PAIA Manual — MONT TECHNOLOGIES (Pty) Ltd, trading as Handley

Prepared in terms of section 51 of the Promotion of Access to Information Act 2 of 2000 (PAIA) and section 23 of the Protection of Personal Information Act 4 of 2013 (POPIA). Date of compilation: 30 October 2026

1. Purpose of this manual

This manual tells you what records Handley holds, which of them are available without a formal request, and how to ask for access to others. It also describes how we process personal information, as POPIA requires.

2. Company and contact details

3. The Information Regulator's guide

The Information Regulator has published a guide on how to use PAIA and POPIA (section 10 of PAIA). It is available from the Information Regulator:

• Website: inforegulator.org.za
• Email: enquiries@inforegulator.org.za

A copy of the guide is also available from us on request at support@handley.co.za.

4. Records available without a request

These are available to anyone, without a PAIA request:

• the Terms of Service and Privacy Policy (handley.co.za/terms and /privacy, and in the app);
• this manual;
• information about our services and pricing shown in the app.

Users can also get their own information directly, without a PAIA request: in the app under Settings → Download My Data, and their booking receipts on each booking.

5. Records held in terms of other legislation

Records are kept, where applicable, in accordance with:

• Companies Act 71 of 2008
• Tax Administration Act 28 of 2011 and Income Tax Act 58 of 1962
• Value-Added Tax Act 89 of 1991 (if and when registered)
• Consumer Protection Act 68 of 2008
• Electronic Communications and Transactions Act 25 of 2002
• Protection of Personal Information Act 4 of 2013
• Financial Intelligence Centre Act 38 of 2001 (where applicable)

6. Subjects and categories of records held

• Company records: memorandum of incorporation, CIPC registration documents, director and shareholder records, minutes and resolutions.
• Financial records: accounting records, bank statements, invoices and receipts, tax returns and records, payment and payout records (processed through Paystack).
• Client records: account and profile details, saved addresses, bookings, payments, ratings, reviews, chat and support messages.
• Provider records: account and profile details, identity-verification results and documents, skills and certifications, bank details for payouts, earnings and withdrawal records, ratings and reviews.
• Waitlist records: name, contact details, suburb and services of people who joined the website waitlist (kept 12 months).
• Operational records: service and pricing configuration, safety and incident reports, fraud-prevention records (including hashed identity references), support records.
• Technology records: system logs, usage analytics and crash reports (retained as set out in the Privacy Policy).
• Supplier records: agreements and correspondence with service providers such as Google, Paystack and Smile Identity.

7. Processing of personal information (POPIA)

Purposes. To provide the Handley marketplace: bookings, matching, payments and payouts, chat, live tracking, ratings and support; to keep users safe and prevent fraud; to communicate with users; to improve the service; and to meet legal obligations.

Categories of data subjects and their information:

• Clients: name, email, mobile number, date of birth, addresses and coordinates, booking details, card brand and last digits (cards are held by Paystack), messages, ratings, device and usage information, location (if allowed).
• Providers: the client categories above, plus identity documents, selfie and face-match result (biometric, with consent), skills, bank details, earnings, and location while a job is active.
• Emergency contacts that users choose to add: name and phone number.
• Suppliers and their contact persons: names and contact details.

Recipients. The other party to a booking (as described in the Privacy Policy), and operators who process information for us: Google (Firebase, Cloud and Maps), Paystack, Smile Identity, Expo, Anthropic, Meta/WhatsApp, Twilio, Resend and Sentry. We also disclose to authorities where the law requires it.

Transborder flows. Some operators process information outside South Africa (mainly the United States, EU and Nigeria), under the safeguards in section 72 of POPIA, as described in the Privacy Policy.

Security measures. Encryption in transit and at rest; card tokenisation by Paystack; database rules that restrict each user to their own data; server-only writes for money records; restricted staff access; breach notification under section 22 of POPIA.

8. How to request access to a record

1. Complete Form 2 (Request for Access to Record) under the PAIA Regulations, available from the Information Regulator's website or from us on request.
2. Send it to the Information Officer at support@handley.co.za or by post to the address in section 2.
3. Provide enough detail to identify the record, the form of access you want, and — if you are asking for a record about another person — the right you want to exercise or protect and why the record is needed.
4. Fees: a requester other than a personal requester may have to pay the request fee and access fees prescribed in the PAIA Regulations. We will tell you if a fee or deposit applies before processing. There is no fee for asking for your own personal information.
5. We will reply within 30 days, which may be extended by up to a further 30 days in the circumstances PAIA allows. If we refuse a request, we will give reasons and tell you how to complain to the Information Regulator or apply to court.

Grounds for refusal are those in Chapter 4 of Part 3 of PAIA, for example to protect another person's privacy, commercial information of a third party, confidential information, safety of individuals, or legally privileged records.

9. Availability of this manual

This manual is available at handley.co.za/paia, at our registered office, and on request from support@handley.co.za. It may also be requested from the Information Regulator.