PAIA & POPIA Manual

This manual is published in terms of section 51 of the Promotion of Access to Information Act 2 of 2000 ("PAIA") and the Protection of Personal Information Act 4 of 2013 ("POPIA"). It explains what records KasiRoots holds, how to request access to them, and how we process personal information.

• Registered name: K2026341542 (South Africa) (Pty) Ltd
• Trading name: KasiRoots
• Registration number: 2026/341542/07
• Company type: Private company
• Director: Thabo Monamodi
• Registered office and postal address: 994 Proper Section, Rethabiseng, Bronkhorstspruit, Gauteng, 1026
• Telephone: 083 588 7290
• Website: https://kasiroots.co.za

Requests for access to records and queries about personal information must be sent to our Information Officer:

• Name: Thabo Vusi Monamodi
• Email: thabo@kasiroots.co.za or legal@kasiroots.co.za
• Telephone: 083 588 7290
• Postal address: 994 Proper Section, Rethabiseng, Bronkhorstspruit, Gauteng, 1026

The Information Regulator has published a guide in each official language on how to use PAIA and POPIA. It is available from the Information Regulator's website at inforegulator.org.za or by email at enquiries@inforegulator.org.za.

The following are freely available on our website and do not require a PAIA request:

• Our Terms of Service, Privacy Policy, Cookie Policy, Refund Policy, Dispute Resolution Policy and Prohibited Items Policy.
• Information about how payments, fees and payouts work.
• This manual.

We keep records as required by the following laws, where they apply to us:

• Companies Act 71 of 2008
• Income Tax Act 58 of 1962 and Tax Administration Act 28 of 2011
• Value-Added Tax Act 89 of 1991
• Consumer Protection Act 68 of 2008
• Electronic Communications and Transactions Act 25 of 2002
• Protection of Personal Information Act 4 of 2013
• Promotion of Access to Information Act 2 of 2000
• Basic Conditions of Employment Act 75 of 1997, Labour Relations Act 66 of 1995 and Unemployment Insurance Act 63 of 2001

• Company records: incorporation documents, Memorandum of Incorporation, registers and resolutions.
• Financial and tax records: accounting records, bank statements, invoices, tax returns.
• User accounts: names, email addresses, contact details and account settings of buyers and sellers.
• Seller records: store details, banking details, identity documents and verification outcomes.
• Transaction records: orders, payments, refunds, commissions and payouts.
• Delivery records: delivery addresses, chosen couriers and tracking numbers.
• Communications: messages between buyers and sellers, disputes, support requests and emails.
• Technical records: security logs and system records.
• Supplier and contract records: agreements with service providers.

1. Complete the prescribed request form (Form 2 of the PAIA Regulations, 2021), available from the Information Regulator's website.
2. Send it to the Information Officer at the email or postal address above.
3. Give enough detail to identify the record and yourself, say how you want access (for example, an electronic copy), and if you are acting for someone else, include proof of your authority.
4. Pay any request and access fees prescribed in the PAIA Regulations. We will tell you if a fee or deposit applies before we process your request.

We will respond within 30 days of receiving a complete request. We may extend this once by up to 30 days where the law allows, and we will tell you if we do.

To access or correct your own personal information, you can also simply email the Information Officer. No form or fee is needed for that.

Access may be refused on the grounds set out in Chapter 4 of Part 3 of PAIA, including to protect the privacy of third parties, commercial information of third parties or of KasiRoots, confidential information, the safety of individuals or property, records privileged from production in legal proceedings, and research information.

If your request is refused, or you are unhappy with how it was handled, you may lodge a complaint with the Information Regulator within 180 days, or apply to a court for relief.

Purpose. We process personal information to run the marketplace: creating accounts, verifying sellers, processing orders and payments, arranging delivery, paying out sellers, resolving disputes, providing support, preventing fraud and meeting our legal obligations.

Data subjects and categories of information.

• Buyers: name, email address, phone number, delivery address, order history and messages.
• Sellers: name, contact details, store details, identity documents, banking details, sales and payout records.
• People who contact us: name, email address and the content of their message.
• Service providers: company and contact details, and banking details for payment.

Recipients. We share personal information only as needed to provide the service: with the seller or buyer in an order, payment providers (PayFast and Paystack), couriers chosen at checkout, and our technology providers for hosting, databases, image storage and email delivery. We may also disclose information where the law requires it.

Cross-border transfers. Some of our technology providers store data on servers outside South Africa. We only use providers that are subject to laws, binding rules or agreements that give an adequate level of protection, as required by section 72 of POPIA.

Security. We protect personal information with encrypted connections, hashed passwords, access controls limited to authorised staff, rate limiting and monitoring of our systems. Card details are entered directly with our payment providers and are never stored by KasiRoots.

More detail is in our Privacy Policy.

This manual is available on our website and, on request, at our registered office.