PAIA and POPIA Manual

1. Introduction

The Promotion of Access to Information Act 2 of 2000 ("PAIA") gives effect to the right of access to information held by the State and by private bodies, as guaranteed by section 32 of the Constitution. The Protection of Personal Information Act 4 of 2013 ("POPIA") governs how personal information is processed and gives data subjects rights over their own information.

AI GPU Data Center (Pty) Ltd is a private body as defined in PAIA. This manual explains what records we hold, how to request access to them, what it costs, and what you can do if we refuse.

Publication of this manual does not create a right of access to any particular record. Access remains subject to the requirements and the grounds for refusal set out in PAIA.

This manual is available on our website at www.aigpudatacenter.co.za and at our registered office during business hours. It is published in English. A translation in another official language may be requested from the Information Officer.

---

2. Particulars of the private body

Head of the private body

Christiaan Frederik du Toit Mostert Director

Information Officer

Christiaan Frederik du Toit Mostert (Chris Mostert) Appointed 1 August 2026 Registered with the Information Regulator under registration number 2026-063540

Email: privacy@aigpudatacenter.co.za Telephone: 082 465 1328 Postal address: 5 Rhodes Street, Kensington B, Randburg, 2195

---

3. The PAIA Guide

The Information Regulator has compiled a guide, in terms of section 10 of PAIA, on how to use the Act. It explains in plain language how to exercise the right of access to information.

The guide is available from the Information Regulator:

Information Regulator (South Africa) JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001 P.O. Box 31533, Braamfontein, Johannesburg, 2017 Telephone: 010 023 5200 Website: https://inforegulator.org.za PAIA enquiries: PAIAComplaints.IR@inforegulator.org.za

---

4. Records available without a PAIA request

Certain records are available without following the PAIA request procedure:

• Information published on our website, including this manual, our Privacy Notice, Cookie Policy, Terms of Use, Disclaimer and Legal Information page
• Company registration information filed with, and publicly obtainable from, the Companies and Intellectual Property Commission
• Any records we are required by other legislation to make publicly available
• Records we make available voluntarily on request

If what you need falls into one of these categories, please simply ask — a formal PAIA request is not necessary.

---

5. Categories of records held

We hold, or may hold, records in the following categories. Listing a category does not mean that access to records in it will be granted.

5.1 Corporate and statutory records

Memorandum of Incorporation; certificate of incorporation and name-change certificates; company registration records; director records; shareholder records; resolutions and minutes; statutory registers.

5.2 Financial records

Accounting records; financial statements; management accounts; invoices and statements; tax records and returns; banking records; asset registers.

5.3 Tax, customs and regulatory records

SARS registration records for income tax, VAT and customs; importer and exporter registrations; B-BBEE affidavits and supporting records; POPIA compliance records including this manual, the Information Officer registration and any impact assessment.

5.4 Commercial records

Customer and prospective customer records; supplier records; quotations and proposals; contracts, capacity reservations and offtake agreements; non-disclosure agreements; commercial correspondence.

5.5 Technical and infrastructure records

Infrastructure design and planning documentation; technical specifications; capacity and power planning records; systems and network documentation; monitoring and operational records; security documentation and access-control records.

5.6 Human resources records

Employment contracts and personnel records; payroll records; recruitment and selection records; training records; records held in terms of the Basic Conditions of Employment Act 75 of 1997, the Labour Relations Act 66 of 1995, the Employment Equity Act 55 of 1998, the Skills Development Act 97 of 1998 and related legislation.

5.7 Website and enquiry records

Enquiries submitted through the website; related correspondence; website technical and security logs; privacy and PAIA requests and our responses to them.

5.8 Insurance, property and legal records

Insurance policies and claims; lease agreements and property records; legal opinions and correspondence; litigation records.

---

6. Legislation under which records are held

Records are held in terms of, among others: the Companies Act 71 of 2008; the Income Tax Act 58 of 1962; the Value-Added Tax Act 89 of 1991; the Tax Administration Act 28 of 2011; the Customs and Excise Act 91 of 1964; the Broad-Based Black Economic Empowerment Act 53 of 2003; the Basic Conditions of Employment Act 75 of 1997; the Labour Relations Act 66 of 1995; the Employment Equity Act 55 of 1998; the Compensation for Occupational Injuries and Diseases Act 130 of 1993; the Unemployment Insurance Act 63 of 2001; the Occupational Health and Safety Act 85 of 1993; the Electronic Communications and Transactions Act 25 of 2002; PAIA; and POPIA.

---

7. How to request access to a record

Step 1 — Complete the prescribed form

Use the form prescribed by the PAIA Regulations for a request for access to a record of a private body. The current forms are published by the Information Regulator at https://inforegulator.org.za and may be downloaded from there.

Step 2 — Give us enough detail

Your request must:

• provide sufficient detail to enable us to identify the record and to identify you
• give an address in the Republic to which we can send our decision, and a telephone number, fax number or email address if you have one
• state the form of access you would prefer — for example an electronic copy, a paper copy or an inspection
• state the right you are seeking to exercise or protect, and explain why the record you want is required to exercise or protect that right
• indicate if you wish to be told of the decision in any manner in addition to writing, and state how
• state on whose behalf you are making the request, if you are acting for someone else

Step 3 — Send it to the Information Officer

Email: privacy@aigpudatacenter.co.za Post: The Information Officer, AI GPU Data Center (Pty) Ltd, 5 Rhodes Street, Kensington B, Randburg, 2195

Step 4 — Pay the request fee

A request fee is payable, unless you are a personal requester asking for a record containing your own personal information. See section 8 below.

Step 5 — Our decision

We will decide whether to grant or refuse your request as soon as reasonably possible, and in any event within 30 days of receiving it. We will notify you of the decision in writing, with reasons if we refuse.

The 30-day period may be extended by a further period of not more than 30 days where the request is for a large number of records, or requires a search through a large number of records, and meeting the original deadline would unreasonably interfere with our activities. If we extend, we will tell you in writing before the first 30 days expire, and give our reasons.

If we grant the request, we will tell you what access fee is payable and in what form access will be given. Access is provided once the access fee is paid.

---

8. Fees

Two fees may apply under PAIA:

• A request fee, payable when you submit the request. A personal requester — someone requesting a record that contains their own personal information — does not pay a request fee.
• An access fee, payable before access is given, calculated according to the time spent searching for and preparing the record, and the format in which it is provided.

The request fee, deposit and access fees are those prescribed by the PAIA Regulations in force at the time of the request. Because the prescribed amounts are set by regulation and are amended from time to time, we will confirm the exact amounts payable in writing when we acknowledge your request, together with our banking details.

We may require a deposit where we estimate that preparation will take more than the prescribed number of hours. We will tell you the amount before doing the work.

---

9. Grounds on which we may refuse

PAIA requires or permits a private body to refuse access in defined circumstances. We may refuse a request where the record:

• contains personal information about a third party, and disclosure would be unreasonable (section 63)
• contains commercial information of a third party, including trade secrets, financial or commercial information that could harm them, or information supplied in confidence in a tender or contract process (section 64)
• was supplied in confidence and disclosure would breach a duty of confidence owed to a third party (section 65)
• could reasonably be expected to endanger the life or physical safety of a person, or prejudice the security of property or a system for protecting people, property or the public (section 66)
• is privileged from production in legal proceedings (section 67)
• contains our own trade secrets, or financial, commercial, scientific or technical information the disclosure of which would harm our commercial or financial interests, or information supplied in confidence in a contractual or negotiation context (section 68)
• contains information about research being carried out by or on behalf of a third party or ourselves, where disclosure would expose the researcher, the subject matter or the research to serious disadvantage (section 69)

Where a ground for refusal applies to only part of a record, we will give access to the remainder if it can reasonably be severed.

Section 70 provides that access must nevertheless be granted where disclosure would reveal a substantial contravention of the law or an imminent and serious public safety or environmental risk, and the public interest in disclosure clearly outweighs the harm.

Given the nature of our business, requests touching on infrastructure security, access controls, client identity, network design or client workload information are likely to engage sections 64, 65, 66 and 68. We will consider each request on its merits rather than applying a blanket refusal.

---

10. Remedies if we refuse

We are a private body, so there is no internal appeal. If you are dissatisfied with our decision, or if we fail to respond within the prescribed period — which is treated as a deemed refusal — you may:

• Lodge a complaint with the Information Regulator under section 77A of PAIA, using the prescribed complaint form, within 180 days; or
• Apply to a court with jurisdiction, under section 78 of PAIA, for appropriate relief.

Complaints to the Regulator go to:

Information Regulator (South Africa), JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001 PAIAComplaints.IR@inforegulator.org.za · https://eservices.inforegulator.org.za

---

11. POPIA — processing of personal information

11.1 Purposes of processing

We process personal information in order to respond to business enquiries, communicate with prospective and actual customers, manage business relationships, administer supplier and service-provider relationships, employ and manage staff, meet our statutory and regulatory obligations, and operate and secure our website.

11.2 Categories of data subjects and information

11.3 Recipients

Personal information may be shared with operators who provide services to us, with our professional advisers, and with regulators, courts and authorities where legally required. Our Privacy Notice lists the operators we currently use.

11.4 Transborder flows

Some technical services that support this website operate internationally. Where personal information is transferred outside the Republic, we do so in accordance with section 72 of POPIA. Our Privacy Notice sets out the current position.

11.5 Security measures

We apply reasonable technical and organisational measures to secure the integrity and confidentiality of personal information in our possession, in accordance with section 19 of POPIA, and we require our operators to do the same under written contract in accordance with section 21.

11.6 Your rights as a data subject

You may request access to, or correction or deletion of, your personal information; object to processing in the circumstances POPIA allows; withdraw consent where processing is based on consent; object to direct marketing; complain to the Information Regulator; and institute civil proceedings.

Requests should be sent to privacy@aigpudatacenter.co.za. Our Privacy Request page explains the process. Requests for access to records are handled under sections 7 to 10 of this manual.

---

12. Availability of this manual

This manual is available:

• on our website at www.aigpudatacenter.co.za/paia-manual/
• at our registered office at 5 Rhodes Street, Kensington B, Randburg, 2195, during business hours
• by email on request to privacy@aigpudatacenter.co.za

We will provide a copy free of charge on request.

---

13. Updating this manual

We will review this manual at least annually and update it whenever there is a material change to our records, our structure, our Information Officer or the applicable law.