WISHALIVE.SHOP DISCLOSURES & LICENSES

MANUAL PREPARED IN ACCORDANCE WITH SECTION 51 OF THE PROMOTION OF ACCESS TO INFORMATION ACT NO 2 OF 2000 (AS AMENDED) (“PAIA”) AND THE PROTECTION OF PERSONAL INFORMATION ACT NO 4 OF, 2013 (“POPIA”) FOR WISHALIVE.SHOP WISHALIVE (PTY) LTD. Date of Compilation: 12 August 2023

INTRODUCTION (a) WISHALIVE.shop WISHALIVE (Pty) Ltd. (“WISHALIVE”) is a South African company that provides cloud computing services to the commercial and public sectors in South Africa. (b) WISHALIVE has prepared this manual in compliance with its obligations under section 51 of PAIA. In addition, the manual has been augmented to reflect WISHALIVE’ additional obligations to data subjects whose personal information it processes under POPIA. (c) The manual provides an outline of the types of records and the personal information kept by WISHALIVE, and explains how you can submit requests for access to these records. In addition, it explains how to access or object to personal information held by WISHALIVE, or request correction of the personal information, in terms of sections 23 and 24 of POPIA. (d) PAIA seeks to give effect to the constitutional right of access to information as contained in section 32 of the Bill of Rights. PAIA establishes certain statutory rights of requesters to access records of a private body if: (i) that record is required for the exercise or protection of any rights; (ii) that requester complies with all procedural requirements; and (iii) access thereto cannot be denied on any grounds referred to in PAIA. (e) POPIA seeks to give effect to the constitutional right to privacy as contained in section 14 of the Bill Rights. POPIA seeks to safeguard personal information by regulating the manner in which it may be processed by public and private bodies. Further, POPIA provides that data subjects have the right to have their personal information maintained in accordance with the conditions for the lawful processing of personal information, which are set out in Chapter 3 of POPIA. 2. SECTION 51(1)(A): ADMINISTRATION OF THE PAIA AND POPIA (a) Rosner Carnegie in his capacity as Head of WISHALIVE has authorised Ms. Katherine Palmer as WISHALIVE information officer. Ms. Katherine Palmer is responsible for ensuring that the requirements of PAIA and POPIA are administered in a fair, objective and unbiased manner for WISHALIVE. (b) All requests for access to records relating to the entity should be addressed the information officer: (i) Company Name: WISHALIVE (Pty) Ltd (ii) Contact person: Ms. Katherine Palmer [2] (iii) Postal address: 2 Ncondo Place, Ridgeside, Umhlanga Ridge, Durban 4319 (iv) Physical address: 2 Ncondo Place, Ridgeside, Umhlanga Ridge, Durban 4319 (v) Email: CustomerCare@WISHALIVE.co 3. SECTION 51(1)(B): INFORMATION REGULATOR GUIDE (a) The Information Regulator has, in terms of section 10(1) of PAIA compiled a guide, which contains information as may reasonably be required by a person who wishes to exercise any right contemplated in PAIA and POPIA (“Guide”). Accordingly, the aforesaid Guide contains a description of: (i) the objects of PAIA and POPIA; (ii) the postal and street address, phone and fax number and, if available, electronic mail address of:(a) the Information Officer of every public body, and (b) every Deputy Information Officer of every public and private body designated in terms of section 17(1) of PAIA and section 56 of POPIA; (iii) the manner and form of a request for: (a) access to a record of a public body contemplated in section 11; and (b) access to a record of a private body contemplated in section 50 (attached hereto as Schedule 1) (iv) the assistance available from the Information Regulator in terms of PAIA and POPIA; (v) all remedies in law available regarding an act or failure to act in respect of a right or duty conferred or imposed by PAIA and POPIA, including the manner of lodging: (a) an internal appeal; (b) a complaint to the Information Regulator; and (c) an application with a court against a decision by the information officer of a public body, a decision on internal appeal or a decision by the Information Regulator or a decision of the head of a private body; (vi) the provisions of sections 14 and 51 enquiring a public body and private body, respectively, to compile a manual, and how to obtain access to a manual; (vii) the provisions of sections 15 and 52 providing for the voluntary disclosure of categories of records by a public body and private body, respectively; (viii) the notices issued in terms of sections 22 and 54 regarding fees to be paid in relation to requests for access; and (ix) the regulations made in terms of section 92. (b) Members of the public can inspect or make copies of the Guide from the offices of the public and private bodies, including the office of the Information Regulator, during normal working hours. (c) The Guide can also be obtained free of charge: (a) upon request to the Information Officer; or from the website of the Information Regulator (https://www.justice.gov.za/inforeg/). (d) A copy of the Guide may directly be requested from the Information Officer. Alternatively, WISHALIVE has also made available the Guide in the following two official languages, for public inspection during normal office hours: [3] 4. SECTION 51(3): AVAILABILITY OF MANUAL A copy of this PAIA manual is available: (i) at the registered address of WISHALIVE set out in paragraph 1(e) for public inspection during WISHALIVE normal business hours; (ii) to any person by sending a request for a copy of the manual to the Information Officer by email and upon the payment of the fee prescribed by paragraph 1(e); or (iii) at https://aws.amazon.com/legal/aws-za/. 5. SECTION 51(1)(C): VOLUNTARY DISCLOSURE (a) No notices relating to WISHALIVE have been published by the Minister responsible for the administration of justice (presently the Minister of Justice and Correctional Services in terms of section 52(2) of the Act. (b) Certain records are available without needing to be requested in terms of the request procedures set out in the Act and provided for in this manual. This information may be inspected, collected, purchased or copied (at the prescribed fee for reproduction) at the South African offices of WISHALIVE. 6. RECORDS AVAILABLE WITHOUT A REQUEST TO ACCESS IN TERMS OF THE ACT (a) Records of a public nature, typically those disclosed on WISHALIVE’s website may be accessed without the need to submit a formal application. (b) Other non-confidential records, such as statutory records maintained at CIPC, may also be accessed without the need to submit a formal application, however, please note that an appointment to view such records may be arranged with the information officer. 7. RECORDS AVAILABLE IN ACCORDANCE WITH ANY OTHER LEGISLATION (a) Where applicable to its operations, WISHALIVE retains records and documents in terms of the legislation listed below: (i) Basic Conditions of Employment Act No. 75 of 1997; (ii) Broad Based Black Economic Empowerment Act 53 of 2003; [4] (iii) Companies Act 71 of 2008; (iv) Compensation for Occupational Injuries and Diseases Act No. 130 of 1993; (v) Employment Equity Act No. 55 of 1998; (vi) Labour Relations Act No. 66 of 1995; (vii) Pension Funds Act 24 of 1956; (viii) Promotion of Access to Information Act 2 of 2000; (ix) Skills Development Act 97 of 1997; (x) Skills Development Levy Act 9 of 1999; (xi) Unemployment Insurance Act No. 63 of 200; (xii) Unemployment Insurance Contributions Act 4 of 2002; (xiii) Value-added Tax Act No. 89 of 1991. (b) Unless disclosure is prohibited in terms of legislation, regulations, contractual agreement or otherwise, records that are required to be made available in terms of the legislation listed above, shall be made available for inspection by interested parties in terms of the requirements and conditions of PAIA; the above mentioned legislation and applicable internal policies and procedures, should such interested parties be entitled to such information. Any request to access must be done in accordance with PAIA. (c) While WISHALIVE has made every effort to identify all pertinent legislation, we cannot guarantee that all legislation has been included. Should you be aware of any specific legislation that should be included and which has been omitted, please contact and notify the information officer. (d) It is further recorded that the accessibility of documents and records may be subject to the grounds of refusal set out in this PAIA manual. 8. SECTION 51 (1)(E): RECORDS HELD BY THE ENTITY IN TERMS OF PAIA (a) For purposes of facilitating a request in terms of PAIA, a description of the records and the categories in which these subjects are classified and held by WISHALIVE are detailed below: Category of Record Types of Records Classification Company Records Statutory documents, such as a Memorandum of Incorporation 1 Customer Related Records Customer Database 4, 5 Customer Contracts 12 [5] Category of Record Types of Records Classification Human Resources Conditions of employment and other personnel-related contractual and quasi-legal records. Employment contracts 5, 12 Employee records provided by employees 4, 5 SETA records 12 PAYE records 12 Training records 12 Performance Appraisal records 4, 5 Safety, health and environment (SHE) Records SHE Policy 1 Mandatory SHE records (employees and contractors) 4, 5, 9 Financial Accounting records 12 Financial statements and Management Accounts 12 Statutory returns 12 Policies and procedures 12 (b) The records classification key below will also assist in identifying access to records: Classification No. Access Classification 1 May be disclosed Public Access Document 2 May not be Disclosed Request after commencement of criminal or civil proceedings [s7] 3 May be disclosed Subject to copyright 4 Limited Disclosure Personal information that belongs to the requester of that information [s61] 5 May not be disclosed Unreasonable disclosure. 6 May not be Disclosed Likely to harm the commercial or financial interests of third party [s64(a)(b)] 7 May not be Disclosed Likely to harm WISHALIVE or third party in contract or other negotiations [s64(c)] 8 May not be Disclosed Would breach a duty of confidence owed to a third party in terms of an Agreement [s65] 9 May not be Disclosed Likely to compromise the safety of individuals or protection of property [s66] 10 May not be Disclosed Legally privileged document [s67] 11 May not be Refused Environmental testing / investigation which reveals public safety / environmental risks [s64(2); s68(2)] 12 May not be Disclosed Commercial information of Private Body [s68] [6] Classification No. Access Classification 13 May not be Disclosed Likely to prejudice research and development information of WISHALIVE or a third party [s69] (c) The inclusion of any subject or category of records should not be taken as an indication that records falling within those subjects and/or category will be made available under PAIA. In particular, certain grounds for refusal as set out in PAIA may be applicable to a request for such records. (d) All requests for access will be evaluated on a case by case basis in accordance with the provisions of PAIA. 9. PROCEDURE TO FOLLOW WHEN SUBMITTING A FORMAL REQUEST OF ACCESS TO A RECORD (a) Use the prescribed Access Request form (“form”) attached hereto as Schedule 1 (Form C) when a request is made to WISHALIVE along with the fees prescribed in paragraph 9. (b) The form must be completed CLEARLY and COMPLETELY and must be addressed and submitted to the Information Officer in accordance with paragraph 1(e). (c) The form must: (i) provide sufficient particulars to enable the Information Officer to identify the record(s) requested and to identify the requester; (ii) indicate which form of access is required; (iii) specify a postal address or fax number of the requester in the Republic of South Africa; (iv) identify the right that the requester is seeking to exercise or protect, and provide an explanation of why the requested record is required for the exercise or protection of that right; and (v) if the request is made on behalf of another person, to submit proof of the capacity in which the requester is making the request, to the reasonable satisfaction of the Information Officer. (d) The Information Officer will respond to your request within 30 days of receiving the request by indicating whether your request for access has been granted. The 30 day period may be extended with a further period of not more than 30 days if the request is for a large number of records or requires a search through a large number of records and compliance with the original period would unreasonably interfere with the activities of WISHALIVE or the records are not located at the building of WISHALIVE, or consultations amongst divisions within WISHALIVE or another private body are required. [7] (e) An application for access to information can be refused in the event that the application does not comply with the procedural requirements of PAIA. In addition, the successful completion and submission of an access request form does not automatically allow the requestor access to the requested record. (f) If access to a record/information is granted, the Information Officer’s response will include: (i) an indication of the access fee (set out in paragraph 9) that should be paid upon gaining access (if any); (ii) an indication of the form in which the access will be granted; and (iii) a notice that you may lodge an application with the court against the access fee to be paid or the form of the access, including guidance on the procedure for lodging the application. (g) If access to a record/information is denied, our response will include: (i) adequate reasons for the refusal; and (ii) notice that you may lodge an application with the court against the refusal and the procedure including the period, for lodging the application.1 (h) Assuming your request for access is granted, you will gain access to the requested records as soon as is reasonably possible and once the access fee has been paid. (i) Access will be granted to a record if the following criteria are fulfilled: (i) the record is required for the exercise or protection of any right; (ii) the requestor complies with the procedural requirements set out in this manual; and (iii) access to the record is not refused in terms of any ground for refusal as contemplated in Chapter 4 of Part 3 of PAIA. 10. SUBMISSION OF ACCESS REQUEST FORM AND PAYMENT OF FEES (a) The completed form, together with a certified copy of the requester’s identity document must be addressed to the Information Officer and submitted via the contact details stated in paragraph 1(e) above. (b) An initial request fee may be payable on submission of the form. Note, that records may be withheld until the fees have been paid. 1 For details on the procedure, please refer to Chapter 2 of Part 4 of the Act. [8] (c) Payment details can be obtained from the Information Officer indicated above and can be made via a direct deposit. Proof of payment must be supplied via the contact details provided in paragraph 1(e) above. (d) If the request for access is successful an access fee may be required for the search, reproduction and/or preparation of the record(s) and will be calculated based on the prescribed fees as set out in Schedule 2 hereto. The access fee must be aid prior to access being given to the requested records. (e) No fee is payable in respect of requests for access to personal information. The forms and fee structure are available at the Information Regulator’s website (www.justice.gov.za/inforeg/index.html). 11. INFORMATION OR RECORDS NOT FOUND (a) If all reasonable steps have been taken to find a record, and such a record cannot be found or if the records do not exist, then the Information Officer shall notify the requester, by way of letter, that it is not possible to give access to the requested record. (b) The letter shall provide a full account of all the steps taken to find the record or to determine the existence thereof, including details of all communications by the Information Officer with every person who conducted the search. (c) The notice, as set out in paragraph 10(a), shall be regarded as a decision to refuse a request for access to the record concerned for the purposes of PAIA. (d) If the record in question should later be found, the requester shall be given access to the record in the manner stipulated by the requester in the prescribed form unless access is refused by the Information Officer. (e) The attention of the requester is drawn to the provisions of Chapter 3 of Part 3 in terms of which AWS may refuse, on certain specified grounds, to provide information to a requester. 12. REQUEST FOR ACCESS TO INFORMATION REGARDING THIRD PARTIES (a) Section 71 of PAIA makes provision for a request for information or records about a third party. (b) In considering such a request, WISHALIVE will adhere to the provisions of sections 71 to 74 of PAIA. (c) The attention of the requester is drawn to the provisions of Chapter 5 of Part 3 of PAIA in terms of which WISHALIVE is obliged, in certain circumstances, to advise third parties of requests lodged in respect of information applicable to or concerning such third parties. [9] (d) In addition, the provisions of Chapter 2 of Part 4 of PAIA entitle third parties to dispute the decisions of the CEO and/or the Information Officer, or by referring the matter to the High Court. 13. GROUNDS FOR REFUSAL (a) WISHALIVE may legitimately refuse to grant access to a requested record that falls within one or more of the following grounds: (i) the mandatory protection of the privacy of a third party who is a natural person, a deceased person or a juristic person, as provided in terms of section 63 of POPIA, which would involve the unreasonable disclosure of personal information of that natural, a deceased person or juristic person; (ii) the mandatory protection of commercial information that WISHALIVE holds about a third party or itself including, but not limited to trade secrets, financial, commercial, scientific or technical information that may harm the commercial or financial interests of WISHALIVE or the third party; (iii) if disclosure of the record would result in a breach of a duty of confidence owed to a third party in terms of an agreement; (iv) if disclosure of the record would endanger the life or physical safety of an individual; (v) if disclosure of the record would prejudice or impair the security of a building or structure; (vi) system, including, but not limited to, a computer or communication system, a means of transport or property; (vii) methods, systems, plans or procedures for the protection of an individual in accordance with a witness protection scheme; the safety of the public, or any part of the public; or the security of property contemplated in subparagraphs 13(a)(v) and (vi); or (viii) disclosure of the record would put AWS at a disadvantage in contractual or other negotiations or prejudice it in commercial competition. 14. PROTECTION OF PERSONAL INFORMATION PROCESSED BY WISHALIVE (a) Chapter 3 of POPIA provides for the minimum Conditions for Lawful Processing of personal information by a Responsible Party. These conditions may not be derogated from unless specific exclusions apply under POPIA. (b) In the event that WISHALIVE is a Responsible Party for the purposes of POPIA, WISHALIVE will ensure that the personal information of a Data Subject: [10] (i) is processed lawfully, fairly and transparently. This includes the provision of appropriate information to Data Subjects when their data is collected by AWS, in the form of privacy or data collection notices. WISHALIVE must also have a legal basis (for example, consent) to process personal information; (ii) is processed only for the purposes for which it was collected; (iii) will not be processed for a secondary purpose unless that processing is compatible with the original purpose; (iv) is adequate, relevant and not excessive for the purposes for which it was collected; (v) is accurate and kept up to date; (vi) will not be kept for longer than necessary; (vii) is processed in accordance with integrity and confidentiality principles; this includes physical and organisational measures to ensure that personal information, in both physical and electronic form, are subject to an appropriate level of security when stored, used and communicated by WISHALIVE, in order to protect against access and acquisition by unauthorised persons and accidental loss, destruction or damage; (viii) is processed in accordance with the rights afforded to Data Subjects, where applicable. (c) Data Subjects have the right to: (i) be notified that their personal information is being collected by WISHALIVE. The Data Subject also has the right to be notified in the event of a data breach; (ii) know whether WISHALIVE holds personal information about them, and to access that information. Any request for information must be handled in accordance with the provisions of this manual; (iii) request the correction or deletion of inaccurate, irrelevant, excessive, out of date, incomplete, misleading or unlawfully obtained personal information; (iv) object to WISHALIVE use of their personal information and request the deletion of such Personal Information (deletion would be subject to WISHALIVE record keeping requirements); (v) object to the processing of personal information for purposes of direct marketing by means of unsolicited electronic communications; and (vi) complain to the Information Regulator regarding an alleged infringement of any of the rights protected under POPIA and to institute civil proceedings regarding the alleged noncompliance with the protection of his, her or its personal information. [11] 15. PURPOSE OF PROCESSING PERSONAL INFORMATION (a) The purpose for which personal information is processed by WISHALIVE will depend on the nature of the information. In general, personal information is processed by WISHALIVE for conducting business, including: (i) To deliver products, services or information; (ii) To assist with matters relating to WISHALIVE products and services; (iii) To improve and better understand preferences in respect of WISHALIVE products and services; or (iv) To fulfil WISHALIVE regulatory obligations. (b) The above list is non-exhaustive. 16. CATEGORIES OF DATA SUBJECTS AND OF THE INFORMATION OR CATEGORIES OF INFORMATION RELATING THERETO The table below sets out the categories of data subjects and the description of the nature or categories of the personal information to be processed. Note that the nature or categories of the personal information is dependent on the purpose of WISHALIVE in performing its functions or services. Category of Records Types of Records 1 Customers Name, address, registration numbers or identity numbers, employment status and bank details 2. Service Providers Names, registration number, vat numbers, address, trade secrets and bank details 3 Employees Address, name, qualifications, gender and race 17. RECIPIENTS AND/OR CATEGORIES OF RECIPIENTS TO WHOM THE PERSONAL INFORMATION MAY BE SUPPLIED The table below sets out the category of personal information which may be disseminated and the recipient or category of recipients of the personal information. Category of personal information Recipients or Categories of Recipients to whom the personal information may be supplied [12] 1 Identity number and names, for criminal checks South African Police Services 2. Qualifications, for qualification verifications South African Qualifications Authority 3 Credit and payment history, for credit information Credit Bureaus 18. OBJECTION TO THE PROCESSING OF PERSONAL INFORMATION BY A DATA SUBJECT Section 11 (3) of POPIA and regulation 2 of the POPIA Regulations provides that a Data Subject may, at any time object to the Processing of his/her/its personal information in the prescribed form attached to this manual as Schedule 3 subject to exceptions contained in POPIA. 19. REQUEST FOR CORRECTION OR DELETION OF PERSONAL INFORMATION Section 24 of POPIA and regulation 3 of the POPIA Regulations provides that a Data Subject may request for their personal information to be corrected/deleted in the prescribed form attached as Schedule 4 to this manual. 20. CROSS-BORDER FLOWS OF PERSONAL INFORMATION (a) Section 72 of POPIA provides that personal information may only be transferred out of the Republic of South Africa if the: (i) recipient country can offer such data an “adequate level” of protection. This means that its data privacy laws must be substantially similar to the Conditions for Lawful Processing as contained in POPIA; or (ii) Data Subject consents to the transfer of their personal information; or (iii) transfer is necessary for the performance of a contractual obligation between the Data Subject and the Responsible Party; or (iv) transfer is necessary for the performance of a contractual obligation between the Responsible Party and a third party, in the interests of the Data Subject; or (v) the transfer is for the benefit of the Data Subject, and it is not reasonably practicable to obtain the consent of the Data Subject, and if it were, the Data Subject, would in all likelihood provide such consent. [13] 21. UPDATING OF THE MANUAL (a) The Information Officer of WISHALIVE.shop WISHALIVE Proprietary Limited will on a regular basis update this manual. (b) This PAIA Manual of WISHALIVE.shop WISHALIVE Proprietary Limited has been approved and signed by the Information Officer of the Private Body on 12 August 2023. Send all request to CustomerCare@WISHALIVE.co with "Request For Access To Record" in your subject line. Please make sure to attach to your Identification in the form of South African ID or International Travel Passport into your email as your Proof of identity. This identification must be attached by the requester to process your request. 2. If requests made on behalf of another person, proof of such authorisation, must be attached.