PAIA and POPIA Manual.

1. Particulars of the private body

The Dream Merchant Group (Pty) Ltd is a private company incorporated in the Republic of South Africa on 22 July 2014 under registration number 2014/140602/07, registered in Pretoria. It is a holding company. It does not trade directly with the public and does not sell goods or services from this website.

Private body

The Dream Merchant Group (Pty) Ltd

Registration number

2014/140602/07

Date of incorporation

22 July 2014

Place of registration

Pretoria, Republic of South Africa

Head of the private body

Cybil Rockefeller Naidoo, Chief Executive Officer

Information Officer

Cybil Rockefeller Naidoo

Deputy Information Officer

None designated. See paragraph 11.

Telephone

+27 12 942 1000

Email

hello@dreammerchants.co.za

Website

www.dreammerchants.co.za

1.1 Which entity a request should go to

Records relating to individual customers, bookings, memberships, vacation ownership and travel arrangements are held by the trading entities within the group, not by the holding company. Where a request concerns such a record, the Information Officer will say so and direct the request to the correct entity, together with that entity's contact details, rather than refusing it on a technicality.

6. Processing of personal information

This paragraph is given in terms of section 51(1)(c) of PAIA, as inserted by the Protection of Personal Information Act 4 of 2013, read with section 17 of that Act. It describes the group's processing operations at holding-company level. Processing carried out by the trading entities within the group is described in their own manuals and privacy notices.

6.1 The purpose of the processing

• Administering the company: governance, statutory filings, board and shareholder administration.
• Financial administration, accounting, audit and tax compliance.
• Contract management with suppliers, service providers and counterparties.
• Corporate correspondence: answering enquiries received by telephone or email and, where the enquiry is commercial, referring it to the correct trading entity.
• Operating and securing this website, diagnosing faults and protecting against attack and abuse.
• Complying with a legal obligation, exercising or defending a legal right, and responding to a lawful request from a court or a regulator.

6.2 Categories of data subjects and of the information held about them

The group collects no personal information from you through this website. It has no enquiry form, no newsletter sign-up, no account creation and no payment function, and no field in which you could supply anything. The only personal information that arises is the server-log data in the last row of the table above, which a web server generates automatically in the course of serving a page. Where an IP address can identify a person it is treated as personal information and handled accordingly.

The group does not, at holding-company level, process the special personal information described in section 26 of POPIA or the personal information of children as contemplated in section 34.

6.3 Recipients or categories of recipients

• Entities within the group, where a shared corporate function requires it.
• Professional advisers: auditors, accountants, attorneys and tax practitioners, under a duty of confidentiality.
• Operators appointed in writing under section 21 of POPIA: banking, information technology, hosting and cloud service providers.
• Regulators and organs of state where the law requires disclosure, including the South African Revenue Service, the Companies and Intellectual Property Commission and the Information Regulator.
• A court, tribunal or law enforcement agency acting within its powers.

The group does not sell, rent or trade personal information. It does not supply personal information to advertising networks or data brokers, and it does not enrich its records from third-party data sources.

6.4 Planned transborder flows of personal information

This website is hosted in South Africa. Certain business systems, in particular email, productivity, backup and cloud infrastructure services, are provided by international providers and may process personal information on servers outside the Republic, including in the European Union and the United States.

Where personal information is transferred outside the Republic the group relies on section 72 of POPIA and satisfies itself that at least one of the following applies: the recipient is subject to a law, binding corporate rules or a binding agreement that upholds principles for the reasonable processing of the information substantially similar to those in POPIA and includes provisions substantially similar to section 72 on onward transfer; the data subject consents; the transfer is necessary for the performance of a contract with the data subject or for the conclusion or performance of a contract concluded in the data subject's interest; or the transfer is for the benefit of the data subject and consent could not reasonably be obtained but would probably be given.

No transfer is made for the purpose of marketing, profiling or sale.

6.5 Information security measures

This is a general description, given in terms of section 51(1)(c)(v), sufficient to allow a preliminary assessment of the suitability of the measures. It is deliberately not a specification, because publishing the detail of a control set would weaken it. It describes the standard the group applies, not a guarantee of any particular outcome.

• Transport. This website is served over an encrypted connection. Business email and cloud services are accessed over encrypted connections.
• Access. Access to systems holding personal information is restricted to those who need it for their role and is individually attributed. The group's standard is that business email and cloud accounts carry multi-factor authentication.
• Devices. Devices used to access group systems are password protected and kept current with security updates.
• Retention and disposal. Records are retained for the period required by the applicable statute or, where none applies, for as long as the purpose requires, and are then deleted or destroyed. Server logs are ordinarily retained for no longer than twelve months.
• Operators. The group's standard is that a third party processing personal information on its behalf does so under a written contract requiring it to establish and maintain the security measures in section 19 of POPIA, and to notify the group immediately where there are reasonable grounds to believe that personal information has been accessed or acquired by an unauthorised person, as section 21 requires.
• Backup and recovery. Business records are backed up, and backups are held separately from the primary systems.
• Compromise. Where there are reasonable grounds to believe that personal information has been accessed or acquired by an unauthorised person, the group notifies the Information Regulator and the affected data subjects as soon as reasonably possible, as section 22 of POPIA requires.
• Review. The measures are reviewed when systems change, and the group's practice is to review them at least annually, having regard to generally accepted information security practices.

No system is perfectly secure and the group does not claim otherwise. The description above states what is in place, not what is guaranteed.

8. How to make a request

Step 1. Decide what you are asking for

A request for a document held by the group is a PAIA request and uses PAIA Form 2. A concern about how your own personal information is being handled is a POPIA matter and uses POPIA Form 1 for an objection, or POPIA Form 2 for a correction or deletion. If you are not sure which applies, describe what you want in an email and the Information Officer will tell you which route fits.

Step 2. Complete the form properly

Give enough detail to identify the record. A description such as "the agreement between the group and my company dated in 2024" is workable. "All your documents" is not, and will be returned for particulars.

Section 50(1)(a) is the part people miss. A private body may only be compelled to release a record where the requester shows that the record is required for the exercise or protection of a right. Form 2 therefore requires you to identify the right you are exercising or protecting, and to explain why the record is required for it. A request that leaves that block blank cannot succeed, whatever the merits.

State how you would like to receive the record, and tell us if you need it in a particular form because of a disability, so that reasonable arrangements can be made.

Step 3. Prove who you are

Attach proof of identity. If you are acting for someone else, attach proof of your authority to act, such as a power of attorney or a company resolution. This protects the person whose information is being requested. No request is finalised without it.

Step 4. Send it

Email the completed form and attachments to hello@dreammerchants.co.za. If you would rather speak to someone first, telephone +27 12 942 1000. The group has no public office counter, so email is the reliable route. A request may also be posted to the postal address in paragraph 12.

Step 5. Fees

Set out in full in paragraph 9. You will be told in writing, on PAIA Form 3, what is payable before any work is done.

Step 6. The decision and the timeline

The Information Officer must decide on a request within 30 days of receiving it and must notify you of the decision in writing. That period may be extended once, by a further 30 days, where the request is for a large number of records or requires a search through records held elsewhere, in which case you will be told of the extension and the reason for it before the first 30 days expire.

If access is granted you will be told the access fee, the form in which access will be given, and that you may lodge a complaint about the fee or the form of access. If access is refused you will be given adequate reasons, the provision of the Act relied on, and a statement of the remedies available to you.

10. Grounds of refusal, and what to do about one

PAIA obliges a private body to refuse access in some circumstances and permits refusal in others. The grounds that can apply to this group are:

• Section 63. The unreasonable disclosure of personal information about a third party. This is a mandatory ground.
• Section 64. Commercial information of a third party: trade secrets, financial, commercial, scientific or technical information the disclosure of which would harm that third party, and information supplied in confidence in the course of negotiation.
• Section 65. Information supplied in confidence, where disclosure would be an actionable breach of a duty of confidence.
• Section 66. Information the disclosure of which could endanger the life or physical safety of a person, or prejudice the security of property or a means of transport.
• Section 67. Records privileged from production in legal proceedings.
• Section 68. Commercial information of the group itself, including trade secrets and information the disclosure of which would put the group at a disadvantage in negotiations or in commercial competition.
• Section 69. Records containing research information of the group or of a third party, where disclosure would expose the researcher or the subject matter to serious disadvantage.
• Section 70. The public interest override. Even where a ground of refusal applies, access must be granted if the record would reveal a substantial contravention of the law or an imminent and serious public safety or environmental risk, and the public interest in disclosure clearly outweighs the harm.

Where only part of a record is protected, the group grants access to the remainder rather than refusing the record as a whole.

If you are not satisfied

There is no internal appeal against a private body. Your remedies are:

• A complaint to the Information Regulator, on PAIA Form 5, within 180 days of the decision. The Regulator may investigate, attempt to settle the matter, or issue an enforcement notice. This step is compulsory.
• An application to court under section 78 of PAIA, but only once the complaints procedure in section 77A has been exhausted. Section 78 is peremptory: a requester who goes straight to court without first complaining to the Regulator will be non-suited.
• For a POPIA matter, a complaint to the Regulator under section 74 of POPIA, or civil proceedings for damages under section 99, which do not depend on proving intent or negligence.

Raising the matter with the Information Officer first is not a precondition to any of these. It is usually faster, and the group would rather correct an error itself than have a regulator correct it.

11. Availability and updating of this manual

This manual is published in terms of section 51(3) of PAIA. It is:

• available on this website, free of charge, at www.dreammerchants.co.za/paia.html;
• available by email to any person on request, free of charge, because the group has no public counter at which a record could be inspected;
• available as a paper copy on request, on payment of the amount prescribed by regulation 6; and
• available to the Information Regulator on request.

The manual is updated on a regular basis, as section 51(2) requires, and whenever the group's records, structure or processing operations change materially. The group's practice is to review it at least annually. It is available in English. Where a person requires it in another official language, the Information Officer will make arrangements on request.

Deputy Information Officer. Section 56 of POPIA requires a responsible party to designate such number of deputy information officers, if any, as is necessary. Given the size of the holding company, none has been designated. Should one be designated, this manual will be updated and the designation registered with the Regulator.