PAIAmanual.

1. What is PAIA?

"PAIA" refers to the Promotion of Access to Information Act, 2000. It allows people to access information held by the State and by certain private bodies when they need it to exercise or protect their rights.

The Information Regulator, established under the Protection of Personal Information Act, 2013 ("POPI Act" or "POPIA"), has published a guide on how to use PAIA, including how a person can access their own personal information in terms of the POPI Act. The guide is available in all official languages at https://inforegulator.org.za/paia-guidelines/.

2. What is this PAIA Manual?

This PAIA Manual is for Auxo Digital (Pty) Ltd, a private company incorporated in South Africa with registration number 2024/374541/07, with our registered address at 6 Hoggs Bay Close, Kyalami, Johannesburg, 1684, South Africa. In this document, we are referred to as "the Company", "we" or "us".

In terms of PAIA, all public and private bodies must have a PAIA Manual. A PAIA Manual explains what information a body holds and how you can ask for access to it.

How to request a record

How to ask for information is set out in the Information Regulator's guide, linked in section 1. In short:

1. Complete Form 2 (Request for Access to Record), available at https://inforegulator.org.za/wp-content/uploads/2020/07/InfoRegSA-PAIA-Form02-Reg7.pdf. This is the form prescribed by Regulation 7 of the PAIA Regulations.
2. Send it to our Information Officer at jabu@auxo.digital, together with satisfactory proof of your identity. If you are asking on behalf of another person, include proof that you are authorised to do so.
3. We will tell you the outcome of your request, together with any fees payable, substantially in the form of Form 3 (Outcome of Request and of Fees Payable), available at https://inforegulator.org.za/wp-content/uploads/2020/07/Form-3-PAIA.pdf, in accordance with Regulation 8 of the PAIA Regulations.

Both forms are linked directly from this manual and from our PAIA manual page, which is linked in our website footer, so you do not need to search for them.

3. What is the purpose of this PAIA Manual?

This PAIA Manual helps the public to:

• check the categories of records we hold that are available without having to submit a formal PAIA request;
• understand how to make a request for access to a record, by describing the subjects on which we hold records and the categories of records held on each subject;
• know which of our records are available in terms of other legislation;
• find the contact details of our Information Officer, who will assist with requests for access;
• know about the Information Regulator's guide on how to use PAIA, and how to obtain it;
• know whether we process personal information, why we process it, and the categories of data subjects and of personal information concerned;
• know the recipients, or categories of recipients, to whom personal information may be supplied;
• know whether we transfer or process personal information outside South Africa, and to whom; and
• know whether we have appropriate security measures to protect the confidentiality, integrity and availability of the personal information we process.

4. Company overview

The Company is a software and AI company based in Johannesburg, South Africa. We build custom software and AI platforms for our clients, provide related digital and agency services, and run our own software products, such as Mema, our events platform.

5. Contact information

The Information Regulator

If you are unhappy with how we dealt with your request, or with how we process your personal information, you may contact the Information Regulator:

• Complaints email: complaints.IR@justice.gov.za
• Website: https://inforegulator.org.za

6. Records available without a formal request

The following are available on our website without a PAIA request:

• our Privacy Notice: https://www.auxodigital.africa/privacy; and
• this PAIA Manual, as a web page (https://www.auxodigital.africa/paia) and as a PDF (https://www.auxodigital.africa/legal/auxo-digital-paia-manual.pdf).

7. Records available in terms of other legislation

We keep records as required by the legislation that applies to us, including:

• the Companies Act, 2008;
• the Income Tax Act, 1962;
• the Tax Administration Act, 2011;
• the Basic Conditions of Employment Act, 1997;
• the Labour Relations Act, 1995;
• the Unemployment Insurance Act, 2001;
• the Unemployment Insurance Contributions Act, 2002;
• the Skills Development Levies Act, 1999;
• the Compensation for Occupational Injuries and Diseases Act, 1993;
• the Electronic Communications and Transactions Act, 2002; and
• the Protection of Personal Information Act, 2013.

8. Records we hold

We hold the categories of records described below. We may have to refuse access to certain records in terms of PAIA, for example to protect our confidential or commercial information, a client's confidential information, or someone else's privacy.

9. Processing of personal information

9.1 Purpose of processing

In our capacity as a Responsible Party for purposes of the POPI Act, we process personal information in our records in accordance with the POPI Act:

• Service providers: where you are our service provider, we process your personal information to onboard you on to our systems for operational and accounting purposes.
• Clients: where you are our client, we process your personal information in order to render services to you.
• Employees and contractors: where you work for us, we process your personal information to manage the working relationship, pay you, and meet our obligations under tax and labour law.
• Website visitors: where you visit our website, we process your personal information to answer your enquiries, keep the website secure and working and, only if you accept analytics cookies, to understand how the website is used.
• Product users: where you use one of our products, we process your personal information to provide that product to you, as described in the product's privacy add-on to our Privacy Notice.

9.2 Categories of data subjects and personal information

9.3 Recipients of personal information

We share personal information only as follows:

Apart from SARS, our auditors and others where the law requires it, and LinkedIn only if a website visitor accepts marketing cookies, we do not share personal information with third parties who use it for their own purposes. Otherwise we share personal information only with our operators, and with our accountants where our accounting obligations require it.

9.4 Operators and transborder flows of personal information

We use hosting, storage and other service providers that process personal information only on our instructions. Under the POPI Act they are our operators. Each operator must have a written contract with us, usually its data processing agreement, that regulates how it acts as our operator.

Some of our operators process personal information outside South Africa. Section 72 of the POPI Act applies to these transfers, even though the recipient is an operator. We transfer personal information outside South Africa only where the recipient is subject to a law, binding corporate rules or a binding agreement that provides an adequate level of protection, substantially similar to the conditions for lawful processing in the POPI Act, including rules on the further transfer of the information to other countries; or where another ground in section 72 applies.

9.5 Security measures

We take appropriate, reasonable technical and organisational measures to protect the confidentiality, integrity and availability of the personal information we process, as required by section 19 of the POPI Act.

Technical measures

• Encryption of personal information in transit (TLS) and at rest.
• Least-privilege access: people and systems get only the access they need.
• Single sign-on (SSO) on our business systems, with multi-factor authentication (MFA) being rolled out.
• Passwords, keys and other secrets kept in a secrets manager, not in code or documents.
• Audit logs of access to, and changes in, our systems.
• Regular backups of the systems that hold personal information.

Organisational measures

• POPIA training for our team.
• An incident response process, including notifying the Information Regulator and affected people of a security compromise as section 22 of the POPI Act requires.
• Written operator contracts with every service provider that processes personal information for us.
• Confidentiality obligations in our employment and contractor agreements.
• Regular review of our security controls and related processes.

10. Availability of this PAIA Manual

This PAIA Manual is available:

• on our website, as a web page: https://www.auxodigital.africa/paia;
• as a PDF download: https://www.auxodigital.africa/legal/auxo-digital-paia-manual.pdf; and
• for inspection at our head office during normal business hours, on request to our Information Officer.

A fee for a copy of the PAIA Manual, as prescribed in the PAIA Regulations, is payable for each A4 photocopy.

11. Updates to this PAIA Manual

We review this PAIA Manual regularly and update it when our records or processing change. The version number and date at the top show when it was last updated.

Version 2.0 · 15 October 2026 · Auxo Digital (Pty) Ltd