PAIA MANUAL

1. Purpose of this manual

This manual provides information required by section 51 of the Promotion of Access to Information Act 2 of 2000, as amended. It describes records that AMB Advisory may hold, records that may be available, how to request access, relevant contact details and the processing of personal information.

In this manual, PAIA means the Promotion of Access to Information Act 2 of 2000; POPIA means the Protection of Personal Information Act 4 of 2013; and the Regulator means the South African Information Regulator.

2. Key contact details

3. Guide on how to use PAIA

The Information Regulator has prepared a PAIA Guide to help people understand and exercise their rights under PAIA and POPIA. It explains requests for records, available assistance, fees and remedies. The Guide and current prescribed forms can be accessed through the Regulator's maintained PAIA resources page. Assistance with obtaining the Guide may also be requested from the Information Officer.

• Information Regulator PAIA Guide and prescribed forms

4. Records available without a formal PAIA request

The following information may be accessed without a formal PAIA request where it has been published or otherwise made publicly available:

• Information published on the AMB Advisory website.
• The Privacy Notice and this PAIA Manual.
• Publicly available company information, through the relevant public source.
• Other information AMB Advisory elects to make publicly available.

Published website records can be viewed or downloaded online. An electronic copy of this manual may also be requested by email without charge. This does not make confidential engagement files or client records publicly accessible.

• AMB Advisory website
• Privacy Notice

5. Records available under other legislation

Records may be maintained or made available as required by applicable South African legislation. The following is a focused description, where applicable. Any access remains subject to the conditions of the relevant law.

6. Subjects and categories of records

Records that may be held in the ordinary course of business include the following. This is a description of possible categories; it does not claim that every listed record exists.

7. Access is not automatic

Listing a category in this manual does not mean that access will automatically be granted. Requests are dealt with in accordance with PAIA, and access may be refused where an applicable ground for refusal exists.

For a private body, access under PAIA generally requires the requested record to be required for the exercise or protection of a right, compliance with the prescribed procedure and the absence of an applicable ground for refusal. Confidentiality and the rights of affected third parties will be considered as required by PAIA.

8. How to make a request

1. Complete the prescribed PAIA Form 2, available from the Information Regulator.
2. Provide enough information to identify and locate the requested record, together with your contact details.
3. Provide proof of identity and, if acting for another person, proof of your authority to act.
4. Identify the right you wish to exercise or protect and explain why the requested record is required for that right, where applicable.
5. Specify your preferred form of access and how you wish to receive the response.
6. Send the completed request to riaan@ambadvisory.co.za.

AMB Advisory will process requests in accordance with PAIA and communicate the decision, any applicable procedural requirements and reasons for a refusal where required. The Regulator's PAIA resources explain complaint procedures and other remedies if a requester is dissatisfied with an outcome or a request is not answered.

• Current PAIA Form 2, guidance and remedies

9. Fees

Prescribed PAIA fees may apply. Where a fee is payable, the requester will be informed in accordance with the applicable PAIA requirements before further processing or before access is provided, as required. Current prescribed fees and forms should be consulted through the Information Regulator. No fixed fee amounts are set out in this manual.

10. POPIA: purposes of processing

Personal information may be processed for the following purposes, as relevant to the interaction or engagement:

• Responding to enquiries and preparing quotations.
• Client acceptance and continuance, including independence procedures.
• Performing Independent Review engagements and communicating with clients.
• Managing contractual relationships and maintaining professional records.
• Invoicing, administration and quality management.
• Satisfying legal, regulatory and professional obligations.
• Security and fraud or misuse prevention.
• Establishing, exercising or defending legal rights.

The website assessment and indicative quote calculation run in the browser. Answers are not automatically submitted or stored by AMB Advisory. A formal quote request becomes correspondence received by AMB Advisory only when the visitor chooses to send the prepared email. Copying a request places it on the visitor's device clipboard.

11. Categories of data subjects and information

Depending on the business relationship and information supplied, the following categories of personal information may be processed:

12. Possible recipients of personal information

AMB Advisory does not sell personal information. Information may be made available, where reasonably necessary, to:

• AMB Advisory personnel or authorised users whose role requires access.
• Technology, cloud, email and productivity-service providers, including Microsoft 365 for business email, communication and document management.
• Professional advisers and service providers supporting an engagement where necessary and appropriately controlled.
• Professional bodies and regulators where required, and courts or authorities where legally required.

Access or disclosure is limited to what is reasonably necessary for the recipient's role and is subject to appropriate confidentiality and data-protection arrangements where applicable.

13. Processing outside South Africa

Some technology and cloud-service providers used by AMB Advisory may process or store information outside South Africa.

Where personal information is transferred across borders, AMB Advisory will take reasonable steps to ensure that the transfer and processing are permitted under applicable data-protection requirements and that appropriate safeguards are in place. This may include information handled in business email, correspondence and client documents through cloud services.

14. Information security

AMB Advisory uses reasonable administrative, technical and organisational safeguards designed to support the confidentiality, integrity and availability of personal information and protect against loss, unauthorised access, misuse, alteration or disclosure.

Measures may include access controls, appropriate user permissions, secure business systems, confidentiality controls, document-access restrictions and Microsoft 365 security controls where configured. These safeguards do not amount to a guarantee of perfect security.

15. Availability of this manual

• This manual is available on https://ambadvisory.co.za.
• An electronic copy is available without charge on request from riaan@ambadvisory.co.za.
• The manual is available for inspection as required by PAIA during normal business hours at the physical address stated in section 2. Contact the Information Officer to arrange inspection.
• The manual is available to the Information Regulator on request.

16. Updates

AMB Advisory will review and update this manual when necessary to reflect material changes to its records, processing or legal requirements.

Manual version: 1.0. Effective: September 2026.

Prepared with reference to the Information Regulator's private-body PAIA Manual template and section 51 of PAIA. Current official guidance and forms are maintained by the Regulator.

• Information Regulator PAIA resources
• Information Regulator
• Promotion of Access to Information Act 2 of 2000
• AMB Advisory Privacy Notice