PAIA MANUAL
STELLANTIS SOUTH AFRICA PROPRIETARY LIMITED
Registration Number: 1997/014154/07
PAIA MANUAL
In terms of Section 51 of the
Promotion of Access to Information Act No. 2 of 2000
This manual applies to Stellantis South Africa and encompasses all brands operating under its authority.
(Collectively referred to in this manual as “Stellantis South Africa”)
Table of Contents
1. Introduction
2. Company Contact Details (SECTION 51(1)(a))
3. The Act
4. Protection of Personal Information That Is Processed by Stellantis South Africa
5. Purpose of the Processing of Personal Information by Stellantis South Africa
6. Categories of Data Subjects and Personal Information/Special Personal Information Relating Thereto:
7. Applicable Legislation (SECTION 51(1)(c))
8. Stellantis South Africa Records (SECTION 51(1)(d))
9. The Request Procedures
10. Fee Structure
11. Notification
12. Grounds for Refusal of Access to Records
13. Appeal
1. Introduction
Stellantis South Africa Proprietary Limited (“Stellantis South Africa”) is a company incorporated in terms of the Companies Act No. 71 of 2008, as amended, with registration number 1997/014154/07. We are a constellation of automotive brands which include Abarth, Alfa Romeo, Chrysler, Citroën, Fiat, Jeep, Opel, Peugeot and LeapMotor
2. Company Contact Details (SECTION 51(1)(a))
| Contact Details: Physical Address: Postal Address: Tel: Email: |
Craig Holz (Head of ICT & Information Officer) 162 Tonetti Street, Halfway House, Building #2, Hornbill Lane, Midpoint Midrand 1685 P.O. Box 389 Kelvin 2054 011 879 7400 craig.holz1@stellantis.com |
3. The Act
The Promotion of Access to Information Act No. 2 of 2000 (“PAIA”) was enacted in accordance with Section 32 of the Constitution of the Republic of South Africa 1996, which provides that legislation must be enacted to give effect to the right of access to information held by the private sector or public bodies, if the record or Personal Information is required for the exercise or protection of any rights unless the Act expressly states that the records containing such information may or must not be released. The purpose of which is to promote transparency, accountability and effective governance of all public and private bodies.
This Promotion of Access to Information Manual (“PAIA Manual”) provides an outline of the type of records and the Personal Information Stellantis South Africa holds and explains how to submit requests for access to these records in terms of PAIA. In addition, it explains how to access and/or object to Personal Information held by Stellantis South Africa, and/or request the correction and/or deletion of the Personal Information in terms of Sections 23 and 24 of the Protection of Personal Information Act No. 4 of 2013 (“POPIA”).
This PAIA Manual is published on Stellantis South Africa’s Brands websites as follows:
| STELLANTIS SOUTH AFRICA BRANDS | WEBSITES |
|---|---|
| Abarth | https://www.abarthcars.co.za/ |
| Alfa Romeo | https://www.alfaromeo.co.za/ |
| Citroën | https://www.citroen.co.za/ |
| Fiat | https://www.fiat.co.za/ |
| Jeep | https://www.jeep.com/za |
| Leapmotor | https://www.leapmotor.net/za |
| Opel | https://www.opel.co.za/ |
| Peugeot | https://www.peugeot.co.za/ |
alternatively, a copy can be requested from the Information Officer (see contact details above).
3.1 Guide on How to Use PAIA
Any person wishing to exercise a right contemplated in PAIA, can obtain a guide in any South African official language from the South African Human Rights Commission (“SAHRC”). The contact details of the SAHRC are as follows:
| Physical Address: Postal Address: Tel: Fax Email: Website: |
Forum 3, Braampark Office Park, 33 Hoofd Street, Braamfontein, Johannesburg. PAIA Unit, Research and Documentation Department Private Bag 2700 Houghton Johannesburg 2041 011 877 3600 011 403 0668 PAIA@sahrc.org.za www.sahrc.org.za |
3.2 Guide on How to Use POPIA
Any person wishing to exercise a right contemplated in the POPIA or direct any queries may approach the Information Regulator South Africa. The contact details of the Information Regulator are as follows:
| Physical Address: Postal Address: Complaints Email: General Enquiries Email: Website: |
JD House 27 Stiemens Street Braamfontein Johannesburg 2001 P.O. Box 31533 Braamfontein Johannesburg 2017 complaints.IR@justice.gov.za inforeg@justice.gov.za www.justice.gov.za/inforeg/index.html |
4. Protection of Personal Information That Is Processed by Stellantis South Africa
Chapter 3 of POPIA provides for the minimum Conditions for lawful processing of Personal Information by Stellantis South Africa. These Conditions may not be derogated from unless specific exclusions apply as outlined in POPIA.
Stellantis South Africa requires Personal Information relating to both individual and juristic persons in order to carry out its business and organisational functions. The manner in which this information is processed and the purpose for which it is processed is determined by Stellantis South Africa. Stellantis South Africa is accordingly the Responsible Party for the purpose of POPIA and shall ensure that the Personal Information of a Data Subject:
- is processed lawfully, fairly and transparently. This includes the provision of appropriate information to Data Subjects when their data is collected by Stellantis South Africa, in the form of privacy or data collection notices. Stellantis South Africa must also have a legal basis (for example, consent) to process Personal Information;
- is processed only for the purposes for which it was collected;
- will not be processed for a secondary purpose unless that processing is compatible with the original purpose;
- is adequate, relevant and not excessive for the purposes for which it was collected;
- is accurate and kept up to date;
- will not be kept for longer than necessary;
- is processed in accordance with integrity and confidentiality principles. This includes physical and organisational measures to ensure that Personal Information, in both physical and electronic form, are subject to an appropriate level of security when stored, used and communicated by Stellantis South Africa, in order to protect against access and acquisition by unauthorised persons and accidental loss, destruction or damage;
- is processed in accordance with the rights of Data Subjects, where applicable Data Subjects have the right to:
- be notified that their Personal Information is being collected by Stellantis South Africa. The Data Subject also has the right to be notified in the event of a data breach;
- know whether Stellantis South Africa holds Personal Information about them, and to access that information. Any request for information must be handled in accordance with the provisions of this PAIA Manual;
- request the correction or deletion of inaccurate, irrelevant, excessive, out of date, incomplete, misleading or unlawfully obtained Personal Information;
- object to Stellantis South Africa’s use of their Personal Information and request the deletion of such Personal Information (deletion would be subject to Stellantis South Africa’s record keeping requirements);
- object to the processing of Personal Information for purposes of direct marketing by means of unsolicited electronic communications; and
- complain to the Information Regulator regarding an alleged infringement of any of the rights protected under the POPIA Act and to institute civil proceedings regarding the alleged non-compliance with the protection of his, her or its Personal Information.
5. Purpose of the Processing of Personal Information by Stellantis South Africa
As outlined above, Personal Information may only be processed for a specific purpose. The purposes for which Stellantis South Africa processes or will process Personal Information are as follows:
| PURPOSE OF THE PROCESSING OF PERSONAL INFORMATION |
TYPE OF PROCESSING |
|---|---|
| To provide services to the Customer in accordance with terms agreed to by the Customer. To undertake activities related to the provision of services and transactions, including: to fulfil foreign and domestic legal, regulatory and compliance requirements and comply with any applicable treaty or agreement with or between foreign and domestic governments applicable to Stellantis South Africa; to verify the identity of Customer representatives who contact Stellantis South Africa or may be contacted by Stellantis South Africa; for risk assessment, information security management, statistical, trend analysis and planning purposes; to monitor and record calls and electronic communications with the Customer for quality, training, investigation and fraud prevention purposes; for crime detection, prevention, investigation and prosecution; to enforce or defend Stellantis South Africa’s rights; and to manage Stellantis South Africa’s relationship with the Customer. The purposes related to any authorised disclosure made in terms of agreement, law or regulation; Any additional purposes expressly authorised by the Customer; and Any additional purposes as may be notified to the Customer or Data Subjects in any notice provided by Stellantis South Africa. |
Collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction. |
6. Categories of Data Subjects and Personal Information/Special Personal Information Relating Thereto:
As per Section 1 of POPIA, a Data Subject may either be a natural or a juristic person. The table below sets out the various categories of Data Subjects that Stellantis South Africa processes Personal Information on and the types of Personal Information relating thereto.
| Categories and Data Subjects of and Categories of Personal Information relating thereto | Data Subject | Personal Information Processed |
|---|---|---|
| Customer: Corporate: Customer Profile information including, account, details, payment information, corporate structure, customer risk rating and other customer information including to the extent the categories of information relate to individuals or representative of customers (e.g., shareholders, directors, etc.) required for the abovementioned purposes. Individual: Name; Contact Details (Company Email Address, Company Telephone Number), Client Details (Home Facsimile Number, Home Postal Address, Home Telephone Number, Personal Cellular, Mobile or Wireless Number, Personal Email Address) ;Regulatory Identifiers (e.g., Tax Identification Number); Account Information (Bank Account Currency Code, Bank Account ID, Bank Account Name, Bank Account Number, Bank Account Type, Bank Account Balance); Transaction Details and Branch Details; “know-your customer” data, Photographs; Other Identification and Verification Data as contained in Images of ID Card, Passport and other ID Documents; Images of Customer Signatures) |
Natural Persons Juristic Persons |
Personal Data relating to a Data Subject received by or on behalf of the Company from the Customer, Customer affiliates and their respective representatives and related parties in the course of providing accounts and services to the Customer or in connection with a transaction or services. Customer Personal Data may include names, contact details, identification and verification information, nationality and residency information, taxpayer identification numbers, voiceprints, bank account and transactional information (where legally permissible), to the extent that these amount to personal data under POPIA. |
| Payment beneficiaries: Bank Account Number, Currency Code, Bank Account Id, Bank Account Type; beneficiary address, transaction details; payment narrative. |
||
| Employees: Name; Employee ID number, Business Contact Details (Address / Telephone Number / Email Address) |
Cross-border flows of Personal Information:
Section 72 of POPIA provides that Personal Information may only be transferred out of the Republic of South Africa if the:
- recipient country can offer such data an “adequate level” of protection. This means that its data privacy laws must be substantially similar to the Conditions for Lawful Processing as contained in POPIA; or
- Data Subject consents to the transfer of their Personal Information; or
- transfer is necessary for the performance of a contractual obligation between the Data Subject and the Responsible Party; or
- transfer is necessary for the performance of a contractual obligation between the Responsible Party and a third party, in the interests of the Data Subject; or
- transfer is for the benefit of the Data Subject, and it is not reasonably practicable to obtain the consent of the Data Subject, and if it were, the Data Subject, would in all likelihood provide such consent.
When making authorised disclosures or transfers of Personal Information in terms of section 72 of POPIA, Personal Data may be disclosed to recipients located in countries which do not offer a level of protection for those data as high as the level of protection as South Africa.
7. Applicable Legislation (SECTION 51(1)(c))
| REFERENCE | ACT |
|---|---|
| Companies Act | No. 71 of 2008 |
| Employment Equity Act | No. 55 of 1998 |
| Labour Relations Act | No. 66 of 1995 |
| Basic Conditions of Employment Act | No. 75 of 1997 |
| Unemployment Insurance Act | No. 63 of 2001 |
| Unemployment Insurance Contributions Act | No. 4 of 2002 |
| Pension Funds Act | No. 24 of 1956 |
| Compensation for Occupational Injuries and Health Diseases Act |
No. 130 of 1993 |
| Occupational Health and Safety Act | No. 85 of 1993 |
| Skills Development Act | No. 97 of 1998 |
| Skills Development Levies Act | No. 9 of 1999 |
| Financial Advisory and Intermediary Services Act | No. 37 of 2002 |
| Consumer Protection Act | No. 68 of 2008 |
| National Credit Act | No. 34 of 2005 |
| Income Tax Act | No. 80 of 1961 |
| Value Added Tax Act | No. 89 of 1991 |
| Copyright Act | No. 98 of 1978 |
| Trade Marks Act | No. 194 of 1993 |
| Secondhand Goods Act | No. 6 of 2009 |
| Electronic Communications and Transactions Act | No. 25 of 2002 |
| Insolvency Act | No. 24 of 1936 |
| Short-Term Insurance Act | No. 53 of 1998 |
| Promotion of Access to Information Act | No. 2 of 2000 |
| Protection of Personal Information Act | No. 4 of 2013 |
| Broad-Based Black Economic Empowerment Act | No. 53 of 2003 |
| Civil Proceedings Evidence Act | No. 25 of 1965 |
| Competitions Act | No. 89 of 1998 |
| Constitution of the Republic of South Africa Act | No. 108 of 1996 |
| Customs and Excise Act | No. 91 of 1964 |
| Finance Act | No. 2 of 2007 |
| Regulation of Interception of Communication and Communication Related Act |
No. 70 of 2002 |
8. Stellantis South Africa Records (SECTION 51(1)(d))
8.1 Company Record Classification Key
| CLASSIFICATION NUMBER |
CLASSIFICATION | ACCESS |
|---|---|---|
| 1 | Public Access Documents | May Be Disclosed |
| 2 | Request After Commencement of Criminal or Civil Proceedings (Section 7) |
May Not Be Disclosed |
| 3 | Subject to Copyright | May Be Disclosed |
| 4 | Health information that belongs to the requestor of that information (Section 61) |
Limited Disclosure |
| 5 | Unreasonable disclosure of personal information of natural person (Section 63(1)) |
May Not Be Disclosed |
| 6 | Likely to harm commercial or financial interests of third party (Section 64(a)-(b)) |
May Not Be Disclosed |
| 7 | Likely to harm Stellantis South Africa or third party in contract or other negotiations (Section 64(c)) | May Not Be Disclosed |
| 8 | Would breach a duty in confidence owed to a third party (Section 65) |
May Not Be Disclosed |
| 9 | Likely to compromise the safety of individuals or protection of property (Section 66) |
May Not Be Disclosed |
| 10 | Legally Privileged Document (Section 67) | May Not Be Disclosed |
| 11 | Environmental testing/investigation which reveals public safety/environmental risks (Sections 64(2); 68(2)) |
May Not Be Refused |
| 12 | Commercial Information of Private Body (Section 68) |
May Not Be Disclosed |
| 13 | Likely to prejudice research and development information of Stellantis South Africa or a third party (Section 69) | May Not Be Disclosed |
| 14 | Disclosure in Public Interest (Section 70) | May Not Be Refused |
8.2 Stellantis South Africa Records Availability
| DEPARTMENT | RECORD DESCRIPTION | AVAILABILITY (REFER TO CLASSIFICATION NUMBER) |
|---|---|---|
| Communications/Public Relations | Product Information | 1 |
| Communications/Public Relations | Public Corporate Records | 1 |
| Communications/Public Relations | Media Releases | 1 |
| Human Resources | Staff Records | 4; 5; 9 |
| Human Resources | Employment Contracts | 4; 5 |
| Human Resources | Policies and Procedures | 4 |
| Human Resources | Health & Safety | 4; 5; 8 |
| Human Resources | Payroll Records | 4; 5 |
| Legal/Secretarial | General Contract Documentation | 6; 12 |
| Legal/Secretarial | Trademarks | 1 |
| Legal/Secretarial | Statutory Records | 12 |
| Marketing | Market Information | 12; 13 |
| Marketing | Customer Information | 1 |
| Marketing | Field Records | 4; 12 |
| Marketing | Performance Records | 12 |
| Marketing | Product Sales Records | 1 |
| Marketing | Marketing Strategies | 12 |
| Marketing | Customer Database | 12 |
| Marketing | Dealer Franchise Documents | 6; 7; 12; 13 |
| Marketing | Launch & Events Records | 4; 5 |
| Products/Logistics | Production Records | 12 |
| Production Engineering | Vehicle & Components | 3; 12; 13 |
| Production Engineering | Specifications Engineering Records | 12; 13 |
| Quality | Quality Records | 12 |
| Financial | Audited Financial Records | 12 |
| Financial | Asset Register | 12 |
| Financial | Tax Records | 4; 12 |
| Supplier Records | 4; 5 | |
| Management Accounts | 12 |
9. The Request Procedures
9.1 Who May Request Information
The PAIA Act provides that a requester is only entitled to access a record required for the exercise or protection of a right. Only requests for access to a record, where the requester has satisfied the Information Officer that the record is required to exercise or protect a right, will be considered. A requester may act in different capacities in making a request for a record. This will influence the amount to be charged when a request has been lodged.
Requesters may make a request as:
- A personal requester who requests a record about him/herself;
- An agent requester who requests a record on behalf of someone else with that person’s consent and where it is required for the protection of that person’s legal right;
- A third party requester who requests a record about someone else with that person’s consent and where it is required for the protection of that person’s legal right; and
- A public body who may request a record if:
- It fulfils the requirements of procedural compliance;
- The record is required for the exercise or protection of a right; and
- No grounds for refusal exist.
9.2 Form Request (SECTION 51(1)(e))
- The requester must use the prescribed form available on https://www.justice.gov.za/forms/paia/J752_paia_Form%20C.pdf to make the request for access to a record. This request must be made to the address set out in Clause 2 of this PAIA Manual.
- It is important to note that an application for access to information can be refused in the event that the application does not comply with the procedures required in terms of the PAIA Act.
- The requester must provide sufficient detail on the request form to enable the head of Stellantis South Africa to identify the record and the requester. The requester should indicate which form of access is required. The requester should also indicate if any other manner is to be used to inform the requester and state the necessary particulars to be so informed.
- The requester must identify the right that is sought to be exercised or to be protected and provide an explanation of why the requested record is required for the exercise or protection of that right.
- If a request is made on behalf of another person, the requester must then submit proof of the capacity in which the requester is making the request to the satisfaction of the head of Stellantis South Africa.
- Decisions made by the head of Stellantis South Africa are final. A requester is, however, entitled to approach a court with the necessary jurisdiction, or the Information Regulator, if access is denied.
- If it is reasonably suspected that the requester has obtained access to Stellantis South Africa records through the submission of materially false or misleading information, legal proceedings may be instituted against such requester.
- The requester must use the prescribed form available on https://www.justice.gov.za/inforeg/legal/20181214-gg42110-rg10897-gon1383- POPIregister.pdf to object to the processing of Personal Information, request for collection or deletion of Personal Information, or destruction or deletion of record of Personal Information.
9.3 Prescribed Fee (SECTION 51(1)(f))
- A requester who seeks access to a record containing Personal Information about that requester is not required to pay the request fee. Every other requester, who is not a personal requester, must pay the required request fee.
- The head of Stellantis South Africa will notify the requester (other than a personal requester) by notice, requiring the requester to pay the prescribed fee before further processing the request.
- The fee that the requester must pay to Stellantis South Africa is R50. The requester may lodge an application to the court against the tender or payment of the request fee.
- After the head of Stellantis South Africa has made a decision on the request, the requester will be notified in the required form.
- If the request is granted then a further access fee will be payable for the search reproduction, preparation and for any time that has exceeded the prescribed hours (currently six) to search and prepare the record for disclosure. One third of the fee will become payable as a deposit by the requester.
- Postage is payable when a copy of a record must be posted to a requester.
10. Fee Structure
| NO | ITEM | AMOUNT |
|---|---|---|
| 1 | For every photocopy of an A4-size page or part thereof |
R1,10 |
| 2 | For every printed copy of an A4-size page or part thereof held on a computer or in electronic or machine-readable form |
R0,75 |
| 3 | For a copy in a computer-readable form on – Stiffy disc Compact disc USB or any other external storage device |
R7,50 R70,00 R70,00 |
| 4 | For a transcription of visual images, for an A4-size page or part thereof For a copy of visual images |
R40,00 R60,00 |
| 5 | For a transcription of an audio record, for an A4-size page or part thereof For a copy of an audio record |
R20,00 R30,00 |
| 6 | The request fee payable by a requester, other than a person requester |
R50,00 |
| 7 | To search for the record of disclosure | R30,00/Hour |
11. Notification
Stellantis South Africa will within 30 (Thirty) days of receipt of the request decide whether to grant or decline the request, may be extended for a further period of not more than 30 (Thirty) days, if the request is for a large volume of information, or the request requires a search for information held at another office of Stellantis South Africa and the information cannot reasonably be obtained within the original 30
(Thirty) day period. Stellantis South Africa will notify the requester in writing should an extension be sought.
If the request for access to a record is successful, the requester will be notified of the following:
- The amount of the access fee payable gaining access to the record;
- An indication of the form in which the access will be granted; and
- Notice that the requester may lodge an application with a court against the payment of the access fee and the procedure, including the period for lodging the application.
- If the request for access to a record is not successful, the requester will be notified of the following:
- Adequate reasons for the refusal, and
- That the requester may lodge an application with a court against the refusal of the request and the procedure, including the period for lodging the application.
12. Grounds for Refusal of Access to Records
The 30 (Thirty) day period within which the Information Officer is required to reply to a request, as stipulated in the Act, shall commence only once a requester has compiled with all the requirements of the Act in requesting access to a record, to the satisfaction of the Information Officer.
Requests may be refused on the following grounds, as set out in the Act:
- Mandatory protection of privacy of a third party who is a natural person, including a deceased person, which would involve the unreasonable disclosure of Personal Information of that natural person;
- Mandatory protection of commercial information of a third party or Stellantis South Africa, if the record contains:
- Trade secrets of the third party or Stellantis South Africa;
- Financial, commercial, scientific or technical information which disclosure could likely cause harm to the financial or commercial interests of the third party or Stellantis South Africa; and
- Information disclosed in confidence by a third party or Stellantis South Africa if the disclosure of the record would result in a breach of a duty of confidence owed to that party in terms of an agreement;
- Mandatory protection of the safety of individuals, and the protection of property;
- Mandatory protection of records privileged from production in legal proceedings, unless the legal privilege has been waived; and
- Mandatory protection of research information of a third party and of Stellantis South Africa.
13. Appeal
If a requester is aggrieved by the refusal of the Information Officer to grant a request for a record, the requester may, within 30 (Thirty) days of notification of the Information Officer’s decision, apply to court for appropriate relief.