PAIA Manual

1. Introduction

Ovitoz is a rewards programme operator that operates a digital rewards ecosystem through which participating customers or members may access, earn, receive, redeem or otherwise benefit from rewards, discounts, benefits, incentives and promotional offerings. Ovitoz works with participating merchants, retailers, sponsors and other commercial partners (“Brand Partners”) to make these rewards and benefits available to members, including by linking rewards to qualifying purchases, sales, transactions, programme activities, campaigns or other eligibility criteria. In the course of operating the Ovitoz rewards programme, Ovitoz creates, receives, stores and processes a variety of records relating to its members, prospective members, Brand Partners, service providers, employees, contractors and other persons with whom Ovitoz interacts. These records include information relating to programme participation, rewards, qualifying transactions, marketing activities, commercial arrangements, technology systems and the administration of the Ovitoz business. Section 32 of the Constitution of the Republic of South Africa, 1996 recognises the right of access to information. The Promotion of Access to Information Act 2 of 2000 (“PAIA”) gives effect to this constitutional right by establishing mechanisms through which persons may request access to records held by public and private bodies. Section 51 of PAIA requires private bodies to prepare and make available a manual containing prescribed information relating to the records held by the body and the manner in which those records may be accessed. This Manual has accordingly been prepared in accordance with section 51 of PAIA. This Manual should also be read together with the Protection of Personal Information Act 4 of 2013 (“POPIA”), the regulations issued under PAIA and POPIA, and Ovitoz's Privacy Policy or Privacy Notice, as amended from time to time. POPIA regulates the lawful processing of personal information and amended certain provisions of PAIA in order to balance the right of access to information with the right to privacy and the protection of personal information. The purpose of this Manual is to provide members of the public with a practical description of the records held by Ovitoz, the procedure for requesting access to such records, the circumstances in which access may be refused, and the rights available to data subjects in respect of personal information processed by Ovitoz.

2. Definitions and interpretation

• “Brand Partner” means a merchant, retailer, service provider, sponsor, advertiser, commercial partner or other participating business that makes rewards, discounts, benefits, incentives, promotions or other offerings available through or in connection with Ovitoz.
• “Data Subject” and “Personal Information” have the meanings assigned to those terms under POPIA.
• “Information Officer” means the person who has been appointed or is deemed to be the Information Officer of Ovitoz for purposes of PAIA and POPIA, and “Deputy Information Officer” means any person designated to assist the Information Officer in the performance of those functions.
• “Member” means a person who registers for, participates in or otherwise uses the Ovitoz rewards programme.
• “Requester” means a person who requests access to a record in accordance with PAIA.
• “Ovitoz” means Ovitoz (Pty) Ltd, trading as Ovitoz. References in this Manual to the “Rewards Programme” include the Ovitoz programme and any associated website, mobile application, digital platform, interface or service through which members may access or use programme functionality.

3. Purpose of the manual

This Manual is intended to assist persons who wish to understand what information Ovitoz holds and how access to that information may be requested. It provides a description of the principal subjects on which Ovitoz holds records, identifies categories of information that may be available without a formal PAIA request and explains the procedure for submitting a request for access to information. The Manual also provides the contact details of the Information Officer and any designated Deputy Information Officer responsible for assisting requesters and data subjects. In addition, it describes the categories of personal information processed by Ovitoz, the purposes for which such information is processed, the categories of recipients to whom information may be disclosed, possible transfers of personal information outside South Africa and the general security measures adopted by Ovitoz. The Manual further explains the remedies available where Ovitoz refuses a request for access and provides information on how data subjects may exercise applicable rights under POPIA.

4. Ovitoz details

The details of the private body to which this Manual applies are as follows:

5. Information Officer

Ovitoz has appointed or recognises an Information Officer responsible for overseeing compliance with PAIA and POPIA. The Information Officer is responsible for receiving and considering requests for access to records, assisting requesters where appropriate, overseeing requests relating to personal information and ensuring that Ovitoz's obligations under applicable access-to-information and data-protection legislation are appropriately administered. Ovitoz may designate one or more Deputy Information Officers to assist the Information Officer. The details of any Deputy Information Officer will be made available through Ovitoz's website or on request. All formal PAIA requests and POPIA-related requests should be directed at the Information Officer or a duly designated Deputy Information Officer.

6. Availability of this manual

This Manual will be made available on the Ovitoz website at www.ovitoz.co.za and may also be inspected at Ovitoz's principal place of business during normal business hours, subject to reasonable arrangements being made in advance where necessary. An electronic copy may be requested from the Information Officer. Ovitoz will also provide the Manual to the Information Regulator where required. The Manual may be amended from time to time to reflect changes in the law, Ovitoz's business activities, the nature of the records it holds or the manner in which it processes personal information. The most recent published version will replace previous versions.

7. Guide on how to use PAIA

The Information Regulator has prepared and made available a Guide in terms of section 10 of PAIA to assist persons who wish to exercise rights under PAIA and POPIA. The Guide explains the objects of the legislation, how requests for access to records may be submitted, what assistance is available from Information Officers and the Information Regulator, what fees may be payable and what remedies are available if a request is refused or a person believes that their rights have been infringed. The Guide may be obtained from the Information Regulator and is available through the Regulator's official channels.

8. Records available without a formal PAIA request

Certain information relating to Ovitoz may be publicly available without requiring a formal request under PAIA. This would ordinarily include information that Ovitoz has deliberately made available through its website, applications, public-facing documents or marketing channels. Publicly available information may include Ovitoz's programme terms and conditions, Privacy Policy or Privacy Notice, programme rules, frequently asked questions, publicly advertised rewards and promotions, information concerning participating Brand Partners, marketing or promotional material, press releases, published corporate information and general contact information. The fact that a category of record is referred to in this section does not mean that every document within that category will necessarily be available to the public. Confidential, commercial, personal or otherwise protected information may remain subject to the limitations and grounds for refusal contained in PAIA.

9. Records held in terms of other legislation

Ovitoz is required to create and retain certain records in accordance with legislation applicable to its business and operations. Depending on the particular circumstances of the business and its employment, tax, corporate, commercial and technology activities, relevant legislation may include the Companies Act 71 of 2008, Consumer Protection Act 68 of 2008, Protection of Personal Information Act 4 of 2013, Promotion of Access to Information Act 2 of 2000, Electronic Communications and Transactions Act 25 of 2002, Income Tax Act 58 of 1962, Value-Added Tax Act 89 of 1991 and Tax Administration Act 28 of 2011. Where Ovitoz has employees, it may also hold records under applicable employment legislation, including the Basic Conditions of Employment Act 75 of 1997, Labour Relations Act 66 of 1995, Employment Equity Act 55 of 1998, Skills Development Act 97 of 1998, Skills Development Levies Act 9 of 1999, Unemployment Insurance Act 63 of 2001, Unemployment Insurance Contributions Act 4 of 2002 and Compensation for Occupational Injuries and Diseases Act 130 of 1993. Ovitoz may additionally hold records relevant to intellectual property, competition, anti-corruption and other legal obligations under legislation such as the Copyright Act 98 of 1978, Trade Marks Act 194 of 1993, Competition Act 89 of 1998 and Prevention and Combating of Corrupt Activities Act 12 of 2004. The inclusion of legislation in this section does not mean that Ovitoz necessarily holds records under every provision of the relevant legislation. Rather, it identifies legislation under which records may be created or retained depending on Ovitoz's operations from time to time.

10. Categories of records held by Ovitoz

Ovitoz holds records arising from the ordinary operation and administration of its business. These include corporate, commercial, operational, financial, technological and customer-related records. The inclusion of a record category in this Manual does not mean that access to a particular record will necessarily be granted.

11. Categories of requesters

Requests for access to records may be made by different categories of persons. A person may request records concerning themselves, act as the authorised representative of another person or request access to records concerning a third party where the requirements of PAIA are satisfied. Public bodies and other persons may also request records in circumstances contemplated by PAIA where access is required for the exercise or protection of a right.

12. Personal information processed by Ovitoz

Ovitoz processes personal information relating to a number of categories of data subjects, principally Members and prospective Members of the Rewards Programme. Ovitoz may also process information relating to users of its website or applications, representatives and employees of Brand Partners, suppliers, service providers, contractors, employees, prospective employees, directors, shareholders, complainants and other persons who interact with Ovitoz. The nature of the personal information processed will depend on the particular relationship and the services used. In the case of Members, this may include names, contact details, account and profile information, online identifiers, authentication information, preferences, marketing choices, transaction-linked information, reward earning and redemption history, voucher usage, engagement data, correspondence, complaints and website or application usage information. Ovitoz may process device identifiers, IP addresses, cookies and similar information generated through use of its digital services. Where specific Ovitoz functionality requires it, Ovitoz may also process location information or geofencing information.

13. Purposes for which personal information is processed

Ovitoz processes personal information primarily to operate and administer the Rewards Programme. This includes registering Members, creating and maintaining Member accounts, authenticating access and determining whether a Member qualifies for a particular reward, benefit, discount or incentive. Personal information may be used to link qualifying transactions or activities to Members and to calculate, allocate, issue, redeem, reverse, cancel or expire rewards. Information may be exchanged with Brand Partners where necessary to verify qualifying activity, administer a campaign, reconcile benefits or fulfil a reward. Ovitoz may also process information to communicate with Members, respond to enquiries and complaints, provide customer support, administer promotions and improve the Rewards Programme. Subject to applicable law, Member information may be analysed to understand programme usage, Member engagement and reward preferences and to develop more relevant benefits and programme functionality. Where permitted by applicable law, personal information may be used for marketing and promotional communications. Ovitoz may maintain records of consents, communication preferences, opt-outs and marketing engagement for this purpose. Ovitoz further processes personal information where necessary to protect the integrity and security of the Rewards Programme, prevent fraud or misuse, comply with contractual and legal obligations, manage its relationships with Brand Partners and service providers, conduct financial administration and manage employment and recruitment matters. Subject to prior affirmative consent where required, Ovitoz may process limited Personal Information, online identifiers and event information for marketing measurement, campaign attribution and related advertising purposes, including conversion measurement for the Ovitoz B2C waitlist engine. Where a Member enables background health synchronisation, Ovitoz may periodically access and synchronise authorised health information from connected devices or health platforms for the authorised rewards and wellness purposes. Synchronisation may continue until the Member revokes the relevant permission or disables the feature. Background location tracking likewise occurs only where expressly authorised. Ovitoz may use Personal Information to personalise rewards, improve AI recommendations, recommend products or participating merchants, personalise wellness journeys, provide chatbot responses, generate predictive analytics and improve Member experiences. AI-generated recommendations are intended to assist Members and are not medical, healthcare or professional advice.

14. Recipients of personal information

Ovitoz may disclose personal information to third parties where this is reasonably necessary for the operation of its business or the Rewards Programme, and where disclosure is permitted under POPIA. In particular, information may be shared with Brand Partners where necessary to verify, allocate, fund, redeem or fulfil a reward or other benefit. Ovitoz may also use technology, hosting, cloud, communications, customer-support, analytics, marketing, payment, voucher or fulfilment service providers that require access to limited personal information in order to perform services on Ovitoz's behalf. Personal information may also be disclosed to professional advisers, auditors, banks, regulators, tax authorities, law-enforcement agencies, courts, tribunals and other public authorities where required or permitted by law. Any operator processing personal information on behalf of Ovitoz is expected to process the information only for authorised purposes and subject to appropriate contractual and security requirements. Participation by a Brand Partner in the Ovitoz Rewards Programme does not, by itself, confer unrestricted access to Member information. Personal information should only be shared where a lawful basis exists and to the extent reasonably necessary for the relevant purpose.

15. Transborder flows of personal information

Ovitoz may use technology providers, cloud infrastructure providers, analytics services, software providers, communications platforms, artificial intelligence services or other operators whose systems or personnel are located outside South Africa. As a result, personal information may in certain circumstances be transferred to, stored in or accessed from countries outside South Africa. Ovitoz will undertake such transfers in accordance with section 72 of POPIA and any other applicable legal requirements. Where required, appropriate contractual, technical and organisational safeguards will be put in place to ensure that personal information transferred outside South Africa receives an adequate level of protection.

16. Information security

Ovitoz recognises that appropriate safeguards are necessary to protect the confidentiality, integrity and availability of personal and confidential information. Ovitoz will implement reasonable and appropriate technical and organisational security measures having regard to the nature of the information processed, the risks associated with the processing and the technology reasonably available to Ovitoz. These measures may include authentication and access controls, password and credential management, encryption, network and infrastructure security, firewalls, endpoint protection, system monitoring, security logging, vulnerability management, backups and disaster-recovery procedures. Ovitoz may also implement confidentiality obligations, role-based access restrictions, information-security training, incident-response procedures, data minimisation measures and retention and deletion controls. Where operators process personal information on behalf of Ovitoz, Ovitoz will take reasonable steps to require those operators to establish and maintain appropriate security safeguards.

17. Procedure for requesting access to a record

A person who wishes to request access to a record held by Ovitoz must submit a request to the Information Officer using the form prescribed under PAIA. The request should contain sufficient information to enable Ovitoz to identify the Requester and locate the requested record. The Requester should describe the record as accurately as reasonably possible and specify the manner in which access is required. Where PAIA requires the Requester to demonstrate that access is necessary for the exercise or protection of a right, the request must identify that right and explain why the requested information is required. If a request is made on behalf of another person, Ovitoz may require appropriate proof of authority to act on that person's behalf. Where the requested information contains personal or confidential information, Ovitoz may also require reasonable proof of identity before providing access. Sensitive identification documents or other personal information submitted in connection with a request should be provided through a secure method specified by the Information Officer. Ovitoz will consider requests within the periods prescribed by PAIA, subject to any extension permitted under the Act. The submission of a request does not automatically entitle a Requester to access the requested record.

18. Decision on a request

Ovitoz will notify the Requester of its decision on a PAIA request in accordance with the timeframes prescribed by law. Where access is granted, Ovitoz will notify the Requester of the form in which access will be provided and of any applicable fees that must be paid before access is provided. Where a request is refused, Ovitoz will provide the Requester with adequate reasons for the refusal to the extent required by PAIA and will inform the Requester of any remedies available.

19. Grounds for refusal of access

PAIA recognises that the right of access to information is not absolute. In certain circumstances, Ovitoz may be required or permitted to refuse access to a requested record. Access may, for example, be refused where disclosure would result in an unreasonable disclosure of personal information concerning another person, reveal confidential commercial information or trade secrets, breach a duty of confidence owed to another person or prejudice the commercial interests of Ovitoz or a third party. Access may also be refused where disclosure would compromise system security, endanger the safety of a person, disclose information protected by legal professional privilege or otherwise fall within a mandatory or discretionary ground for refusal under PAIA. Where only part of a record is protected and the protected information can reasonably be separated from the remainder of the record, Ovitoz will consider whether the remainder may lawfully be disclosed.

20. Records that cannot be found or do not exist

Where Ovitoz has taken reasonable steps to locate a requested record but the record cannot be found or there are reasonable grounds to believe that the record does not exist, the Information Officer will notify the Requester in accordance with PAIA. The notification will contain the information required by PAIA and may include an explanation of the steps taken to search for the record. If the record is subsequently located, Ovitoz will consider the request for access in accordance with PAIA and the other provisions of this Manual.

21. Third-party information

A request for access may relate to information concerning a third party. In those circumstances, Ovitoz may be required to notify the affected third party and afford that person an opportunity to make representations regarding whether the information should be disclosed. The existence of a third-party consultation process does not determine the outcome of the request. Ovitoz will ultimately determine the request in accordance with PAIA and any applicable grounds for mandatory or discretionary refusal.

22. Fees

Fees payable in connection with requests under PAIA will be determined in accordance with the applicable PAIA Regulations and prescribed fee schedule in force at the relevant time. Where a fee is lawfully payable, Ovitoz may require payment of the prescribed request, reproduction or access fee before processing the request further or providing access to the relevant record. Where permitted by PAIA, Ovitoz may also require payment of a deposit where the search for and preparation of the requested record is likely to require a substantial amount of time. The Requester will be informed of any applicable fee and the manner in which payment should be made.

23. Rights of data subjects under POPIA

POPIA provides data subjects with rights relating to personal information held about them. Subject to the provisions and limitations of POPIA, a person may ask Ovitoz to confirm whether it holds personal information concerning that person and may request access to that information. A data subject may also request that personal information be corrected where it is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or unlawfully obtained. Where Ovitoz is no longer authorised to retain particular personal information, a data subject may request its deletion or destruction, subject to any legal obligation or lawful basis requiring Ovitoz to retain the information. A data subject may object to certain processing where POPIA permits such an objection and may withdraw consent where processing is based on consent. Withdrawal of consent does not affect the lawfulness of processing that occurred before the consent was withdrawn and may affect Ovitoz's ability to provide functionality that depends upon the relevant information. Data subjects may also object to or unsubscribe from direct marketing and may lodge a complaint with the Information Regulator if they believe their rights under POPIA have been infringed. A request for deletion is not an absolute right to immediate erasure in every circumstance. Ovitoz may retain information where retention is required or authorised by law, necessary for evidential, contractual, security or dispute purposes, or otherwise permitted under POPIA. Where deletion is appropriate, Ovitoz will delete, destroy or de-identify the information in a manner that prevents reconstruction in an intelligible form. A Data Subject may withdraw consent to optional health synchronisation, background location processing, chatbot processing or optional cookie/pixel tracking through the relevant Platform, device, preference-centre or account controls where available, or by contacting the Information Officer. Withdrawal applies prospectively and does not invalidate processing lawfully undertaken before withdrawal.

24. POPIA requests and prescribed forms

A data subject wishing to exercise a right under POPIA should submit the relevant request to the Ovitoz Information Officer. Where a prescribed form is required, the applicable form published under the POPIA Regulations should be used. This includes the prescribed form for objecting to the processing of personal information and the prescribed form for requesting correction or deletion of personal information or destruction or deletion of a record of personal information. Ovitoz may require reasonable proof of identity before providing personal information or acting on a correction or deletion request. Where a person acts on behalf of a data subject, appropriate proof of authority may also be required.

25. Complaints to the Information Regulator

A Requester or data subject who is dissatisfied with the manner in which Ovitoz has dealt with a PAIA request or a matter concerning the processing of personal information may, where permitted under PAIA or POPIA, lodge a complaint with the Information Regulator. Complaints should be submitted in accordance with the procedures and forms prescribed by the Information Regulator.

26. Application to court

A person who is dissatisfied with a decision relating to access to a record may, subject to the requirements and time periods prescribed under PAIA, apply to a competent court for appropriate relief. A person may also have additional remedies under POPIA or other applicable law depending on the circumstances giving rise to the complaint.

27. Retention of records

Ovitoz retains records for periods determined with reference to applicable legal requirements, contractual obligations and legitimate operational needs. The appropriate retention period will depend upon the nature of the record and the purpose for which it was created. Certain corporate, accounting, tax, employment and contractual records may be subject to mandatory statutory retention periods, while other operational information may be retained for so long as reasonably necessary to administer the Rewards Programme, resolve disputes, protect Ovitoz's rights or meet legitimate business requirements. Personal information will not be retained for longer than permitted under POPIA. Where Ovitoz is no longer authorised or required to retain personal information, it will be deleted, destroyed or de-identified in accordance with applicable law and Ovitoz's internal retention procedures.

28. Updating of this manual

Ovitoz will review this Manual periodically to ensure that it remains appropriate to the nature of its business and reflects applicable legal requirements. The Manual may be amended where there are changes to PAIA, POPIA or their regulations, changes in guidance issued by the Information Regulator, material changes to Ovitoz's business model or technology, or material changes to the categories of records or personal information processed by Ovitoz. The Information Officer is responsible for overseeing the maintenance and periodic review of this Manual.