HENRY AI PAIA MANUAL

Prepared under section 51 of the Promotion of Access to Information Act 2 of 2000, as amended

Standard and Enterprise arrangements: The standard position described in this document applies unless a signed Enterprise Annex expressly varies an eligible, identified contractual matter. Where legally and operationally available, any enhanced or non-standard scope, service level, support, infrastructure, assurance, reporting, implementation or other commitment must be separately requested, assessed, approved and priced under the Enterprise Agreement. An Enterprise Annex cannot alter rights or obligations under PAIA, POPIA or other mandatory law.

Contents

1. Purpose and scope
2. Key terms
3. Henry and its contact details
4. The Information Regulator's PAIA Guide
5. Records available without a PAIA request
6. Records kept under other legislation
7. Subjects and categories of records held by Henry
8. Personal information processed by Henry
9. How to request access to a record
10. Fees
11. How Henry will decide a request
12. Refusal, partial access and third-party information
13. Complaints and court proceedings
14. Availability and maintenance of this Manual
15. Approval
16. Official resources

1. Purpose and scope

1.1 Why this Manual exists

The Constitution protects access to information held by another person when that information is needed to exercise or protect a right. The Promotion of Access to Information Act 2 of 2000 (PAIA) gives practical effect to that right.

This Manual helps a requester to:

• identify Henry AI (Pty) Ltd (Henry) and its Information Officer;
• understand the main subjects on which Henry keeps records;
• find information that is already publicly available;
• understand Henry's processing of personal information;
• submit a valid request for a record held or controlled by Henry; and
• understand the fees, timeframes, possible outcomes and remedies that apply.

1.2 When PAIA applies

A person requesting a record from a private body must ordinarily show that the record is reasonably required to exercise or protect an identified right, follow PAIA's procedural requirements and overcome any lawful ground for refusal.

PAIA concerns existing recorded information. It does not ordinarily require Henry to create a new record, answer a general questionnaire, provide legal advice, develop a report that does not exist or disclose information that is not in Henry's possession or under its control.

1.3 Relationship with Henry's privacy documents

This Manual should be read with Henry's Privacy Policy, Henry Consumer Privacy Notice, Operator Agreement, Suboperator List, Cookies Policy, supporting security, retention and transfer schedules, applicable Product and Processing Schedules and other published legal documents.

The Privacy Policy explains how personal information is handled in day-to-day operations. This Manual explains how to seek access to an existing record under PAIA. A privacy request may also engage rights under the Protection of Personal Information Act 4 of 2013 (POPIA), including access to or correction of personal information.

1.4 Records processed for Tenants

Henry's legal role depends on the relevant activity. Henry may act as:

• an Operator when it processes information for purposes determined by a customer or other tenant (Tenant);
• a Responsible Party for information Henry sources or controls as a lead provider (Henry Lead Data);
• a Responsible Party for matters such as account administration, authentication, billing, security, fraud prevention, legal compliance, service-usage records and ordinary business operations; or
• an independent or joint Responsible Party where Henry determines a workflow's purpose or essential means.

A PAIA request must still be sent to Henry if the requested record is held or controlled by Henry. Where a record is processed for a Tenant, Henry may need to consult the Tenant, consider confidentiality and third-party rights, or direct the requester to the responsible entity where appropriate.

2. Key terms

In this Manual:

• Data Subject means the person or juristic person to whom personal information relates, as recognised by POPIA.
• Information Officer means the person responsible for Henry's PAIA and POPIA functions.
• Manual means this PAIA Manual and any later approved revision.
• Personal Information has the meaning given in POPIA.
• Personal Requester means a requester seeking access to a record containing personal information about that requester.
• Record includes recorded information in any form that is held or controlled by Henry, whether or not Henry created it.
• Regulator means the Information Regulator of South Africa.
• Requester means a person making a request under PAIA, personally or through an authorised representative.

Terms defined in Henry's Privacy Policy or Terms of Service carry the same meaning where used in the same context.

3. Henry and its contact details

3.1 Private-body details

3.2 Information Officer

This version does not list a Deputy Information Officer. Henry intends to hire an Operations and Security Manager, who may be designated and registered as Deputy Information Officer only after appointment and completion of the required statutory process. Until an approved revision records that designation, all requests and enquiries must be addressed to the Information Officer. The signed approval pack must include the Information Regulator registration record and any separately required authority record.

4. The Information Regulator's PAIA Guide

The Regulator publishes a practical Guide explaining PAIA and related POPIA access rights. It covers, among other matters, how requests work, the assistance available, prescribed forms and fees, complaints, court remedies and the contact details of information officers.

The Guide is available in South Africa's official languages and in accessible formats made available by the Regulator. It may be obtained:

• from the Regulator's PAIA information page;
• by requesting assistance from the Regulator; or
• by asking Henry's Information Officer for reasonable help locating the Guide.

Before this Manual is published as approved, Henry will maintain inspectable copies of the Guide in English at its principal office during the inspection hours in Section 3.1. A requester may ask for another available official-language or accessible version, and Henry will assist the requester to obtain it from the Regulator. Henry will obtain South African legal confirmation on the language versions in which this private-body Manual itself must be made available and record that decision in the approval pack.

The Regulator's current general contact details are:

Contact details may change. Requesters should confirm them on the Regulator's website before submitting a complaint.

5. Records available without a PAIA request

The following records may be accessed without submitting Form 2, subject to website availability, document status and any stated conditions:

Making a record publicly available does not make related working papers, source material, security information, customer information, internal correspondence or confidential records publicly accessible. Henry may remove obsolete publications or replace them with updated versions.

Unless Henry publishes a notice under section 52 of PAIA, the table above records Henry's practical publication arrangements and should not be read as a formal section 52 notice.

6. Records kept under other legislation

Henry may create, receive or retain records under the legislation below, where that legislation applies to Henry, its personnel, a particular service or a particular transaction. Inclusion in this list does not mean that every record is disclosable under PAIA.

Sector-specific laws may also apply to a Tenant, lender, dealer, credit bureau, transaction participant or configured workflow. The presence of sector-related information in Henry's systems does not necessarily mean that Henry performs the regulated function or is the entity responsible for the corresponding statutory record.

7. Subjects and categories of records held by Henry

Henry may hold the following categories of records. The list is intended to help a requester identify records and is not an assurance that a particular record exists or will be disclosed.

Some categories contain confidential information, trade secrets, legally privileged material, security-sensitive information or personal information belonging to another person. Such information will be assessed under PAIA's refusal and third-party-notification provisions.

Henry operates primarily through electronic systems. A record may therefore be held in an application, connected source, cloud platform, encrypted backup, provider environment or archived business system rather than at Henry's physical address. A record remains within the scope of a request only where it is in Henry's possession or under Henry's control as understood under PAIA.

8. Personal information processed by Henry

8.1 Purposes of processing

Depending on Henry's role and the selected service or workflow, Henry may process personal information to:

• verify identity, authority and eligibility to use a service;
• administer accounts, access, authentication, subscriptions, contracts, billing and support;
• connect authorised sources and receive, store, extract, transcribe, classify, redact, validate, enrich, link or deduplicate records;
• create structured records, digital twins, reports, dashboards, analytics, matches, scores, recommendations and decision-support outputs;
• source, qualify, match and route leads, applicants, vehicles, dealers, lenders and other authorised participants;
• manage consent, communications, applications, bids, referrals, transactions, outcomes and fees;
• operate AI-assisted, document, workflow, integration and automation features;
• secure the service, segregate Tenants, detect abuse or fraud, monitor performance, investigate incidents and preserve evidence;
• meet legal, regulatory, accounting, tax, insurance and dispute-management duties; and
• improve the service, develop reusable features and create or use lawfully de-identified information.

Henry's standard service is not intended to make a solely automated decision that has a legal or similarly significant effect without a lawful basis, appropriate safeguards, meaningful human involvement and an opportunity for the affected person to make representations where required.

8.2 Categories of Data Subjects and information

Henry does not intend to collect payment-card security codes. Children or special personal information may be processed only through an approved, lawful workflow with any additional notice, authority and safeguards that are required.

8.3 Recipients

Personal information may be supplied, where lawful and necessary, to:

• the relevant Tenant and authorised Users;
• authorised lenders, banks, dealers, vehicle providers, referral partners and transaction participants;
• identity, validation, valuation, bureau, bank-statement and other authorised data providers;
• cloud-hosting, database, storage, AI, analytics, integration, messaging, support and security providers;
• payment providers, banks and ordinary business suppliers;
• professional advisers, auditors, insurers, financiers and confidential transaction counterparties;
• regulators, courts, law-enforcement bodies and other persons entitled to receive it by law; and
• a person instructed or authorised by the applicable Responsible Party or Data Subject.

For clarity, a Suboperator processes only for Henry's delegated Operator purpose under written duties; an independent Responsible Party such as a lender, dealer, insurer or product provider determines its own underwriting, contracting, legal or fulfilment purpose; a regulator, court or law-enforcement body receives information under lawful authority; and an ordinary professional or business recipient receives only the minimum information for advice, payment, insurance or another stated purpose. A recipient's appearance in a workflow does not make it a Suboperator. The current provider list and role-specific purposes are described in Henry's Suboperator List and International Transfer and Recipient Register.

8.4 Cross-border processing

Henry uses cloud and technology providers whose principal or supporting processing locations may include South Africa, the United States, India, a Tenant-selected Microsoft or Google region, and other enabled or provider-support regions. Information transferred may include account data, Tenant Data, documents, prompts and outputs, business contacts, support records, integration metadata, tokens, logs, security information and operational records.

For transfers controlled by Henry, Henry applies measures intended to satisfy section 72 of POPIA, which may include contractual protection, an assessment of applicable foreign law, binding rules, consent, contractual necessity or another lawful transfer ground. A Tenant remains responsible for transfers it independently directs through its own sources, recipients and configuration.

The standard service does not promise country-exclusive data residency unless Henry agrees to that arrangement in writing.

8.5 Security safeguards

Henry uses risk-based safeguards designed to protect the confidentiality, integrity and availability of information. Depending on the system and risk, these measures may include:

• governance, policies, confidentiality duties and security awareness;
• role-based and privileged-access controls, least privilege and available multi-factor authentication;
• protected credentials and secrets management;
• cryptographic protection for network transmission and stored data where the relevant system supports it;
• separation between Tenant environments at the logical-access layer;
• controlled system changes, weakness management, event records, monitoring and incident handling;
• access provisioning, periodic review and prompt withdrawal when a person's role or relationship changes;
• proportionate device, premises and physical-record protections where relevant;
• backup, continuity and recovery arrangements;
• supplier review and contractual safeguards; and
• investigation, containment, remediation and notification procedures.

Controls may evolve as Henry's systems, providers and risks change. No internet or cloud service is completely secure, and this summary does not promise a specific algorithm, test interval, patch deadline, certification or customer-managed key.

8.6 Retention and deletion

Henry applies the record-class periods in its Retention, Deletion and De-identification Schedule. For Tenant Data, the standard post-termination lifecycle is a 90-day limited-function export period followed by deletion from active production systems and protected backups within an additional 90 days. Different periods apply to account, integration, log, transaction, consent, support, security, finance, suppression and PAIA records. A legal hold or minimum security, finance or proof requirement may suspend ordinary deletion only for the affected record and purpose.

Additional information appears in the Privacy Policy.

9. How to request access to a record

9.1 Before submitting a PAIA request

One-page request guide

Henry will provide reasonable assistance to complete or correct a request and will not refuse it solely for a remediable form defect without first offering that assistance.

A requester should first check whether the record is already publicly available or can be provided through an ordinary account, support, contractual or privacy-request channel.

After suitable identity and authority checks, Henry may provide routine records through a simpler operational channel where lawful and technically available. Examples may include:

• the requester's account and profile details;
• recorded communication, consent and preference information relating to the requester;
• standard support correspondence involving the requester;
• an available account or service export; and
• a transaction status or record concerning a transaction to which the requester is a party, after protecting another person's information.

Using a simpler channel does not reduce a person's PAIA or POPIA rights. Henry may require Form 2 where the scope, legal basis, identity, authority, confidentiality or third-party impact needs a formal assessment.

For a PAIA request to a private body, the requester must identify the right to be exercised or protected and explain why the requested record is reasonably required for that purpose. A broad statement that the information may be useful is unlikely to be sufficient.

9.2 Form and delivery

Use the Regulator's prescribed Form 2: Request for Access to Record. The current form is available from the Regulator's PAIA page.

Send the completed and signed form to:

The Information Officer
Henry AI (Pty) Ltd
Email: legal@henryai.co.za
Address: Great Westerford, 240-221, M4, Rondebosch, Cape Town, 7700, South Africa
Suggested subject: PAIA request — [requester's name]

Electronic submission is preferred. Postal delivery may use the same address. Henry has no fax line. A requester who needs reasonable assistance may contact the Information Officer.

If disability, literacy, language or another practical barrier prevents a person from completing the form, the Information Officer will provide reasonable assistance appropriate to the circumstances. Henry may record an assisted request in writing and ask the requester to confirm that the recorded details are correct.

9.3 Information to include

The request should:

• give enough detail to identify the requester and the specific record or records;
• state whether the request is made personally or for someone else;
• include proof of identity and, where relevant, authority to act for another person;
• identify the right to be exercised or protected;
• explain the connection between that right and the requested record;
• state the preferred form of access;
• provide contact details and the preferred method for receiving the decision; and
• identify any claimed fee exemption or accessibility need.

To reduce identity fraud, Henry may request proportionate verification. Requesters should not email unnecessary identity documents or authentication secrets. Henry may offer a more secure submission method where appropriate.

9.4 Requests concerning personal information

A person seeking their own personal information may use Form 2 or make an appropriate request under POPIA. Henry must process a PAIA request for a record that Henry holds or controls even where Henry acts as Operator. Henry may consult the relevant Tenant, coordinate a POPIA response, protect third-party rights or explain the Responsible Party's separate process, but it will not treat Operator status alone as a ground to refuse or disregard a PAIA request.

9.5 Requests made for another person

An authorised representative must provide adequate evidence of authority. For a company, trust, estate, minor or person under a legal disability, Henry may request the corporate resolution, mandate, power of attorney, appointment document or other evidence reasonably needed to verify capacity.

9.6 POPIA objections, corrections and deletion requests

The PAIA and POPIA forms use overlapping numbers and should not be confused:

• PAIA Form 2 is used to request access to a record.
• POPIA Form 1 is used when a Data Subject objects to processing on a ground recognised by POPIA.
• POPIA Form 2 is used to ask for correction or deletion of personal information, or destruction or deletion of a record, in the circumstances allowed by POPIA.
• POPIA Form 5 is used for a complaint to the Regulator concerning alleged interference with the protection of personal information.

The current POPIA forms are available from the Regulator's POPIA forms page. A completed form concerning Henry-controlled processing may be sent to legal@henryai.co.za. Where Henry acts only as an Operator, Henry may coordinate the request with or refer it to the relevant Responsible Party.

Henry accepts a prescribed form or a reasonable electronic equivalent containing the necessary information where law permits. Henry will acknowledge a privacy or rights request within five Business Days, verify identity proportionately and help correct a material deficiency before refusing solely for form. This acknowledgement does not extend a statutory period.

An objection, correction or deletion request is not automatically granted. Henry will consider identity, authority, accuracy, lawfulness, Henry's role, the applicable processing ground, another person's rights and any lawful retention requirement. Henry may restrict processing while a material accuracy dispute is being resolved where appropriate and reasonably practicable.

9.7 Transaction-participant records and suspected misconduct

A buyer, seller, applicant, dealer, lender, referral partner or other transaction participant is entitled to request records concerning their own participation. That status does not create an automatic right to another participant's identity, contact details, financial information, communications or confidential records.

A requester seeking another participant's information must use the appropriate formal route, identify the right at issue and explain why the specific record is required. Henry may notify the affected person, redact protected information or offer a less intrusive response, such as forwarding a communication, confirming a transaction event or supplying a limited record that addresses the stated need.

Suspected fraud, illegality, non-performance or inability to contact another participant may be reported to legal@henryai.co.za with supporting details. Henry may preserve relevant evidence, investigate within its role, notify the appropriate Tenant or participant, or cooperate with an authorised regulator or law-enforcement body. Making such a report does not by itself entitle the reporting person to another person's protected information.

10. Fees

10.1 General rules

For a request to this private body, the prescribed R140 request fee is payable by every requester, including a Personal Requester, unless PAIA, the Regulations or another applicable exemption provides otherwise. Henry will not demand the fee without first issuing the prescribed written fee notice and confirming whether an exemption applies. The request fee is distinct from any access, reproduction, search, preparation, media or delivery fee that becomes payable if access is granted.

If access is granted, the requester may also have to pay prescribed reproduction, search, preparation, media, delivery or transfer costs. Henry may withhold access until the applicable fee has been paid. Where the prescribed search threshold is expected to be exceeded, Henry may require the permitted deposit after giving the calculation in the fee notice. A deposit must be refunded if the request is ultimately refused.

10.2 Current prescribed amounts

The following amounts reflect Annexure B to the PAIA Regulations, 2021 and the Information Regulator's current PAIA Fee Structure and Exemptions as at the last revision date. If the Regulations or official fee schedule are amended, the legally prescribed amount then in force will apply.

Henry will issue a fee notice where payment is required and will provide payment instructions separately. VAT may be added only where lawfully chargeable.

Henry will use the prescribed Form 3: Outcome of Request and of Fees Payable to communicate the outcome and applicable request fee, deposit, access fee, reproduction, search, preparation and delivery mechanics. A requester may ask Henry or the Regulator to confirm the current fee schedule before payment; the current legally prescribed amount prevails over an outdated amount in this Manual.

11. How Henry will decide a request

11.1 Assessment

Henry will consider whether:

• the requested record exists and is held or controlled by Henry;
• the request complies with PAIA;
• the record is required for the exercise or protection of the identified right;
• a request fee, access fee or deposit is payable;
• another person must be notified or consulted;
• a mandatory or discretionary ground for refusal applies; and
• protected parts can be separated so that the balance may be released.

11.2 Timeframe

Henry will ordinarily notify the requester of its decision within 30 days after receiving a compliant request, subject to PAIA. The period may be extended once, by no more than a further 30 days, in the circumstances permitted by PAIA. If Henry extends the period, it will give notice and reasons.

A failure to decide within the applicable statutory period is treated as a refusal for PAIA purposes.

11.3 Outcome

Henry will use prescribed Form 3 for the outcome and any fee payable. If access is granted, Henry will state the form of access, deposit or access fee, reproduction/search/preparation calculation, delivery method and payment instructions. Access may take the form of inspection, a copy, an electronic record, a transcription or another form allowed by PAIA and reasonably available.

If access is refused in whole or in part, Henry will provide adequate reasons without revealing the protected content and will explain the available remedy.

12. Refusal, partial access and third-party information

PAIA requires or permits refusal in defined circumstances. Depending on the record, these may concern:

• unreasonable disclosure of another person's personal information;
• confidential information supplied by another person;
• another person's commercial, financial, scientific, technical or trade-secret information;
• Henry's commercial information, trade secrets, software, methods, research or other protected intellectual property;
• privileged legal communications or material prepared for legal proceedings;
• safety, security, crime prevention or the protection of systems, infrastructure or persons;
• records whose disclosure would breach a legal duty of confidence;
• research information where disclosure would expose the research or a researcher to serious disadvantage;
• a record requested for civil or criminal proceedings where section 7 of PAIA applies; or
• a request that otherwise falls outside the right of access created by section 50 of PAIA.

Where only part of a record is protected and the balance can reasonably be separated, Henry will consider granting access to the remaining part. PAIA's public-interest override will be applied where its statutory requirements are met.

Where a request affects a third party, Henry may notify that person and consider their representations before deciding. Notice to or consultation with a third party does not give that person an absolute veto; Henry must apply PAIA.

Henry will keep an administrative record of a formal request, material correspondence, identity and authority checks, fee notices, third-party notices, the decision and the access provided or refused. These records support consistent decision-making, regulatory reporting and proof of compliance and will themselves be protected and retained according to applicable law and Henry's retention criteria.

13. Complaints and court proceedings

There is no internal appeal against a decision of the head of a private body.

A requester or affected third party may submit a written complaint to the Regulator using Form 5 within 180 days of the relevant decision, subject to the Regulator's power to condone late submission. The requester should ordinarily give Henry an opportunity to respond first and should attach the request, Henry's response and relevant correspondence.

Complaints may be sent to PAIAComplaints@inforegulator.org.za or submitted through a channel made available by the Regulator. The current form and instructions appear on the Regulator's PAIA page and Form 5 page.

After the applicable complaint procedure has been exhausted, a requester or third party may apply to a court with jurisdiction for appropriate relief. PAIA generally provides a 180-day period for the court application, subject to the court's power to condone non-compliance where the interests of justice require it. A person considering litigation should obtain independent legal advice.

14. Availability and maintenance of this Manual

14.1 Availability

Once signed, approved and published, the current Manual will be available:

• through the legal-document section of Henry's website, clearly labelled Henry AI PAIA Manual;
• for inspection at Henry's principal address during ordinary business hours, by prior arrangement;
• by request to legal@henryai.co.za; and
• to the Information Regulator upon request.

Electronic copies will ordinarily be supplied without charge. A physical copy may attract the reproduction fee permitted by the Regulations.

14.2 Review and updates

The Information Officer will review this Manual at least annually and when material changes occur to Henry's contact details, record categories, processing activities, providers, security arrangements or applicable law. The version and dates at the start of the Manual must be updated whenever a revised edition is approved.

14.3 Internal request procedure and governance

Before publication, Henry must maintain a secure PAIA/POPIA case process using controlled Zoho Forms for intake where appropriate, automated or manual email receipts, and a restricted Zoho Sheet as the authoritative case register. The procedure must cover identity and authority verification, preservation, searches across Henry-controlled and provider systems, Tenant consultation, third-party notice, severability and redaction, fee and Form 3 notices, decision approval, secure delivery, complaints, legal holds and closure. The register must record the request, dates, owner, statutory deadline, extension, fees, affected third parties, decision, access supplied, complaint or court outcome, evidence links and retention class. Access and change history must be restricted and reviewable; ordinary email is not the authoritative case record.

Ian Fourie, as Henry's registered Information Officer, coordinates the annual section 83(4) reporting calendar and evidence pack and obtains qualified external legal review where the filing position or authority is uncertain. Henry will archive each approved Manual version, signature and authority record, Guide-language evidence, request forms, SOP test result and annual submission confirmation. A sample request must be tested before publication and at least annually thereafter.

15. Approval

This Manual takes effect when signed by Henry's statutory Head of Private Body or a person with documented lawful authority to approve it, and published as Henry's current PAIA Manual.

16. Official resources

• Promotion of Access to Information Act 2 of 2000
• Information Regulator: PAIA resources, Guide and forms
• Information Regulator: private-body PAIA Manual template
• Information Regulator contact information
• Information Regulator: POPIA forms
• Information Regulator: PAIA Fee Structure and Exemptions
• Information Regulator: PAIA annual reporting
• PAIA Regulations, 2021

END OF HENRY AI PAIA MANUAL