PAIA Manual

1. Introduction

The Promotion of Access to Information Act, 2000 ("PAIA") gives effect to the constitutional right of access to any information held by the State and any information held by another person that is required for the exercise or protection of any rights.

The Protection of Personal Information Act, 2013 ("POPIA") regulates how personal information is processed by public and private bodies in South Africa. Section 51 of PAIA, as amended by POPIA, requires every private body to compile a manual describing the records it holds, the procedure for requesting access, and certain disclosures relating to the processing of personal information.

This manual has been prepared by Mahapa Financial Advisory Services CC ("Mahapa Financial", "we", "us" or "our") for use by any person who wishes to request access to a record held by us.

2. Particulars of the private body

Key Individuals (FAIS)

Authorised representatives (FAIS)

• Kaleka Mahapa
• Mpopeng Mahapa
• Sesupa Philemon Mahapa

External compliance officers

Approved product categories

As reflected on the FSCA register, Mahapa Financial is authorised to render financial services in respect of the following Category I product subcategories:

• Long-Term Insurance subcategory A
• Long-Term Insurance subcategory B1
• Long-Term Insurance subcategory B1-A
• Long-Term Insurance subcategory B2
• Long-Term Insurance subcategory B2-A
• Long-Term Insurance subcategory C
• Short-Term Insurance Personal Lines
• Short-Term Insurance Personal Lines A1
• Short-Term Insurance Commercial Lines
• Retail Pension Benefits
• Pension Funds Benefits
• Participatory interests in a collective investment scheme

The current FSCA register entry for FSP 6604 is publicly available at fsca.co.za.

3. Information Officer & Deputy Information Officer

In terms of section 1 of PAIA read with section 56 of POPIA, the head of the private body is the Information Officer. The Information Officer for Mahapa Financial is:

4. Guide on how to use PAIA

The Information Regulator has published a guide in terms of section 10 of PAIA, in an easily comprehensible form, to assist a person who wishes to exercise any right contemplated in PAIA or POPIA. The guide is available in all official languages and may be obtained from:

5. Records automatically available without a PAIA request

The following categories of records are voluntarily made available to the public and may be obtained without submitting a formal request:

• Marketing material on our website at mahapafinancial.co.za
• Our Privacy Policy and Cookie Policy
• This PAIA Manual
• Disclosure documents required under the Financial Advisory and Intermediary Services Act, 2002 (FAIS Act)

6. Records available in terms of other legislation

Certain records held by Mahapa Financial are accessible in terms of legislation other than PAIA, including but not limited to:

• Companies Act, 2008 (Act 71 of 2008) and Close Corporations Act, 1984
• Financial Advisory and Intermediary Services Act, 2002 (Act 37 of 2002)
• Financial Intelligence Centre Act, 2001 (Act 38 of 2001) (FICA)
• Long-term Insurance Act, 1998 and Short-term Insurance Act, 1998
• Tax Administration Act, 2011 and Income Tax Act, 1962
• Basic Conditions of Employment Act, 1997 and Labour Relations Act, 1995
• Protection of Personal Information Act, 2013 (POPIA)

7. Categories of records held

The following categories of records are held by Mahapa Financial. Access is subject to the procedures, fees and grounds for refusal set out in this manual.

Client records

• Client onboarding documents (FICA / KYC, ID copies, proof of address)
• Financial needs analyses, advice records and recommendations
• Investment, retirement, insurance and estate planning files
• Correspondence and records of advice

Corporate records

• Founding statements, registration documents and FSCA licence records
• Financial statements, management accounts and tax records
• Internal policies and compliance manuals

Employee records

• Employment contracts, performance and disciplinary records
• Payroll, tax and benefit records

Supplier & product-provider records

• Agreements with product providers (e.g. Old Mutual, ITransact, Auto & General)
• Service-level agreements and supplier correspondence

8. POPIA — purpose of processing personal information

We process personal information for the following purposes:

• Providing financial advisory and intermediary services
• Complying with our regulatory obligations under FAIS, FICA, POPIA and tax legislation
• Administering client accounts and processing transactions
• Communicating with clients, prospective clients and product providers
• Managing employees and contractors
• Detecting and preventing fraud, money laundering and other financial crime

9. POPIA — categories of data subjects and personal information

10. POPIA — recipients of personal information

Personal information may be shared, where lawful and necessary, with:

• Product providers and underwriters that we recommend or transact with on a client's behalf
• Regulators and authorities, including the FSCA, FIC, SARS and the Information Regulator
• Professional advisers (auditors, attorneys, compliance officers)
• IT, hosting and communications service providers acting as our operators
• Third parties where required by law or with the data subject's consent

11. POPIA — planned transborder flows of personal information

We may transfer personal information outside the Republic of South Africa where our cloud-based service providers (such as email, hosting and CRM platforms) store data internationally. Such transfers will only occur where the recipient is subject to a law, binding corporate rules, or binding agreement that provides an adequate level of protection, or where the data subject has consented, in line with section 72 of POPIA.

12. Security safeguards

Mahapa Financial has implemented reasonable, appropriate technical and organisational measures to secure the integrity and confidentiality of personal information, including access controls, encryption in transit, secure storage, staff training, and regular review of security practices in line with section 19 of POPIA.

13. How to request access to records

A request for access to a record must be made on the prescribed Form 2 (Form of Request for Access to Record of Private Body) issued by the Information Regulator. The form is available at inforegulator.org.za.

The completed request form should be sent to the Information Officer at:

The requester must:

• Provide sufficient detail to enable the record to be identified
• Indicate the form of access required
• Provide a postal address or email address in the Republic
• Identify the right that the requester is seeking to exercise or protect, and provide an explanation of why the requested record is required
• Pay the prescribed request fee (where applicable)

The Information Officer will respond to the request within 30 days of receipt, as required by section 56 of PAIA.

14. Fees

Fees are payable in accordance with the prescribed Regulations under PAIA and may include a request fee, an access fee and a deposit. The current fee schedule is published by the Information Regulator and available on our request. Indigent requesters may apply to be exempted from request and access fees.

15. Grounds for refusal of access

Access to a record may be refused on the grounds set out in Chapter 4 of Part 3 of PAIA, including (without limitation):

• Mandatory protection of the privacy of a third party who is a natural person (s 63)
• Mandatory protection of commercial information of a third party (s 64)
• Mandatory protection of certain confidential information of a third party (s 65)
• Mandatory protection of the safety of individuals and property (s 66)
• Mandatory protection of records privileged from production in legal proceedings (s 67)
• Commercial information of the private body (s 68)
• Research information of a third party and the private body (s 69)

The mandatory disclosure provision in section 70 of PAIA (public interest override) will be applied where it is engaged.

16. Remedies available to a requester

If a request is refused, or the requester is dissatisfied with the response, the requester may:

• Lodge a complaint with the Information Regulator in terms of section 77A of PAIA, or
• Apply to a court of competent jurisdiction (the High Court or Magistrate's Court) for relief in terms of section 78 of PAIA, after exhausting the internal complaints procedure.

17. Availability of this manual

This manual is available:

• At our principal place of business at 93 Onder Street, Polokwane, during normal business hours
• On our website at mahapafinancial.co.za/paia
• On request from the Information Officer, on payment of a reasonable fee

The Information Officer reviews and updates this manual on a regular basis to ensure it remains accurate and current.