PAIA manual.

1. Purpose of this manual

This manual is published in terms of section 51 of the Promotion of Access to Information Act 2 of 2000 (PAIA), as amended, and includes the information required by the Protection of Personal Information Act 4 of 2013 (POPIA). PAIA gives effect to section 32 of the Constitution, namely the right of access to information held by the State and to information held by another person where that information is required for the exercise or protection of any right.

It is intended to help you to:

• see which records are available without a formal PAIA request;
• understand the subjects on which we hold records and the categories of records held on each;
• see which records are available under other legislation;
• reach the Information Officer and Deputy Information Officer;
• find the Information Regulator’s guide on how to use PAIA;
• understand how and why we process personal information, whose information we process and who may receive it;
• know whether we transfer personal information outside South Africa; and
• understand the security measures protecting that information.

2. Private-body and contact details

3. Information Regulator’s PAIA guide

The Information Regulator has, in terms of section 10(1) of PAIA, published a guide explaining how PAIA and POPIA work. It describes the objects of both Acts, the contact details of information officers and deputy information officers, the manner and form of a request for access to a record of a public body (section 11) and of a private body (section 50), the assistance available from information officers and from the Regulator, the remedies available in law including internal appeals, complaints to the Regulator and court applications, the obligation on public and private bodies to compile manuals, the voluntary disclosure of records, the notices on fees issued under sections 22 and 54, and the regulations made under section 92.

The guide is available in each of the official languages and in braille. You may obtain it from inforegulator.org.za/paia, by emailing enquiries@inforegulator.org.za, on 010 023 5200, or on request from our Information Officer. Copies of the guide and of this manual may also be inspected at the offices of the Regulator and at our office during normal business hours.

4. Records held

Subject to the facts and applicable law, our record categories may include:

• company, governance, licensing, compliance and risk records;
• financial, tax, accounting, banking, insurance and asset records;
• employee, contractor and training records;
• client identity, needs analysis, advice, quotation, application, policy, investment, claim, complaint and correspondence records;
• product-provider, supplier, operator and professional-service agreements;
• marketing, website, analytics, lead and communications records;
• information-security, access-control, incident and business-continuity records; and
• records required by FAIS, FICA, POPIA, PAIA, Companies Act, tax, labour and other applicable laws.

5. Subjects on which we hold records

6. Records available without a PAIA request

The following records are available without a person having to submit a formal PAIA request. Availability does not waive any intellectual-property or confidentiality rights.

Our public website pages, published legal notices and public regulator or licence listings are likewise available without a request.

7. Records available in terms of other legislation

Records may also be kept or made available under the Financial Sector Regulation Act, the Insurance Acts, the Income Tax Act, the Value-Added Tax Act, the Labour Relations Act, the Electronic Communications and Transactions Act and the Consumer Protection Act, where applicable.

8. POPIA: purpose of processing personal information

We collect and process personal information in the course of rendering financial services. The type of personal information depends on the need for which it is collected, and it is processed for that purpose only. Examples include, but are not limited to:

• a client’s identity number, name, surname, address, postal code, marital status and number of dependants;
• assets and liabilities;
• income and expenditure;
• existing insurance and investments;
• medical information as may be required for underwriting purposes; and
• any other information required by us, by suppliers or by insurers in order to provide clients with an accurate analysis of their insurance needs.

We may also process personal information for our own internal marketing purposes, to ensure that our products and services remain applicable and appropriate. We have agreements in place with all our product suppliers, insurers and third-party service providers to establish a mutual understanding on the protection of personal information; our suppliers are subject to the same regulations that apply to us. Personal information is processed only where it is adequate, relevant and not excessive, and only for the express purpose for which it was obtained.

Beyond advice and intermediary services, our purposes include product applications and servicing, claims, compliance, fraud prevention, security, operations, employment, marketing where lawful, and responding to requests.

9. POPIA: categories of data subjects and information processed

We also process information about prospective and former clients, beneficiaries, dependants and representatives, job applicants, product-provider contacts, complainants and website users.

10. POPIA: recipients of personal information

Information may also be supplied to authorised product providers, insurers, schemes, administrators, compliance providers, professional advisers, regulators and law-enforcement bodies where lawfully required, and to technology operators including hosting, email-delivery and analytics providers.

11. POPIA: planned transborder flows of personal information

The transfer of personal information from the Republic to a foreign country is prohibited unless:

• the recipient is subject to a law, binding corporate rules or binding agreement that provides an adequate level of protection, upholding principles for reasonable processing substantially similar to the conditions for lawful processing under POPIA, including provisions on the further transfer of personal information to third parties in a foreign country;
• the data subject has consented to the transfer;
• the transfer is necessary for the performance of a contract between the data subject and the responsible party, or for pre-contractual measures taken in response to the data subject’s request;
• the transfer is necessary for the conclusion or performance of a contract concluded in the data subject’s interest between the responsible party and a third party; or
• the transfer is for the data subject’s benefit and it is not reasonably practicable to obtain their consent, and such consent, if it were reasonably practicable to obtain it, would likely have been given.

In the ordinary course and scope of its business operations, Preevees Trading (Pty) Ltd transfers personal information to foreign jurisdictions. No processing of data outside standard operational requirements will be done in regions that are not POPIA or GDPR compliant. All data processing falls within the South African and Western European regions. Any data-sharing agreements are explicit and transparent, and no sharing or processing of data will be performed outside standard operational requirements or the existing data-sharing agreements in place with service providers.

12. POPIA: information security measures

Preevees Trading (Pty) Ltd has implemented IT security initiatives including, but not limited to:

• firewall and network endpoint protection;
• antivirus software and multifactor authentication;
• encryption of data at rest, including backups, and encryption in transit;
• application security as a priority;
• role-based access, authentication, managed hosting, access reviews and secure deletion;
• confidentiality duties, operator contracts and incident procedures;
• disaster recovery and business continuity management; and
• governance driven by our Information Security Policy.

Data quality and integrity are governed through data governance standards, represented in the data quality standards document where controls are defined and monitored. Special personal information is masked, and access is managed through approval processes and is monitored and logged when accessed. Controls are adjusted to the sensitivity and risks of the information concerned.

13. How to request access

1. Use the prescribed PAIA Form 2 available from the Information Regulator.
2. Describe the record clearly, identify the right you seek to exercise or protect, explain why the record is required for that purpose, and provide proof of identity and authority where relevant.
3. Send the request to the Information Officer at priyesh@preevees.co.za or deliver it to our physical address.
4. Pay any prescribed request or access fee after receiving notice, unless an exemption applies.

Access is not automatic. We will assess each request under PAIA, including mandatory and discretionary grounds for refusal, third-party procedures and applicable time periods.

14. Remedies

If a request to this private body is refused or not answered, the requester may approach a competent court or lodge a complaint with the Information Regulator using prescribed Form 5. PAIA complaints may be sent to PAIAComplaints@inforegulator.org.za.

15. Availability of this manual

A copy of this manual is available:

• free of charge on this website;
• at the head office of Preevees Trading (Pty) Ltd for public inspection during normal business hours, by prior appointment;
• to any person upon request and upon payment of the reasonable prescribed fee; and
• to the Information Regulator upon request.

A fee for a copy of the manual, as contemplated in Annexure B of the Regulations, is payable for each A4-size photocopy made. Contact us if you need reasonable assistance or an accessible copy.

16. Updating this manual

The head of Preevees Trading (Pty) Ltd updates this manual on a regular basis. This version was issued on 14 September 2026 by Priyesh Sathdav, director and key individual of Preevees Trading (Pty) Ltd.