MyDrive

PAIA Manual

Admin Focus Underwriting Managers (Pty) Ltd

Prepared in terms of section 51 of the Promotion of Access to Information Act 2 of 2000

1. Acronyms

2. Purpose of this manual

PAIA gives everyone the right to request records held by a private body where the record is needed to exercise or protect a right. This manual explains:

• who to contact at AFUM
• what records we hold
• which records are available without a formal request
• how to request a record, what it may cost and how long it takes
• the grounds on which a request may be refused
• how we process personal information, as section 51 of PAIA (as amended by POPIA) requires

This manual covers AFUM as a whole, including every product we manage, such as MyDrive and FlexiFocus.

3. About AFUM

4. Contact details for access to information

Head of the private body and Information Officer

Stephanus J (Fanie) Vermaak, Director fanie@adminfocus.co.za 010 006 5266 Anglers Loft No 48, Peninsula on Vaal, Oranjeville, 1995

AFUM has not designated a deputy information officer. All requests go to the Information Officer.

5. The Regulator's PAIA Guide

The Information Regulator publishes a Guide on how to use PAIA, in every official language. It explains your rights under PAIA and POPIA and how to exercise them. You can get it:

• on the Regulator's website, inforegulator.org.za
• at the Regulator's office: JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001
• from our Information Officer, who will give you a copy on request

Information Regulator contact details:

• Toll free: 0800 017 160
• Telephone: 010 023 5200
• General enquiries: enquiries@inforegulator.org.za
• PAIA complaints: PAIAComplaints@inforegulator.org.za
• POPIA complaints: POPIAComplaints@inforegulator.org.za

6. Records available without a request

These records are available to anyone, without a PAIA request or fee:

• the information on our websites
• our Privacy Policy, Cookies page and Terms of Use
• our Complaints process
• our Conflict of Interest Management Policy
• our FAIS and insurer disclosures
• our Treating Customers Fairly statement
• product information and brochures
• this manual

Policyholders can get a copy of their own policy wording, schedule and quotation from their broker, in the MyDrive app, or from us, without a PAIA request.

7. Records held in terms of other legislation

We keep records as required by, among others, the following laws. Where one of these laws gives you access to a record, you may request it under that law.

• Basic Conditions of Employment Act 75 of 1997
• Companies Act 71 of 2008
• Compensation for Occupational Injuries and Diseases Act 130 of 1993
• Consumer Protection Act 68 of 2008
• Electronic Communications and Transactions Act 25 of 2002
• Employment Equity Act 55 of 1998
• Financial Advisory and Intermediary Services Act 37 of 2002
• Financial Intelligence Centre Act 38 of 2001
• Financial Sector Regulation Act 9 of 2017
• Income Tax Act 58 of 1962
• Insurance Act 18 of 2017
• Labour Relations Act 66 of 1995
• Occupational Health and Safety Act 85 of 1993
• Protection of Personal Information Act 4 of 2013
• Short-term Insurance Act 53 of 1998, including the Policyholder Protection Rules
• Skills Development Levies Act 9 of 1999
• Tax Administration Act 28 of 2011
• Unemployment Insurance Act 63 of 2001
• Value-Added Tax Act 89 of 1991

8. Subjects and categories of records we hold

Listing a record here does not mean it will be released. Every request is considered against the grounds for refusal in section 11.

9. Processing of personal information

9.1 Why we process personal information

• To give quotations and check that quotation requests are genuine
• To assess risk, underwrite and issue policies
• To confirm vehicle and other asset values
• To administer policies, including premiums, changes and renewals
• To assess and settle claims
• To handle complaints
• To appoint, manage and pay brokers, dealerships and service providers
• To employ and manage staff
• To comply with the law, including the FAIS Act, the Insurance Act, the Policyholder Protection Rules and FICA
• To detect and prevent fraud
• To communicate with clients, brokers and service providers

9.2 Categories of data subjects and their personal information

Special personal information, such as health information, is processed only where POPIA allows it, mainly under section 32, which lets insurers process health information to assess risk and handle claims.

9.3 Recipients of personal information

• The insurer of the relevant policy (Guardrisk Insurance Company Limited or Bryte Insurance Company Limited)
• The client's broker, and where relevant the dealership connected to that broker
• Vehicle valuation providers
• Assessors, repairers, towing, salvage and roadside assistance providers
• Payment service providers
• Industry claims and fraud-prevention databases, and the South African Police Service where a claim involves a crime
• Finance houses noted on a policy
• Regulators and authorities where the law requires it, including the FSCA, the Information Regulator, the Financial Intelligence Centre and SARS
• Our auditors, compliance officer and legal advisers
• Technology service providers that host and support our systems, under written confidentiality and security obligations

9.4 Cross-border transfers

Some of our technology service providers, including hosting, database, email and address lookup providers, process or store information outside South Africa. We only transfer personal information where the recipient is bound by law, binding corporate rules or a written agreement that gives protection comparable to POPIA, or where another basis in section 72 of POPIA applies.

9.5 Security measures

We protect personal information with technical and organisational measures appropriate to the risk, including:

• access restricted by role and need to know
• encryption of data in transit
• authentication controls on our systems
• activity logging on client, policy and claims records
• written confidentiality and security obligations for every service provider that processes personal information for us
• a process to notify the Information Regulator and affected people of a security compromise, as section 22 of POPIA requires

10. How to request a record

1. Complete Form 2 (Request for Access to Record) under the PAIA Regulations. It is available on the Regulator's website or from our Information Officer.
2. Describe the record in enough detail for us to identify it.
3. State the right you want to exercise or protect, and explain why you need the record for that purpose. PAIA requires this for requests to a private body.
4. Say how you want access, for example an electronic copy or an inspection at our office.
5. Send the form to our Information Officer by email or post, or deliver it to our office, with a copy of your ID. If you are asking on someone else's behalf, include proof of your authority.

If you only want to see the personal information we hold about you, you do not need Form 2. Email our Information Officer and we will handle it under POPIA.

Timeframes

We decide on a request within 30 days of receiving it. We may extend this once, by up to 30 more days, in the circumstances set out in section 57 of PAIA, for example where a large number of records must be searched. We will tell you in writing if we extend. If we do not respond within the time allowed, the request is regarded as refused.

If the record contains information about a third party, we must notify them and give them 21 days to make representations before we decide. This can affect the timeline.

Fees

• Request fee. A request fee applies unless you are asking for your own personal information. It must be paid before we process the request.
• Access fee. If your request is granted, an access fee may apply for searching for, preparing and reproducing the record.
• Deposit. If the search and preparation will take longer than the period prescribed in the PAIA Regulations, we may ask for a deposit of up to one third of the access fee before we start.

All fees are those prescribed in the PAIA Regulations. We will tell you the amount before any fee is charged. If your request is refused, any deposit is refunded.

Our decision

We will tell you in writing whether access is granted. If it is, we tell you the access fee and the form of access. If it is refused, we give our reasons and explain how to challenge the decision.

11. Grounds for refusal

PAIA requires or allows a private body to refuse access in certain circumstances, including where a record:

• contains personal information about a third party, and disclosure would be unreasonable (section 63)
• contains a third party's trade secrets or confidential commercial, financial or technical information (section 64)
• would breach a duty of confidence owed to a third party (section 65)
• could endanger someone's life or physical safety, or the security of property (section 66)
• is privileged from production in legal proceedings (section 67)
• contains AFUM's own trade secrets or confidential commercial, financial or technical information, including our rating information (section 68)
• contains research information of AFUM or a third party (section 69)

We must still disclose a record if its disclosure would reveal a serious breach of the law or an imminent and serious risk to public safety or the environment, and the public interest clearly outweighs the harm (section 70).

Where only part of a record may be refused, we release the rest.

12. Remedies if you are unhappy

AFUM is a private body, so there is no internal appeal. If your request is refused, or you are unhappy with the fee, the form of access or an extension, you may, within 180 days of our decision:

• complain to the Information Regulator (Form 5, sent to PAIAComplaints@inforegulator.org.za), or
• apply to a court for relief.

13. Availability of this manual

This manual is available:

• on mydrive.direct/paia and on adminfocus.co.za
• at our office, for inspection during business hours, at no charge
• from our Information Officer, by email, at no charge

A printed copy may attract the prescribed reproduction fee.

14. Updates

We review this manual regularly and update it whenever our business, our records or the law changes materially.

Stephanus J (Fanie) Vermaak Director and Information Officer Admin Focus Underwriting Managers (Pty) Ltd