Privacy Policy, POPIA & PAIA Manual

Privacy Policy:

1. Introduction and Scope

1.1 Easy Rentals Group (Pty) Ltd (registration number 2022/767191/07) ("Easy Rentals Group", "ERG", "we", "us" or "our") respects the privacy of every person whose personal information it processes. This Privacy Policy explains how we collect, use, share, protect and retain personal information in compliance with the Protection of Personal Information Act 4 of 2013 ("POPIA").

1.2 This Policy applies to all personal information processed by Easy Rentals Group across its three service divisions:

1.2.1 Appliance Rentals, being the fixed-term rental of fridges, bar fridges, microwaves and combination packages;

1.2.2 Holiday Storage, being the collection, safekeeping and return of customers' belongings; and

1.2.3 Student Accommodation, being the letting of rooms at property owned by Easy Rentals Group.

1.3 This Policy applies to applicants, customers, tenants, guarantors, parents or guardians, website visitors and any other person who interacts with us through our website at www.easyrentalsgroup.co.za, our customer portal, WhatsApp, email, telephone or in person.

1.4 By submitting an application, creating a portal account or otherwise providing personal information to us, you acknowledge that you have read and understood this Policy. Where consent is required, we obtain it separately and expressly.

1.5 Definitions. In this Policy, unless the context indicates otherwise:

1.5.1 "personal information", "processing", "data subject", "responsible party" and "operator" have the meanings given to them in section 1 of POPIA;

1.5.2 "Customer" means any person who applies for or uses any service of Easy Rentals Group, including a tenant of the Student Accommodation division;

1.5.3 "Guarantor" means a person who agrees to be liable for, or to support, a Customer's obligations to Easy Rentals Group; and

1.5.4 "Portal" means the Easy Rentals Group online customer account and application system.

2. Responsible Party and Information Officer

2.1 Easy Rentals Group is the responsible party for the personal information described in this Policy.

2.2 All requests, objections and complaints relating to personal information must be directed to the Information Officer at the email address above, marked "Privacy Request".

3. Personal Information We Collect

3.1 We collect only the personal information that is adequate, relevant and necessary for the service a Customer applies for. The categories collected are set out below.

3.2 Guarantor information. Where a guarantor is required, we collect the guarantor's full name, identity number and copy of identity document, contact details, physical address and relationship to the Customer [and proof of income, if required]. The Customer must inform the guarantor that their information is being provided to us. Before relying on the guarantee, we notify the guarantor directly of the processing described in this Policy.

3.3 Information collected automatically. When you use our website or Portal, we collect technical information such as your IP address, device and browser type, login times, and records of documents accepted and electronically signed. We use this information for security, fraud prevention and to evidence your acceptance of agreements.

3.4 Information from third parties. We may receive personal information about you from a guarantor, parent or guardian, a courier, or our attorneys in the course of debt recovery.

3.5 Information we do not collect. We do not intentionally collect special personal information such as health, religious, biometric or criminal information. Customers should not include such information in any application or upload.

4. Age Requirement

4.1 Our services are available only to persons aged 18 years or older. By submitting an application, you confirm that you are at least 18 years of age.

4.2 We do not knowingly collect personal information from persons under 18. If we become aware that an applicant is under 18, we will decline the application and delete the information submitted, unless we are required by law to retain it.

5. Purposes and Lawful Basis for Processing

5.1 We process personal information only for specific, lawful purposes connected to our services, on the grounds permitted by section 11 of POPIA.

5.2 We will not use personal information for a purpose that is incompatible with the purpose for which it was collected, unless you consent or the law permits it.

5.3 We do not sell personal information. We do not use automated decision-making that produces legal effects for you; every application is reviewed by a member of our team.

6. Sharing of Personal Information

6.1 We share personal information only where necessary for the purposes in section 5. Where a third party processes information on our behalf, it acts as our operator and is bound by written terms requiring confidentiality and appropriate security measures, as required by sections 20 and 21 of POPIA.6.2 We may also disclose personal information where required by law, court order or a lawful request from a regulatory or law-enforcement authority, or where necessary to protect our legal rights or the safety of any person.

6.2 Our website and Portal are hosted in South Africa. However, some of the service providers listed in section 6 store or process information on servers located outside South Africa, including Google (Google Drive), Zoho (Zoho Mail) and WhatsApp (Meta).

6.3 We transfer personal information outside South Africa only where section 72 of POPIA permits it, namely where:

6.3.1 the recipient is subject to a law, binding corporate rules or a binding agreement providing an adequate level of protection substantially similar to POPIA; or

6.3.2 the transfer is necessary for the performance of your agreement with us; or

6.3.3 you have consented to the transfer.

6.4 By accepting this Policy, you acknowledge and consent to the transfer of your personal information to these service providers for the purposes described.

8. CCTV at the Storage Facility

8.1 We operate closed-circuit television (CCTV) cameras at our storage facility for the purposes of security, the protection of stored items, the prevention and investigation of theft or damage, and the safety of staff and visitors.

8.2 Signage is displayed at the facility to notify persons that CCTV is in operation.

8.3 Footage is accessible only to authorised personnel and is retained for [30] days, after which it is automatically overwritten. Footage relevant to an incident, claim or investigation is retained until that matter is finally resolved.

8.4 Footage may be disclosed to law-enforcement authorities, our insurers or our attorneys where necessary in connection with an incident.

9. Direct Marketing

9.1 We send marketing messages about our own services via WhatsApp. We do so only:

9.1.1 to persons who have given their express opt-in consent, which is requested separately from the acceptance of any agreement; or

9.1.2 to existing Customers, about similar services offered by Easy Rentals Group, in accordance with section 69(3) of POPIA.

9.2 Every marketing message identifies Easy Rentals Group and gives you a simple way to opt out. You may opt out at any time by replying "STOP" or by emailing info@easyrentalsgroup.co.za. Opting out does not affect service messages about your account, bookings or payments.

9.3 We do not share your contact details with third parties for their marketing purposes.

10. Security of Personal Information

10.1 We take appropriate, reasonable technical and organisational measures to prevent the loss of, damage to, unauthorised destruction of, and unlawful access to personal information, as required by section 19 of POPIA. These measures include:

10.1.1 secure, encrypted connections (HTTPS) for the website and Portal;

10.1.2 role-based access, so that staff can view only the information required for their duties;

10.1.3 confidentiality undertakings signed by all staff;

10.1.4 secure storage of physical documents at our premises; and

10.1.5 payment card details captured and processed by PayFast, a PCI DSS-compliant payment provider, and never stored by Easy Rentals Group.

10.2 You are responsible for keeping your Portal login details and password confidential. Notify us immediately if you suspect unauthorised access to your account.

10.3 If there are reasonable grounds to believe that your personal information has been accessed or acquired by an unauthorised person, we will notify the Information Regulator and you as soon as reasonably possible, in accordance with section 22 of POPIA.

11. Retention of Personal Information

11.1 We retain personal information only for as long as necessary to achieve the purpose for which it was collected, or as required by law, in accordance with section 14 of POPIA.

11.2 Where an account is in arrears, in dispute or handed over for recovery, we retain the relevant records until the matter is finally resolved, despite the periods above.

11.3 At the end of the retention period, personal information is securely deleted or destroyed, or de-identified so that it can no longer be linked to you.

12. Your Rights

12.1 Subject to POPIA, you have the right to:

12.1.1 be notified when your personal information is collected, and when it has been accessed by an unauthorised person;

12.1.2 request confirmation of whether we hold personal information about you, and request access to it;

12.1.3 request the correction or deletion of personal information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or unlawfully obtained;

12.1.4 request the destruction or deletion of personal information that we are no longer authorised to retain;

12.1.5 object to the processing of your personal information on reasonable grounds, where processing is based on legitimate interest;

12.1.6 object to direct marketing at any time;

12.1.7 withdraw consent where processing is based on consent, without affecting processing that took place before the withdrawal; and

12.1.8 lodge a complaint with the Information Regulator.

12.2 Requests must be submitted in writing to info@easyrentalsgroup.co.za. We may require proof of identity before acting on a request. We will respond within a reasonable time, and in any event within [30] days.

12.3 Requests for access to records are governed by the Promotion of Access to Information Act 2 of 2000. Our PAIA Manual is available on our website.

12.4 Some requests may limit our ability to provide a service. For example, we cannot administer an active agreement without your identity and contact details.

12.5 If you are not satisfied with our response, you may lodge a complaint with the Information Regulator:

[Confirm the Regulator's contact details on its website before publication.]

13. Cookies, Changes and Contact

13.1 Cookies. Our website uses essential cookies required for Portal login, security and session management. You may disable cookies in your browser settings, but the Portal may not function correctly without essential cookies.

13.2 Third-party links. Our website may contain links to third-party websites, including PayFast. We are not responsible for the privacy practices of those websites.

13.3 Changes to this Policy. We may update this Policy from time to time. The current version will always be published at www.easyrentalsgroup.co.za, with its effective date. Material changes will be communicated to active Customers by email or WhatsApp.

13.4 Contact. Questions about this Policy may be directed to:

The Information Officer Easy Rentals Group (Pty) Ltd 26985 First Avenue, Vista Park, Bloemfontein info@easyrentalsgroup.co.za · 063 852 9306

PAIA and POPIA Manual

Prepared in terms of section 51 of the Promotion of Access to Information Act 2 of 2000 ("PAIA"), as amended by the Protection of Personal Information Act 4 of 2013 ("POPIA").

1. Introduction and Purpose

1.1 PAIA gives effect to the constitutional right of access to information held by private bodies, where that information is required for the exercise or protection of any right.

1.2 This Manual sets out:

1.2.1 the contact details of Easy Rentals Group (Pty) Ltd and its Information Officers;

1.2.2 the categories of records held by Easy Rentals Group, and which records are available without a formal request;

1.2.3 the procedure and fees for requesting access to records; and

1.2.4 How Easy Rentals Group processes personal information, as required by POPIA.

1.3 Making a request in terms of this Manual does not guarantee access. Access may be refused on the grounds set out in PAIA.

2. Company and Contact Details

3. Guide by the Information Regulator

3.1 The Information Regulator has published a Guide on how to use PAIA and POPIA, as required by section 10 of PAIA. The Guide explains how to exercise the rights contained in PAIA and POPIA.

3.2 The Guide is available in all official languages on the Information Regulator's website at www.inforegulator.org.za, and copies may be inspected at the offices of Easy Rentals Group during business hours.

3.3 Information Regulator contact details:

4. Records Automatically Available

4.1 The following records are available without a formal request in terms of PAIA, on the Easy Rentals Group website or on request to the Information Officer:

4.1.1 information about our services, pricing and products published on the website;

4.1.2 the Website Terms of Use, Privacy Policy, and Cancellation and Refund Policy;

4.1.3 this Manual; and

4.1.4 marketing and promotional material.

5. Records Held in Terms of Legislation

5.1 Easy Rentals Group keeps records in accordance with the following legislation, as applicable to its business:

5.2 This list is not exhaustive. Records held under any other applicable legislation may be requested in terms of this Manual.

6. Categories of Records Held

7. Processing of Personal Information

7.1 This section sets out the information required by section 51(1)(c) of PAIA. Full details are contained in the Easy Rentals Group Privacy Policy, available at www.easyrentalsgroup.co.za.

7.2 Purposes of processing. Personal information is processed to assess applications; to conclude and administer rental, storage and accommodation agreements; to deliver, collect, store and return appliances and items; to receive payments; to recover overdue amounts; to secure our premises; to comply with legal obligations; and, with consent, for direct marketing.

7.3 Categories of data subjects and their information.

7.4 Cross-border transfers. Some service providers, including Google, Zoho and WhatsApp, process information outside South Africa. Such transfers take place only in accordance with section 72 of POPIA.

7.6 Security measures. Easy Rentals Group applies reasonable technical and organisational measures, including encrypted connections, Password authentication, role-based access, staff confidentiality undertakings, secure physical storage, and the processing of card payments by a PCI DSS-compliant provider.

8. Request Procedure

8.1 A request for access to a record must be made on the prescribed form (Form 2 of the PAIA Regulations), available on the Information Regulator's website or from the Information Officer, and submitted to the Information Officer by email or at the physical address in section 2.

8.2 The requester must:

8.2.1 provide sufficient detail to enable the record to be identified;

8.2.2 state the form of access required, such as a copy or an inspection;

8.2.3 identify the right the requester seeks to exercise or protect, and explain why the record is required for that purpose;

8.2.4 provide proof of identity; and

8.2.5 where the request is made on behalf of another person, provide proof of the capacity in which the request is made.

8.3 Personal information. A data subject who wishes to confirm whether Easy Rentals Group holds their personal information, or to obtain a description of it, may do so free of charge in terms of section 23 of POPIA. Requests to correct or delete personal information may be made in terms of section 24 of POPIA on the prescribed form.

8.4 Timelines. The Information Officer will decide on a request within 30 days of receiving it. This period may be extended once by up to a further 30 days where permitted by section 57 of PAIA, in which case the requester will be notified with reasons. A failure to respond within the applicable period is deemed to be a refusal.

8.5 Third parties. Where a request concerns a record containing information about a third party, the third party will be notified and given an opportunity to make representations before a decision is made, in accordance with section 71 of PAIA.

9. Grounds for Refusal and Remedies

9.1 Access to a record may be refused on the grounds set out in Chapter 4 of Part 3 of PAIA, including where disclosure would:

9.1.1 involve the unreasonable disclosure of personal information about a third party, including another customer or tenant;

9.1.2 disclose trade secrets, or financial, commercial or technical information of Easy Rentals Group or a third party, the disclosure of which could cause harm;

9.1.3 breach a duty of confidence owed to a third party;

9.1.4 endanger the life or physical safety of any person, or the security of property, including the storage facility; or

9.1.5 disclose records that are privileged from production in legal proceedings.

9.2 Easy Rentals Group will grant access despite these grounds where section 70 of PAIA requires disclosure in the public interest.

9.3 Where a request is refused, the requester will be informed of the reasons and of their rights to:

9.3.1 lodge a complaint with the Information Regulator within 180 days of the decision; or

9.3.2 apply to a court of competent jurisdiction for appropriate relief.

10. Fees

10.1 Fees are charged in accordance with the PAIA Regulations.

10.2 Where the search and preparation of a record is expected to exceed [6] hours, the requester may be required to pay a deposit of [one third] of the access fee before the search begins. The deposit is refunded if access is refused.

10.3 Records will not be released until all applicable fees have been paid.

11. Availability of this Manual

11.1 This Manual is available:

11.1.1 on the Easy Rentals Group website at www.easyrentalsgroup.co.za;

11.1.2 for inspection at our offices during business hours, free of charge; and

11.1.3 on request to the Information Officer, on payment of the prescribed copying fee where a printed copy is required.

12. Updating of this Manual

12.1 This Manual is reviewed at least annually, and updated whenever there is a material change to the information it contains, including changes to Information Officers, contact details, service providers or the categories of records held.