PAIA Manual

The Protection of Personal Information Act, Number 4 of 2013 (POPIA) regulates the lawfulness of processing activities of South Africa's Personal Information. POPIA applies to any data processing that takes place in South Africa, regardless of where the Data Subject is from.

The 1996 South African Constitution, by providing a statutory right of access on request to any record held by the state as well as access to records held by private bodies, entrenches the fundamental right of access to information.

The Promotion of Access to Information Act 2 of 2000 (the “Act” and/or “PAIA”), which came into effect on 9 March 2001, seeks to advance the values of transparency and accountability in South Africa and provides the mechanism for requestors to exercise and protect their constitutional right to request access to a record.

PAIA establishes the following statutory rights of requestors to any record of a private body if:

• That record is required for the exercise or protection of any of his or her legal rights.
• That requestor complies with all the procedural requirements.
• Access is not refused in terms of any ground referred to in the Act.

This document serves as the nuvoteQ Promotion of Access to Information Act Manual (the “PAIA Manual”) in accordance with section 51 of the Act to facilitate access to records held by nuvoteQ. The Manual is available:

• To any person of the public on the nuvoteQ website (nuvoteq.io) or on request from the Information Officer.
• In physical copies, subject to prescribed fees, at the offices of nuvoteQ.

PAIA provides that a requestor is only entitled to access a record if the record is required for the exercise or protection of a right. Only requests where the Information Officer is satisfied of that requirement will be considered.

A requestor may act in different capacities, which will influence the fee charged. Requestors may make a request as:

• A personal requestor who requests a record about him/herself.
• An agent requestor who requests a record on behalf of someone else with that person's consent, where required for the protection of that person's legal right.
• A third-party requestor who requests a record about someone else with that person's consent, where required for the protection of that person's legal right.
• A public body who may request a record if it fulfils procedural compliance, the record is required for the exercise or protection of a right, and no grounds for refusal exist.

The Chief Executive Officer of nuvoteQ has delegated his powers to the Information Officer below in terms of PAIA to handle all requests on nuvoteQ's behalf and ensure that the requirements of PAIA are administered in a fair, objective and unbiased manner.

Information Officer: Marina Lazaridis — marina@nuvoteq.io

Deputy Information Officer: Ricky Haug — ricky@nuvoteq.io

Physical address: 47 Hazelwood Rd, Hazelwood, Pretoria, 0081, South Africa.

nuvoteQ will protect the confidentiality of information provided to it by third parties (OP-GM-03, PC-HR-01, PC-GM-03), subject to nuvoteQ's obligations to disclose information in terms of any applicable law or a court order requiring disclosure of the information.

If access is requested to a record that contains information about a third party, nuvoteQ is obliged to attempt to contact that third party to inform them of the request. The third party then has the opportunity to consent to the access or provide reasons why access should be denied. Where reasons are furnished, the Information Officer will consider them in determining whether access should be granted.

nuvoteQ collects Personal Information of visitors to nuvoteq.io where such Personal Information is voluntarily disclosed by the visitor to enable nuvoteQ to provide feedback on a request from that visitor (PC-GM-04).

Using cookie-based technologies, nuvoteQ may collect various data linked to virtual identities allocated to visitors when they access nuvoteQ's website. This data is used for site analytics and first-party marketing. In certain cases these virtual identities are linked to the real-world identities of visitors only when they choose to provide their Personal Information (PC-GM-03).

Cookies are small text files placed on the computer, smartphone, or other device when accessing the internet. Cookies are used to:

• Ensure that web pages can function properly.
• Recognise your navigation and user experience.
• Collect anonymous statistical information, such as which sections have been visited and how long a person has been in the nuvoteQ environment.
• Note: It is possible to modify and/or block the installation of cookies sent by the nuvoteQ website; however, the quality of the operation of the services may be affected.

The Information Regulator is required, in terms of section 10 of the Act, to update and make available the existing guide compiled by the South African Human Rights Commission (SAHRC) or its successor. The guide contains information to assist a person wishing to exercise a right in terms of PAIA and POPIA. You may request additional information to assist you in making a request from the SAHRC and/or the Information Regulator.

Please direct any queries to the Information Regulator (South Africa):

Physical Address: Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2001.

Postal Address: PO Box 31533, Braamfontein, Johannesburg, 2017.

Tel: +27 80 001 7160 (Toll Free).

Email (complaints): POPIAComplaints@inforegulator.org.za

Email (general enquiries): enquiries@inforegulator.org.za

Website: https://inforegulator.org.za/

nuvoteQ is a registered South African-based company providing digital technology solutions in the clinical and pharmaceutical research space as well as to other organisations. Additional information on nuvoteQ is available at nuvoteq.io. The scope of this Manual serves to provide a reference regarding the records held by nuvoteQ at its Registered Office.

Key definitions used in this Manual:

• Cookies — A small text file (up to 4KB) created by a website, stored on the user's device either temporarily for a session or permanently on the hard disk. Cookies allow the website to recognise a user and keep track of their preferences.
• Data — Information, facts and statistics used for reference or analysis in electronic form.
• Data Subject — The person to whom the Personal Information relates.
• Information Officer (IO) — The Chief Executive Officer or his/her designee. For purposes of this Manual, Marina Lazaridis has been appointed as the Information Officer of nuvoteQ. The Deputy Information Officer (DIO) assists with duties and responsibilities as assigned.
• Information Regulator — An independent body established in terms of Section 39 of POPIA, empowered to monitor and enforce compliance by public and private bodies.
• Personal Information — Information relating to an identifiable, living natural person, or an identifiable, existing juristic person, as defined in POPIA (including race, gender, marital status, nationality, contact details, biometrics, opinions, correspondence and identifiers). Personal Information must always be treated as Confidential Information, even after the individual's death, and includes Pseudonymised or de-identified data that can be re-attributed.

A request for access to information can be made to both public and private bodies. PAIA requires the request to be submitted on the prescribed form. Two forms can be used and are available on the Information Regulator's website:

For PAIA requests — the InfoRegSA-PAIA-Form02-Reg7 form available at inforegulator.org.za.

For POPIA correction, deletion or destruction of personal information — the Request for Correction or Deletion form available at inforegulator.org.za.

The following internal nuvoteQ procedural documents are related to this Manual:

• OP-GM-03 — Confidentiality of Information
• OP-IT-01 — Security, Management and Use of Information Technology
• PC-GM-03 — Privacy, Security and Protection of Personal Information
• PC-GM-04 — nuvoteQ Online Services Privacy Policy
• PC-HR-01 — Code of Conduct
• WI-GM-01 — Good Documentation Practice

Automatic disclosure: No notice has been published in terms of section 52 of PAIA. However, the following records are automatically available at the registered office of nuvoteQ on payment of the prescribed reproduction fee — (a) documentation relating to nuvoteQ held by the Companies and Intellectual Property Commission per section 25 of the Companies Act 71 of 2008; (b) product and promotional brochures; (c) news and other marketing information.

Legislative requirements: Records are kept in accordance with such other legislation as applicable to nuvoteQ, which may include but is not limited to:

• Broad-Based Black Economic Empowerment Act 53 of 2003, as amended.
• Companies Act 71 of 2008, as amended.
• Consumer Protection Act 68 of 2008, as amended.
• Employment Equity Act 55 of 1998, as amended January 2025.
• Labour Relations Act 66 of 1995, as amended.
• Medical Schemes Act No. 131 of 1998, as amended.
• National Health Act (Act No. 61 of 2003), as amended.
• Promotion of Access to Information Act 2 of 2000 (PAIA), as amended.
• Protection of Personal Information Act 4 of 2013 (POPIA), as amended.
• Skills Development Act 97 of 1998.
• South African Revenue Service Act 34 of 1997.
• Records held by nuvoteQ may include: Corporate Affairs and Investor Relations; Corporate Secretariat and Governance; Finance and Taxation; Human Resources; Information Technology; Intellectual Property; Legal; and Sales, Marketing and Communication. Many records held by nuvoteQ concern third parties (such as clients and their Employees/Data Subjects) and are the property of the client, not nuvoteQ.

nuvoteQ processes Personal Information of Data Subjects for the following purposes:

• Fulfilling statutory obligations in terms of applicable legislation.
• Verifying information provided to nuvoteQ.
• Obtaining information necessary to provide contractually agreed services to a Client/Vendor.
• Monitoring, maintaining and managing nuvoteQ's contractual obligations to customers, suppliers, employees, directors and other third parties.
• Marketing and advertising, resolving complaints, and monitoring the assets, employees and visitors to nuvoteQ premises.
• Document retention, archiving and historical record keeping in accordance with appropriate documentation practices, research and statistics necessary for fulfilling nuvoteQ's business objectives (WI-GM-01).

For nuvoteQ to facilitate access to a record you need to complete the prescribed form available on the Information Regulator's website. The form must be completed in full — failure to do so will delay the process. The Access Request Form must be completed in the English language in BLOCK LETTERS, with proof of identity, and submitted by hand, courier or email addressed to the Information Officer.

Payment can be made via EFT or direct deposit (no credit card payments). Proof of payment must be supplied. Four types of fees are provided for in terms of the Act:

• Request fee — An initial, non-refundable R57.00 (incl. VAT) payable on submission. Not applicable to personal requestors seeking their own records.
• Reproduction fee — Payable with respect to all records that are automatically available.
• Access fee — Where a request is successful, an access fee may be required to reimburse nuvoteQ for the costs of search, reproduction and record preparation.
• Deposit — One-third of the applicable access fee, payable if the request is for information held about a person other than the requestor and preparation will take more than six (6) hours. The full deposit is refunded if access is refused.

nuvoteQ will within thirty (30) days of receipt of the request decide whether to grant or decline it and give notice with reasons. The 30-day period may be extended by a further 30 days if the request is for a large volume of information or requires a search across offices — the requestor will be notified in writing of any extension.

Requests may be refused on the following grounds as set out in the Act:

• Mandatory protection of the privacy of a third party who is a natural person, including a deceased person, where disclosure would be an unreasonable disclosure of personal information.
• Mandatory protection of commercial information — trade secrets; financial, commercial, scientific or technical information; information disclosed in confidence; and duties of confidence owed to third parties.
• Mandatory protection of the safety of individuals and the protection of property.
• Mandatory protection of records privileged from production in legal proceedings, unless privilege has been waived.
• Mandatory protection of research information of a third party or nuvoteQ.
• Appeal: If a requestor is aggrieved by the refusal of the Information Officer to grant a request, the requestor may, within thirty (30) days of notification of the decision, apply to court for appropriate relief.
• Records that cannot be found or do not exist: If nuvoteQ has searched for a record and it is believed the record either does not exist or cannot be found, the requestor will be notified by way of an affidavit or affirmation including the steps taken to try to locate the record.

To request the correction, deletion, destruction or destroy of a Personal Information record, complete the prescribed form available on the Information Regulator's website. Complete in English, in BLOCK LETTERS, with proof of identity, and submit by hand, courier or email addressed to the Information Officer.

nuvoteQ will within thirty (30) days of receipt action the request accordingly. The 30-day period may be extended by a further 30 days for large volumes; the requestor will be notified in writing of any extension. If the request is successful, the requestor will be notified accordingly.

This Manual is grounded in the following legislation:

• South African Protection of Personal Information Act No. 4 of 2013 (POPIA).
• South African Promotion of Access to Information Act 2 of 2000 (PAIA).