PAIA Manual

1. About this manual

Section 51 of PAIA requires every private body to publish a manual. This is ours. Use it to find out:

• which records you can see without making a request;
• what subjects we hold records on, so that you can describe the record you want;
• which records we keep because other laws require them;
• who to contact, and where to find the Information Regulator's guide to PAIA;
• what personal information we process, why, who receives it, whether it leaves South Africa, and how we protect it;
• how to make a request, what it costs, how long it takes, and what you can do if you're not satisfied.

Our privacy policy explains your rights over your own personal information in more detail.

2. Words used in this manual

• PAIA: the Promotion of Access to Information Act 2 of 2000, as amended.
• POPIA: the Protection of Personal Information Act 4 of 2013.
• The Regulator: the Information Regulator, which oversees PAIA and POPIA.
• Head: the person PAIA makes responsible for a private body's requests. For a close corporation, that is its equivalent of a chief executive, or a person they authorise (section 1).
• Record: any recorded information we hold or control, in any form, whether or not we created it (section 1).
• "We", "us", "Exotic Vacations": Exotic Island and Ski Holidays CC.

3. Who we are, and who to contact

Exotic Vacations is the trading name of Exotic Island and Ski Holidays CC, a close corporation registered in South Africa. We are an online travel agency, and have planned holidays for South Africans since 2005.

• Registration number: 2010/020819/23
• VAT number: 4740204955
• Members: Marthinus Johannes Strydom and Heidi Ingrid Strydom
• Head and Information Officer: Marthinus Johannes Strydom, member and chief executive. He is registered with the Information Regulator as our Information Officer (registration number 2026-071538).
• Deputy Information Officer: none designated. Our Information Officer handles every request.
• Email for requests: info@exoticvacations.co.za. Please put "PAIA request" in the subject line.
• Phone and WhatsApp: 062 082 1262, Monday to Friday, 08:30 to 17:00
• Postal and physical address: 4 Estuary Heights, Knysna, 6570, South Africa. We work online, so this is not a walk-in office.
• Website: exoticvacations.co.za

4. The Regulator's guide to PAIA

The Information Regulator publishes a guide on how to use PAIA and POPIA (section 10 of PAIA). It explains:

• what PAIA and POPIA are for;
• how to ask a public or private body for a record;
• the help the Regulator can give you;
• the forms, the fees and the regulations;
• your remedies, including complaints to the Regulator and applications to court.

You can get the guide:

• from the Regulator's website, free, in English, Afrikaans and nine other official languages: inforegulator.org.za/paia-guidelines;
• from us, free of charge. Ask our Information Officer in writing, preferably on the Regulator's Form 1 (regulation 3);
• at our address, where you can read a copy in English or Afrikaans during office hours, by appointment (regulation 3(1));
• from the Regulator's office: Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191; enquiries@inforegulator.org.za; 010 023 5200.

5. Records you can see without a request

These are on our website, free to read, with no PAIA request needed:

• this manual (/paia-manual);
• our privacy policy;
• our booking terms and conditions;
• our company details, on our About page.

If you are our client, your consultant can send you copies of your own quotes, invoices and booking documents. You don't need a PAIA request for those.

6. Records we keep because other laws require them

A record on this list is not automatically available. You still need to request it, unless it is listed in section 5.

7. Subjects on which we hold records

8. How we process personal information

8.1 Why we process it

We process personal information to:

• answer enquiries and prepare quotes;
• book, ticket and manage holidays, send travel documents, reminders and travel tips, and help clients while they're away;
• pass travellers' dietary, mobility or medical needs to the suppliers of their trip, with their consent;
• process children's details for their travel, with the consent of a parent or guardian;
• employ and pay our staff;
• keep the accounting, tax and employment records the law requires;
• keep our website secure, count visits, and learn which pages and ads lead to enquiries and bookings;
• ask clients how their trip went and invite a review, and send the marketing emails described in our privacy policy, each with a one-click unsubscribe link.

Eva, our website assistant, and some of our staff's admin tools use an AI provider to answer questions and draft replies. Our privacy policy explains exactly what is sent, and the legal ground for each purpose above.

8.2 Whose information we process, and what

Dietary requirements can reveal religion, and mobility or medical needs are health information. POPIA calls this special personal information. We ask for it only so that suppliers can look after travellers, and only with consent.

8.3 Who receives it

We do not sell personal information.

8.4 Information sent outside South Africa

• For the holiday. We send travellers' details to the hotels, tour operators, airlines and transfer companies in the countries they visit, such as Mauritius, Tanzania (Zanzibar), the Seychelles, the Maldives, Thailand and Indonesia. We do this because it is necessary to carry out the holiday booked (POPIA section 72(1)(c) and (d)).
• Our systems. Our website, booking system and database, and our previous booking system, run on Linode servers in London, in the United Kingdom. Linode is part of Akamai, a US company. Our backups are also copied to backup storage in South Africa.
• AI. What we send to xAI goes to the United States. So would anything sent to Anthropic, our back-up provider.
• Other service providers. Google, Cloudflare and WhatsApp (Meta) are US companies, and SMTP2GO is a New Zealand company. They process information under data-processing terms we have accepted with each of them.

8.5 How we protect it

• Our website uses encrypted (HTTPS) connections.
• ID and passport numbers are stored encrypted.
• Staff sign in to reach client records, and each person's access matches their role. Passport copies can be opened only by signed-in staff.
• Our database can't be reached from the internet.
• A security service protects our website and admin system against attacks and automated abuse.
• We back up our systems every night, and keep copies in more than one place.
• Our service providers process personal information only to provide their service to us, under data-processing terms.
• If we believe someone has gained access to personal information without authority, we tell the people affected and the Regulator, as POPIA section 22 requires.

Our privacy policy explains how long we keep personal information.

9. How to ask for a record

9.1 Who can ask

Anyone can ask. PAIA gives you access to a record of a private body like ours if:

• you need the record to exercise or protect a right;
• you follow the procedure below; and
• no ground for refusal in section 10 of this manual applies (section 50(1)).

This includes records that contain personal information about you (section 50(3)).

9.2 If you want your own personal information

POPIA gives you rights over your own information (section 23):

• Asking whether we hold personal information about you is free. We'll ask you for proof of identity first.
• To get a copy or a description of it, email our Information Officer. These requests follow the PAIA procedure below (POPIA section 25), so we may ask you to complete Form 2.
• If a fee applies, we'll give you a written estimate before we do the work, and we may ask for a deposit (POPIA section 23(3)).

To correct or delete your information, or to object to how we use it, see our privacy policy.

9.3 Making the request

1. Complete Form 2, the Regulator's request for access to a record (regulation 7(1)). It asks you to:
   • describe the record clearly enough for us to find it;
   • say in what form you want access, such as a printed copy or an email;
   • give your contact details, including an address in South Africa;
   • name the right you want to exercise or protect, and explain why you need the record for it (section 53(2)).
2. Attach proof of identity. If you are asking on behalf of someone else, also attach proof that you may act for them.
3. Send it to our Information Officer at info@exoticvacations.co.za, with "PAIA request" in the subject line, or by post or by hand to our address in section 3 (section 53(1)).

We'll help you complete the form. If you can't complete it because you can't read or write, or because of a disability, you may make the request orally, and we'll complete Form 2 for you and give you a copy (regulation 7(2)).

9.4 Fees

PAIA fees are set by the Regulations relating to PAIA, 2021 (GN R757, Government Gazette 45057 of 27 August 2021), Annexure B, "Fees in respect of private bodies". We may charge only these fees.

• Request fee: R140.00, payable by every requester before we process the request (item 1; PAIA section 54(1)). We'll send you a notice, with how to pay.
• Access fee, payable only if we grant access. It covers copying, and the time needed to search for and prepare the record (section 54(6)):

• Deposit. If the search and preparation will take more than six hours, we may ask for a deposit of up to one third of the access fee before we start (section 54(2); regulation 8(3); item 10). If we then refuse the request, we refund the deposit (section 54(4)).
• Release. We may hold back the record until the fees are paid (section 54(5)).

9.5 Our decision, and how long it takes

• 30 days. We decide as soon as reasonably possible, and within 30 days of receiving your request with all the details Form 2 asks for (section 56(1)).
• One extension. We may extend this once, by up to 30 more days, for the reasons PAIA allows: for example, if the request involves a large number of records or needs consultation, or if you agree in writing. We'll tell you within the first 30 days, with the reasons (section 57).
• Other people's information. If the record contains another person's personal, commercial, confidential or research information, we must tell that person and give them the chance to respond. PAIA sets the steps and the time this adds (sections 71 to 73).
• No answer in time counts as a refusal (section 58), and you may then use the remedies in section 11.
• If we grant access, we tell you the access fee, the form of access and your right to complain about either (section 56(2)). We give access in the form you reasonably ask for (section 60).
• If we refuse, we give you the reasons and the sections of PAIA we rely on (section 56(3)).
• If a record can't be found or doesn't exist, we tell you so in an affidavit that sets out the steps we took to find it (section 55).

10. When we must or may refuse

We must refuse access, unless an exception in PAIA applies, if disclosure would:

• unreasonably disclose personal information about another person, including someone who has died (section 63);
• reveal a third party's trade secrets, or financial or commercial information that would be likely to harm them, or information they gave us in confidence that could weaken them in negotiations or competition (section 64);
• breach a duty of confidence we owe a third party under an agreement (section 65);
• endanger someone's life or physical safety (section 66(a));
• reveal a record privileged from production in legal proceedings, unless the privilege is waived (section 67);
• seriously disadvantage a third party through their research information (section 69(1)).

We may refuse access if disclosure would:

• prejudice the security of a building, a means of transport, a computer or communication system or other property, or the methods used to protect people or property (section 66(b));
• reveal our own trade secrets, financial or commercial information that would be likely to harm us, information that could weaken us in negotiations or competition, or a computer program we own (section 68);
• seriously disadvantage us through our own research information (section 69(2)).

Even then, we must grant access if the record would reveal a substantial breach of the law, or an imminent and serious risk to public safety or the environment, and the public interest in disclosure clearly outweighs the harm (section 70).

If only part of a record can be refused, we give you the rest (section 59).

11. If you're not satisfied

There is no internal appeal against a decision of a private body. Instead:

• Complain to the Information Regulator within 180 days of our decision, on the Regulator's Form 5. You may complain about a refusal, the request fee or deposit, an extension, or the form of access (section 77A(2)(d)). A third party may complain about our decision to grant access (section 77A(3)(c)). The Regulator must help you put a complaint in writing (section 77B(2)).
• Apply to court within 180 days, once the Regulator's complaints procedure has been completed (section 78).

Information Regulator:

• PAIA complaints: PAIAComplaints@inforegulator.org.za
• General enquiries: enquiries@inforegulator.org.za
• Phone: 010 023 5200, or toll-free 0800 017 160
• Address: Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191
• Website: inforegulator.org.za

12. Where to find this manual

This manual is available free:

• on our website, at exoticvacations.co.za/paia-manual;
• by email: ask our Information Officer and we'll send it to you;
• at our address in section 3, to read during office hours, by appointment.

A printed copy costs R2.00 per A4 page (Annexure B, item 2), plus the actual cost of postage (item 11). We give the Regulator a copy on request (section 51(3)).

13. Updates

The head of Exotic Vacations updates this manual regularly (section 51(2)), and whenever something it describes changes. The version on our website is the current one.

Issued on 9 November 2026 by Marthinus Johannes Strydom, member, chief executive and Information Officer, Exotic Island and Ski Holidays CC, trading as Exotic Vacations.