PAIA Manual

Wyvern Freight provides freight, courier, warehousing, customs and logistics services across Southern Africa.

The business is headquartered in Zimbabwe and supports freight movements involving South Africa and other regional markets.

Wyvern Freight’s South African operation forms part of this regional network and may hold records relating to customers, shipments, employees, vendors, carriers, customs activities, commercial agreements and other business activities conducted in or through South Africa.

South African legal entity / registered branch

[insert exact registered name]

Registration number

[insert]

Physical address

[insert South African address]

Postal address

[insert]

Telephone

[insert]

Website

www.wyvernfreight.com

General enquiries

info@wyvernfreight.com

This Manual is intended to help members of the public understand:

• what categories of records Wyvern Freight holds;
• which information may already be publicly available;
• how to request access to a record;
• who is responsible for PAIA requests;
• what categories of personal information Wyvern Freight processes in South Africa;
• the purposes for which that information may be processed;
• who information may be shared with;
• whether information may be transferred across borders; and
• the general measures used to safeguard information.

PAIA requests relating to Wyvern Freight’s South African operation must be directed to the designated Information Officer or an authorised Deputy Information Officer.

Information Officer

Name

[insert]

Position

[insert]

Email

[insert]

Telephone

[insert]

Physical address

[insert]

Deputy Information Officer, if appointed

Name

[insert]

Position

[insert]

Email

[insert]

The Information Regulator of South Africa publishes an official Guide explaining how PAIA works and how a person may exercise rights under PAIA and POPIA.

The Guide provides information about:

• requesting access to records;
• the prescribed request forms;
• fees that may apply;
• grounds on which access may be refused;
• complaints to the Information Regulator;
• court remedies; and
• the responsibilities of Information Officers.

The Guide and prescribed PAIA forms are available from the Information Regulator. The Regulator currently provides Form 2 — Request for Access to Record, Form 3 — Outcome of Request and Fees Payable, and Form 5 — Complaint Form.

A number of Wyvern Freight records may already be publicly available and may be accessed without making a formal PAIA request.

These may include:

• information published on www.wyvernfreight.com;
• company and contact information;
• descriptions of freight and logistics services;
• careers and vacancy information;
• public news and insights;
• Privacy & Data Protection notices;
• Code of Ethics;
• Modern Slavery Statement;
• Vulnerability Disclosure Policy;
• whistleblowing information;
• Vendor Onboarding information;
• Standard Trading Terms and Conditions;
• Conditions of Carriage;
• public policies and governance statements; and
• other information that Wyvern Freight has chosen to make publicly available.

Public availability of one document does not mean that all underlying or related internal records are automatically accessible.

Wyvern Freight may hold records in the following categories.

Corporate and governance records

These may include:

• company and branch-registration records;
• statutory records;
• licences and permits;
• governance policies;
• management records;
• powers of attorney;
• contracts and commercial agreements;
• legal correspondence;
• dispute and litigation records; and
• regulatory correspondence.

Customers and prospective customers

These may include:

• quotations;
• customer applications;
• account records;
• contracts;
• contact information;
• correspondence;
• billing information;
• shipment instructions;
• complaints;
• claims;
• service history; and
• other records relating to the customer relationship.

Freight and shipment records

These may include:

• consignment information;
• shipment instructions;
• collection records;
• delivery records;
• tracking events;
• route information;
• cargo information;
• manifests;
• proof of delivery;
• photographs relating to collection or delivery;
• exception reports;
• claims and damage reports; and
• communications concerning freight movements.

Customs and cross-border records

These may include:

• customs declarations;
• import and export documentation;
• commercial invoices;
• packing lists;
• permits;
• certificates;
• clearing documentation;
• border documentation;
• customs instructions;
• regulatory correspondence; and
• records supplied by customers, clearing agents or customs authorities.

Fleet, drivers and transport operations

These may include:

• vehicle records;
• trailer records;
• maintenance information;
• inspection records;
• driver records;
• licence and permit information;
• trip records;
• route records;
• fuel and operational records;
• incident records;
• safety records; and
• transport instructions.

Vendors, carriers and subcontractors

These may include:

• Vendor Onboarding applications;
• supplier information;
• company-registration documents;
• licences;
• permits;
• insurance information;
• banking information;
• tax information;
• beneficial ownership or authorised-person information where required;
• carrier records;
• driver and vehicle information;
• agreements;
• compliance reviews;
• performance records; and
• vendor correspondence.

Employees and job applicants

These may include:

• employment agreements;
• employee records;
• payroll information;
• leave records;
• performance information;
• disciplinary records;
• training records;
• qualifications;
• recruitment applications;
• CVs;
• background or verification records where lawfully obtained;
• health and safety records; and
• emergency-contact information.

Financial and tax records

These may include:

• invoices;
• credit notes;
• debtor and creditor records;
• banking records;
• payment records;
• accounting information;
• financial statements;
• tax records;
• VAT records;
• audit records; and
• supporting financial documentation.

Insurance and claims records

These may include:

• insurance policies;
• cargo claims;
• accident and incident records;
• damage reports;
• supporting evidence;
• insurer and broker correspondence; and
• investigation records.

Information technology and cybersecurity

These may include:

• IT policies;
• access-control information;
• system records;
• audit logs;
• cybersecurity records;
• incident-response records;
• vulnerability reports;
• software-provider records;
• backup information; and
• security-management records.

Privacy and compliance records

These may include:

• privacy policies;
• consent records;
• data-subject requests;
• compliance reviews;
• information-security incidents;
• processing records;
• whistleblowing reports;
• investigations;
• ethics and compliance records; and
• correspondence with regulators.

Depending on the activities of the South African operation, Wyvern Freight may hold records under legislation including:

• Promotion of Access to Information Act 2 of 2000;
• Protection of Personal Information Act 4 of 2013;
• Companies Act 71 of 2008;
• Income Tax Act 58 of 1962;
• Value-Added Tax Act 89 of 1991;
• Tax Administration Act 28 of 2011;
• Basic Conditions of Employment Act 75 of 1997;
• Labour Relations Act 66 of 1995;
• Employment Equity Act 55 of 1998;
• Unemployment Insurance Act 63 of 2001;
• Compensation for Occupational Injuries and Diseases Act 130 of 1993;
• Occupational Health and Safety Act 85 of 1993;
• National Road Traffic Act 93 of 1996;
• Customs and Excise Act 91 of 1964; and
• Electronic Communications and Transactions Act 25 of 2002,

together with other legislation applicable to Wyvern Freight’s particular transport, employment, customs, tax and commercial activities.

This list should not be understood as a statement that every listed Act applies to every Wyvern Freight record or activity.

Wyvern Freight’s South African operation may process personal information relating to:

• customers and prospective customers;
• shipment senders and recipients;
• authorised customer-account users;
• customer directors, representatives and employees;
• employees;
• job applicants;
• drivers;
• vendors;
• carriers;
• subcontractors;
• customs and clearing agents;
• website visitors;
• people contacting customer support;
• claimants;
• complainants;
• whistleblowers who elect to identify themselves; and
• other persons involved in the provision of logistics services.

Depending on the relationship involved, personal information may include:

• names;
• contact information;
• identification information;
• employment information;
• company and job-title information;
• driver's licence and permit information;
• account information;
• payment and banking information;
• shipment information;
• delivery information;
• proof-of-delivery information;
• vehicle information;
• vendor due-diligence information;
• tax information;
• contractual information;
• communications;
• device and security information; and
• other information reasonably necessary for the relevant business activity.

Sensitive or special personal information will only be processed where permitted by applicable law and where necessary for a legitimate purpose.

Personal information may be processed for purposes including:

• preparing quotations;
• establishing customer accounts;
• providing freight, courier, warehousing and logistics services;
• collecting and delivering shipments;
• providing tracking information;
• customs and border coordination;
• proof of delivery;
• vendor and carrier onboarding;
• subcontractor management;
• employment and recruitment;
• payroll and benefits;
• safety and incident management;
• invoicing and payments;
• credit administration;
• insurance and claims;
• fraud prevention;
• information security;
• legal and regulatory compliance;
• customer support;
• complaints and dispute resolution; and
• maintaining and improving Wyvern Freight systems and services.

Where lawful and reasonably necessary, information may be shared with:

• Wyvern Freight group or affiliated operations involved in the service;
• customers;
• recipients and consignees;
• carriers and transport subcontractors;
• clearing and customs agents;
• customs, border and regulatory authorities;
• warehouses and distribution partners;
• banks and payment providers;
• insurers and brokers;
• auditors;
• legal and professional advisers;
• tax and regulatory authorities;
• information-technology and hosting providers;
• cybersecurity providers;
• employment and verification providers; and
• law-enforcement authorities where disclosure is legally required.

Access under PAIA is separate from ordinary operational sharing. A PAIA request does not automatically override privacy, confidentiality, commercial sensitivity or other lawful grounds for refusing disclosure.

Wyvern Freight operates a regional freight network.

Information associated with a shipment or business relationship may need to move between South Africa, Zimbabwe and other Southern African countries involved in the service.

Wyvern’s existing Privacy Notice specifically identifies potential transfers involving South Africa, Zimbabwe, Zambia, Botswana, Mozambique, Malawi, Namibia, the Democratic Republic of Congo and other countries connected with a shipment.

Cross-border transfers will be managed in accordance with applicable legal requirements and appropriate safeguards.

Information may also be processed by technology or service providers located outside South Africa where this is reasonably necessary to provide or support Wyvern Freight services.

Wyvern Freight takes reasonable technical and organisational measures designed to protect information against loss, misuse, unauthorised access, disclosure, alteration or destruction.

Depending on the information and system concerned, measures may include:

• identity and access controls;
• password and authentication controls;
• role-based permissions;
• encryption;
• firewalls and network protection;
• malware protection;
• security monitoring;
• logging;
• backups;
• physical security;
• confidentiality obligations;
• vendor-security requirements;
• incident-response processes; and
• employee awareness and training.

Security measures are reviewed according to the nature of the information, technology involved and relevant risks.

A person seeking access to a record held by Wyvern Freight’s South African operation must submit the prescribed Form 2 — Request for Access to Record to the Information Officer.

The Information Regulator identifies Form 2 as the prescribed request form under Regulation 7.

A request should provide enough information to:

• identify the requester;
• identify the requested record;
• enable Wyvern Freight to locate the record;
• explain the right that the requester seeks to exercise or protect;
• explain why the record is required for exercising or protecting that right; and
• identify the preferred form of access.

Requests should be submitted to

Information Officer

[insert name]

Email

[insert PAIA email]

Physical address

[insert]

PAIA permits prescribed fees to be charged in certain circumstances.

Where a fee is payable, Wyvern Freight will notify the requester of:

• the amount payable;
• the basis on which the fee has been calculated; and
• the payment process.

Any fee charged will be determined in accordance with PAIA and applicable regulations.

Wyvern Freight will consider PAIA requests in accordance with the Act.

Access may be:

• granted in full;
• granted in part; or
• refused where PAIA permits or requires refusal.

Grounds for refusal may include protections relating to:

• the privacy of another person;
• confidential information;
• commercial information;
• trade secrets;
• privileged legal communications;
• safety and security;
• third-party records; and
• other interests protected under PAIA.

Where a request is refused, the requester will be informed of the decision and of applicable remedies as required by law.

A requester who is dissatisfied with the handling or outcome of a PAIA request may have remedies available through the Information Regulator and the courts.

The Information Regulator provides Form 5 — Complaint Form for PAIA complaints.

Information Regulator (South Africa)

Address

Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191

Telephone

010 023 5200

Toll free

0800 017 160

General enquiries

enquiries@inforegulator.org.za

PAIA complaints

PAIAComplaints@inforegulator.org.za

This Manual will be made available:

• on the Wyvern Freight website;
• at the South African office during normal business hours, where applicable;
• from the Information Officer upon request; and
• to the Information Regulator where required.

Wyvern Freight will make this Manual available in the languages required under applicable PAIA requirements and Information Regulator guidance.

Wyvern Freight may update this Manual when:

• the South African business structure changes;
• Information Officer details change;
• new categories of records are created;
• systems or services change;
• personal-information processing changes;
• cross-border processing arrangements change; or
• applicable legislation or regulatory guidance changes.

The latest version will be published on the Wyvern Freight website.

Prepared for

Wyvern Freight — South African registered operation

Legal entity

[exact registered name]

Registration number

[registration number]

Information Officer

[name]

Effective date

[date]

Last reviewed

[date]

• Privacy Notice
• Terms & Conditions
• Code of Ethics
• Integrity Line