties ensuring this. We cannot, however, guarantee the security of any information which we share with a third party.

16.2 Where we wish to share your Personal Information for marketing purposes, we will ask for your consent before we do so.

16.3 We will also share your Personal Information in the following circumstances:

16.3.1 Where we need to do so to comply with our legal or regulatory obligations (which may include sharing information with regulators, auditors, government bodies or law enforcement agencies).

16.3.2 Where necessary, to protect or defend our legal rights or the legal rights of another company or person.

16.3.3 If our business, or any part of it, is transferred or sold, we will transfer your Personal Information to the company taking over our role, which could include a purchaser or the provider replacing us. Where necessary to provide our services, with service providers supporting hosting, communications and customer-authorised integrations, subject to the applicable data-protection requirements.

16.4 We will never sell your information to anybody for unsolicited marketing.

17. TRANSFER OF PERSONAL INFORMATION OUTSIDE OF SOUTH AFRICA¹⁰

17.1 Should we ever send your Personal Information to another country, we will always ensure adequate measures are in place to safeguard it and to ensure you can exercise your rights effectively.

17.2 Note that we do not transfer Personal Information to another country. If you would like more information about transfers to other countries and the ways in which we will protect your Personal Information, please contact our Information Officer.

18. GENERAL DESCRIPTION OF INFORMATION SECURITY MEASURES¹¹

18.1 We use reasonable and appropriate technical and organisational measures to ensure that Personal Information is kept secure and is protected against unauthorised or unlawful processing, accidental loss, destruction or damage, and unauthorised alteration, disclosure or access. We contractually require that service providers who handle your Personal Information for us do the same.

18.2 We have policies in place to ensure that your Personal Information is kept secure. We support these policies with the following security measures, amongst others, -

18.2.1 physical access controls in respect of physically stored Personal Information;

18.2.2 information technology access controls and defences; and

18.2.3 internal training and policies on data protection matters.

18.3 We implement security measures appropriate to the nature of the processing and regularly review these measures to ensure they remain appropriate.

19. SECURITY COMPROMISE

19.1 Should AllWage experience a Security Compromise, we will ensure that all reasonable steps are taken to prevent any further loss of data and to secure the data as soon as possible. The Regulator will be informed of the data breach, as required by POPIA and all further notifications required by POPIA will be complied with.

19.2 The Security Compromise will be investigated, and the Information Officer will supervise the response to the breach. Once the Security Compromise has been contained and the investigation concluded, AllWage will compile a report on the cause of the Security Compromise and the actions to be taken to prevent a future data breach from occurring again which could include, amongst others, amending AllWage's policies and procedures.

20. EXERCISE OF A RIGHT IN TERMS OF POPIA

If you are our Data Subject, you have the rights afforded to you in POPIA. You may exercise the rights described below in the manner so described.

1. Objection¹²

Where you wish to object to the processing of their Personal Information, you must complete the prescribed form attached to this Manual as Form 2 in Annexure A.

1.2 Correction / Deletion¹³

Where you wish to request that we delete or correct your Personal Information, you must complete the prescribed form attached to this Manual as Form 2 in Annexure B.

1.3 Access¹⁴

1.3.1 You have the right to request that we confirm, free of charge, whether we hold Personal Information about you. You may request from us the record or a description of the Personal Information which we hold, including information about the identity of all third parties, or categories of third parties, who have, or have had, access to the information.

1.3.2 Where you are required to pay a fee for access in terms of POPIA, we will provide you with a written estimate and may require that you pay a deposit.

1.3.3 A request for access to Personal Information may be subject to refusal in terms of PAIA.

ACCESS TO RECORDS

21. PAIA - HOW TO REQUEST ACCESS TO A RECORD

21.1 To request a record in terms of PAIA, you (a "Requester") must complete the prescribed form attached to this Manual as Annexure A (the "Request"). This Request must be sent to the Information Officer at the addresses provided at 8.1.

21.2 You must in the Request -

21.2.1 provide sufficient detail to enable the Information Officer to identify the record(s) requested and the Requestor;

21.2.2 indicate which form of access is required;

21.2.3 identify the right that they are seeking to exercise or protect;

21.2.4 provide an explanation of why the requested record is required for the exercise or protection of that right; and

21.2.5 if the Request is made on behalf of another person, the Requestor must submit proof of the capacity in which the Requestor is making the Request, to the reasonable satisfaction of the Information Officer.

21.3 PAIA makes provision for certain grounds upon which a request for access to information must be refused. On this basis, the Information Officer will make a decision whether or not to grant a Request.

22. PAYMENT OF FEES

22.1 PAIA provides for two types of fees for Requesters requesting a record -

22.1.1 a request fee, which will be a standard non-refundable administration fee, payable prior to the Request being considered (collectively, "the Request Fee"); and

22.1.2 an access fee, payable when access to the record is granted, which must be calculated by taking into account reproduction costs, search and preparation time and cost, as well as postal costs (collectively, "the Access Fee").

22.2 Once a Request has been made by you, the Information Officer will give you notice to pay the Request Fee, which must be paid before your Request can be further processed.

22.3 If the preparation of a record being requested will require more than six hours, we will request you to pay one third of the Access Fee as a deposit.

22.4 We may withhold a record until you have paid the fees as indicated in 22.1.

23. APPLICABLE TIME PERIODS

23.1 We will by notice inform you within 30 days after receipt of a Request of its decision whether or not to grant the Request.

23.2 The 30-day period may be extended by a further period of not more than 30 days for one of the reasons indicated in PAIA, including where the Request is for a large number of records or requires a search through a large number of records.

24. OUTCOME OF THE REQUEST (GRANTING OR REFUSING)

24.1 If your Request has been granted, you must pay the Access Fee.

24.2 If your Request is refused, the notice referred to in 23.1 will state adequate reasons for the refusal, including the provisions of PAIA relied upon; and that you may lodge a complaint to the Regulator or an application with a Court against the refusal of the request.

25. GROUNDS FOR REFUSAL OF ACCESS TO RECORDS

25.1 A Request may be refused on one or more of the following grounds –

25.1.1 protection of privacy to a third party who is a natural person;

25.1.2 protection of the commercial information of a third party;

25.1.3 protection of certain confidential information of a third party;

25.1.4 protection of the safety of individuals and the protection of property;

25.1.5 protection of records privileged from production and legal proceedings;

25.1.6 our commercial information; and/or

25.1.7 the protection of our or a third party's research information.

25.2 Despite any grounds for refusal of access to records provided for in PAIA, a Request must be granted if the disclosure of the record would reveal evidence of substantial contravention of or failure to comply with the law or imminent and serious public safety or environment risk, and the public interest in the disclosure of the record clearly outweighs the harm contemplated.¹⁵

26. REMEDIES FOR REFUSAL

26.1 If a deposit has been paid in respect of a Request which is refused, the Information Officer or his/her duly authorised representative shall repay the deposit to the Requester.

26.2 Should the Requester be dissatisfied with the Information Officer’s decision to refuse access, that person may within 30 days after notification of the refusal lodge a complaint with the Regulator or apply to a Court for the appropriate relief.