PAIA Manual

SMART OPERATOR SA (Pty) Ltd

Prepared in terms of section 51 of the Promotion of Access to Information Act 2 of 2000 (as amended), read with the Protection of Personal Information Act 4 of 2013.

This Manual explains which records we hold, how to request access to them, and how we process personal information.

Who we are

SMART OPERATOR SA (Pty) Ltd ("Smart Operator", "we", "our", "us") is an AI research and deployment company registered in South Africa (No. 2025/828938/07) with its registered office at 2nd floor Sedgwick House, 24 Bloem Street, Cape Town, Western Cape, 8001, South Africa.

We are a wholly owned subsidiary of Smart Operator Ltd, registered in England and Wales (No. 13260272). We provide the Operating Performance System (OPS), an AI-powered operations and upskilling platform for the hospitality sector.

Our Information Officer is registered with the Information Regulator under registration number 2026-069925.

For more information, visit www.smart-operator.ai.

Manual Details
Date of last revision	21 October 2026
Version	1.1

1. List Of Acronyms And Abbreviations

The following acronyms and abbreviations have the meanings set out below throughout this Manual:

Term	Meaning
"CEO"	Chief Executive Officer;
"DIO"	Deputy Information Officer;
"Group"	Smart Operator Ltd (United Kingdom) and each of its subsidiaries, including Smart Operator;
"Guide"	the Guide on how to use PAIA, as updated and made available by the Regulator in terms of section 10 of PAIA;
"IO"	Information Officer;
"Manual"	this PAIA Manual;
"Minister"	Minister of Justice and Constitutional Development;
"PAIA"	Promotion of Access to Information Act 2 of 2000 (as amended);
"POPIA"	Protection of Personal Information Act 4 of 2013;
"Regulations"	the Regulations relating to the Promotion of Access to Information, 2021, made in terms of section 92 of PAIA;
"Regulator"	Information Regulator (South Africa);
"Republic"	Republic of South Africa; and
"Smart Operator"	SMART OPERATOR SA (Pty) Ltd, registration number 2025/828938/07.

2. Purpose Of This PAIA Manual

This Manual is useful for the public to:

2.1check the categories of records held by Smart Operator which are available without a person having to submit a formal PAIA request;

2.2have a sufficient understanding of how to make a request for access to a record of Smart Operator, by providing a description of the subjects on which Smart Operator holds records and the categories of records held on each subject;

2.3know the description of the records of Smart Operator which are available in accordance with any other legislation;

2.4access all the relevant contact details of the Information Officer and Deputy Information Officer who will assist the public with the records they intend to access;

2.5know the description of the Guide on how to use PAIA, as updated by the Regulator, and how to obtain access to it;

2.6know if Smart Operator will process personal information, the purpose of processing of personal information and the description of the categories of data subjects and of the information or categories of information relating thereto;

2.7know the description of the categories of data subjects and of the information or categories of information relating thereto;

2.8know the recipients or categories of recipients to whom the personal information may be supplied;

2.9know if Smart Operator has planned to transfer or process personal information outside the Republic and the recipients or categories of recipients to whom the personal information may be supplied; and

2.10know whether Smart Operator has appropriate security measures to ensure the confidentiality, integrity and availability of the personal information which is to be processed.

3. Key Contact Details For Access To Information Of SMART OPERATOR SA (Pty) Ltd

3.1 Information Officer

Name	Servaas van Breda Malherbe
Designation	Chief Executive Officer and Director
Email	IO@smart-operator.ai
Regulator registration	2026-069925 (appointed 1 March 2026)

3.2 Deputy Information Officer

The following Deputy Information Officer is designated in terms of section 17(1) of PAIA and section 56 of POPIA:

Name	David Johannes Botha
Designation	Chief Technology Officer and Director
Email	IO@smart-operator.ai
Regulator registration	2026-069925 (appointed 1 March 2026)

3.3 Access to Information General Contacts

Administrator	Nicole van Rooyen, Chief Operating Officer and Director
Email	OPS@smart-operator.ai

3.4 National or Head Office

Postal Address	2nd floor Sedgwick House, 24 Bloem Street, Cape Town, Western Cape, 8001
Physical Address	2nd floor Sedgwick House, 24 Bloem Street, Cape Town, Western Cape, 8001
Email	OPS@smart-operator.ai
Website	www.smart-operator.ai

4. Guide On How To Use PAIA And How To Obtain Access To The Guide

4.1The Regulator has, in terms of section 10(1) of PAIA, as amended, updated and made available the revised Guide on how to use PAIA ("Guide"), in an easily comprehensible form and manner, as may reasonably be required by a person who wishes to exercise any right contemplated in PAIA and POPIA.

4.2The Guide is available in each of the official languages and in braille.

4.3The Guide contains the description of:

(a)the objects of PAIA and POPIA;
(b)the postal and street address, phone and fax number and, if available, electronic mail address of the Information Officer of every public body, and every Deputy Information Officer of every public and private body designated in terms of section 17(1) of PAIA and section 56 of POPIA;
(c)the manner and form of a request for access to a record of a public body contemplated in section 11, and access to a record of a private body contemplated in section 50;
(d)the assistance available from the Information Officer of a public body in terms of PAIA and POPIA;
(e)the assistance available from the Regulator in terms of PAIA and POPIA;
(f)all remedies in law available regarding an act or failure to act in respect of a right or duty conferred or imposed by PAIA and POPIA, including the manner of lodging an internal appeal, a complaint to the Regulator, and an application with a court against a decision by the information officer of a public body, a decision on internal appeal, a decision by the Regulator or a decision of the head of a private body;
(g)the provisions of sections 14 and 51 requiring a public body and private body, respectively, to compile a manual, and how to obtain access to a manual;
(h)the provisions of sections 15 and 52 providing for the voluntary disclosure of categories of records by a public body and private body, respectively;
(i)the notices issued in terms of sections 22 and 54 regarding fees to be paid in relation to requests for access; and
(j)the regulations made in terms of section 92.

4.4Members of the public can inspect or make copies of the Guide from the offices of the public and private bodies, including the office of the Regulator, during normal working hours.

4.5The Guide can also be obtained:

(a)upon request to the Information Officer; and
(b)from the website of the Regulator (inforegulator.org.za).

4.6A copy of the Guide is also available in the following two official languages, for public inspection during normal office hours at our head office: English and Afrikaans.

Statutory references

Section 17(1) of PAIA – each public body must designate such number of deputy information officers as are necessary to render it as accessible as reasonably possible for requesters of its records.

Section 56(a) of POPIA – each public and private body must make provision, in the manner prescribed in section 17 of PAIA, for the designation of such number of deputy information officers as is necessary to perform the duties set out in section 55(1) of POPIA.

Section 50(1) of PAIA – a requester must be given access to any record of a private body if (a) that record is required for the exercise or protection of any rights; (b) that person complies with the procedural requirements in PAIA relating to a request for access to that record; and (c) access to that record is not refused in terms of any ground for refusal contemplated in Chapter 4 of Part 3 of PAIA.

Section 51(1) of PAIA – the head of a private body must make available a manual containing the information listed above. Section 52(1) – the head of a private body may, on a voluntary basis, make available a description of the categories of records that are automatically available. Section 54(1) – the head of a private body must by notice require the requester to pay the prescribed request fee (if any) before further processing the request.

Section 92(1) of PAIA – the Minister may, by notice in the Gazette, make regulations regarding any matter required or permitted by PAIA to be prescribed, fees, notices, and any administrative or procedural matter necessary to give effect to PAIA.

5. Categories Of Records Of SMART OPERATOR SA (Pty) Ltd Which Are Available Without A Person Having To Request Access

The following categories of records are automatically available without a person having to request access in terms of PAIA. They may be downloaded from our website or requested by email to the Information Officer.

Category of records	Types of the record	Available on website	Available upon request
Legal and policy documents	Terms of Service (including Schedule 1: Data Processing Terms); Privacy Policy; this PAIA Manual	✓	✓
Company information	Company name, registration number, registered office and directors, as recorded with the Companies and Intellectual Property Commission		✓
Product and service information	Descriptions of the OPS platform, products, services and courses; marketing and promotional material	✓	✓
Communications	Press releases, published articles and public announcements	✓	✓

6. Description Of The Records Of SMART OPERATOR SA (Pty) Ltd Which Are Available In Accordance With Any Other Legislation

Smart Operator holds records in terms of the following legislation, where applicable to it. This list is not exhaustive, and access to these records remains subject to PAIA and the legislation concerned.

Category of Records	Applicable Legislation
Memorandum of Incorporation; securities register; register of directors; minutes and resolutions; annual financial statements	Companies Act 71 of 2008
PAIA Manual	Promotion of Access to Information Act 2 of 2000
Records of personal information processing; Information Officer registration	Protection of Personal Information Act 4 of 2013
Tax returns, assessments and supporting records; employees' tax records	Income Tax Act 58 of 1962; Tax Administration Act 28 of 2011
Value-added tax records	Value-Added Tax Act 89 of 1991
Employment contracts, payroll, leave and working time records	Basic Conditions of Employment Act 75 of 1997; Labour Relations Act 66 of 1995
Employment equity records	Employment Equity Act 55 of 1998
Workplace injury and compensation records	Compensation for Occupational Injuries and Diseases Act 130 of 1993
Unemployment insurance records and contributions	Unemployment Insurance Act 63 of 2001; Unemployment Insurance Contributions Act 4 of 2002
Skills development and levy records	Skills Development Act 97 of 1998; Skills Development Levies Act 9 of 1999
Health and safety records	Occupational Health and Safety Act 85 of 1993
Exchange control approvals and cross-border funding records	Currency and Exchanges Act 9 of 1933 and the Exchange Control Regulations
Electronic transactions and communications records	Electronic Communications and Transactions Act 25 of 2002
Consumer transaction records	Consumer Protection Act 68 of 2008
Intellectual property assignments and licences	Copyright Act 98 of 1978

7. Description Of The Subjects On Which The Body Holds Records And Categories Of Records Held On Each Subject By SMART OPERATOR SA (Pty) Ltd

Subjects on which the body holds records	Categories of records
Corporate governance and statutory	Memorandum of Incorporation; statutory registers; board and shareholder resolutions and minutes; CIPC filings; Group structure records
Finance and tax	Accounting records; annual financial statements; management accounts; budgets and forecasts; banking records; invoices; tax and VAT records; intercompany agreements; exchange control records
Human resources	HR policies and procedures; employment and consultant contracts; payroll and benefit records; leave records; performance records; recruitment records and advertised posts; disciplinary records; training records
Commercial	Customer agreements and order records; partner, reseller and affiliate agreements; non-disclosure agreements; proposals and quotations; customer correspondence
Platform and technology	OPS platform account records; user and Operator records; usage, billing and AI credit records; system logs; security and access records; software and system documentation
Intellectual property	Source code; AI models, prompts and configurations; course and learning content; trade marks and brand assets; IP assignment and licence agreements
Learning and upskilling	Course materials; assessment and completion records; certification records
Suppliers and procurement	Supplier and service provider agreements; operator (sub-processor) agreements; purchase records
Marketing and communications	Marketing material; website content; newsletter and contact lists; consent records
Legal and compliance	Legal opinions; litigation records; regulatory correspondence; POPIA and PAIA compliance records; insurance policies
Property and premises	Lease agreements; office administration records

8. Processing Of Personal Information

8.1 Purpose of Processing Personal Information

Smart Operator processes personal information lawfully and only for specific, explicitly defined and legitimate purposes related to its functions and activities, including to:

(a)provide, operate, support, secure and improve the OPS platform and our products, services and courses;
(b)register and administer customer and user accounts, including the Operators who use the platform on behalf of our customers;
(c)process personal information on behalf of our customers as an operator, in accordance with our Terms of Service and Schedule 1: Data Processing Terms;
(d)conclude and perform agreements with customers, partners, affiliates, suppliers and consultants;
(e)invoice, collect payment and manage subscriptions and AI credits;
(f)recruit, employ and manage employees and contractors, and administer payroll and benefits;
(g)comply with legal, regulatory, tax and reporting obligations;
(h)communicate with customers and prospective customers, including direct marketing in accordance with section 69 of POPIA;
(i)detect, prevent and investigate fraud, misuse and security incidents; and
(j)establish, exercise or defend legal claims.

8.2 Description of the Categories of Data Subjects and of the Information or Categories of Information Relating Thereto

Categories of Data Subjects	Personal Information that may be processed
Customers / Clients (juristic persons)	Registered name, registration number, VAT number, address, contact persons, billing and payment details, contractual records
Customer representatives and Operators (platform users)	Name, job title, work contact details, employer, login credentials, platform usage and activity data, learning and assessment results, content submitted to the platform
Employees and job applicants	Name, identity number, contact details, address, qualifications, employment history, remuneration and bank details, tax and benefit information, leave and performance records, demographic information where required by employment equity legislation
Consultants and contractors	Name, identity or registration number, contact details, qualifications, fee and bank details, tax information
Partners, resellers and affiliates	Name, registration number, contact persons and details, commission and bank details, contractual records
Service Providers and suppliers	Name, registration number, VAT number, address, contact persons, trade information and bank details
Directors and shareholders	Name, identity number, contact details, address, shareholding and appointment records
Website visitors and prospects	Name, contact details, enquiries, marketing preferences, device and usage information

8.3 The Recipients or Categories of Recipients to Whom the Personal Information May Be Supplied

Category of personal information	Recipients or Categories of Recipients to whom the personal information may be supplied
Tax and statutory information	South African Revenue Service; Companies and Intellectual Property Commission
Employee information, for statutory compliance	Department of Employment and Labour; Unemployment Insurance Fund; Compensation Fund; relevant SETA
Cross-border funding and exchange control information	South African Reserve Bank and authorised dealers
Payment and billing information	Banks and payment service providers
Platform data, for hosting and service delivery	Cloud hosting, AI model and technology service providers engaged as operators under written agreements
Group reporting and shared services information	Smart Operator Ltd and other Group companies
Information required for professional services	Auditors, accountants, company secretarial providers, legal advisers and insurers
Information required by law or court order	Law enforcement agencies, regulators and courts, where legally required

8.4 Planned Transborder Flows of Personal Information

8.4.1OPS platform data is hosted on Google Cloud in the United Kingdom (europe-west2, London) and the European Economic Area (europe-west4, Netherlands).

8.4.2Personal information may also be transferred to our parent company, Smart Operator Ltd, in the United Kingdom, and to service providers that process information outside the Republic, including payment and AI model providers.

8.4.3We transfer personal information outside the Republic only in accordance with section 72 of POPIA – where the recipient is subject to a law, binding corporate rules or a binding agreement which provides an adequate level of protection, where the data subject consents, or where the transfer is otherwise permitted by section 72.

8.5 General Description of Information Security Measures to Be Implemented by the Responsible Party to Ensure the Confidentiality, Integrity and Availability of the Information

Smart Operator has implemented, or is implementing, appropriate, reasonable technical and organisational measures in accordance with section 19 of POPIA, including:

encryption of data in transit and at rest;
role-based access controls, unique user credentials and multi-factor authentication;
logging and monitoring of access to systems and data;
regular back-ups and business continuity arrangements;
anti-virus, anti-malware and vulnerability management;
confidentiality undertakings from employees, consultants and contractors;
written agreements with operators requiring them to maintain appropriate security measures (section 21 of POPIA); and
a security incident response procedure, including notification of security compromises to the Regulator and affected data subjects in terms of section 22 of POPIA.

9. Request Procedure And Fees

9.1A request for access to a record of Smart Operator must be made on Form 2 prescribed by the Regulations (Request for Access to Record), available from the Regulator's website (inforegulator.org.za) or from the Information Officer, and submitted to the Information Officer at IO@smart-operator.ai.

9.2The requester must provide sufficient detail to enable the Information Officer to identify the record and the requester, indicate the form of access required, and identify the right the requester is seeking to exercise or protect and explain why the record is required for that purpose. A person requesting on behalf of another must submit proof of the capacity in which the request is made.

9.3The Information Officer will decide on the request within 30 days of receipt, which period may be extended once by a further period of not more than 30 days in the circumstances contemplated in section 57 of PAIA. A failure to decide within the applicable period is regarded as a refusal of the request.

9.4Access may be refused only on the grounds set out in Chapter 4 of Part 3 of PAIA, including protection of the privacy of a third party, commercial information of a third party or of Smart Operator, confidential information, the safety of individuals and property, records privileged from production in legal proceedings, and research information.

9.5A data subject may request confirmation of, access to, or correction or deletion of their personal information in terms of sections 23 and 24 of POPIA, and may object to processing in terms of section 11(3) of POPIA, by contacting the Information Officer on the forms prescribed under POPIA.

9.6Smart Operator does not have an internal appeal procedure. A requester or third party aggrieved by a decision of the Information Officer may, within 180 days of being notified of the decision, lodge a complaint with the Regulator in terms of section 77A of PAIA, or apply to a court in terms of section 78 of PAIA.

9.7The following fees, as prescribed for private bodies and published by the Regulator, are payable. Fees are subject to change by the Minister; the fee structure published by the Regulator from time to time prevails.

Item	Description	Amount
1	Request fee payable by every requester	R140.00
2	Photocopy or printed copy of an A4-size page	R2.00 per page or part thereof
3	Copy on a flash drive or compact disc provided by the requester	R40.00
4	Copy on a compact disc provided by Smart Operator	R60.00
5	Transcription of visual images, or copy of visual images	As quoted by the service provider
6	Transcription of an audio record, per A4-size page	R24.00
7	Copy of an audio record on a flash drive or compact disc provided by the requester	R40.00
8	Copy of an audio record on a compact disc provided by Smart Operator	R60.00
9	Search for and preparation of the record, per hour or part of an hour, excluding the first hour	R145.00, to a maximum of R435.00
10	Deposit, where the search exceeds six hours	One third of the amount per request, calculated in terms of items 2 to 8
11	Postage, email or other electronic transfer	Actual expense, if any

Information Regulator

Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191 | P.O. Box 31533, Braamfontein, Johannesburg, 2017

General enquiries: enquiries@inforegulator.org.za | PAIA complaints: PAIAComplaints@inforegulator.org.za | POPIA complaints: POPIAComplaints@inforegulator.org.za

Telephone: 010 023 5200 | Toll free: 0800 017 160 | Website: inforegulator.org.za

10. Availability Of The Manual

10.1A copy of this Manual is available:

(a)on our website at www.smart-operator.ai/paia-manual;
(b)at the head office of SMART OPERATOR SA (Pty) Ltd for public inspection, by appointment only, arranged at OPS@smart-operator.ai;
(c)to any person upon request and upon the payment of a reasonable prescribed fee; and
(d)to the Regulator upon request.

10.2A fee for a copy of the Manual, as contemplated in Annexure B of the Regulations, is payable per each A4-size photocopy made.

11. Updating Of The Manual

The head of SMART OPERATOR SA (Pty) Ltd will on a regular basis, and at least annually, review and update this Manual.

Issued by

Servaas van Breda Malherbe

Chief Executive Officer and Information Officer

SMART OPERATOR SA (Pty) Ltd

21 October 2026

Important Contacts

Information Officer

IO@smart-operator.ai

Deputy Information Officer

IO@smart-operator.ai

Privacy / Data / Access Requests

IO@smart-operator.ai