NHM Global Advisory (Pty) Ltd · trading as ClearComply

Manual of NHM Global Advisory (Pty) Ltd

Prepared in terms of section 51 of the Promotion of Access to Information Act 2 of 2000 (as amended by the Protection of Personal Information Act 4 of 2013 and the PAIA Amendment Act 31 of 2019).

1. List of acronyms and abbreviations

2. Purpose of this PAIA Manual

This manual is prepared in terms of section 51 of PAIA and is intended to enable any person to exercise their right of access to records held by NHM. The manual sets out:

1. the categories of records available without a person having to make a request (Section 52);
2. how to submit a request for access to records that are not automatically available;
3. records held in accordance with any other legislation;
4. contact details of the Information Officer and any Deputy Information Officers;
5. a reference to the Guide produced by the Regulator in terms of section 10 of PAIA;
6. the purpose of processing personal information as required by section 51(1)(c) of POPIA;
7. the categories of data subjects and categories of personal information held;
8. the recipients (or categories of recipients) to whom personal information may be supplied;
9. planned transborder flows of personal information; and
10. a general description of the information-security measures NHM has implemented.

3. Key contact details for access to information

3.1 Head of the Private Body and Information Officer

3.2 Deputy Information Officers (section 17(1) PAIA)

NHM has not designated any Deputy Information Officers at the date of this manual. Should one be designated, this manual will be updated accordingly and the update published on the website.

3.3 General access-to-information e-mail

Any person wishing to request access to a record held by NHM, or to pose an access-related query, may write to privacy@clearcomply.co.za.

3.4 National / head office

4. Guide on how to use PAIA and how to obtain it

4.1 In terms of section 10(1) of PAIA, the Regulator has compiled and published an official Guide (in all eleven official languages and braille) explaining the manner and form in which access to records may be obtained under PAIA.

4.2The Regulator's PAIA Guide contains, among other things:

• the objects of PAIA and POPIA;
• the contact details of the Information Officer and Deputy Information Officers of every public and private body;
• the manner and form of a request for access;
• the assistance available from the Information Officer;
• the assistance available from the Regulator;
• all remedies available in law in respect of a refused request, including internal appeal, complaint to the Regulator, and application to court;
• the provisions of sections 14 and 51 of PAIA regarding the compilation of manuals;
• the provisions of sections 15 and 52 of PAIA regarding voluntary disclosure and automatic availability of records;
• the notices issued under sections 22 and 54 of PAIA regarding fees payable;
• the regulations made under section 92 of PAIA.

4.3 The Guide may be obtained from the Regulator's website at inforegulator.org.za or from the Regulator at: JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001 · tel +27 (0)10 023 5207 · inforeg@justice.gov.za.

4.4A copy of this manual is available for inspection at NHM's head office during normal office hours, free of charge. A copy may also be obtained on request subject to the fee referred to in clause 10.2.

4.5 This manual is published in English. NHM will, on request, provide a translation into any one additional official South African language where that is reasonably practicable.

5. Records available without a person having to request access (section 52)

The following categories of records are made voluntarily available in terms of section 52 of PAIA. They do not require the submission of a request form (Form C or otherwise).

6. Records held in accordance with other legislation

NHM holds records in accordance with the following legislation. Access to these records is regulated by both PAIA and the relevant legislation and any access rights or restrictions in that legislation apply in addition to those in PAIA.

7. Subjects on which NHM holds records and categories of records held

8. Processing of personal information

This clause is included as required by section 51(1)(c) of POPIA. A fuller description of NHM's personal-information practices is set out in the Privacy Policy.

8.1 Purpose of processing

• to provide compliance monitoring, deadline tracking, and fix-guidance services to customers;
• to manage customer accounts, authenticate users, and process payments;
• to deliver legitimate-interest outreach to CIPC-flagged companies in accordance with POPIA section 11(1)(f) and the Legitimate Interest Assessment on file;
• to operate the Marketplace, including the routing of documents and messages between clients and accountants and the disbursement of payments through Stripe Connect;
• to discharge NHM's own statutory obligations to SARS, CIPC, the Department of Employment and Labour, and the Information Regulator.

8.2 Categories of data subjects and personal information held

8.3 Recipients of personal information

8.4 Planned transborder flows of personal information

Personal information processed by NHM is transferred to the following foreign jurisdictions via the sub-processors listed in clause 8.3:

• European Union (Supabase, Stripe, PostHog) — transfers are subject to contracts of processing incorporating terms substantially equivalent to those in section 72(1)(a) of POPIA.
• United States of America (Vercel, Resend, Anthropic, Google) — transfers are subject to contracts of processing incorporating terms substantially equivalent to those in section 72(1)(a) of POPIA and, where applicable, the EU-US Data Privacy Framework.

8.5 Information-security measures

NHM has implemented appropriate technical and organisational measures to protect personal information in its custody, including:

• encryption of data in transit (TLS) and at rest (AES-256);
• role-based access controls, password hashing, and optional multi-factor authentication;
• private storage buckets for Marketplace Engagement documents, accessible only through presigned URLs that expire within five minutes;
• automated anti-virus and anti-malware scanning on document upload;
• audit logging of authentication, data-access, and administrative actions;
• scheduled backups and disaster-recovery procedures;
• written data-processing agreements with every sub-processor identified in clause 8.3.

9. How to request access to records

9.1 Request form

A request for access to a record that is not voluntarily available under clause 5 must be submitted on Form C of the Regulations to PAIA (for requests by a requester on behalf of a data subject who is the requester) or on Form 2of Annexure B to the Regulations (for requests by any other requester). Forms are available on the Regulator's website.

9.2 Fees

• A request fee of R50.00 is payable on submission of a request by a requester other than a personal requester.
• An access fee is payable where the request is granted, calculated on the basis prescribed in Annexure B of the Regulations (for example R1.10 per A4 photocopy, R0.75 per printed page, and actual postage or electronic-delivery cost).
• A deposit of one-third of the estimated access fee may be required where preparation of the record will take more than six hours.
• No feeis payable by a personal requester seeking a record that contains the requester's own personal information.

9.3 Response time

A decision on the request will be communicated to the requester as soon as reasonably possible, and in any event within 30 days of receipt of the request (section 56 of PAIA), with a further extension of up to 30 days permitted under section 57 where the request is complex or affects third-party rights.

9.4 Grounds for refusal

Access to a record may be refused on any of the grounds contemplated in Chapter 4 of PAIA, including (without limitation): protection of third-party privacy (section 63), protection of commercial or confidential information (sections 64, 65, 68, 69), protection of research information (section 69), legal professional privilege (section 67), and protection of safety (section 66). Where refusal is partial, the severable non-exempt part of the record will be supplied (section 28 of PAIA).

9.5 Remedies

A requester whose request is refused may:

1. lodge an internal appeal with the Head of the Private Body in accordance with section 74 of PAIA within 60 days of receipt of the decision;
2. lodge a complaint with the Information Regulator in accordance with Part 4 of Chapter 5 of PAIA; or
3. apply to the High Court for appropriate relief under section 78 of PAIA.

10. Availability of this manual

10.1 In accordance with section 51(3) of PAIA, this manual is available:

• on NHM's website at www.clearcomply.co.za/paia-manual;
• for inspection at the head office (First Floor, 61 Katherine Street, Sandton) during normal office hours and by appointment with the Information Officer;
• on request to any person, on payment of the fee set out in clause 10.2; and
• on request to the Information Regulator at any time.

10.2 A fee of R1.10 per A4 photocopy (as prescribed in Annexure B of the Regulations) is payable where a printed copy of the manual is requested. An electronic copy by e-mail is provided free of charge.

11. Updating of this manual

This manual is updated by the Head of the Private Body from time to time, and at least annually. A change of any contact detail, a material change in NHM's operations, or a material change in PAIA, POPIA, or the applicable Regulations will trigger an earlier update. The version history is recorded on the cover page and the most recent version is always published on the ClearComply website.