POPIA / PAIA Manual

Introduction

GQ Beyond Holdings (Pty) Ltd ("the Company") is committed to protecting the privacy, confidentiality, and security of personal information processed in the course of its business operations.

This POPIA / PAIA Manual is compiled to:

• Give effect to the constitutional right to privacy.
• Promote the lawful and responsible processing of personal information.
• Provide transparency regarding how personal information is collected, used, stored, and protected.
• Outline the rights of data subjects and the procedures to exercise those rights.

This Manual must be read together with the Company's internal POPIA policies, procedures, and security controls.

Company Details

Information Officer

In terms of Section 55 of POPIA and Section 51 of PAIA, the Company has appointed an Information Officer responsible for ensuring compliance with applicable data protection legislation.

The Information Officer is registered with the Information Regulator of South Africa.

Scope of Application

This Manual applies to all:

• Employees
• Directors
• Contractors
• Operators
• Third parties who process personal information on behalf of the Company

It covers personal information relating to:

• Clients and prospective clients
• Employees and job applicants
• Directors, shareholders, and officers
• Suppliers, service providers, and business partners

Categories of Personal Information Processed

The Company processes personal information relevant to its operations, including but not limited to:

5.1 Client Information

• Names, identity numbers, contact details
• Company registration and compliance information
• Financial and transactional information
• Correspondence and service records

5.2 Employee & HR Information

• Identity and contact details
• Employment history and contracts
• Payroll and banking information
• Performance, disciplinary, and leave records

5.3 Corporate & Compliance Information

• Director and shareholder details
• Beneficial ownership information
• Regulatory filings and correspondence
• Risk, compliance, and governance records

Purpose of Processing Personal Information

Personal information is processed for lawful business purposes, including:

• Client onboarding and service delivery
• Contractual performance
• Regulatory and statutory compliance
• Human resources administration
• Financial management and record-keeping
• Risk management and corporate governance

The Company does not process personal information for unlawful or excessive purposes.

Lawful Basis for Processing

Personal information is processed in accordance with POPIA's lawful processing conditions, including:

• Consent of the data subject
• Performance of a contract
• Compliance with legal obligations
• Legitimate business interests of the Company
• Protection of a legitimate interest of the data subject

Information Sharing & Disclosure

Personal information may be shared with:

• Regulatory authorities where required by law
• Professional advisors (accountants, auditors, legal counsel)
• Operators and service providers under written agreements
• Financial institutions and statutory bodies

All third-party operators are required to implement appropriate security safeguards.

Cross-Border Transfers

Where personal information is transferred outside the Republic of South Africa, the Company ensures that:

• The recipient is subject to data protection laws providing an adequate level of protection; or
• Appropriate contractual safeguards are in place; or
• The data subject has consented to the transfer.

Security Safeguards

The Company has implemented reasonable technical and organisational measures to protect personal information against:

• Loss
• Unauthorised access
• Unlawful processing
• Accidental damage

Security measures include access controls, confidentiality obligations, secure storage, and staff awareness.

Data Subject Rights

Data subjects have the right to:

• Access their personal information
• Request correction or deletion
• Object to processing in certain circumstances
• Withdraw consent where applicable
• Lodge a complaint with the Information Regulator

Requests may be submitted to the Information Officer using the prescribed forms at info@gqbeyond.co.za.

Access to Records (PAIA Requests)

Records may be requested in terms of PAIA by completing the prescribed PAIA Request Form and submitting it to the Information Officer. Requests must provide sufficient detail to identify the record and the right being exercised or protected.

Fees

Where applicable, fees may be charged in accordance with PAIA regulations:

The requester will be notified of any applicable fees before processing commences.

Decision Period

• Requests will be processed within 30 days of receipt.
• The period may be extended where permitted by law.
• The requester will be informed in writing of the outcome.

Grounds for Refusal

Access to records may be refused on lawful grounds, including:

• Protection of personal information
• Commercial confidentiality
• Legal privilege
• Security and safety considerations

Reasons for refusal will be provided as required by PAIA.

Information Regulator Contact Details

Availability of This Manual

This POPIA / PAIA Manual is available:

• At the Company's physical office — 211 Rensburg Street, Arcadia, Gqeberha
• On the Company website at www.gqbeyond.co.za
• Upon request from the Information Officer at info@gqbeyond.co.za

Review & Updates

This Manual will be reviewed periodically and updated as required to ensure ongoing compliance with applicable legislation. The Information Officer is responsible for maintaining and updating this Manual.