have a sufficient understanding of how to make a request for access to a record of the body, by providing a description of the subjects on which the body holds records and the categories of records held on each subject;

know the description of the records of the body which are available in accordance with any other legislation;

access all the relevant contact details of the Information Officer and Deputy Information Officer who will assist the public with the records they intend to access;

know the description of the guide on how to use PAIA, as updated by the Regulator and how to obtain access to it;

know if the body will process personal information, the purpose of processing of personal information and the description of the categories of data subjects and of the information or categories of information relating thereto;

know the description of the categories of data subjects and of the information or categories of information relating thereto;

know the recipients or categories of recipients to whom the personal information may be supplied;

know if the body has planned to transfer or process personal information outside the Republic of South Africa and the recipients or categories of recipients to whom the personal information may be supplied; and

know whether the body has appropriate security measures to ensure the confidentiality, integrity and availability of the personal information which is to be processed.

3.KEY CONTACT DETAILS FOR ACCESS TO INFORMATION OF 4 SEASONS CAR HIRE CC

Chief Information Officer

Name: Wouter Evers

Email: w.evers@4seasons-car-rental.com

Access to information general contacts
w.evers@4seasons-car-rental.com

National or Head Office

Postal Address: 30 Topaz Street

Somerset West

7130

Physical Address: 30 Topaz Street

Somerset West

7130

Email: w.evers@4seasons-car-rental.com

Tel: (021) 855 5691

Website: https://www.4seasons-car-rental.com/

4.GUIDE ON HOW TO USE PAIA AND HOW TO OBTAIN ACCESS TO THE GUIDE

The Regulator has, in terms of section 10(1) of PAIA, as amended, updated and made available the revised Guide on how to use PAIA (“Guide”), in an easily comprehensible form and manner, as may reasonably be required by a person who wishes to exercise any right contemplated in PAIA and POPIA.

The Guide is available in each of the official languages and in braille.

The aforesaid Guide contains the description of

the objects of PAIA and POPIA;

the postal and street address, phone and fax number and, if available, electronic mail address of-

the Information Officer of every public body, and

every Deputy Information Officer of every public and private body designated in terms of section 17(1) of PAIA¹ and section 56 of POPIA²;

the manner and form of a request for-

access to a record of a public body contemplated in section 11³; and

access to a record of a private body contemplated in section 50⁴;

the assistance available from the IO of a public body in terms of PAIA and POPIA;

the assistance available from the Regulator in terms of PAIA and POPIA;

all remedies in law available regarding an act or failure to act in respect of a right or duty conferred or imposed by PAIA and POPIA, including the manner of lodging-

1 Section 17(1) of PAIA- For the purposes of PAIA, each public body must, subject to legislation governing the employment of personnel of the public body concerned, designate such number of persons as deputy information officers as are necessary to render the public body as accessible as reasonably possible for requesters of its records.

2 Section 56(a) of POPIA- Each public and private body must make provision, in the manner prescribed in section 17 of the Promotion of Access to Information Act, with the necessary changes, for the designation of such a number of persons, if any, as deputy information officers as is necessary to perform the duties and responsibilities as set out in section 55(1) of POPIA.

3 Section 11(1) of PAIA- A requester must be given access to a record of a public body if that requester complies with all the procedural requirements in PAIA relating to a request for access to that record; and access to that record is not refused in terms of any ground for refusal contemplated in Chapter 4 of this Part.

4 Section 50(1) of PAIA- A requester must be given access to any record of a private body if-

that record is required for the exercise or protection of any rights;
that person complies with the procedural requirements in PAIA relating to a request for access to that record; and
access to that record is not refused in terms of any ground for refusal contemplated in Chapter 4 of this Part.

an internal appeal;

a complaint to the Regulator; and

an application with a court against a decision by the information officer of a public body, a decision on internal appeal or a decision by the Regulator or a decision of the head of a private body;

the provisions of sections 14⁵ and 51⁶ requiring a public body and private body, respectively, to compile a manual, and how to obtain access to a manual;

the provisions of sections 15⁷ and 52⁸ providing for the voluntary disclosure of categories of records by a public body and private body, respectively;

the notices issued in terms of sections 22⁹ and 54¹⁰ regarding fees to be paid in relation to requests for access; and

the regulations made in terms of section 92¹¹.

Members of the public can inspect or make copies of the Guide from the offices of the public and private bodies, including the office of the Regulator, during normal working hours.

The Guide can also be obtained-

upon request to the Information Officer;
from the website of the Regulator (https://www.justice.gov.za/inforeg/).

5 Section 14(1) of PAIA- The information officer of a public body must, in at least three official languages, make available a manual containing information listed in paragraph 4 above.

6 Section 51(1) of PAIA- The head of a private body must make available a manual containing the description of the information listed in paragraph 4 above.

7 Section 15(1) of PAIA- The information officer of a public body, must make available in the prescribed manner a description of the categories of records of the public body that are automatically available without a person having to request access

8 Section 52(1) of PAIA- The head of a private body may, on a voluntary basis, make available in the prescribed manner a description of the categories of records of the private body that are automatically available without a person having to request access

9 Section 22(1) of PAIA- The information officer of a public body to whom a request for access is made, must by notice require the requester to pay the prescribed request fee (if any), before further processing the request.

10 Section 54(1) of PAIA- The head of a private body to whom a request for access is made must by notice require the requester to pay the prescribed request fee (if any), before further processing the request.

11 Section 92(1) of PAIA provides that –“The Minister may, by notice in the Gazette, make regulations regarding-

any matter which is required or permitted by this Act to be prescribed;
any matter relating to the fees contemplated in sections 22 and 54;
any notice required by this Act;
uniform criteria to be applied by the information officer of a public body when deciding which categories of records are to be made available in terms of section 15; and
any administrative or procedural matter necessary to give effect to the provisions of this Act.”

A copy of the Guide is also available in the following two official languages, for public inspection during normal office hours-

1. English And Afrikaans

5.CATEGORIES OF RECORDS OF 4 SEASONS CAR HIRE CC WHICH ARE AVAILABLE WITHOUT A PERSON HAVING TO REQUEST ACCESS

Category of records	Availability
PAIA Manual	Website or by email request
Contact Details	Website and business listings
Company Registration Information	Website or available via email request
Vehicle Rental Options & Pricing	Website
Branch Locations & Depots	Website
Terms & Conditions (e.g. Refund Policy)	Website
Privacy & Cookie Policies	Website
Booking Management Tools	Website
Rental Partners	Website

DESCRIPTION OF THE RECORDS 4 SEASONS CAR HIRE CC WHICH ARE AVAILABLE IN ACCORDANCE WITH ANY OTHER LEGISLATION

Category of Records	Applicable Legislation
PAIA Manual	Promotion of Access to Information Act (Act 2 of 2000)
Employment Contracts	Basic Conditions of Employment Act (Act 75 of 1997)
Health & Safety Reports	Occupational Health and Safety Act (Act 85 of 1993)
Tax Records (e.g. VAT, PAYE)	Income Tax Act (Act 58 of 1962) and Value Added Tax Act (Act 89 of 1991)
Financial Statements	Companies Act (Act 71 of 2008)
UIF Registration & Contributions	Unemployment Insurance Act (Act 63 of 2001)
COIDA Registration & Incident Reports	Compensation for Occupational Injuries and Diseases Act (Act 130 of 1993)
POPIA Compliance Documentation	Protection of Personal Information Act (Act 4 of 2013)
B-BBEE Certificates	Broad-Based Black Economic Empowerment Act (Act 53 of 2003)
Vehicle Licensing & Roadworthy Records	National Road Traffic Act (Act 93 of 1996)

7.DESCRIPTION OF THE SUBJECTS ON WHICH THE BODY HOLDS RECORDS AND CATEGORIES OF RECORDS HELD ON EACH SUBJECT BY 4 SEASONS CAR HIRE CC

Subjects on which the body holds records	Categories of records
Finance	Annual financial statements Invoices, receipts, and bank records Tax and VAT submissions Payroll records and budgets
Human Resources (HR)	Employee records and personal files Recruitment advertisements and applications HR policies and procedures Training and skills development documents
Operations	Health and safety reports Vehicle maintenance logs and incident reports Standard operating procedures (SOPs) Fleet usage and scheduling records
Supply Chain / Fleet Management	Vehicle acquisition and disposal records Supplier contracts and service agreements Inventory and parts tracking Insurance and registration documents
Legal & Compliance	PAIA Manual POPIA compliance documentation Licensing and regulatory certificates B-BBEE documentation
Customer Service & Bookings	Booking confirmations and rental agreements Customer feedback and complaint logs Refund and cancellation records Marketing and promotional materials

8.PROCESSING OF PERSONAL INFORMATION

8.1Purpose of Processing Personal Information

4 Seasons Car Hire CC collects and uses personal information for operational purposes, in line with South African privacy and data protection laws:

Facilitating vehicle rentals, bookings, and related services.
Verifying identity and driving credentials of clients (e.g., license and ID checks).
Drafting and managing rental agreements and legal documentation.
Communicating with clients regarding booking confirmations, vehicle availability, and service updates.
Managing marketing communications with consent, including newsletters, promotions, and travel alerts.
Ensuring regulatory and legislative compliance (e.g., POPIA, COIDA, SARS reporting).
Maintaining accurate records for accounting, fleet management, and administrative purposes.

8.2Description of the categories of Data Subjects and of the information or categories of information relating there to

Categories of Data Subjects

Personal Information that may be processed

Customers / Clients

Full name and surname

Physical or postal address

ID or passport number

Driver’s license details

Employment status

Bank account and payment details

Employees

Contact information (phone, email, address)

ID number and employment history

Tax number and payroll data

Leave and attendance records

Medical aid and provident fund membership

Suppliers / Contractors

Company name and registration number

Contact person’s name and details

Banking information

B-BBEE certificate and other compliance documents

Website Users / Enquirers

Name and contact details submitted via online forms

IP address and browser data

Booking preferences and rental history

Rental Partners

Business contact details

Partnership agreements and service records

Licensing and insurance documentation

8.3The recipients or categories of recipients to whom the personal information may be supplied

Recipients or Categories of Recipients to whom the personal information may be supplied	Purpose for Supplying Personal Information	Category of Personal Information
South African Police Service (SAPS)	Criminal background checks and legal compliance	ID numbers, driver’s license details, criminal history
Banks and Financial Institutions	Processing salary payments and verifying account details	Employee banking details, salary information
Debt Collection Agencies	Recovering outstanding accounts	Customer contact details, account balances, payment history
Benefit Administrators	Managing employee benefits such as medical aid and pensions	ID numbers, medical aid and provident fund membership
Government Departments (e.g. SARS)	Statutory reporting and regulatory compliance	Tax numbers, UIF contributions, employment records
Insurance Providers	Underwriting policies and processing claims	Vehicle details, driver information, claim history
IT and System Service Providers	Maintaining secure systems and managing booking platforms	Usernames, email addresses, booking data
Rental Partners and Affiliates	Coordinating third-party or cross-border vehicle rentals	Booking details, customer contact information
Legal Advisors or Auditors	Ensuring legal compliance and conducting financial audits	Financial records, contracts, compliance documentation

8.4Planned transborder flows of personal information

4 Seasons Car Hire CC makes use of secure cloud-based services which may result in certain categories of personal information being stored or processed outside the Republic of South Africa.

Destination Country: United States

Cloud-based data storage and communication services through Microsoft 365 and related platforms.

Types of Information:

Employee information: names, contact details, HR and payroll records.
Client and prospective client information: email addresses, contact details, booking preferences, invoicing information.
General communication data: emails, shared documents, meeting notes.

8.5Personal information received from third parties

When we receive personal information from a third party on behalf of a data subject, we assume confirmation that they have written consent from the data subject that they are aware of the contents of this PAIA manual and the privacy policy, and do not have any objection to our processing their information in accordance with this policy.

8.6General description of Information Security Measures to be implemented by the responsible party to ensure the confidentiality integrity and availability of the information

4 Seasons Car Hire CC applies appropriate technical and organizational measures to safeguard personal information against loss, misuse, unauthorized access, or cyber threats. All protective actions are implemented in accordance with the Protection of Personal Information Act (POPIA) 4 of 2013 and industry best practices. Current security measures in place include:

Data Encryption
- Encrypts files, emails, and communications to prevent unauthorized access
- Applied to cloud storage, internal databases, and online booking systems

Antivirus and Anti-malware Software
- Installed on all employee devices
- Regularly updated to detect and block viruses, ransomware, and spyware

Firewalls and Network Security
- Protects internal systems from external threats and unauthorized access
- Monitors incoming and outgoing traffic for suspicious activity

Access Controls and User Authentication
- Role-based access to sensitive data
- Password protection and multi-factor authentication for system logins

Physical Security Measures
- Restricted access to office premises using keycards or biometric systems
- Secure storage of paper records in locked filing cabinets

Regular Backups and Data Recovery Plans
- Automated backups of critical data to prevent loss
- Disaster recovery protocols in place for system failures

Employee Training and Awareness
- Staff educated on data protection policies and cybersecurity best practices
- Ongoing training to identify phishing and social engineering threats

Compliance Monitoring
- Regular audits to ensure alignment with POPIA and other data protection laws
- Documentation of data handling procedures and breach response plans

Data Breaches

Where are the reasonable grounds to believe that the personal information of a data subject has been accessed or acquired by any unauthorized person, the body shall notify the Information Regulator and the data subject, unless the identity of such data subject cannot be established.

The notification will be made as soon as reasonably possible after the discovery of the compromise, taking into account the legitimate needs of law enforcement or any measures reasonably necessary to determine the scope of the compromise and to restore the integrity of the responsible party’s information system.

9.AVAILABILITY OF THE MANUAL

A copy of the Manual is available-

head office of 4 Seasons Car Hire CC for public inspection during normal business hours;
on their website

to any person upon request and upon the payment of a reasonable prescribed fee; and

to the Information Regulator upon request.

A fee for a copy of the Manual as contemplated in annexure B of the Regulations shall be payable per each A4-size photocopy made.

10.UPDATING OF THE MANUAL

The head of Webb Accountants (SA) will on a regular basis update this manual.

FORMS

The following forms are attached hereto for ease of reference:

Form 1: Request for a copy of the guide
Form 2: Request for access to record
Form 3: Outcome of request and fees payable
Form 5: Complaint form

Signed by

W. Evers

W. Evers

Director

BOOK YOUR VEHICLE :

RENTAL TYPE :

CAR/SUV RENTAL

CAMPER RENTAL

4X2/4x4 RENTAL

PICK UP LOCATION

RETURN LOCATION

DRIVER AGE :

CURRENCY :

DRIVER'S COUNTRY OF RESIDENCE :

South Africa

International