PAIA AND POPIA MANUAL

This manual was prepared in accordance with section 51 of the Promotion of Access to Information Act, 2000 and to address requirements of the Protection of Personal Information Act, 2013.

This manual applies to

CITY LODGE HOTELS LIMITED

Registration number: 1986/002864/06

1. Background to the Promotion of Access to Information Act.4

2. City Lodge Hotels Limited (“City Lodge”/”We”/“the Company”)4

3. Purpose of the PAIA Manual5

4. Contact Details of the Chief Executive Officer [Section 51(1)(a)]5

5. The Information Officer [Section 51(1)(b)]5

6. Guide of SA Human Rights Commission (Section 51(1) (b))6

7. Automatic Disclosure – Categories of Records Available Without Having To Request Access (Section 51(1)(c) in terms of PAIA..7

9. Description of the Records of the Body which are Available in Accordance with any other Legislation (Section 51(1) (d))11

10. Detail to Facilitate a Request for Access to a Record of City Lodge Hotels (Section 51(1) (e))13

11. Refusal of Access to Records.14

12. Remedies Available When City Lodge Hotels Refuses a Request.15

13. Access to Records Held by City Lodge Hotels.16

14. Prescribed Fees (Section 51 (1) (f))17

15. Other Fees.18

16. Decision..19

17. Protection of Personal Information that is Processed by City Lodge Hotels.20

18. Availability and Updating of the PAIA Manual22

APPENDIX A:  REQUEST FOR INFORMATION FORM – FORM 02.23

APPENDIX B: OUTCOME OF REQUEST AND OF FEES PAYABLE - FORM 03

APPENDIX C: PART 1 – PROCESSING OF PERSONAL INFORMATION IN ACCORDANCE WITH POPIA..39

APPENDIX C: PART 2 - CATEGORIES OF DATA SUBJECTS AND CATEGORIES OF PERSONAL INFORMATION RELATING  THERETO..41

APPENDIX C: PART 3 - RECIPIENTS OF PERSONAL INFORMATION..42

APPENDIX C: PART 4 – CROSS BORDER TRANSFERS OF PERSONAL INFORMATION..43

APPENDIX C: PART 5 – DESCRIPTION OF INFORMATION SECURITY MEASURES.44

APPENDIX D: OBJECTION TO THE PROCESSING OF PERSONAL INFORMATION IN TERMS OF SECTION 11(3) OF THE PROTECTION OF PERSONAL INFORMATION ACT, 2013.45

1. Background to the Promotion of Access to Information Act

 1.1. The Promotion of Access to Information Act, No. 2 of 2000 (“PAIA”) was enacted on 3 February 2000, giving effect to the constitutional right in terms of section 32 of the Bill of Rights contained in the Constitution of the Republic of South Africa 108 of 1996 (the “Constitution”) of access to any information held by the state and any information that is held by another person and that is required for the exercise or protection of any rights.

1.2. In terms of section 51 of PAIA, all non-governmental entities are required to compile an Information Manual (“PAIA Manual”).

1.3. Where a request is made in terms of PAIA, the entity to whom the request is made is obliged to release the information, subject to the applicable legislative and / or regulatory requirements of PAIA.

2. City Lodge Hotels Limited (“City Lodge Hotels”/”We”/“the Company”)

 2.1. City Lodge Hotels owns and operates hotels in South Africa, Botswana, Namibia and Mozambique. We are listed on the Johannesburg Stock Exchange in accordance with the company laws of the Republic of South Africa and have built a reputation for providing high quality, value for money accommodation and conferencing facilities at our hotels.

2.2. This PAIA Manual is available at the Company registered office: The Lodge, Bryanston Gate Office Park, Corner Homestead Avenue and Main Road, Bryanston, as well as on the Company’s website, www.citylodgehotels.com

2.3. City Lodge comprises the following companies:

·       City Lodge Hotels Limited

·       Budget Hotels (Pty) Limited

·       City Lodge Holdings (Share Block) (Pty) Limited

·       Courtyard Management Company (Pty) Limited

·       Gallic Courtyard (Arcadia) Share Block (Pty) Limited

·       Gallic Courtyard (Bruma Lake) Share Block (Pty) Limited

·       Gallic Courtyard (Rosebank) Share Block Limited

·       Gallic Courtyard (Sandton) Share Block Limited

·       Property Lodging Investments (Pty) Limited

·       City Lodge Hotels (Africa) (Pty) Ltd

·       City Lodge Hotels (Botswana) (Pty) Ltd

·       City Lodge Hotels (Namibia) Pty Ltd

·       CLHG Mozambique Lda

·       Newshelf 892 (Pty) Limited

·       Newshelf 935 (Pty) Limited

·       Vuwa Hotels (Pty) Limited

This PAIA Manual applies to all the aforementioned South African entities, both jointly and severally, and such entities are referred to both individually and collectively as City Lodge Hotels.

3. Purpose of the PAIA Manual

3.1. The purpose of PAIA is to promote the right of access to information, to foster a culture of transparency and accountability within City Lodge Hotels by giving the right to information that is required for the exercise or protection of any right and to actively promote a society in which the people of South Africa have effective access to information to enable them to exercise and protect their rights.

3.2. In order to promote effective governance of non-governmental entities, it is necessary to ensure that everyone is empowered and educated to understand their rights in terms of PAIA.

3.3. Section 9 of PAIA recognises that the right to access information cannot be unlimited and should  be subject to justifiable limitations, including, but not limited to:

3.3.1. limitations aimed at the reasonable protection of privacy;

3.3.2. commercial confidentiality; and

3.3.3. effective, efficient and good governance;

and in a manner which balances that right with any other rights, including such rights contained in the Bill of Rights in the Constitution.

3.4. This PAIA Manual complies with the requirements of the guide mentioned in section 10 of PAIA and recognises that upon commencement of the Protection of Personal Information Act 4 of 2013 (“POPIA”), that  the appointed Information Regulator will be responsible to regulate compliance with PAIA and its  regulations by private and public bodies.

3.5. Capitalised terms used in this PAIA Manual bear the same definition used in PAIA and POPIA.

4. Contact Details of the Chief Executive Officer [Section 51(1)(a)]

5. The Information Officer [Section 51(1)(b)]

5.1. City Lodge Hotels has opted to appoint     an Information Officer, registered with the Information Regulator, to assess requests for access to information as well as to oversee its required functions, duties and responsibilities in terms of PAIA and POPIA.

5.2. The Information Officer may appoint, where it is deemed necessary, Deputy Information Officers, as allowed in terms of section 17 of the Act as well as section 56 of POPIA. This is in order to render City Lodge Hotels as accessible as reasonably possible for requesters of its records and to ensure fulfilment of its obligations and responsibilities   as prescribed in terms of section 55 of POPIA. All requests for information in terms of PAIA and / or POPIA must be addressed to the Information Officer.

Contact Details of the Information Officer

6. Guide of SA Human Rights Commission (Section 51(1) (b))

6.1. PAIA grants a requester access to the records of a private entity, if the record is required for the exercise or protection of any rights.

6.2. Requests in terms of PAIA must be made in accordance with the prescribed procedures, at the   rates provided. The forms and tariff are dealt with in paragraphs 14 and 15 and the Appendices of the Manual.

6.3. Requesters are referred to the official Guide, which has been compiled by the Information Regulator.

6.4. The Guide is available at no cost, and any person may request a copy of the Guide. The Guide has been compiled, which contains information to assist a person wishing to exercise a right of access to information in terms of PAIA and POPI. Copies of the updated Guide are available from the Information Regulator in the manner prescribed. Any enquiries regarding the guide should be directed to:

7. Automatic Disclosure – Categories of Records Available Without Having To Request Access (Section 51(1)(c) in terms of PAIA

7.1 The web page www.citylodgehotels.com is accessible to anyone who has access to the Internet. The City Lodge Hotels website hosts the following categories of information:

o    Hotel Brands

§   Courtyard Hotel

§   City Lodge Hotel

§   Town Lodge

§   Road Lodge

o    Hotel Information

§   Rates

§   Reservations

§   Contact Details

§   Location Maps

§   Hotel Amenities and Services Offered

o    Corporate Information

§   Corporate Profile

§   Financials: Integrated Report, Annual Financial Statements and Interim Reports

§   King IV Governance Register

§   Memorandum of Incorporation

§   Investor Relations including SENS and Circulars

§   BEE Industry Scorecard and Commission Report

§   Career Opportunities

o    Legal

§   General Terms of Use

§   Privacy Policy

§   POPI and PAIA Manual

§   Terms of Residence

o    Other Information

§   Specials and Promotions

§   Product and Promotional Brochures/Pamphlets

§   Loyalty and Rewards

§   News and Marketing Information

§   Sponsorships

§   Partners

§   Social Media Links

§   Other literature intended for public viewing

7.2 Other non-confidential records, such as statutory records maintained at CIPC, may also be accessed without the need to submit a formal application, however, please note that an appointment to view such records will still have to be made with the Information Officer.

8. Subjects and Categories of Records Available only on Request to Access in Terms of PAIA (Section 51(1) (e))

8.1. Records held by City Lodge

For the purposes of this clause 8.1, “Personnel” refers to any person who works for, or provides services to, or on behalf of City Lodge Hotels and receives or is entitled to receive remuneration and any other person who assists in carrying out or conducting the business of City Lodge Hotels. This includes, without limitation, directors (executive and non-executive), all permanent, temporary and part-time staff, as well as contract workers.

This clause serves as a reference to the categories of information that City Lodge Hotels holds. The information is classified and grouped according to records relating to the following subjects and categories:

8.2. Note that the accessibility of the records may be subject to the grounds of refusal set out in this PAIA Manual. Amongst other, records deemed confidential on the part of a third party, will necessitate written consent from the third party concerned, in addition to normal requirements, before   City Lodge Hotels will consider access.

9. Description of the Records of the Body which are Available in Accordance with any other Legislation (Section 51(1) (d))

9.1. Where applicable to its operations, City Lodge Hotels also retains records and documents in terms of the legislation below. Unless disclosure is prohibited in terms of legislation, regulations, contractual agreement or otherwise, records that are required to be made available in terms of these acts shall be made available for inspection by interested parties in terms of the requirements and conditions of PAIA; the below mentioned legislation and City Lodge Hotels applicable internal policies and procedures, should such interested parties be entitled to such information. A request to access must be done in accordance with the requirements of PAIA.

·       Basic Conditions of Employment Act, No 75 of 1997;

·       Broad- Based Black Economic Empowerment Act, No 75 of 1997;

·       Businesses Act, No 71 of 1991;

·       Companies Act, No 71 of 2008;

·       Compensation for Occupational Injuries & Diseases Act, 130 of 1993;

·       Competition Act, No.71 of 2008;

·       Constitution of the Republic of South Africa 2008;

·       Consumer Protection Act, 2008;

·       Copyright Act, No 98 of 1978;

·       Customs & Excise Act, 91 of 1964;

·       Deeds Registries Act, 1937

·       Electronic Communications Act, No 36 of 2005;

·       Electronic Communications and Transactions Act, No 25 of 2002;

·       Employment Equity Act, No 55 of 1998;

·       Financial Intelligence Centre Act, No 38 of 2001;

·       Financial Markets Act, 2012

·       Foodstuffs, Cosmetics and Disinfectants Act, 1972

·       Harmful Business Practices Act, 1999

·       Immigration Act, No. 13 of 2002;

·       Income Tax Act, No 58 of 1962;

·       Intellectual Property Laws Amendment Act, No 38 of 1997;

·       JSE Listings Requirements;

·       Labour Relations Act, No 66 of 1995;

·       Long Term Insurance Act, No 52 of 1998;

·       Medical Schemes Act, 1956;

·       National Liquor Act, No 59 of 2003 and Liquor legislation for the various provinces and related By-laws;

·       Occupational Health & Safety Act, No 85 of 1993;

·       Pension Funds Act, No 24 of 1956;

·       Prescription Act, No 68 of 1969;

·       Prevention of Organised Crime Act, No 121 of 1998;

·       Promotion of Access to Information Act, No 2 of 2000;

·       Protected Disclosures Act, No. 26 of 2000;

·       Protection of Personal Information Act, No. 4 of 2013;

·       Regulation of Interception of Communications and Provision of Communication-Related Information Act 70 of 2002;

·       Skills Development Levies Act, No. 9 of 1999;

·       Short-term Insurance Act No. 53 of 1998;

·       Trademarks Act, 1993

·       Trust Property Control Act 57 of 1988;

·       Unemployment Insurance Contributions Act 4 of 2002;

·       Value Added Tax Act 89 of 1991;

* Although we have used our best endeavours to supply a list of applicable legislation, it is possible that this list may be incomplete. Whenever it comes to our attention that existing or new legislation allows a Requester access on a basis other than as set out in PAIA, we shall update the list accordingly. If a Requester believes that a right of access to a record exists in terms of other legislation listed above or any other legislation, the Requester is required to indicate what legislative right the request is based on, to allow the Information Officer the opportunity of considering the request in light thereof.

9.2. It is further recorded that the accessibility of documents and records may be subject to the   grounds of refusal set out in this PAIA Manual.

10. Detail to Facilitate a Request for Access to a Record of City Lodge Hotels (Section 51(1) (e))

10.1. The requester must comply with all the procedural requirements contained in PAIA relating to the request for access to a record.

10.2. The requester must complete the prescribed form attached as Appendix A, and submit same as well as  payment of a request fee and a deposit (if applicable) to the Information Officer at the postal, physical address or electronic mail address as noted in clause 5 above.

10.3. The prescribed from must be filled in with sufficient information to enable the Information Officer to identify:

a. the record or records requested; and

b. the identity of the requester.

10.4. The requester should indicate which form of access is required and specify a postal address or e-mail address of the requester in the Republic;

10.5. The requester must state that he/she requires the information in order to exercise or protect a right, and clearly state what the nature of the right is so to be exercised or protected. The requester must clearly specify why the record is necessary to exercise or protect such a right (section 53(2)(d)).

10.6. City Lodge Hotels will process the request within 30 (thirty) days, unless the requester has stated  special reasons to the satisfaction of the Information Officer that circumstances dictate that the  above time periods not be complied with.

10.7. The requester shall be advised whether access is granted or denied in writing. If, in addition, the requester requires the reasons for the decision in any other manner, the requester will be obliged to state which manner and the particulars required.

10.8. If a request is made on behalf of another person, then the requester must submit proof of the capacity in which the requester is making the request to the reasonable satisfaction of the Information Officer (section 53(2)(f)).

10.9. If an individual is unable to complete the prescribed form because of illiteracy or disability, such a person may make the request orally.

10.10. The requester must pay the prescribed fee, before any further processing can take place.

10.11. All information as listed in clause 10 herein should be provided, failing which the process will be delayed until the required information is provided. The prescribed time periods will not commence until the requester has furnished all the necessary and required information. The Information Officer shall sever a record, if possible, and grant only access to that portion requested and which is not prohibited from being disclosed.

11. Refusal of Access to Records

11.1. Grounds to Refuse Access

A private body such as City Lodge Hotels is entitled to refuse a request for information.

11.1.1. The main grounds for City Lodge Hotels to refuse a request for information relates to the:

a. mandatory protection of the privacy of a third party who is a natural person or a deceased person (section 63) or a juristic person, as included in POPIA, which would involve the unreasonable disclosure of personal information of that natural or juristic person;

b. mandatory protection of personal information and for disclosure of any personal information to, in addition to any other legislative, regulatory or contractual agreements, comply with the provisions of POPIA;

c. mandatory protection of the commercial information of a third party (section 64) if the record contains:

i. trade secrets of the third party;

ii. financial, commercial, scientific or technical information which disclosure could likely cause harm to the financial or commercial interests of that third party;

iii.    information disclosed in confidence by a third party to City Lodge, if the disclosure    could put that third party at a disadvantage in negotiations or commercial competition;

d. mandatory protection of confidential information of third parties (section 65) if it is protected in terms of any agreement;

e. mandatory protection of the safety of individuals and the protection of property (section 66);  and

f. mandatory protection of records which would be regarded as privileged in legal proceedings (section 67).

11.1.2. The commercial activities (section 68) of a private body, such as City Lodge, which may  include:

a. trade secrets of City Lodge;

b. financial, commercial, scientific or technical information which disclosure could likely cause harm to the financial or commercial interests of City Lodge;

c. information which, if disclosed could put City Lodge Hotels at a disadvantage in negotiations or commercial competition;

d. a computer program which is owned by City Lodge, and which is protected by copyright;

e. the research information (section 69) of City Lodge Hotels or a third party, if its disclosure would disclose the identity of City Lodge, the researcher or the subject matter of the  research and would place the research at a serious disadvantage; and

f. any information, which may affect City Lodge’s Share Price or impact compliance with JSE listing requirements.

11.1.3. Requests for information that are clearly frivolous or vexatious, or which involve an   unreasonable diversion of resources shall be refused.

11.1.4. All requests for information will be assessed on their own merits and in accordance with the applicable legal principles and legislation.

11.1.5. If a requested record cannot be found or if the record does not exist, the Information Officer shall, by way of an affidavit or affirmation, notify the requester that it is not possible to give access to the requested record. Such a notice will be regarded as a decision to refuse a request for access to the record concerned for the purpose of PAIA. If the record should later be found, the requester shall be given access to the record in the manner stipulated by the requester in the prescribed form, unless the Information Officer refuses access to such record.

12. Remedies Available When City Lodge Hotels Refuses a Request

12.1. Internal Remedies

City Lodge Hotels does not have internal appeal procedures. The decision made by the Information Officer is final. Requesters will have to exercise such external remedies at their disposal if the request for information is refused, and the requestor is not satisfied with the answer supplied by the Information Officer.

12.2. External Remedies

12.2.1. A requestor that is dissatisfied with the Information Officer's refusal to disclose information, may within 30 (thirty) days of notification of the decision, apply to a Court for relief.

12.2.2. A third party dissatisfied with the Information Officer's decision to grant a request for information, may within 30 (thirty) days of notification of the decision, apply to a Court for relief.

12.2.3. For purposes of PAIA, the Courts that have jurisdiction over these applications are the Constitutional Court, the High Court or another court of similar status and a Magistrate's Court designated by the Minister of Justice and Constitutional Development and which is presided over by a designated Magistrate.

13. Access to Records Held by City Lodge

13.1. Prerequisites for Access by Personal/Other Requester

13.1.1. Records held by City Lodge Hotels may be accessed by requests only once the prerequisite requirements for access have been met.

13.1.2. A requester is any person making a request for access to a record of City Lodge Hotels. There  are two types of requesters:

a. Personal Requester

i. A personal requester is a requester who is seeking access to a record containing personal information about the requester.

ii. City Lodge Hotels will voluntarily provide the requested information, or give access to any record with regard to the requester's personal information. The prescribed fee for reproduction of the information requested will be charged.

b. Other Requester

i. This requester (other than a personal requester) is entitled to request access to information of third parties.

ii. In considering such a request, City Lodge Hotels will adhere to the provisions of both PAIA and POPIA. Section 71 requires that the Information Officer take all reasonable steps to inform a third party to whom the requested record relates of the request, informing him/her that  he/she may make a written or oral representation to the Information Officer why the request should be refused or, where required, give written consent for the disclosure of the information.

City Lodge Hotels is not obliged to voluntarily grant access to such records. The requester must fulfil the requirements of PAIA as stipulated in Chapter 5; Part 3, including the payment of a request and access fee.

14. Prescribed Fees (Section 51 (1) (f))

14.1. Fees Provided by PAIA

14.1.1. PAIA provides for two types of fees, namely:

a. A request fee, which is a form of administration fee to be paid by all requesters except personal requesters, before the request is considered and is not refundable; and

b. An access fee, which is paid by all requesters in the event that a request for access is granted. This fee is inclusive of costs involved by the private body in obtaining and preparing a record for delivery to the requester.

14.1.2. When the request is received by the Information Officer, such officer shall by notice require the requester, other than a personal requester, to pay the prescribed request fee, before further processing of the request (section 54(1)).

14.1.3. If the search for the record has been made and the preparation of the record for disclosure, including arrangement to make it available in the requested form, requires more than the hours prescribed in the regulations for this purpose, the Information Officer shall notify the requester to pay as a deposit the prescribed portion of the access fee which would be payable if the request is granted.

14.1.4. The Information Officer shall withhold a record until the requester has paid the fees as indicated below.

14.1.5. A requester whose request for access to a record has been granted, must pay an access fee that is calculated to include, where applicable, the request fee, the process fee for reproduction and for search and preparation, and for any time reasonably required in excess of the prescribed hours to search for and prepare the record for disclosure including making arrangements to make it available in the requested form.

14.1.6. If a deposit has been paid in respect of a request for access, which is refused, then the Information Officer concerned must repay the deposit to the requester.

15. Other Fees

15.1. Reproduction Fee

Where City Lodge Hotels has voluntarily provided the Minister with a list of categories of records that will automatically be made available to any person requesting access thereto, the only charge that may be levied for obtaining such records, will be a fee for reproduction of the record in question.

15.2. Request Fees

Where a requester submits a request for access to information held by an institution on a person other than the requester himself/herself, a request fee in the amount of R50.00 (fifty Rand) is payable upfront before the institution will further process the request received.

15.3. Access Fees

15.3.1. An access fee is payable in all instances where a request for access to information is granted, except in those instances where payment of an access fee is specially excluded in terms of the Act or an exclusion is determined by the Minister in terms of section 54(8).

The applicable access fees which will be payable are:

15.4. Deposits

15.4.1. Where City Lodge Hotels receives a request for access to information held on a person other than  the requester himself/herself and the Information Officer upon receipt of the request is of the opinion that the preparation of the required record of disclosure will take more than 6 (six) hours, a deposit is payable by the requester.

15.4.2. The amount of the deposit is equal to 50% (fifty percent) of the amount of the applicable access fee.

 5.5. Collection Fees

15.5.1. The initial "request fee" of R50.00 (fifty Rand) should be deposited into the bank account below and a copy of the deposit slip, application form and other correspondence / documents, forwarded to the Information Officer via e-mail.

15.5.2. The officer will collect the initial "request fee" of applications received directly by the Information Officer via email.

15.5.3. All fees are subject to change as allowed for in the Act and as a consequence such escalations may not always be immediately available at the time of the request being made. Requesters shall be informed of any changes in the fees prior to making a payment.

16. Decision

16.1. Time Allowed to Institution

16.1.1. City Lodge Hotels will, within 30 (thirty) days of receipt of the request, decide whether to grant or decline the request and give notice with reasons (if required) to that effect.

16.1.2. The 30 (thirty) day period within which City Lodge Hotels has to decide whether to grant or refuse the request, may be extended for a further period of not more than (30) thirty days if the request is for a large amount of information, or the request requires a search for information held at another office of City Lodge Hotels and the information cannot reasonably be obtained within the original 30 (thirty) day period.

16.1.3. City Lodge Hotels will notify the requester in writing should an extension be sought.

17. Protection of Personal Information that is Processed by City Lodge Hotels

17.1. Chapter 3 of POPIA provides for the minimum Conditions for Lawful Processing of Personal Information by a Responsible Party. These conditions may not be deviated from unless specific exclusions apply as outlined in POPIA.

17.2. City Lodge Hotels needs Personal Information relating to both individual and juristic persons in order   to carry out its business and organisational functions. The manner in which this information is Processed and the purpose for which it is Processed is determined by City Lodge Hotels. City Lodge Hotels is accordingly a Responsible Party for the purposes of POPIA and will ensure that the Personal Information of a Data Subject:

17.2.1. is processed lawfully, fairly and transparently. This includes the provision of appropriate information to Data Subjects when their data is collected by City Lodge Hotels, in the form of privacy or data collection notices. City Lodge Hotels must also have a legal basis (for example, consent) to process Personal Information;

17.2.2. is processed only for the purposes for which it was collected;

17.2.3. will not be processed for a further purpose unless that processing is compatible with the original purpose.

17.2.4. is adequate, relevant and not excessive for the purposes for which it was collected;

17.2.5. is accurate and kept up to date;

17.2.6. will not be kept for longer than necessary;

17.2.7. is processed in accordance with integrity and confidentiality principles;

17.2.8. is safeguarded which includes physical  and organisational measures to ensure that Personal Information, in both physical and electronic form, are subject to an appropriate level of security when stored, used and communicated by City Lodge Hotels, in order to protect against access and acquisition by unauthorised persons and accidental loss, destruction or damage;

17.2.9. is processed in accordance with the rights of Data Subjects, where applicable.

17.3. Data Subjects  have the right to:

17.3.1. be notified that their Personal Information is being collected by City Lodge Hotels. The Data Subject also has the right to be notified in the event of a data breach;

17.3.2. know whether City Lodge Hotels holds Personal Information about them, and to access that information. Any request for information must be handled in accordance with the provisions   of this PAIA Manual;

17.3.3. request the correction or deletion of inaccurate, irrelevant, excessive, out of date,  incomplete, misleading or unlawfully obtained personal information;

17.3.4. object to City Lodge Hotels’ use of their Personal Information and request the deletion of such Personal Information (deletion would be subject to City Lodge Hotels’ record keeping requirements);

17.3.5. object to the processing of Personal Information for purposes of direct marketing by means  of unsolicited electronic communications; and

17.3.6. complain to the Information Regulator regarding an alleged infringement of any of the rights protected under POPIA and to institute civil proceedings regarding the alleged non-compliance with the protection of his, her or its personal information.

17.4. Purpose of the Processing of Personal Information by the Company

As outlined above, Personal Information may only be processed for a specific purpose. The purposes for which City Lodge Hotels processes or will process Personal Information is set out in Part 1 of Appendix C.

17.5. Categories of Data Subjects and Personal Information / Special Personal Information relating thereto

As per section 1 of POPIA, a Data Subject may either be a natural or a juristic person. Part 2 of Appendix C sets out the various categories of Data Subjects in terms of which City Lodge Hotels Processes Personal Information and the types of Personal Information relating thereto.

17.6. Recipients of Personal Information

Part 3 of Appendix C outlines the recipients to whom City Lodge Hotels may provide a Data Subject’s Personal Information.

17.7. Cross-border flows of Personal Information

17.7.1. Section 72 of POPIA provides that Personal Information may only be transferred out of the Republic of South Africa if the:

a. recipient country can offer such data an “adequate level” of protection. This means that its data privacy laws must be substantially similar to the Conditions for Lawful Processing as contained in POPIA; or

b. Data Subject consents to the transfer of their Personal Information; or

c. transfer is necessary for the performance of a contractual obligation between the Data   Subject and the Responsible Party; or

d. transfer is necessary for the performance of a contractual obligation between the Responsible Party and a third party, in the interests of the Data Subject; or

e. the transfer is for the benefit of the Data Subject, and it is not reasonably practicable to obtain the consent of the Data Subject, and if it were, the Data Subject, would in all likelihood provide such consent.

17.7.2. Part 4 of Appendix C sets out the cross-border transfers of Personal Information which City Lodge Hotels requires and the conditions applicable thereto.

17.8. Description of information security measures to be implemented by City Lodge Hotels

Part 5 of Appendix C sets out the types of security measures implemented by City Lodge Hotels in order to ensure that Personal Information is respected and protected. A preliminary assessment of the suitability of the information security measures implemented or to be implemented by City Lodge Hotels may be conducted in order to ensure that the Personal Information that is processed by City Lodge Hotels is safeguarded and Processed in accordance with the Conditions for Lawful Processing.

17.9. Objection to the Processing of Personal Information by a Data Subject

Section 11 (3) of POPIA and regulation 2 of the POPIA Regulations provides that a Data Subject may, at any time object to the Processing of his/her/its Personal Information in the prescribed form attached to this PAIA Manual as Appendix D subject to exceptions contained in POPIA.

17.10. Request for correction or deletion of Personal Information

Section 24 of POPIA and regulation 3 of the POPIA Regulations provides that a Data Subject may request for their Personal Information to be corrected/deleted in the prescribed form attached as      Appendix E to this PAIA Manual

18. Availability and Updating of the PAIA Manual

18.1 City Lodge Hotels will update this PAIA Manual at such intervals as may be deemed necessary by PAIA, POPIA or any other applicable law;

18.2             This PAIA Manual of City Lodge Hotels is available to view at its premises and on its website www.citylodgehotels.com.

APPENDIX A:  REQUEST FOR INFORMATION FORM – FORM 02

REPUBLIC OF SOUTH AFRICA

FORM 02 - REQUEST FOR ACCESS TO RECORD OF PRIVATE BODY

(Section 53(1) of the Promotion of Access to Information Act, 2000 (Act No. 2 of 2000))

[Regulation 7]

NOTE:

1.      Proof of identity must be attached by the requester.

2.      If requests made on behalf of another person, proof of such authorisation, must be attached to this form.

TO:       The Information Officer

            Bryanston Gate Office Park Building 7

            “The Lodge”

            Corner Homestead Avenue and Main Road

            Bryanston

            2191

Mark with an "X"

Request is made in my own name                      Request is made on behalf of another person.

You will be notified in writing whether your request has been approved or denied and if approved the costs relating to your request, if any. Please indicate your preferred manner of correspondence:

Signed at                                       this                       day of                               20                 

Signature of Requester / person on whose behalf request is made

FOR OFFICIAL USE

Signature of Information Officer

APPENDIX B

OUTCOME OF REQUEST AND OF FEES PAYABLE – FORM 03

[Regulation 8]

    Note;

1.      If your request is granted the—

(a)    amount of the deposit, (if any), is payable before your request is processed; and

(b)    requested record/portion of the record will only be released once proof of full payment is received.

2.      Please use the reference number hereunder in all future correspondence.

Reference number:                                            

TO:                 

Your request dated                         , refers.

1.             You requested:

OR

2.             You requested:

3.             To be submitted:

Kindly note that your request has been: Approved

Denied, for the following reasons:

4.             Fees payable with regards to your request:

5.             Deposit payable (if search exceeds six hours):

Yes                                                                                                           No

The amount must be paid into the following Bank account:

Signed at                                       this                       day of                               20                  

Information officer

APPENDIX C: PART 1 – PROCESSING OF PERSONAL INFORMATION IN ACCORDANCE WITH POPIA

For clients (including guests of any City Lodge Hotels hotel)

a.      Making hotel reservations for clients.

b.      Report to Immigration Services in accordance with Immigration Act.

c.       Performing duties in terms of any agreement with clients.

d.      Make, or assist in making, credit decisions about clients.

e.      Operate and manage clients’ accounts and manage any application, agreement or correspondence clients may have with City Lodge Hotels.

f.        Communicating (including direct marketing) with clients by email, SMS, letter, telephone or in any other way about City Lodge Hotels’ products and services, promotions and competitions, unless clients indicate otherwise.

g.      To form a view of clients as individuals and to identify, develop or improve products that may be  of interest to clients.

h.      Carrying out market research, business and statistical analysis.

i.        Performing other administrative and operational purposes including the testing of systems.

j.        Recovering any debt clients may owe to City Lodge Hotels.

k.       Complying with City Lodge Hotels’ regulatory and other obligations inclusive of the Immigration Act, The Consumer Protection Act and the National Credit Act.

l.        Any other reasonably required purpose relating to the City Lodge Hotels business.

For prospective clients (including prospective guests of any City Lodge Hotels hotel)

a.      Making hotel reservations.

b.      Verifying and updating information.

c.       Pre-credit scoring.

d.      Direct marketing.

e.      Communicating (including direct marketing) with clients by email, SMS, letter, telephone or in any other way about City Lodge Hotels’ products and services, promotions and competitions, unless clients indicate otherwise.

f.        Any other reasonably required purpose relating to the processing of a prospect’s personal information reasonably related to the City Lodge Hotels’ business.

For employees

a.      The same purposes as for clients (above).

b.      Verification of applicant employees’ information during recruitment process.

c.       General matters relating to employees:

i.       Pension

ii.      Medical aid

iii.     Payroll

iv.     Disciplinary action

v.      Training

d.      Any other reasonably required purpose relating to the employment or possible employment relationship.

For vendors /suppliers /other businesses

a.      Verifying information and performing checks.

b.      Purposes relating to the agreement or business relationship or potential agreement or business relationships between the Parties.

c.       Payment of invoices.

d.      Complying with City Lodge Hotels’ regulatory and other obligations; and

e.      Any other reasonably required purpose relating to the City Lodge Hotels business.

and in relation to the aforementioned any legitimate interest of City Lodge Hotels as is detailed in City Lodge Hotels’ Privacy Policy published on its websites: www.clhg.com or www.citylodgehotels.com  or the City Lodge Hotels App.

APPENDIX C PART 2 - CATEGORIES OF DATA SUBJECTS AND CATEGORIES OF PERSONAL INFORMATION RELATING THERETO

Employees

a.      Name and contact details.

b.      Identity number and identity documents including passports.

c.       Employment history and references.

d.      Banking and financial details.

e.      Details of payments to third parties (deductions from salary).

f.        Employment contracts.

g.      Employment equity plans.

h.      Medical aid records.

i.        Pension Fund records.

j.        Remuneration/salary records.

k.       Performance appraisals.

l.        Disciplinary records.

m.     Leave records.

n.      Training records.

Clients and prospective clients / guests (which may include employees and prospective employees)

a.      Postal and/or street address.

b.      Title and name.

c.       Contact numbers and/or e-mail address.

d.      Nationality.

e.      Identity document, birth certificate or passport.

f.        Financial information.

g.      Browsing habits and click patterns on City Lodge Hotels’ websites as per the City Lodge Hotels Privacy and Cookie Policy.

h.      Responses to Surveys and Competitions an Promotions

i.        Customer comments and service reviews

Vendors /suppliers / other businesses

a.      Name, address and contact details.

b.      Identity and legal entity details and applicable statutory information.

c.       Banking and financial information.

d.      Information about products or services.

e.      Browsing habits and click patterns on City Lodge Hotels’ websites as per the City Lodge Hotels Privacy and Cookie Policy.

f.        Other information not specified, reasonably required to be processed for business operations.

1.       APPENDIX C: PART 3 - RECIPIENTS OF PERSONAL INFORMATION

a.       Any firm, organisation or person that City Lodge Hotels uses to collect payments and recover       debts or to provide a service on its behalf;

b.       Any firm, organisation or person that/who provides City Lodge Hotels with products or services;

c.       Any payment system City Lodge Hotels uses;

d.       Regulatory and governmental authorities or ombudsmen, or other authorities, including immigration and  tax authorities, where City Lodge Hotels has a duty to share information;

e.       Third parties to whom payments are made on behalf of employees;

f.         Financial institutions from whom payments are received on behalf of data subjects;

g.       Any other Operator not specified;

h.       Employees, contractors and temporary staff; and

i.         Agents.

2.       APPENDIX C: PART 4 – CROSS BORDER TRANSFERS OF PERSONAL INFORMATION

Personal Information may be transmitted trans-border to City Lodge Hotels’ service providers in other countries, and Personal Information may be stored in data servers hosted outside South Africa, which may not have adequate data protection laws. City Lodge Hotels will endeavour to ensure that its service providers will    make all reasonable efforts to secure the data and Personal Information.

City Lodge Hotels will transfer Personal Information outside South Africa in the following circumstances:

1.       a client reservation is with a City Lodge Hotels hotel located internationally;

2.       where City Lodge Hotels is required to make contact on behalf of client outside South Africa;

3.       where electronic services and resources are based outside South Africa for example banking and credit card payment services;

4.       where there is an international element to a reservation.

City Lodge Hotels will take steps to ensure that, wherever possible, the transfer complies with POPIA and endeavour to ensure that our host providers are subject to laws, or policies, which uphold principles for the reasonable processing of information substantially similar to the POPIA to ensure adequate protection of Personal Information.

For further information please contact the Information Officer.

3.              APPENDIX C: PART 5 – DESCRIPTION OF INFORMATION SECURITY MEASURES

City Lodge Hotels undertakes to institute and maintain the data protection measures to accomplish the following objectives outlined below. The details given are to be interpreted as examples of how to achieve an adequate data protection level for each objective. City Lodge Hotels may use alternative measures and adapt to technological security development, as needed, provided that the objectives are achieved.

1.         Access Control of Persons

City Lodge Hotels shall implement suitable measures in order to prevent unauthorized persons from   gaining access to the data processing equipment where the data are processed.

2.         Data Media Control

City Lodge Hotels undertakes to implement suitable measures to prevent the unauthorized manipulation of media, including reading, copying, alteration or removal of the data media used by City Lodge Hotels and containing personal data of Customers.

3.         Access Control to Data

City Lodge Hotels represents that the persons entitled to use City Lodge Hotels’ data processing system are only able to access the data within the scope and to the extent covered by their respective access permissions (authorisation).

4.         Transmission Control

City Lodge Hotels shall be obliged to enable the verification and tracing of the locations/destinations to which the personal information is transferred by utilization of City Lodge Hotels’ data communication equipment/devices.

5.         Transport Control

City Lodge Hotels shall implement suitable measures to prevent Personal Information from being read, copied, altered or deleted by unauthorized persons during the transmission thereof or during the transport of the data media.

6.         Organisation Control

City Lodge Hotels shall maintain its internal organisation in a manner that meets the requirements of this Manual.

APPENDIX D: OBJECTION TO THE PROCESSING OF PERSONAL INFORMATION IN TERMS OF SECTION 11(3) OF THE PROTECTION OF PERSONAL INFORMATION ACT, 2013

REGULATIONS IN RESPECT OF THE PROTECTION OF PERSONAL INFORMATION ACT, 2018

[Regulation 2]

Note:

1      Affidavits or other documentary evidence as applicable in support of the objection may be attached.

2      If the space provided for in this Form is inadequate, submit information as an Annexure to this Form and sign each page.

3      Complete as is applicable

Signed at ………………..………………… on this …..…….. day of ………….……………………… 20………

……………………………………………………………………………

Signature of Data Subject/Designated Person

APPENDIX E: REQUEST FOR CORRECTION OR DELETION OF PERSONAL INFORMATION OR DESTROYING OR DELETION OF RECORD OF PERSONAL INFORMATION IN TERMS OF SECTION 24(1) OF THE PROTECTION OF PERSONAL INFORMATION ACT, 2013

REGULATIONS RELATING TO THE PROTECTION OF PERSONAL INFORMATION, 2018

[Regulation 3]

Note:

1.    Affidavits or other documentary evidence as applicable in support of the request may be attached.

2.    If the space provided for in this Form is inadequate, submit information as an Annexure to this Form and sign each page.

3.  Complete as is applicable.

Mark the appropriate box with an "x".  Request for:

ÿ               Correction or deletion of the personal information about the data subject which is in possession or under the control of the responsible party.

ÿ               Destroying or deletion of a record of personal information about the data subject which is in possession or under the control of the responsible party and who is no longer authorised to retain the record of information

Signed at ………………..………………… on this …..…….. day of ………….……………………… 20………

……………………………………………………………………………

Signature of Data Subject/Designated Person