PAIA & POPIA manual

This manual is published by Mylz Auto (Pty) Ltd (“Mylz”) under section 51 of the Promotion of Access to Information Act 2 of 2000 (PAIA), as amended by the Protection of Personal Information Act 4 of 2013 (POPIA). It explains what records we hold, how you can request access to them, the fees involved and the grounds on which a request may be refused, and sets out the information about our processing of personal information that section 51(1)(c) of PAIA requires.

Mylz is a private body. It provides premium vehicle rental, chauffeur and related services in Cape Town and the Western Cape, including vehicles placed with it by private owners under vehicle management agreements.

Requests under PAIA and POPIA must be addressed to our Information Officer. Under PAIA and POPIA the head of a private body is its Information Officer, who may designate deputies. Our Information Officer is registered with the Information Regulator.

Telephone: +27 69 644 1767. Postal address: as in section 2.

The Information Regulator has compiled a guide, in each official language, on how to use PAIA and POPIA, as section 10 of PAIA requires. It explains your rights and the remedies available. You can obtain it from the Information Regulator's website at inforeg.org.za, or request a copy from our Information Officer, who will make it available for inspection or provide a copy during normal business hours.

Mylz has not published a notice under section 52 of PAIA. The following information is, however, freely available on our website without a formal request: our rental terms and conditions, privacy policy, cookie policy, cancellation policy, damage and deposit policy, complaints procedure, Owner Partner terms, website terms of use, this manual, our fleet, pricing information and protection plans.

Customers can view and download their own booking records, invoices and a copy of their personal information in their account.

We keep records as required by, among others, the following laws (where applicable to us):

• Companies Act 71 of 2008
• Income Tax Act 58 of 1962; Value-Added Tax Act 89 of 1991; Tax Administration Act 28 of 2011
• Basic Conditions of Employment Act 75 of 1997; Labour Relations Act 66 of 1995; Employment Equity Act 55 of 1998
• Unemployment Insurance Act 63 of 2001; Unemployment Insurance Contributions Act 4 of 2002; Skills Development Levies Act 9 of 1999
• Compensation for Occupational Injuries and Diseases Act 130 of 1993; Occupational Health and Safety Act 85 of 1993
• Consumer Protection Act 68 of 2008; Electronic Communications and Transactions Act 25 of 2002
• Protection of Personal Information Act 4 of 2013; Promotion of Access to Information Act 2 of 2000
• National Road Traffic Act 93 of 1996; Administrative Adjudication of Road Traffic Offences Act 46 of 1998
• Financial Intelligence Centre Act 38 of 2001 (reporting obligations); Cybercrimes Act 19 of 2020

Some of these records may be available only to the persons or authorities specified in the relevant law.

1. Complete the prescribed request form (Form 2, “Request for access to record”, under the PAIA Regulations), available on the Information Regulator's website (inforeg.org.za) or from our Information Officer.
2. Submit it to the Information Officer by e-mail to bookings@mylzrentals.co.za, or by post or hand delivery to the address in section 2.
3. Provide enough detail to identify the record(s) and yourself, state the form of access you want (for example a copy or inspection), give your contact details, and identify the right you want to exercise or protect and explain why the record is required for that purpose (section 53 of PAIA).
4. If you request on behalf of someone else, include proof of the capacity in which you make the request.
5. Pay the request fee (if applicable) and provide proof of payment.

If you are unable to read or write, or have a disability, you may make the request orally and the Information Officer will complete the form for you. To access your own personal information, you can also simply use your account or e-mail us — see our Privacy Policy (POPIA).

• Request fee: a requester (other than a person requesting their own personal information) must pay the request fee prescribed in the PAIA Regulations (currently R140 for requests to private bodies) before the request is processed.
• Access fee: if access is granted, an access fee is payable for reproduction, search and preparation of the record, and postage, at the rates prescribed in the PAIA Regulations.
• Deposit: if the search and preparation will take longer than the period prescribed in the Regulations, we may ask for a deposit of up to one third of the estimated access fee. If access is refused, the deposit is refunded.

Fees are those prescribed in the PAIA Regulations as amended from time to time. We will tell you in writing of any fee before it is payable. Payment details are available from the Information Officer. Records are not released until fees are paid.

We may (and in some cases must) refuse access to a record on the grounds set out in Chapter 4 of Part 3 of PAIA, including:

• protecting the privacy of a third party who is a natural person, including a deceased person (section 63);
• protecting commercial information of a third party, such as an Owner Partner or supplier (section 64);
• protecting confidential information of a third party where disclosure would breach a duty of confidence (section 65);
• protecting the safety of individuals and the security of property, including our vehicles and tracking systems (section 66);
• records privileged from production in legal proceedings (section 67);
• our own commercial information, such as trade secrets, financial or commercial information and negotiating positions (section 68);
• research information of Mylz or a third party (section 69).

Despite these grounds, access must be granted where disclosure would reveal evidence of a substantial contravention of the law or an imminent and serious public safety or environmental risk, and the public interest clearly outweighs the harm (section 70). Requests that are manifestly frivolous or vexatious, or that would involve a substantial and unreasonable diversion of resources, may also be refused.

We will decide on your request within 30 days of receiving a complete request and notify you of the decision. We may extend this once by up to 30 days where section 57 of PAIA allows, and will tell you why. If we do not respond in time, the request is regarded as refused. Where a record contains third-party information, we will notify the third party and give them an opportunity to make representations as PAIA requires.

Mylz is a private body and has no internal appeal procedure. If you are dissatisfied with a decision (including a refusal, fees, an extension or the form of access), you may, within 180 days of the decision, lodge a complaint with the Information Regulator (inforeg.org.za, complaints.IR@inforeg.org.za) under section 77A of PAIA, or apply to a court with jurisdiction for appropriate relief under section 78.

• Concluding and performing vehicle rental, chauffeur and related agreements, including bookings, payments, handover and return;
• Verifying the identity, age and licences of drivers, and preventing fraud, theft and misuse of vehicles;
• Managing vehicles placed with us by Owner Partners, including statements, payouts and claims;
• Vehicle tracking, roadside assistance, accident management, damage assessment and claims;
• Traffic-fine nomination or redirection and toll administration;
• Employment, payroll and human-resources administration;
• Supplier and operator management, accounting, tax and statutory compliance;
• Information security, audit and legal claims;
• Customer service, direct marketing (with consent or to existing customers) and the loyalty programme.

• Customers and additional drivers: identity and contact details, ID/passport and licence details and images, selfie and liveness captures (which may include biometric information), verification results, booking and payment records, telematics data, claims and fines.
• Owner Partners: identity and contact details, banking details, tax and VAT numbers, vehicle ownership, licensing, finance and insurance details.
• Employees, chauffeurs and contractors: identity and contact details, employment records, remuneration, banking and tax details, licences and PrDPs, and limited health information where the law requires (for example occupational injury).
• Suppliers and operators: company details, contact persons, banking and B-BBEE information.
• Website and app users: account details, technical data and cookies.

Operators acting on our behalf (identity verification, payment gateways such as PayFast and Yoco, banks, e-mail and SMS delivery, hosting and cloud storage, vehicle tracking, roadside assistance, IT support); Owner Partners (limited vehicle-usage information); insurers, assessors, repairers and legal advisers; traffic, toll and tax authorities; SAPS, courts and regulators where required by law; debt collectors; and professional advisers and auditors.

Some operators, such as cloud hosting, e-mail delivery, identity verification and web-push services, may process personal information outside South Africa. Such transfers are made only in compliance with section 72 of POPIA: where the recipient is bound by law, binding corporate rules or an agreement providing adequate protection, where the transfer is necessary to perform a contract with the data subject, or with consent.

Encryption in transit and at rest of sensitive identifiers; private, access-controlled storage of identity documents and images; role-based access controls and two-factor authentication for staff; audit logging of access to and changes of records; password hashing, rate limiting and session controls; secure backups; written operator agreements; staff confidentiality undertakings and training; and security-compromise notification procedures under section 22 of POPIA.

This manual is available on our website at mylzrentals.co.za/paia-manual and on request from the Information Officer, free of charge (a printed copy may attract the prescribed reproduction fee). It will be updated whenever material changes occur; the “last updated” date at the top shows the current version.