PAIA Manual

Manual in terms of section 51 of the Promotion of Access to Information Act 2 of 2000 ("PAIA"), incorporating the processing description required by the Protection of Personal Information Act 4 of 2013 ("POPIA")

This manual is available on our website at willandtrust.co.za/paia-manual/ and from the Information Officer on request (free of charge by email).

1. Purpose of this manual

PAIA gives effect to the constitutional right of access to information. This manual explains what records K2023120042 (South Africa) (Pty) Ltd t/a willandtrust.co.za (the "Company") holds, how to request access to them, the applicable fees, the grounds on which access may be refused, and how POPIA data-subject rights may be exercised.

2. Contact details of the Information Officer

All PAIA requests, POPIA requests, and related complaints and enquiries must be directed to:

Muhammad Khan — Information Officer K2023120042 (South Africa) (Pty) Ltd t/a willandtrust.co.za 185 Gingerbeer Road, Stanger, KwaZulu-Natal, 4450 Email: lunleamk@gmail.com

The Information Officer is registered (or in the process of registration) with the Information Regulator via the Regulator's e-Services portal, as required.

3. The Regulator's Guide on how to use PAIA (section 10)

The Information Regulator has published a Guide, in all official languages, on how to use PAIA. The Guide contains, among other things, an explanation of PAIA and its objects, the contact details of all Information Officers, the manner and form of a request, the assistance available from Information Officers and the Regulator, the remedies available, and all fees. The Guide is available from the Information Regulator:

Information Regulator (South Africa) JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001 Website: https://inforegulator.org.za/ General enquiries: enquiries@inforegulator.org.za Complaints: complaints.IR@inforegulator.org.za PAIA enquiries: PAIA@inforegulator.org.za

4. How to request a record (section 53)

4.1 A request for access to a record must be made on Form 2 (Request for Access to Record), prescribed under the PAIA Regulations, 2021, available from the Information Regulator's website or from our Information Officer on request.

4.2 The request must be sent to the Information Officer at lunleamk@gmail.com (or the physical address above) and must:

• identify the record, or provide enough detail to enable us to identify it;
• state the requester's identity, and proof of identity (and, where the request is made on behalf of another person, proof of the capacity in which the request is made);
• specify the form of access required (inspection, copy, electronic copy);
• state the right the requester seeks to exercise or protect, and why the record is required for that right (this does not apply to a personal requester — a person requesting access to a record containing their own personal information); and
• provide a postal address, email address or fax number in South Africa.

4.3 We will give reasonable assistance, free of charge, to help a requester complete or correct a deficient request before refusing it on formal grounds.

4.4 We will acknowledge the request, verify identity and authority, preserve potentially responsive records (suspending routine deletion), and decide the request within 30 calendar days of receipt, unless the period is lawfully extended (by up to a further 30 days, with written notice and reasons). The outcome is given in writing, with reasons for any refusal and the remedies available.

5. Fees (PAIA Regulations, 2021)

5.1 A personal requester (requesting their own personal information) pays no request fee, and only the prescribed access/reproduction fees, if any.

5.2 Any other requester must pay the prescribed request fee of R140.00 before the request is processed, plus the prescribed access fees for search, preparation and reproduction, and a deposit where preparation will take more than the prescribed hours. Current prescribed fees include (per the PAIA Regulations, 2021, Annexure C): R2.00 per A4 photocopy or printed page; R40.00 per electronic copy on a requester-supplied medium (or emailed free of charge where feasible); and R145.00 per hour (or part) for search and preparation exceeding the prescribed threshold. Fees are prescribed by regulation and may change; the current fee schedule is available from the Information Regulator, and we will confirm the applicable fees before processing.

5.3 No fee is charged for a POPIA data-subject request to confirm, free of charge, whether we hold personal information about the requester, or for an objection or a direct-marketing opt-out.

6. Records automatically available (no PAIA request needed)

The following are freely available without a formal request, at willandtrust.co.za or from the Information Officer:

• our Terms of Service (willandtrust.co.za/terms/);
• our Privacy Policy / POPIA section 18 notice (willandtrust.co.za/privacy/);
• this PAIA Manual (willandtrust.co.za/paia-manual/);
• public marketing material and website content; and
• our contact and company registration details.

7. Records available in terms of other legislation

Certain records may be requested under other legislation, where applicable, including: the Companies Act 71 of 2008 (company records); the Income Tax Act 58 of 1962 and Tax Administration Act 28 of 2011 (tax records); the Consumer Protection Act 68 of 2008; the Electronic Communications and Transactions Act 25 of 2002; POPIA (personal-information records); Basic Conditions of Employment Act 75 of 1997 and related labour legislation (employment records); and RICA 70 of 2002 (communication-related records).

8. Categories of records held by the Company

The listing of a category does not mean access to a record in it will be granted; every request is assessed under PAIA, including the grounds for refusal.

9. POPIA processing description (Regulation on PAIA manuals / POPIA s 17)

9.1 Purposes of processing. Responding to enquiries; qualifying needs; scheduling human follow-up; administering referrals to authorised advisors and product suppliers; direct marketing (with opt-in consent or under the existing-customer exception); call recording and transcription for quality, evidence and compliance; service improvement using de-identified data; keeping compliance, consent and suppression records; and meeting legal obligations.

9.2 Categories of data subjects and their personal information.

Special personal information (for example health information) and children's information are processed only where genuinely needed for the estate-planning journey, under an applicable POPIA authorisation, with heightened safeguards.

9.3 Recipients or categories of recipients. Authorised advisors and financial services providers to whom leads are referred with consent; product suppliers (including Capital Legacy); lenders (only with consent and where regulated steps are met); operators/service providers (CRM, telephony/dialer, hosting, messaging and AI vendors) under written POPIA operator contracts; and regulators, courts or others where the law requires.

9.4 Planned cross-border flows. Where service providers (for example cloud or AI vendors) are located outside South Africa, transfers occur only on a lawful basis under POPIA section 72 (comparable law, binding agreement or rules, consent, or contractual necessity). A register of each provider's country, purpose, transfer basis and safeguards is maintained and available from the Information Officer on request.

9.5 Security measures. Appropriate, reasonable technical and organisational measures are maintained under POPIA section 19, including access control, multi-factor authentication where available, encryption in transit and at rest where appropriate, logging and least-privilege access, secure credential management, backups and tested restore, and secure development and patching. Operators are bound by written contracts imposing equivalent safeguards, sub-operator controls and 72-hour breach notification to the Company. Security compromises are notified to the Information Regulator and affected data subjects as soon as reasonably possible under section 22.

10. POPIA data-subject requests

A data subject may, at any time, by contacting the Information Officer at lunleamk@gmail.com:

• request confirmation, free of charge, of whether the Company holds personal information about them, and request access to it (using Form 2 where a formal record request is made);
• request correction or deletion of personal information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or unlawfully obtained (Form 1 under the POPIA Regulations may be used);
• object to processing based on legitimate interests (Form 1);
• object to, or opt out of, direct marketing at any time, free of charge;
• withdraw consent previously given; and
• request human review of, make representations about, and request an explanation of the main logic of any decision alleged to be based solely on automated processing (POPIA section 71).

Requests are logged in our Data-Subject Request Register, identity is verified, potentially responsive records are preserved, and a written outcome with reasons and the complaint route is provided within a reasonable time.

11. Grounds for refusal and third-party procedure

Access to a record may or must be refused on the grounds in Chapter 4 of Part 3 of PAIA, including: mandatory protection of the privacy of a third party who is a natural person; mandatory protection of commercial information of a third party or of the Company (including trade secrets, financial, commercial, scientific or technical information whose disclosure would likely cause harm); mandatory protection of confidential information of third parties; protection of the safety of individuals and of property; protection of records privileged from production in legal proceedings; protection of research information; and requests that are manifestly frivolous or vexatious or would involve an unreasonable diversion of resources.

Where a requested record contains information about a third party, the Company will notify the third party under sections 71 to 73 of PAIA, give the third party the opportunity to make representations or consent, and take those representations into account before deciding the request. Severable portions of a record may be released where the remainder is protected.

No person may destroy, conceal, falsify or alter a record with the intention of denying a right of access under PAIA; doing so is an offence.

12. Remedies

If a request is refused, not answered within the statutory period (a deemed refusal), or the requester is aggrieved by a fee or form-of-access decision, the requester may:

1. Complain to the Information Regulator — using the Regulator's complaint form, at complaints.IR@inforegulator.org.za or via https://inforegulator.org.za/; and/or
2. Apply to a court with appropriate jurisdiction for relief.

Complaints about the processing of personal information under POPIA may likewise be lodged with the Information Regulator at the details above.

13. Availability and updating of this manual

This manual is available free of charge on our website (willandtrust.co.za/paia-manual/) and by email from the Information Officer, and will be made available through any additional channels the Information Regulator requires. The Information Officer reviews and updates this manual at least annually, and whenever there is a material change in our processing, operators, cross-border flows or the law.

---

Adopted on 7 July 2026 by K2023120042 (South Africa) (Pty) Ltd t/a willandtrust.co.za · Information Officer: Muhammad Khan · lunleamk@gmail.com · Version 1.0