PAIA Manual

1.1 The Organisation

1.2 The Information Officer (IO)

1.3 Deputy Information Officer (DIO)

No Deputy Information Officer is presently designated. If a DIO is designated, this Manual will be updated accordingly.

1.4 Information Regulator contact details

1.5 Categories of records available with or without request

In this Manual, unless the context indicates otherwise, “Companies Act” means the Companies Act 71 of 2008; “CPA” means the Consumer Protection Act 68 of 2008; “Data Subject” means an identifiable living natural person and, where applicable, an identifiable existing juristic person to whom Personal Information relates; “DIO” means a Deputy Information Officer designated in terms of PAIA and POPIA, if applicable; “Guide” means the Guide on how to use PAIA issued and updated by the Information Regulator; “IO” means the Information Officer of the Organisation; “Manual” means this PAIA Manual; “Organisation” means Shalan Properties (Pty) Ltd; “PAIA” means the Promotion of Access to Information Act 2 of 2000, as amended; “POPIA” means the Protection of Personal Information Act 4 of 2013; and “Regulator” means the Information Regulator established in terms of section 39 of POPIA.

“Personal Information”, “Responsible Party” and “Special Personal Information” have the meanings assigned to them in POPIA. Processing includes collection, receipt, recording, storage, updating, retrieval, consultation, use, dissemination, merging, restriction, erasure or destruction of Personal Information.

References to clauses and items are references to this Manual and its Schedule. A reference to legislation includes that legislation as amended or replaced from time to time and any applicable regulations. Words importing the singular include the plural and vice versa, and references to a person include a natural or juristic person where the context permits.

The headings are for convenience only and do not affect interpretation. “Including” and “in particular” are without limitation. Any time of day is a reference to Johannesburg time. Nothing in this Manual is intended to limit or contravene PAIA, POPIA, the CPA or other applicable law.

Shalan Properties (Pty) Ltd is a Private Body for purposes of PAIA. This Manual is intended to facilitate compliance with PAIA and POPIA and, in particular, section 51 of PAIA.

The Manual enables members of the public to understand the categories of records held by the Organisation, the records that may be available without a formal request, the procedure for requesting access to records, the categories of Personal Information processed by the Organisation, the purposes of processing, possible recipients, trans-border processing and the security measures applied to Personal Information.

The key person appointed to assist the public with requests for access to information held by the Organisation is the Information Officer, Denis Shaun Coghlan. General access-to-information requests may be sent to shaun@shalanprop.co.za.

The Information Regulator regulates and enforces both PAIA and POPIA. The Regulator’s current contact details are set out in item 1.4 above. Members of the public may also use the Regulator’s eServices platform for relevant PAIA and POPIA services and support.

The Information Regulator has, in terms of section 10(1) of PAIA, as amended, updated and made available a Guide on how to use PAIA in an easily comprehensible form. The Guide is intended to assist any person who wishes to exercise a right contemplated in PAIA or POPIA.

The Guide is available in each of the official languages and in braille. It includes information on the objects of PAIA and POPIA, contact details of Information Officers and Deputy Information Officers, the manner and form of requests, assistance available from Information Officers and the Regulator, applicable fees, remedies and complaints, and the requirements relating to PAIA manuals and automatically available records.

The Organisation may or must refuse access to a requested record where PAIA provides a ground of refusal. This may include the unreasonable disclosure of Personal Information of a third party; disclosure prohibited by law or contract; confidential or commercial information of a third party; legally privileged records; information whose disclosure could endanger the safety of a person or security of property; protected research information; and the Organisation’s own confidential commercial or technical information where PAIA permits refusal.

Requests that are clearly frivolous or vexatious, or that would involve an unreasonable diversion of resources, may be refused where PAIA permits. If a requested record cannot be found or does not exist, the Information Officer will notify the requester in the manner required by law.

A request for access should be submitted on the prescribed Form 2. The Organisation will notify the requester of the outcome and any fees payable using the prescribed process and within the time period required by PAIA.

Records identified in item 1.5 as being available without a formal Form 2 request may be downloaded from the Website or requested by email or telephone, depending on the nature of the record. The Organisation may require reasonable verification before releasing a record that is not already public.

Where a request for Personal Information is approved, the Organisation will determine the appropriate manner of access having regard to the requester’s preference, the nature of the record, security, confidentiality and the applicable requirements of PAIA and POPIA.

14.1 Purpose of Processing Personal Information

The Organisation processes Personal Information for legitimate business and legal purposes, including property broking and advisory services; client and prospect relationship management; property marketing and enquiries; preparation and conclusion of mandates, offers, leases and sale-related documents; FICA and regulatory compliance; invoicing and accounting; supplier management; website enquiries; direct marketing where lawful; security and fraud prevention; and administration of the Organisation’s systems and records.

14.2 Categories of Data Subjects and Personal Information

14.3 Recipients or categories of recipients

Personal Information may be supplied, where lawful and necessary, to property owners, landlords, developers, purchasers, tenants, professional advisers, attorneys, accountants, financial institutions, credit bureaus, FICA verification providers, technology and cloud service providers, regulators, public authorities and other service providers supporting a transaction or the Organisation’s operations.

14.4 Planned trans-border flows of Personal Information

The Organisation may use cloud-based, website, communications, software and backup service providers that process or store information outside South Africa. Where Personal Information is transferred outside South Africa, the Organisation will take reasonable steps to ensure that the transfer complies with section 72 of POPIA and that appropriate safeguards are in place.

14.5 General description of information-security measures

The Organisation applies reasonable technical and organisational measures appropriate to its size and operations. These may include access controls, strong passwords and multi-factor authentication where available, secure cloud services, anti-malware and anti-virus protections, backups, software updates, limited access based on business need, encryption or secure transmission where appropriate, physical security and confidentiality obligations.

The Organisation takes reasonable measures to identify foreseeable internal and external risks to Personal Information in its possession or under its control, to establish safeguards against those risks, to verify that safeguards are effectively implemented and to update safeguards in response to new risks or deficiencies.

The Organisation seeks to use reputable technology and cloud providers and restricts access to Personal Information to persons who require such access for legitimate business purposes. Security measures are reviewed as systems and risks change.

Where applicable to its operations, the Organisation creates and retains records to comply with South African legislation. This includes, as applicable:

• Basic Conditions of Employment Act 75 of 1997
• Broad-Based Black Economic Empowerment Act 53 of 2003
• Companies Act 71 of 2008
• Competition Act 89 of 1998
• Consumer Protection Act 68 of 2008
• Copyright Act 98 of 1978
• Electronic Communications and Transactions Act 25 of 2002
• Employment Equity Act 55 of 1998
• Financial Intelligence Centre Act 38 of 2001
• Income Tax Act 58 of 1962
• Labour Relations Act 66 of 1995
• Occupational Health and Safety Act 85 of 1993
• Property Practitioners Act 22 of 2019
• Promotion of Access to Information Act 2 of 2000
• Protection of Personal Information Act 4 of 2013
• Skills Development Act 97 of 1998
• Skills Development Levies Act 9 of 1999
• Unemployment Insurance Act 63 of 2001
• Unemployment Insurance Contributions Act 4 of 2002
• Value-Added Tax Act 89 of 1991

The Property Practitioners Act 22 of 2019 replaced the Estate Agency Affairs Act 112 of 1976 with effect from 1 February 2022.

Fees payable in connection with PAIA requests are prescribed by regulation. The fee schedule below reflects the Information Regulator’s published fee structure for private bodies as reviewed for this Version 3.0 Manual.

The applicable regulations and any subsequent amendments or exemptions prevail if there is any difference between this summary and the prescribed fees in force at the time of a request.

A copy of this Manual is available on the Organisation’s website at www.shalanprop.co.za, at the Organisation’s head office for public inspection during normal business hours by prior arrangement, to any person upon request (subject to any prescribed fee for copies), and to the Information Regulator upon request.

The head of the Organisation or the Information Officer will review and update this Manual on a regular basis and when material changes to the Organisation, its processing activities, applicable law or regulatory guidance make an update appropriate.