PAIA Manual

1. Company details

• Entity: Ovitoz (Pty) Ltd, a private body
• Location: Gauteng, South Africa
• Information Officer: Privacy & Compliance Officer
• Email: privacy@ovitoz.co.za
• Website: https://ovitoz.co.za

2. Purpose of this manual

This manual explains which records Ovitoz holds, how you can request access to them, and the rights you have over your personal information.

3. Guide from the Information Regulator

The Information Regulator publishes a guide on how to use PAIA and POPIA. It is available at inforegulator.org.za or from the Information Regulator, JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001 (enquiries@inforegulator.org.za).

4. Records held

• Company records: incorporation documents, statutory registers, minutes
• Financial records: statements, tax records, banking and invoices
• Member records: account details, consent and cookie-choice records, referral codes, activity summaries, Vitoz balances and voucher history
• Partner records: merchant agreements, campaign and redemption reports
• Operational records: policies, security logs, supplier and operator agreements

Records automatically available without a request include the content of this website and our published policies.

5. Processing of personal information (POPIA)

We process personal information to run member accounts, verify physical activity, award and redeem Vitoz, prevent fraud, support partners and meet legal duties. Categories include identity and contact details, device and health-activity summaries (with your consent), and partner business contacts. Information is shared only with operators bound by written agreements, and cross-border transfers happen only with adequate protection under Section 72 of POPIA. We use appropriate technical and organisational safeguards, including encryption at rest and in transit.

6. How to request access

• Complete Form 2 (Request for Access to Record) prescribed under the PAIA Regulations.
• Email it to privacy@ovitoz.co.za with proof of identity.
• Give enough detail to identify the record and the form of access you want.
• If you request on behalf of someone else, include proof of your authority.

We will decide on your request within 30 days. This may be extended once by up to a further 30 days, in which case we will tell you why.

7. Fees

Fees follow the PAIA Regulations. A request fee may apply to requests for records other than your own personal information, and an access fee may apply for search, preparation and reproduction. No request fee applies when you ask for your own personal information. We will tell you of any fee before processing, and a deposit may be required where the search takes longer than the prescribed hours.

8. Grounds for refusal

Access may be refused on the grounds in Chapter 4 of Part 3 of PAIA, including protection of third parties' personal information, commercial information, confidential information, safety of individuals and privileged records.

9. Your rights as a data subject

• Be told when your personal information is collected
• Access your personal information
• Ask for correction or deletion of your information (Form 2 under POPIA Regulations)
• Object to processing, including direct marketing (Form 1 under POPIA Regulations)
• Withdraw consent at any time
• Complain to the Information Regulator (complaints.IR@inforegulator.org.za)

10. Remedies

Ovitoz has no internal appeal procedure. If you are unhappy with a decision, you may complain to the Information Regulator within 180 days or apply to court.

11. Availability

This manual is available on our website and on request from privacy@ovitoz.co.za.