PAIA & POPIA Manual

This Manual has been prepared in accordance with the provisions of the Promotion of Access to Information Act, 2 of 2000 ("PAIA"), as amended, and the Protection of Personal Information Act, 4 of 2013 ("POPIA").

The purpose of this Manual is to:

• Provide a guide regarding the records held by ALFA CAS (Pty) Ltd trading as We Spot Cars
• Outline the procedure to request access to information held by the Company
• Explain how personal information is collected, processed, stored and protected
• Inform data subjects of their rights in terms of POPIA
• Promote transparency, accountability and lawful information processing

This Manual applies to all operations, products, services, websites, applications, platforms and business activities conducted by ALFA CAS (Pty) Ltd trading as We Spot Cars.

For purposes of this Manual:

"Company"

means ALFA CAS (Pty) Ltd trading as We Spot Cars.

"Data Subject"

means any identified or identifiable natural or juristic person whose personal information is processed by the Company.

"Information Officer"

means the individual responsible for ensuring compliance with PAIA and POPIA.

"Personal Information"

shall have the meaning assigned to it in POPIA and includes information relating to an identifiable individual or juristic person.

"Processing"

means any operation performed on personal information including collection, storage, use, dissemination, modification or destruction.

"Record"

means any recorded information regardless of form or medium.

ALFA CAS (Pty) Ltd trading as We Spot Cars is a South African vehicle marketplace and automotive lead generation platform.

The Company facilitates connections between vehicle buyers, dealerships and automotive service providers through a technology-driven platform. Services may include:

• Vehicle search and marketplace services
• Dealer marketing and lead generation
• Buyer enquiry management
• Finance assistance through licensed finance providers and authorised Financial Service Providers
• Trade-in assistance where offered by participating dealerships
• Automotive product referrals including warranties, service plans and vehicle tracking solutions
• Dealer subscription services
• Consumer support and advisory services
• Digital marketing and advertising services

The Company does not sell vehicles directly unless expressly stated otherwise and does not act as a credit provider, bank, insurer, financial institution or vehicle dealer.

This Manual serves to:

• Enable members of the public to understand what records are held by the Company
• Explain how access to records may be requested
• Outline the Company's responsibilities regarding the lawful processing of personal information
• Promote transparency and accountability
• Provide information required by PAIA and POPIA

The Company has appointed the following Information Officer responsible for compliance with PAIA and POPIA:

The Information Officer is responsible for:

• Ensuring compliance with PAIA and POPIA
• Processing access to information requests
• Responding to data subject requests
• Managing privacy and information security matters
• Liaising with the Information Regulator where required

No Deputy Information Officer has been appointed at the date of publication of this Manual.

Members of the public may obtain guidance regarding PAIA from the Information Regulator of South Africa.

The Information Regulator is responsible for monitoring and enforcing compliance with PAIA and POPIA in South Africa.

The Company maintains records in various formats including electronic records, cloud-based systems, databases, correspondence, agreements and operational records.

The following information may be available without a formal PAIA request:

• Website content
• Product and service information
• Marketing materials
• Terms and Conditions
• Privacy Policy
• Cookie Policy
• PAIA & POPIA Manual
• Public announcements
• Contact details

The Company reserves the right to determine whether information is publicly available.

The Company may hold records in compliance with various legislation, including but not limited to:

• Companies Act 71 of 2008
• Promotion of Access to Information Act 2 of 2000
• Protection of Personal Information Act 4 of 2013
• Electronic Communications and Transactions Act 25 of 2002
• Consumer Protection Act 68 of 2008
• Basic Conditions of Employment Act 75 of 1997
• Labour Relations Act 66 of 1995
• Employment Equity Act 55 of 1998
• Occupational Health and Safety Act 85 of 1993
• Income Tax Act 58 of 1962
• Value Added Tax Act 89 of 1991 (where applicable)
• Financial Intelligence Centre Act 38 of 2001 (where applicable)
• Any other applicable legislation governing the Company's operations

Any person seeking access to information held by the Company must submit a written request to the Information Officer. The request must contain:

• Full name and contact details
• Sufficient particulars identifying the requested record
• Reason for requesting access
• Preferred form of access
• Proof of identity where required

Requests may be submitted to:

The Company may request additional information necessary to verify identity before processing a request.

The Company reserves the right to charge fees permitted under PAIA. Applicable fees may include:

• Request fees
• Search and preparation fees
• Reproduction fees
• Postage and courier fees

Fees shall be determined in accordance with applicable regulations published under PAIA.

Access to records may be refused where permitted by PAIA, including where:

The Company will provide written reasons where access is refused.

The Company processes personal information in accordance with POPIA. Information may be collected from:

• Website users
• Consumers
• Dealerships
• Automotive service providers
• Finance applicants
• Trade-in applicants
• Marketing participants
• Business partners
• Employees
• Suppliers

Depending on the service provided, the Company may collect:

Consumer Information

• Name and surname
• Identity or passport number
• Telephone number
• Email address
• Residential area
• Vehicle preferences
• Budget information
• Employment information
• Income information
• Trade-in information
• Communication history

Dealer Information

• Business name
• Registration details
• Dealer principal details
• Contact information
• Banking information
• Subscription information
• Vehicle listing information

Website Information

• IP addresses
• Browser information
• Device information
• Website usage data
• Cookie data

The Company may process personal information for:

• Providing services
• Generating leads
• Matching buyers and dealerships
• Facilitating finance introductions
• Facilitating trade-in assistance
• Dealer management
• Customer support
• Marketing communications
• Website administration
• Fraud prevention
• Compliance with legal obligations
• Business analytics

The Company generally does not intentionally process special personal information unless:

• Required by law
• Necessary to provide a service
• Consent has been obtained
• Processing is otherwise permitted under POPIA

The Company may share information with:

• Participating dealerships
• Licensed finance providers
• Authorised Financial Service Providers
• Warranty providers
• Vehicle tracking providers
• Service plan providers
• Technology service providers
• Regulatory authorities
• Legal advisors

Information will only be shared where necessary and lawful.

The Company may use cloud-based systems or service providers located outside South Africa.

Where information is transferred internationally, the Company will take reasonable steps to ensure appropriate safeguards are in place.

The Company implements reasonable technical and organisational measures to protect personal information, including:

• Access controls
• Password protection
• Secure hosting
• Firewalls
• Encryption where appropriate
• System monitoring
• Data backup procedures
• Staff confidentiality obligations

No system can guarantee absolute security; however, reasonable measures are maintained.

Personal information will be retained:

• For as long as necessary to fulfil the purpose collected
• As required by law
• For legitimate business purposes
• Until destruction is authorised

Records may be securely destroyed once no longer required.

Data subjects may:

• Request access to personal information
• Request correction of information
• Request deletion where lawful
• Object to processing
• Withdraw consent where applicable
• Lodge complaints with the Information Regulator

Requests should be directed to:

The Company may communicate with individuals through:

• Email
• Telephone
• SMS
• WhatsApp
• Social media platforms
• Digital advertising platforms

Marketing communications will comply with POPIA and applicable laws. Individuals may opt out of marketing communications at any time.

The Company may utilise technology tools, algorithms, chatbots and automated systems to:

• Respond to enquiries
• Qualify leads
• Match vehicle preferences
• Facilitate finance introductions
• Improve customer experience

Automated processes may assist decision-making but do not guarantee outcomes.

The Company is not a dealership, bank, credit provider or insurer.

Trade-in services remain subject to the policies and acceptance criteria of participating dealerships.

Finance approvals remain subject to the lending criteria of licensed finance providers and authorised Financial Service Providers.

No approval, valuation or acceptance is guaranteed.

Any concerns relating to privacy, information access or personal information processing may be submitted to:

The Company will investigate complaints and respond within a reasonable period.

Complaints may also be submitted to:

The Company reserves the right to amend this Manual from time to time to reflect:

• Changes in legislation
• Changes in business operations
• Regulatory guidance
• Operational requirements

Updated versions will be made available on the Company's website.

This PAIA & POPIA Manual has been approved by: