PAIA Manual

TABLE OF CONTENTS

List of acronyms and abbreviations

CEO: Chief Executive Officer

IO: Information Officer

PAIA: Promotion of Access to Information Act, 2 of 2000

POPIA: Protection of Personal Information Act, 4 of 2013

Regulator: Information Regulator of South Africa

Other competent regulatory, licensing, enforcement or dispute-resolution authorities in South Africa or other jurisdictions in which TryBookAfrica operates, where applicable.

Introduction

This Manual is prepared in accordance with Section 51 of the Promotion of Access to Information Act 2 of 2000 ("PAIA").

TryBookAfrica is a private body operating a digital tourism marketplace connecting travellers with tourism suppliers, accommodation establishments, safari operators, tour and experience providers, restaurants, transport providers and other tourism businesses.

This Manual provides a regulatory framework through which persons may request access to records held by TryBookAfrica, subject to the requirements and limitations contained in PAIA.

Purpose

The purpose of this Manual is to:

Set out categories of records held by TryBookAfrica which are available without a person having to submit a formal PAIA request

Assist the public on how to make a request for access to a records of TryBookAfrica, by providing a description of the subjects on which TryBookAfrica holds records and the categories of records held on each subject

Know the description of the records of TryBookAfrica which are available in accordance with any other legislation.

Key contact and company details for access to information for Trybookafrica

Name: TryBookAfrica

Registration Number: 2021/652846/07

Principal Place of Business:
320 Slate Crescent, Stoneridge Country Estates, Monavoni, Centurion

Postal Address:
320 Slate Crescent, Stoneridge Country Estates, Monavoni, Centurion

Website: TryBookAfrica.com

General Email:
legal@trybookafrica.com

Information Officer

The Information Officer responsible for PAIA and POPIA compliance is:

Name: Dr Chisava Juma

Designation: Information Officer

Email: chisava.juma@trybookafrica.com

PAIA Guide

The Information Regulator has issued a Guide explaining how PAIA may be used to exercise rights of access to information.

Users are encouraged to consult the latest Guide and prescribed forms available from the Information Regulator.

The Regulator publishes PAIA forms, including the prescribed request for access to records and complaint procedures.

Records automatically available

TryBookAfrica makes certain information available without a formal PAIA request, including:

• company information;

• website terms and conditions;

• privacy policy;

• cookie policy;

• supplier policies;

• booking terms and conditions;

• responsible tourism policies;

• verified supplier policy;

• publicly available supplier profiles;

• publicly available tourism information;

• contact information;

• marketing material; and

• other information published on the Platform.

RECORDS WHICH ARE AVAILABLE IN ACCORDANCE WITH LEGISLATION

Records held by Trybookafrica

Records may include:

Corporate records

• registration documents;

• Memorandum of Incorporation (MOI);

• shareholder and director information where applicable;

• governance records;

• contracts;

• policies;

• licences and permits.

Financial records

• invoices;

• accounting records;

• Supplier payout records;

• payment records;

• commission records;

• tax records.

Supplier records

• registration information;

• verification documents;

• licences;

• permits;

• business information;

• Supplier agreements;

• correspondence.

Traveller records

• account information;

• Booking information;

• communication records;

• reviews;

• support records;

• payment-related transaction information.

Technical records

• system logs;

• security records;

• access logs;

• website analytics;

• cookies and technical identifiers.

Legal and compliance records

• complaints;

• dispute records;

• regulatory correspondence;

• investigations;

• compliance assessments.

Requesting access

A request for access to records must be made using the prescribed PAIA process (PAIA Form 2 – Request for Access to Record)

The request should identify:

1. the record requested;

2. the person making the request;

3. the preferred form of access;

4. the reason for the request where required;

5. sufficient information to identify the record; and

6. any other information required by PAIA.

TryBookAfrica may require proof of identity where appropriate.

Personal Information

Where a request concerns the requester's own personal information, the request may also be governed by the applicable provisions of POPIA.

TryBookAfrica will process access requests subject to applicable privacy, confidentiality and statutory restrictions.

Grounds for refusal

TryBookAfrica may refuse access where permitted or required by PAIA, including where disclosure would involve:

• unreasonable disclosure of personal information;

• confidential commercial information;

• privileged information;

• trade secrets;

• third-party confidential information;

• security-sensitive information;

• legally protected information; or

• other information protected under PAIA.

Third-Party Information

Where a requested record contains information relating to another person or organisation, TryBookAfrica may be required to consult that person or organisation before making a decision.

Fees

Any applicable request, access, reproduction or related fees will be handled in accordance with PAIA and applicable regulations.

TryBookAfrica will communicate any applicable fee before it becomes payable where required.

POPIA

13.1 Purpose of processing personal information

TryBookAfrica processes personal information relating to travellers/clients, suppliers, business partners, employees, prospective employees, contractors and other relevant individuals for the following purposes:

• Contractual obligations: Establishing, performing and managing agreements with Travellers, Suppliers, employees, contractors and business partners.

• Booking and travel services: Facilitating accommodation reservations, safari bookings, tours, activities, transport arrangements and other tourism-related services offered through the platform.

• Supplier onboarding and verification: Registering Suppliers, verifying business identities and supporting documents, assessing listing eligibility, maintaining accurate supplier records and administering Verified Supplier status.

• Payments and financial administration: Facilitating payments, refunds, commissions, supplier payouts, reconciliations, invoicing, accounting and related financial administration through applicable payment service providers.

• Customer service and communications: Responding to enquiries, handling complaints, resolving booking disputes, providing booking confirmations and updates, and assisting Travellers and Suppliers.

• Legal and regulatory compliance: Complying with applicable legislation, regulatory requirements, lawful requests, tax obligations, recordkeeping duties and reporting requirements.

• Platform operation and improvement: Operating, maintaining, securing and improving the TryBookAfrica website, booking systems, supplier dashboards and related digital services.

• Security and fraud prevention: Detecting and preventing fraud, unauthorised access, suspicious transactions, misuse of the platform and other unlawful or harmful activities.

• Marketing and promotional activities: Communicating relevant offers, destination information, travel experiences, promotions and company updates, subject to applicable consent and direct-marketing requirements.

• Analytics and business development: Analysing booking trends, customer preferences, supplier performance, platform usage and market demand to improve services, develop products and support business planning.

• Employment and human resources: Managing recruitment, employment relationships, payroll, benefits, performance management, workplace administration and related legal obligations.

• Business relationships and partnerships: Managing relationships with tourism organisations, technology providers, payment processors, marketing agencies, insurers and other service providers.

• Risk management and dispute resolution: Investigating complaints, managing claims, enforcing contractual rights, maintaining appropriate records and establishing, exercising or defending legal claims.

• Responsible tourism and service quality: Supporting applicable supplier standards, tourism-related compliance, customer feedback, service quality assessments and responsible tourism initiatives.

• Corporate administration and business transactions: Managing audits, insurance, corporate governance, professional advice and potential mergers, acquisitions, restructurings or other legitimate business transactions.

TryBookAfrica will process personal information only where a lawful basis exists under applicable data protection legislation, for purposes that are lawful, specific and appropriately connected to its business activities. Personal information will not be retained longer than necessary, except where a longer retention period is required or permitted by law.

Where personal information is shared with Suppliers, payment service providers, technology providers or other third parties, such sharing will be limited to what is necessary for the relevant purpose and subject to applicable legal requirements and appropriate safeguards.

Description of the categories of data subjects and of the information or categories of information relating thereto

Recipients or categories of recipients to whom the personal information may be supplied

13.2 Planned trans-border flows of personal information

TryBookAfrica is a South African-founded tourism booking marketplace intended to facilitate tourism-related services across Africa and, where applicable, internationally. In the ordinary course of its anticipated operations, personal information may be transferred to or accessed by recipients located outside South Africa.

Such recipients may include:

• Tourism Suppliers: Accommodation establishments, safari lodges, tour operators, activity providers, transport operators and other tourism businesses located in countries where TryBookAfrica operates or facilitates bookings.

• Technology and Hosting Providers: Website hosting companies, cloud storage providers, booking platform developers, software providers, customer support systems and other technology service providers that may store, process or access personal information from outside South Africa.

• Payment Service Providers: Payment gateways, payment processors, financial institutions and other relevant service providers involved in processing payments, refunds, commissions and supplier payouts, where their operations require cross-border processing.

• Business and Marketing Partners: Relevant tourism distribution partners, analytics providers, communication service providers and other authorised business partners, where the transfer is necessary for a lawful and disclosed purpose.

• Professional and Regulatory Recipients: Legal advisers, auditors, insurers, courts, regulators or other competent authorities outside South Africa, where disclosure is lawfully required or otherwise permitted.

Cross-border transfers may involve personal information such as names, contact details, booking and travel information, supplier business contact details, transaction records, account information and other information necessary for the relevant service or lawful purpose.

TryBookAfrica will assess each relevant cross-border processing arrangement and ensure that transfers comply with section 72 of the Protection of Personal Information Act 4 of 2013 (POPIA). Depending on the circumstances, this may require an adequate level of protection under the recipient country’s laws or binding corporate rules, an appropriate agreement with the recipient, the data subject’s consent where legally applicable, or another permitted basis under section 72.

Where appropriate, TryBookAfrica will implement contractual data protection obligations, access controls, security measures and other safeguards designed to protect personal information against loss, unauthorised access, disclosure or misuse.

The specific destination countries, recipients and transfer arrangements will depend on the suppliers, payment service providers and technology providers engaged by TryBookAfrica. These details will be assessed and documented as the relevant arrangements are established and updated when material changes occur.

This section describes anticipated cross-border processing arrangements and does not imply that transfers to every category of recipient or country are currently taking place. Further information about particular processing arrangements may be requested through the procedures set out in this PAIA Manual, subject to applicable legal restrictions.

13.3 General Description of information security measures

TryBookAfrica continuously establishes and maintains appropriate, reasonable technical and organisational measures by taking appropriate, reasonable technical and organisational measures to prevent

• loss of, damage to or unauthorised destruction of personal information; and

• unlawful access to or processing of personal information.

TryBookAfrica has taken reasonable measures, as contained below, to-

• identify all reasonably foreseeable internal and external risks to personal information in its possession or under its control;

• establish and maintain appropriate safeguards against the risks identified;

• regularly verify that the safeguards are effectively implemented; and

• ensure that the safeguards are continually updated in response to new risks or deficiencies in previously implemented safeguards.

Measures taken by the TryBookAfrica includes, amongst others:-

• Access Control;

• Data Encryption;

• Defensive Measure

• Robust Monitoring,

• Auditing and Reporting capabilities;

• Data Backups;

• Anti-virus and Anti-Malware Solutions;

• Awareness and Vigilance; and

• Agreements are concluded with Operators to implement security controls.

Nothing in this Manual should be interpreted as reducing a data subject's rights under POPIA.

13.4 Records That Cannot Be Found

Requesters have the right to receive a response in the form of an affidavit or affirmation where records cannot reasonably be located, but to which a requester would have had access had the record been available.

Requesters also have the right to receive a response in the form of an affidavit or affirmation where requested records do not exist.

These records may include information that has been lost and cannot be relocated, the records of information that has already been either redacted or destroyed or records in the possession of third parties.

13.5 Disposal of Records

Requesters will be advised whether a particular record has been disposed of where this is relevant to the records requested.

In accordance with section 24(1) of POPIA, TryBookAfrica may, upon receipt of the request from a data subject:

• correct or delete personal information about the data subject in its possession or under its control that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or obtained unlawfully; or

• destroy or delete a record of personal information about the data subject that the Regulator is no longer authorised to retain in terms of section 14 of POPIA.

Availability of this Manual

This Manual will be made available:

• on the TryBookAfrica website;

• at the principal place of business; and

• through the Information Regulator's applicable systems where required.

Updates

This Manual may be updated from time to time.

The latest version will be published on the TryBookAfrica website.

Approval

Approved by:

Name: Dr Chisava Juma

Designation: Information Officer

Signature:

Date: 01 November 2026

© 2026 TryBookAfrica. All rights reserved.