Governance & Statutory  |  PAIA Manual

Access to Information, Plainly Set Out.

Sticitt’s manual published in terms of section 51 of the Promotion of Access to Information Act 2 of 2000.

PART ONE

Contents

• 1. About Sticitt
• 2. What this manual is for
• 3. Who to contact
• Information Officer
• Deputy Information Officer and Administration Officer
• 4. The Information Regulator and the PAIA Guide
• 5. Records you can have without asking
• 6. Records available under other laws
• 7. What records Sticitt holds
• 8. How Sticitt processes personal information
• 8.1 Why we process personal information
• 8.2 Whose personal information we process
• 8.3 What personal information we process
• 8.4 Who receives personal information
• 8.5 Whether personal information leaves South Africa
• 8.6 How we keep personal information secure
• 9. How to ask for a record
• 9.1 If you want your own personal information
• 9.2 If you want any other record
• 9.3 What happens next, and how long it takes
• 10. When we may refuse
• 11. If you are unhappy with our decision
• 12. What it costs
• 13. Where to find this manual

1. About Sticitt

Sticitt (Pty) Ltd is a South African company that builds money tools for schools and families. We run a cashless payment ecosystem that lets schools collect and reconcile money, lets parents pay and manage their children's spending, and helps young people build healthy money habits. We operate only in South Africa.

Registered name — Sticitt (Pty) Ltd

Registration number — 2014/095879/07

Regulatory status — A registered TPPP sponsored by ABSA, Capitec Bank, and Nedbank.

A juristic representative of RainFin Proprietary Limited, a licensed FSP

Principal place of business — C Ground, The Beachhead, 10 Niblick Way, Somerset West.

Website — www.sticitt.co.za

2. What this manual is for

This manual is published in terms of section 51 of the Promotion of Access to Information Act 2 of 2000 (PAIA), as amended by the Protection of Personal Information Act 4 of 2013 (POPIA). It tells you what records Sticitt holds, how to ask for access to a record, what it costs, and what to do if we say no.

It also tells you how Sticitt processes personal information, because POPIA requires that disclosure to sit in this manual. If you want to know what we do with your information and how to exercise your privacy rights, section 9 is the part you want, and our Privacy Policy sets it out in more detail.

Every private body in South Africa has had to publish a manual like this since 1 January 2022. There is no small-business exemption.

3. Who to contact

Send every request under PAIA, and every request or objection under POPIA, to the Information Officer at the address below. We monitor it, and the statutory clock starts when it arrives.

Information Officer

Deputy Information Officer and Administration Officer

Deputies carry the day-to-day work and are designated in writing. Only employees may be designated, and each is registered with the Information Regulator.

4. The Information Regulator and the PAIA Guide

The Information Regulator (South Africa) oversees both PAIA and POPIA. It has published a guide, in terms of section 10 of PAIA, that explains how to use PAIA to get access to records. The guide is free, and the Regulator makes it available in each of the official languages and in braille.

If you are not sure whether PAIA gives you a right to a record, read the guide first — it is written for the public, not for lawyers.

5. Records you can have without asking

Some records are already public, so there is no need to lodge a formal request under PAIA. In terms of section 52 of PAIA, the following are available without a request, free of charge where they are published online:

• •Anything published on sticitt.co.za and its subdomains, including product information, pricing pages and support material.
• •Our Privacy Policy, our Terms of Use for wallet holders, and our General Merchant Terms of Use.
• •This manual.
• •Marketing and communications material already in the public domain.

If you want a printed copy of any of these, we may charge the reproduction fees in section 12.

6. Records available under other laws

Some laws give specific people a right to specific records held by Sticitt, without going through PAIA. If you believe one of these applies to you, say so in your request and tell us which law you are relying on, so the Information Officer can consider it properly.

Records may be accessible in terms of, among others:

• •Companies Act 71 of 2008
• •Protection of Personal Information Act 4 of 2013
• •Financial Intelligence Centre Act 38 of 2001
• •National Payment System Act 78 of 1998
• •Consumer Protection Act 68 of 2008
• •Electronic Communications and Transactions Act 25 of 2002
• •Basic Conditions of Employment Act 75 of 1997
• •Labour Relations Act 66 of 1995
• •Employment Equity Act 55 of 1998
• •Occupational Health and Safety Act 85 of 1993
• •Compensation for Occupational Injuries and Diseases Act 130 of 1993
• •Income Tax Act 58 of 1962 and the Tax Administration Act 28 of 2011
• •Value Added Tax Act 89 of 1991
• •Unemployment Insurance Act 63 of 2001 and the Unemployment Insurance Contributions Act 4 of 2002
• •Skills Development Act 97 of 1998 and the Skills Development Levies Act 9 of 1999
• •Prevention of Organised Crime Act 121 of 1998
• •Cybercrimes Act 19 of 2020

7. What records Sticitt holds

These are the subject categories of records Sticitt keeps. A category being listed does not mean every record in it is accessible — section 10 sets out the grounds on which access may be refused.

8. How Sticitt processes personal information

POPIA requires this manual to disclose what we do with personal information. Our Privacy Policy says the same things in more detail and in plainer language — this section is the statutory version.

8.1 Why we process personal information

• •To open and operate wallets, cards and accounts, and to provide the services a user has signed up for.
• •To verify identity and meet our obligations under financial-sector law, including customer due diligence where it applies to us.
• •To process, authorise, settle and reconcile payments, and to handle refunds, disputes and chargebacks.
• •To support users and schools, answer questions and resolve complaints.
• •To onboard, monitor and manage school and merchant relationships.
• •To detect, investigate and prevent fraud, money laundering, terrorist financing and abuse of the service.
• •To meet legal, regulatory, card-scheme and contractual obligations, and to keep the records those obligations require.
• •To keep the service secure, available and working, and to improve it.
• •To employ people, and to run our own business administration.
• •Where a person has consented, to tell them about Sticitt's own similar products and services.

8.2 Whose personal information we process

• •Parents, guardians and other wallet holders.
• •Learners, who are children. A learner's personal information is processed with the prior consent of a competent person — in practice, a parent or guardian — as section 35(1)(a) of POPIA requires.
• •Cardholders.
• •School and merchant representatives, authorised signatories and beneficial owners.
• •Employees, contractors, job applicants and referees.
• •Supplier and service provider contacts.
• •Visitors to our websites and users of our apps.

8.3 What personal information we process

8.4 Who receives personal information

We share personal information only where it is needed to run the service, or where the law requires it. We require every operator processing personal information for Sticitt to work under a written contract that obliges it to maintain the security measures POPIA requires and to notify us immediately of any compromise. We are completing these contracts with each of our operators.

8.5 Whether personal information leaves South Africa

Some of the operators that process personal information for Sticitt do so outside South Africa. Where that happens, we transfer personal information only where the recipient is subject to a law, binding corporate rules or a binding agreement that provides an adequate level of protection substantially similar to the conditions for lawful processing in POPIA, and that restricts onward transfer in substantially the same way — as section 72(1)(a) of POPIA requires. We are documenting a written assessment for each recipient, and will review it whenever a recipient or a hosting location changes.

Current processing locations:

8.6 How we keep personal information secure

Sticitt takes appropriate, reasonable technical and organisational measures to secure personal information, as section 19 of POPIA requires, having regard to generally accepted information security practice and to the rules that apply to us as a payments business. In practice that means:

• •A cardholder data environment that is PCI DSS compliant and kept isolated from the rest of our systems.
• •Encryption of personal information in transit and at rest, with TLS enforced on all traffic.
• •Role-based access control through a managed identity platform, with access granted on a least-privilege basis and reviewed regularly.
• •Network segmentation, firewalling and gateway-level authentication and input filtering.
• •Segregation of duties on any manual process that moves money.
• •Logging, monitoring and alerting, with a documented incident response and security compromise process that is being put on a regular testing cycle.
• •Automated backups and point-in-time recovery, with documented business continuity and disaster recovery plans.
• •Annual penetration testing of the cardholder data environment.
• •A documented information security policy suite, confidentiality undertakings from everyone with access, and regular training.
• •Written contracts with operators, requiring them to maintain the same standard and to tell us immediately if personal information is compromised, which we are putting in place with every operator.

9. How to ask for a record

There are two routes, and which one you are on changes what it costs and how long it takes. Tell us which one you want and we will help if you have picked the wrong one.

9.1 If you want your own personal information

Under section 23 of POPIA you may ask us to confirm, free of charge, whether we hold personal information about you. Just email the Information Officer with proof of identity. If you then want the record itself, or a description of it, that part runs through the PAIA process in section 9.2 and the fees in section 12 apply.

You may also ask us to correct or delete personal information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or obtained unlawfully, and you may object to processing on reasonable grounds. Use POPIA Regulation Form 1 to object or Form 2 to ask for a correction or deletion — or anything substantially similar. We accept these by email, SMS or WhatsApp as well as on paper, free of charge, and we will tell you once the correction or deletion is done.

9.2 If you want any other record

Use the prescribed PAIA request Form 2 (Request for Access to Record) under Regulation 7 of the PAIA and send it to the Information Officer. The form is available from the Information Regulator's website and from us on request. Your request must give us enough to work with:

1. 1.Enough detail to identify the record you want, and the form of access you want it in.
2. 2.Enough detail to identify you, and proof of identity. If you are acting for someone else, proof that you are entitled to.
3. 3.A postal address, email address or contact number in South Africa.
4. 4.If you want to be told the outcome in a way other than in writing, how.
5. 5.The right you are trying to exercise or protect, and why you need this record to do it. This one matters: PAIA gives access to a private body's records where the record is required for the exercise or protection of a right. Without this, we cannot grant the request.

9.3 What happens next, and how long it takes

10. When we may refuse

PAIA obliges a private body to refuse access in some cases and permits it in others. We may or must refuse where granting access would:

• •unreasonably disclose personal information about a third party who is a natural person, including someone who has died;
• •disclose a third party's trade secrets, or financial, commercial, scientific or technical information that would harm them;
• •breach a duty of confidence we owe a third party;
• •endanger a person's life or safety, or prejudice the security of property or a protected system;
• •disclose a record privileged from production in legal proceedings, unless the privilege has been waived;
• •harm Sticitt's own commercial or financial interests, or disclose our trade secrets;
• •disclose results of research in a way that would seriously prejudice the researcher or the subject; or
• •in the case of a request for someone else's personal information, run against the protections POPIA gives that person.

Access must still be granted, despite those grounds, where disclosure would reveal a substantial contravention of the law or an imminent and serious public safety or environmental risk, and the public interest in disclosure clearly outweighs the harm — the public interest override in PAIA. Where only part of a record is protected, we sever that part and give you the rest.

11. If you are unhappy with our decision

There is no internal appeal against a private body's decision. You may:

• •lodge a complaint with the Information Regulator on the prescribed complaint Form 5 (Complaint Form), under Regulation 10 of the PAIA; or
• •apply to a court for appropriate relief.

Either route must be taken within 180 days of the decision, or of the deemed refusal. The Information Regulator's contact details are in section 4.

12. What it costs

PAIA fees are prescribed by the Minister and published by the Information Regulator. The fees below are the schedule current at the date of this manual. Requests for your own personal information are treated as personal requests, and the request fee does not apply to them.

We will tell you the total before we do the work. If you think a fee is unreasonable you may apply to a court against the tender or payment of it.

13. Where to find this manual

This manual is available:

• •on our website at sticitt.co.za/legal
• •at our principal place of business during business hours;
• •by email, on request to the Information Officer; and
• •to the Information Regulator on request.

We will provide a copy in another official language or in an alternative format where it is reasonably practicable to do so.