INSTORE24 PAIA Manual

Manual in terms of section 51 of the Promotion of Access to Information Act 2 of 2000, incorporating the information required under the Protection of Personal Information Act 4 of 2013.

This Manual is published by In-Store Marketing Platform (Pty) Ltd (registration number 2023/727068/07), trading as “INSTORE24” (“INSTORE24”, “we”, “us” or “our”), in terms of section 51 of the Promotion of Access to Information Act 2 of 2000 (“PAIA”). It also contains the information that INSTORE24 is required to make available under PAIA as read with the Protection of Personal Information Act 4 of 2013 (“POPIA”).

The purpose of this Manual is to inform you of the records held by INSTORE24, how to request access to them, and how INSTORE24 processes personal information. It is available free of charge on INSTORE24’s website and for inspection at our offices, and has been submitted to the Information Regulator.

1. ABOUT INSTORE24 AND HOW TO CONTACT US

1.1 INSTORE24 operates an omni-channel retail, marketing, loyalty, analytics and Click & Collect platform connecting shopping centres, retailers, cinemas and consumers.

1.2 Our particulars are:

1.2.1 Name: In-Store Marketing Platform (Pty) Ltd, trading as “INSTORE24”;

1.2.2 Registration number: 2023/727068/07;

1.2.5 Physical and postal address: The Harrington, 2nd Floor, 50 Harrington Street, District Six, Cape Town;

1.2.6 Email: info@instore24.com; Website: www.instore24.com

2. THE GUIDE ON HOW TO USE PAIA

2.1 The Information Regulator has, in terms of section 10 of PAIA, compiled a Guide on how to use PAIA. The Guide contains information reasonably required by a person who wishes to exercise a right under PAIA, and is available from the Information Regulator in each of the official languages.

2.2 The Information Regulator (South Africa) may be contacted at: website inforegulator.org.za; email PAIAComplaints@inforegulator.org.za or enquiries@inforegulator.org.za.

3. RECORDS AVAILABLE IN TERMS OF OTHER LEGISLATION

3.1 Certain records are available or accessible in terms of legislation other than PAIA. Access to those records is in accordance with the relevant legislation. These include records kept or made available in terms of, among others:

3.1.1 the Companies Act 71 of 2008;

3.1.2 the Income Tax Act 58 of 1962 and the Tax Administration Act 28 of 2011;

3.1.3 the Value-Added Tax Act 89 of 1991;

3.1.4 the Labour Relations Act 66 of 1995, the Basic Conditions of Employment Act 75 of 1997 and the Employment Equity Act 55 of 1998;

3.1.5 the Unemployment Insurance Act 63 of 2001 and the Compensation for Occupational Injuries and Diseases Act 130 of 1993;

3.1.6 the Protection of Personal Information Act 4 of 2013;

3.1.7 the Electronic Communications and Transactions Act 25 of 2002; and

3.1.8 the Consumer Protection Act 68 of 2008.

4. CATEGORIES OF RECORDS HELD BY INSTORE24

4.1 Subject to the grounds for refusal in clause 7, the following categories of records may be requested:

4.1.1 corporate and statutory records (such as the memorandum of incorporation, registration documents, resolutions and the securities register);

4.1.2 financial records (such as annual financial statements, management accounts, tax records and invoices);

4.1.3 agreements and contracts (with shopping centres, retailers, cinemas, suppliers and service providers);

4.1.4 personnel and employment records (where applicable);

4.1.5 operational records (such as platform documentation, policies and procedures);

4.1.6 marketing and advertising records;

4.1.7 information-technology and data records (subject to POPIA and confidentiality);

4.1.8 consumer and business-participant records (subject to POPIA); and

4.1.9 general correspondence.

4.2 Some records may be automatically available, or available in terms of other legislation, and need not be requested under PAIA.

5. HOW TO REQUEST ACCESS TO A RECORD

5.1 A request for access to a record held by INSTORE24 must be made on the prescribed form (Form 2 of the Regulations made under PAIA), addressed to the Information Officer at the address in clause 1.

5.2 The request must: provide sufficient particulars to enable the Information Officer to identify the record and the requester; identify the right that the requester seeks to exercise or protect, and explain why the requested record is required for the exercise or protection of that right; and state the form of access required and how the requester wishes to be notified of the decision.

5.3 Where a request is made on behalf of another person, the requester must submit proof of the capacity in which the request is made.

6. FEES

6.1 A requester (other than a personal requester seeking access to their own personal information) must pay the prescribed request fee before the request is processed, and may be required to pay an access fee (for the search, preparation, reproduction and, where applicable, postage of the record) and a deposit, as prescribed under PAIA.

6.2 INSTORE24 will notify the requester of any fees payable before giving access, and the requester may lodge an internal or external complaint against the amount of the fees in accordance with PAIA.

7. GROUNDS FOR REFUSAL OF ACCESS

7.1 INSTORE24 may or must refuse a request for access on the grounds set out in Chapter 4 of Part 3 of PAIA, including:

7.1.1 the mandatory protection of the privacy of a third party who is a natural person;

7.1.2 the mandatory protection of the commercial information of a third party or of INSTORE24;

7.1.3 the mandatory protection of confidential information of third parties;

7.1.4 the protection of records that are privileged from production in legal proceedings;

7.1.5 the protection of research information of a third party or of INSTORE24; and

7.1.6 any other ground for refusal provided for in PAIA.

7.2 Access must be granted where the disclosure of the record is required in the public interest as contemplated in section 70 of PAIA.

8. DECISION AND REMEDIES

8.1 INSTORE24 will notify the requester of its decision within 30 (thirty) days of receipt of the request, which period may be extended as permitted by PAIA.

8.2 A requester whose request is refused may apply to a court with jurisdiction, or lodge a complaint with the Information Regulator, in accordance with PAIA.

9. INFORMATION IN TERMS OF POPIA

9.1 This clause sets out the information required under POPIA regarding INSTORE24’s processing of personal information. Full details are contained in INSTORE24’s Privacy Policy, available on the Website.

9.2 Purpose of processing: INSTORE24 processes personal information in order to provide, operate and improve the Platform and user accounts; deliver personalised and location-based offers and notifications; administer the MallMiles loyalty programme; facilitate Click & Collect; communicate with users; generate aggregated, anonymised analytics; prevent fraud; and comply with the law.

9.3 Categories of data subjects and of personal information:

9.3.1 consumers — identity, contact, account, location, usage and behavioural, device and technical, transaction, and marketing-preference information;

9.3.2 representatives of shopping centres, retailers and cinemas — business and contact information; and

9.3.3 employees, suppliers and service providers — information necessary for the relevant relationship.

9.4 Recipients to whom personal information may be supplied: operators and service providers (such as hosting, IT, analytics, communications and payment-facilitation providers); retailers (to fulfil Click & Collect orders); payment gateways; shopping centres, retailers and cinemas (in aggregated, anonymised and de-identified form only); and authorities and advisers where required by law.

9.5 Cross-border transfers: INSTORE24 may transfer personal information outside the Republic (for example, to cloud-hosting or service providers), in accordance with section 72 of POPIA.

9.6 Security safeguards: INSTORE24 has appropriate, reasonable technical and organisational measures in place to secure personal information, as required by section 19 of POPIA.

9.7 Data subject rights: data subjects have the rights set out in POPIA and in INSTORE24’s Privacy Policy, including to access, correct or delete their personal information, to object to processing, and to withdraw consent, by contacting the Information Officer; and the right to complain to the Information Regulator.