PAIA Manual for Zatami (Pty) Ltd

1. Purpose of this Manual

This manual has been prepared in accordance with Section 51 of the Promotion of Access to Information Act 2 of 2000 ("PAIA"), as amended.

The purpose of this manual is to provide information about:

• Zatami (Pty) Ltd and its Information Officer;
• The records held by Zatami;
• The categories of records that may be requested under PAIA;
• The manner in which a person may request access to records held by Zatami; and
• The processing of personal information by Zatami in accordance with the Protection of Personal Information Act 4 of 2013 ("POPIA").

Zatami (Pty) Ltd operates a South African peer-to-peer vehicle bidding marketplace that provides the technology and platform through which independent vehicle sellers and buyers can participate in timed bidding events.

2. Company and Information Officer Details

Company Name: Zatami (Pty) Ltd

Registration Number: 2026 / 596726 / 07

Information Officer: Michael Sibeko

Physical Address: 1204 Rammulotsi, Viljoenskroon, Free State, 9520, South Africa

Postal Address: 1204 Rammulotsi, Viljoenskroon, Free State, 9520, South Africa

Email: support@zatami.co.za

Telephone: 060 187 6018

Website: zatami.co.za

3. Guide on How to Use PAIA

The Information Regulator of South Africa has published a guide explaining how a person may exercise their rights under PAIA.

The guide provides information regarding:

• The manner in which requests for access to records may be made;
• The rights of requesters;
• The applicable procedures and forms; and
• The remedies available where access to information is refused.

The guide is available from the Information Regulator of South Africa or may be requested from Zatami's Information Officer.

4. Records Held in Accordance with Other Legislation

Zatami maintains records where required for its business operations and applicable legal and regulatory obligations.

Depending on the nature of the record, these may include records maintained in terms of:

• Companies Act 71 of 2008;
• Protection of Personal Information Act 4 of 2013 (POPIA);
• Promotion of Access to Information Act 2 of 2000 (PAIA);
• Financial Intelligence Centre Act 38 of 2001 (FICA), where applicable;
• Tax Administration Act 28 of 2011;
• Income Tax Act 58 of 1962;
• Value-Added Tax Act 89 of 1991, where applicable;
• Consumer Protection Act 68 of 2008; and
• Electronic Communications and Transactions Act 25 of 2002.

The existence of a category of records listed in this manual does not necessarily mean that every record within that category will be available for disclosure. Access remains subject to PAIA, POPIA, confidentiality obligations, privilege and any other applicable legal restrictions.

5. Categories of Records Held by Zatami

Zatami may hold records in the following categories.

5.1 Corporate and Governance Records

These may include:

• CIPC registration documents;
• Memorandum of Incorporation;
• Director and shareholder records;
• Company resolutions;
• Corporate policies and procedures; and
• Other records relating to the management and governance of the company.

5.2 Financial and Accounting Records

These may include:

• Accounting records;
• Financial statements;
• Invoices and receipts;
• Tax records and returns;
• Banking and payment records;
• Manual EFT deposit records;
• Payment references and confirmations;
• Transaction records; and
• Records relating to Zatami's financial operations.

5.3 Platform and User Records

These may include:

• User registration information;
• Account information;
• Contact information;
• User verification records;
• Onboarding and questionnaire information;
• Bidding participation records;
• Bid amounts and timestamps;
• Deposit verification records;
• Notifications and account activity;
• Administrative audit logs; and
• Records relating to interactions with the Zatami platform.

5.4 Vehicle Listing Records

These may include:

• Vehicle make, model and year;
• Mileage and vehicle identification information;
• Vehicle descriptions;
• Photographs;
• Required vehicle videos, including cold-start and walkaround videos;
• Ownership and vehicle documentation submitted by sellers;
• Listing approval records; and
• Records relating to the publication, amendment, suspension or removal of listings.

5.5 Commercial and Operational Records

These may include:

• Agreements with service providers;
• Technology and hosting agreements;
• Payment service provider records;
• Identity verification service records;
• Supplier and contractor records;
• Operational procedures;
• Customer support records; and
• Other records relating to the operation and administration of the Zatami platform.

5.6 Personnel Records

Where applicable, these may include:

• Employment agreements;
• Personnel files;
• Payroll records;
• Leave records;
• Performance-related records; and
• Other employment-related records.

6. Processing of Personal Information under POPIA

Zatami processes personal information in accordance with POPIA and applicable data protection requirements.

6.1 Data Subjects

Depending on the nature of the interaction with Zatami, personal information may relate to:

• Registered buyers;
• Vehicle sellers;
• Representatives of registered businesses;
• Website visitors;
• Customers and prospective customers;
• Service providers and suppliers;
• Contractors; and
• Employees or prospective employees, where applicable.

6.2 Personal Information Processed

Depending on the services used, Zatami may process information including:

• Names and surnames;
• Email addresses;
• Mobile telephone numbers;
• Account and authentication information;
• Identity verification information;
• Vehicle ownership and registration documentation;
• Vehicle listing information and media;
• Bidding activity and bid history;
• Deposit and payment verification information;
• Customer support communications;
• Device and technical information; and
• Security and administrative audit information.

Zatami collects and processes information that is reasonably necessary to operate, secure and administer the marketplace and to comply with applicable legal obligations.

6.3 Purposes of Processing

Personal information may be processed to:

• Create and administer user accounts;
• Verify user identities;
• Enable participation in bidding events;
• Verify bidding deposits;
• Review and administer vehicle listings;
• Maintain the integrity and security of the marketplace;
• Detect and prevent fraud or misuse;
• Facilitate contact between a winning buyer and seller where applicable;
• Provide customer support;
• Maintain appropriate business and financial records; and
• Comply with applicable legal and regulatory requirements.

6.4 Recipients of Personal Information

Where reasonably necessary and lawful, personal information may be shared with:

• Payment service providers;
• Identity verification providers;
• Cloud hosting and infrastructure providers;
• Technology and communications service providers;
• Professional advisers;
• Regulatory authorities; and
• Law enforcement authorities where legally required.

Where a bidding event successfully concludes, relevant contact information may be shared between the winning buyer and seller for the purpose of arranging the vehicle inspection, payment, collection and transfer.

Zatami does not sell or rent users' personal information.

6.5 Transborder Information Flows

Certain technology, hosting or service providers used by Zatami may process or store information outside South Africa.

Where personal information is transferred to or processed in another country, Zatami will take reasonable steps to ensure that the transfer and processing comply with applicable POPIA requirements and that appropriate safeguards are in place.

6.6 Security Safeguards

Zatami implements reasonable technical and organisational measures designed to protect personal information against unauthorised access, loss, misuse, alteration or disclosure.

These measures may include:

• Access controls and restricted administrative permissions;
• Secure authentication mechanisms;
• Encryption or secure transmission protocols;
• Database access controls;
• Server-side processing of sensitive platform functions;
• Audit logging; and
• Reasonable monitoring and security procedures.

No internet-based system can guarantee absolute security. Zatami nevertheless takes reasonable steps to protect information entrusted to it and to respond appropriately to security incidents.

7. Requesting Access to Records

A person who wishes to request access to a record held by Zatami may make a request in accordance with PAIA.

7.1 Request Form

Requests should be made using Form 2 – Request for Access to Record, as prescribed under PAIA.

The applicable form may be obtained from the Information Regulator or requested from Zatami's Information Officer.

7.2 Submission

Completed requests should be submitted to:

Information Officer, Zatami (Pty) Ltd

Email: support@zatami.co.za

The requester should provide sufficient information to enable Zatami to identify:

• The record or records requested;
• The identity of the requester;
• The preferred form of access, where applicable; and
• Any other information reasonably required to process the request.

Proof of identity may be required where appropriate.

7.3 Fees

Prescribed fees may apply to requests for access to records in accordance with PAIA and the applicable regulations.

Where a fee is required, Zatami will provide the requester with the relevant information regarding the applicable fee before proceeding where required.

7.4 Response Period

Zatami will deal with access requests within the period prescribed by PAIA.

Where permitted by PAIA, the applicable period may be extended in accordance with the Act, and the requester will be notified accordingly.

7.5 Grounds for Refusal

Access to a requested record may be refused where a ground for refusal exists under PAIA or another applicable law.

Examples may include records containing:

• Third-party personal information;
• Confidential commercial information;
• Legally privileged information;
• Information protected by applicable law; or
• Other information for which PAIA provides a lawful ground for refusal.

Where applicable, Zatami will provide the requester with the reasons for a refusal in accordance with PAIA.

8. Access to Personal Information under POPIA

Where a request relates to a person's own personal information, the request may also be dealt with in accordance with the access rights provided under POPIA.

Requests concerning personal information may be submitted to Zatami's Information Officer using: support@zatami.co.za

Zatami may require reasonable proof of identity before providing access to personal information.

Requests remain subject to applicable legal limitations, including circumstances where disclosure may adversely affect the rights of another person or where retention or disclosure is required by law.

9. Zatami's Role as a Vehicle Bidding Marketplace

Zatami operates as a technology platform that facilitates connections between independent vehicle sellers and buyers.

Zatami provides features including:

• Vehicle listing and submission workflows;
• Administrative listing review;
• Vehicle information and media presentation;
• User verification processes;
• Timed bidding events;
• Bid recording and validation;
• Deposit verification; and
• Post-event contact facilitation where applicable.

Vehicles listed on the platform are provided by independent sellers. Zatami does not ordinarily own, purchase or sell the vehicles listed on the platform.

The underlying vehicle transaction, including physical inspection, vehicle handover, payment of the purchase price and transfer of ownership, is arranged between the relevant buyer and seller.

The respective rights and responsibilities of Zatami, buyers and sellers are set out in Zatami's Terms & Conditions and other applicable platform policies.

10. Availability of this Manual

This PAIA Manual is available:

• On the Zatami website;
• For inspection at Zatami's physical address, where applicable; and
• Through Zatami's Information Officer upon reasonable request.

Zatami will review this manual periodically and update it where necessary to reflect changes to its business, information-processing activities or applicable legislation.

11. Contact Details

For PAIA, POPIA or information-access enquiries, please contact:

Zatami (Pty) Ltd

Information Officer: Michael Sibeko

Email: support@zatami.co.za

Telephone: 060 187 6018

Physical Address: 1204 Rammulotsi, Viljoenskroon, Free State, 9520, South Africa

Website: zatami.co.za

12. Information Regulator of South Africa

Where applicable, a person may contact the Information Regulator regarding their rights under PAIA or POPIA.

Information Regulator of South Africa

Website: inforegulator.org.za

Email: enquiries@inforegulator.org.za

For POPIA-related complaints, the Information Regulator may also be contacted through its designated complaints channels.