This PAIA Manual explains what records A Spot of Innovation (Pty) Ltd (“Spot”) holds, how to request access to them, and how Spot processes personal information for lawful purposes related to its operations and the court-mandated settlement administration work.

• See which records are available without a formal request.
• Understand how to submit a formal request under PAIA.
• Find contact details for the Information Officer.
• Learn what data Spot processes, why, and how it is protected.

The Information Regulator publishes a user guide on how to exercise rights under PAIA and POPIA. The guide is available in all official languages and Braille from the Regulator and may be downloaded from their website.

Records may also be available or governed under legislation such as the Companies Act, Income Tax Act, Labour Relations Act, POPIA, PAIA, ECTA, OHS Act, and others listed in the Manual.

Spot holds records across (among others): Company Secretarial, Authorisations & Licences, Financial, HR, Legal Services, Property, Marketing, IP, IT & Admin, Operations, Compliance and Website (Claimant portal, policies, etc.). Availability is subject to PAIA grounds of refusal and third-party protections.

Purpose: corporate governance and legal compliance; employee administration; court-mandated settlement administration (identify and communicate with potential class members, verify identities/vehicle/banking, administer claims and payments); supplier administration.

Data Subjects & typical data:

• Service providers (entity details, bank details, contacts)
• Employees/contractors (ID, contact, employment, banking)
• Potential/actual claimants (contact details, ID/company numbers, VINs & ownership history, banking)

Recipients: Banks (for verified pay-outs), RTMC/eNaTIS (VIN/vehicle verification), law firms and the High Court case manager (per court order), independent verification providers—strictly for settlement administration and legal compliance.

Cross-border: Where foreign law firms advise SA counsel, limited information may be shared for that purpose. Spot’s dedicated servers are hosted privately in South Africa; Microsoft 365 is configured for the African region.

• Physical security at privately hosted data centre (24/7 security).
• Role-based access control, MFA, IP allow-listing, audit logs; managed laptops.
• Network: DDoS mitigation, RPF protection, firewalls; AV scanning; encrypted personal data; weekly multi-server backups.
• Operational segregation (business IT vs application data); encryption keys required for access via app.
• Incident response with reporting to the Information Regulator; regular POPIA training; compliance reviews and audits.

1. Complete Form 2: Request for Access to Record (attach proof of identity and authority if acting for someone else).
2. Describe the record clearly (reference numbers if known), preferred format and delivery method.
3. Submit to the Information Officer at privacy@spotsettlements.co.za. A request fee may be payable.

Request and reproduction fees apply as prescribed in regulations (e.g., per-page photocopying/printing, media copies, transcriptions). You will be notified of any fees payable for search, preparation and reproduction before processing continues.

• On the website and at Spot’s head office during business hours.
• Available on request (reasonable fee may apply) and to the Information Regulator on request.