PAIA manual

AUTOFUNDER (PROPRIETARY) LIMITED

Registration number 2026/777357/07

Prepared in terms of section 51 of the Promotion of Access to Information Act 2 of 2000 and Regulation 4 of the PAIA Regulations, 2021

Reference: AF/LEG/006 · Version 3 · 19 October 2026

1. List of acronyms and abbreviations

2. Purpose of this manual

2.1 This Manual is published in terms of section 51 of PAIA. It is useful to the public to:

– check the categories of records held by AutoFunder which are available without a person having to submit a formal PAIA request;

– have a sufficient understanding of how to make a request for access to a record of AutoFunder, by providing a description of the subjects on which AutoFunder holds records and the categories of records held on each subject;

– know the description of the records of AutoFunder which are available in accordance with any other legislation;

– access all the relevant contact details of the Information Officer and Deputy Information Officer who will assist the public with the records they intend to access;

– know the description of the guide on how to use PAIA, as updated by the Regulator, and how to obtain access to it;

– know whether AutoFunder will process personal information, the purpose of processing, and a description of the categories of data subjects and of the information or categories of information relating to them;

– know the recipients or categories of recipients to whom the personal information may be supplied;

– know whether AutoFunder has planned to transfer or process personal information outside the Republic and the recipients to whom it may be supplied; and

– know whether AutoFunder has appropriate security measures to ensure the confidentiality, integrity and availability of the personal information which is to be processed.

2.2 AutoFunder is a private body as defined in section 1 of PAIA. It operates a South African online car, finance and insurance marketplace. A buyer chooses a vehicle from dealer stock, uploads payslips and bank statements, receives an affordability view (the “Money Picture”) and applies once. The application is submitted to participating banks through the Seriti dealer finance platform under the relevant dealer’s codes. Banks decide whether to make offers. AutoFunder does not grant credit. Insurance quotes are obtained from insurers.

3. Key contact details for access to information

3.1 Requests for access to records of AutoFunder must be addressed to the Information Officer. Cameron Billson has been authorised in writing by the CEO, in terms of the definition of “head” in section 1 of PAIA, to act as Information Officer (resolution AF_LEG_004, with effect from 30 September 2026).

4. Guide on how to use PAIA and how to obtain access to the guide

4.1 The Regulator has, in terms of section 10(1) of PAIA, updated and made available the Guide, which contains information needed by any person who wishes to exercise any right contemplated in PAIA and POPIA.

4.2 The Guide is available in each of the official languages and in braille. It contains, among other things, a description of:

– the objects of PAIA and POPIA;

– the postal and street address, telephone number and e-mail address of the Information Officer of every public body and every Deputy Information Officer designated in terms of section 17(1) of PAIA and section 56 of POPIA;

– the manner and form of a request for access to a record of a public body (section 11) and a private body (section 50);

– the assistance available from the Information Officer of a public body and from the Regulator in terms of PAIA and POPIA;

– all remedies in law available regarding an act or failure to act in respect of a right or duty conferred or imposed by PAIA and POPIA, including the manner of lodging an internal appeal, a complaint to the Regulator and an application to court;

– the provisions of sections 14 and 51 of PAIA requiring public and private bodies to compile a manual, and how to obtain access to a manual;

– the provisions of sections 15 and 52 of PAIA providing for the voluntary disclosure of categories of records;

– the notices issued in terms of sections 22 and 54 of PAIA regarding fees to be paid in relation to requests for access; and

– the regulations made in terms of section 92 of PAIA.

4.3 Members of the public may inspect or make copies of the Guide from the offices of AutoFunder at the address in paragraph 3 during normal working hours, and from the Regulator’s website at https://inforegulator.org.za. A copy of the Guide may also be requested from the Information Officer at privacy@autofunder.co.za.

5. Categories of records available without a request

5.1 The following categories of records are automatically available, in terms of section 52 of PAIA, without a person having to request access in terms of PAIA:

5.2 A notice in terms of section 52(2) of PAIA has not been submitted to the Minister. Records listed above may be obtained free of charge, save for the cost of reproduction where a printed copy is requested.

6. Description of records available in accordance with other legislation

6.1 Records are kept in accordance with the following legislation, as amended, insofar as it applies to AutoFunder. Some records may be available only to the persons or bodies specified in the relevant Act:

6.2 Reference to legislation in this paragraph does not mean that every record mentioned is held by AutoFunder or that it is available on request. Access remains subject to PAIA, including the grounds for refusal summarised in paragraph 12.

7. Description of the subjects on which AutoFunder holds records and categories of records held

7.1 AutoFunder holds records on the following subjects. Inclusion of a category does not mean that access will be granted; each request is considered in terms of PAIA.

8. Processing of personal information

PURPOSE OF PROCESSING

8.1 AutoFunder processes personal information to:

– receive and assess vehicle finance applications and prepare the Money Picture affordability view;

– verify the identity of applicants against Home Affairs records;

– submit applications to participating banks through Seriti under the relevant dealer’s codes and relay offers to applicants;

– obtain insurance quotes from insurers;

– obtain the written consent of spouses of applicants married in community of property in terms of sections 15(2)(f) and 15(5) of the Matrimonial Property Act 88 of 1984;

– communicate with clients, including on WhatsApp, and pay cashbacks;

– provide an automated first indication through its in-house Intelligence Engine, subject to the right to human review in terms of section 71 of POPIA;

– manage relationships with dealers, suppliers, operators, employees and contractors;

– conduct direct marketing to persons who have consented, and operate its website (including cookies, after cookie consent);

– keep the platform secure, prevent fraud and comply with legal and regulatory obligations.

CATEGORIES OF DATA SUBJECTS AND PERSONAL INFORMATION

8.2 Description of the categories of data subjects and of the information or categories of information relating to them:

RECIPIENTS OR CATEGORIES OF RECIPIENTS

8.3 Personal information may be supplied to the following recipients, only to the extent necessary for the relevant purpose:

PLANNED TRANSBORDER FLOWS OF PERSONAL INFORMATION

8.4 AutoFunder’s primary hosting is in the Republic (Amazon Web Services, Cape Town). The following transfers outside the Republic are planned:

8.5 These transfers are made in terms of section 72(1)(a) of POPIA (the recipient is subject to a binding agreement providing an adequate level of protection) and section 72(1)(b) of POPIA (the data subject’s consent).

GENERAL DESCRIPTION OF INFORMATION SECURITY MEASURES

8.6 AutoFunder has implemented the following measures to secure the integrity and confidentiality of personal information:

– encryption of personal information at rest (using customer-managed keys) and in transit;

– access to systems through single sign-on with multi-factor authentication;

– least-privilege access, so that staff and agents can access only what their role requires;

– logging and monitoring of system activity, and a web application firewall;

– penetration testing before go-live;

– written agreements with operators in terms of sections 20 and 21 of POPIA;

– confidentiality undertakings signed by staff; and

– defined retention periods, after which personal information is deleted or de-identified.

9. Request procedure

9.1 A requester must comply with all the procedural requirements of PAIA. In terms of section 50 of PAIA, access to a record of a private body must be given if the record is required for the exercise or protection of any right, the requester complies with the procedural requirements, and access is not refused on any ground set out in PAIA.

9.2 A request must be made on Form 2 of the PAIA Regulations (Request for Access to Record) and submitted to the Information Officer by e-mail to privacy@autofunder.co.za or by post or hand delivery to the address in paragraph 3.

9.3 The requester must:

– provide sufficient particulars to enable the Information Officer to identify the record and the requester;

– indicate the form of access required;

– state a postal address or e-mail address in the Republic;

– identify the right the requester is seeking to exercise or protect and explain why the record is required for that purpose;

– state whether the requester wishes to be informed of the decision in any other manner, and the necessary particulars; and

– if the request is made on behalf of another person, submit proof of the capacity in which the request is made.

9.4 A requester who cannot read or write, or who has a disability, may make the request orally. The Information Officer will reduce the oral request to writing on Form 2 and give a copy to the requester.

9.5 Before access is given, the identity of a requester asking for personal information about themselves will be verified, so that personal information is not disclosed to the wrong person.

10. Fees

10.1 Fees are payable as prescribed in the PAIA Regulations. AutoFunder does not charge fees other than those prescribed.

10.2 Request fee. A requester, other than a personal requester, must pay the prescribed request fee before the request is processed. The Information Officer will notify the requester of the amount.

10.3 Access fee. If access is granted, the prescribed access fee is payable for the search, preparation and reproduction of the record and for postage, where applicable. If the search and preparation of the record will take longer than the time prescribed in the PAIA Regulations, the requester may be required to pay a prescribed deposit.

10.4 The record will not be released until the applicable fees have been paid. A requester may lodge a complaint with the Regulator, or apply to court, regarding the fees payable.

11. Decision on request and time periods

11.1 The Information Officer will decide on a request within 30 days of receiving it and notify the requester of the decision.

11.2 The 30-day period may be extended once, for a further period of not more than 30 days, if the request is for a large number of records, requires a search through a large number of records, requires consultation, or the requester consents. The requester will be notified in writing of the extension, the reasons for it and the right to lodge a complaint with the Regulator or apply to court against the extension.

11.3 If the Information Officer fails to respond within the period allowed, the request is regarded as having been refused (deemed refusal).

11.4 If a request concerns a record containing information about a third party, the third party will be notified and given an opportunity to make representations, as required by PAIA, before a decision is taken.

12. Grounds for refusal of access

12.1 Access may or must be refused on the grounds set out in Chapter 4 of Part 3 of PAIA (sections 62 to 70). In summary, these include:

12.2 In terms of section 70 of PAIA, access must nonetheless be given to a record if its disclosure would reveal evidence of a substantial contravention of, or failure to comply with, the law, or an imminent and serious public safety or environmental risk, and the public interest in disclosure clearly outweighs the harm contemplated.

12.3 If access is refused, the requester will be given adequate reasons, with reference to the relevant provisions of PAIA, and informed of the remedies available.

13. Remedies

13.1 AutoFunder does not have an internal appeal procedure. A requester or third party who is dissatisfied with a decision of the Information Officer (including a refusal, a deemed refusal, the fees charged, an extension of time or the form of access) may:

– lodge a complaint with the Regulator, in the prescribed form, within 180 days of the decision (sections 77A and 77B of PAIA); or

– apply to court for appropriate relief within 180 days, subject to the requirements of PAIA (sections 78 and 82 of PAIA).

13.2 The contact details of the Regulator are:

14. Availability of the manual

14.1 A copy of this Manual is available:

– on AutoFunder’s website at https://autofunder.co.za/paia;

– at AutoFunder’s registered office at 180 President Brand Road, Rynfield AH, Benoni, Gauteng, 1514, for public inspection during normal business hours;

– to any person on request, against payment of a reasonable amount for a printed copy, as prescribed; and

– to the Regulator on request.

15. Updating of the manual

15.1 The Information Officer will review this Manual at least once a year, and sooner if there is a material change to AutoFunder’s records, processing activities or contact details. The updated version will be published as described in paragraph 14.

Issued by:

Cameron Billson

Information Officer, AUTOFUNDER (Proprietary) Limited

Date: 19 October 2026

Version 3 · 19 October 2026