Privacy Policy

Privacy Policy

1. LIST OF ACRONYMS AND ABBREVIATIONS

1.1. "B2B" means any transaction entered into between YUCCA and another juristic entity for the supply of goods and/or services;

1.2. "Data Subjects" means any natural or juristic person to whom the Personal Information and Special Personal Information processed by YUCCA relates;

1.3. "PAIA" means the Promotion of Access to Information Act No. 2 of 2000 (as amended);

1.4. "Personal Information" means the personal information as defined in section 1 of POPIA;

1.5. "Personnel" means all individuals who are engaged by YUCCA in any capacity, including employees and directors;

1.6. "Policy" means this document;

1.7. "POPIA" means the Protection of Personal Information Act No.4 of 2013;

1.8. "Processing" means any operation or activity, whether or not by automatic means, concerning Personal Information as defined in section 1 of POPIA;

1.9. "Record(s)" means any recorded information as defined in section 1 of POPIA;

1.10. "Regulations" means the Promotion of Access to Information Act No. 2 of 2000: Regulations Relating to the Promotion of Access to Information, 2021;

1.11. "Regulator" means the Information Regulator of South Africa, established in terms of section 39 of POPIA;

1.12. "Responsible Party" means a natural or juristic person who determines the purpose of and means for Processing Personal Information, as defined in section 1 of POPIA;

1.13. "Special Personal Information" means the Personal Information Processed by YUCCA as contemplated in section 26 of POPIA;

1.14. "VAT" means value added tax imposed in terms of the Value Added Tax Act, No 89 of 1990 (as amended);

1.15. "YUCCA" means Yucca Holdings (Proprietary) Limited, a private company duly incorporated in terms of the laws of the Republic of South Africa under registration number: 2001/028529/07;

1.16. “YUCCA Terms and Conditions” means the terms and conditions of the Yucca website, at https://yucca.co.za/terms-conditions/;

2. INTRODUCTION

POPIA came into effect on 1 July 2020 and gives effect to the constitutional right to privacy by safeguarding Personal Information when Processed by a Responsible Party.

A key purpose of POPIA is to regulate the manner in which Personal Information may be Processed by prescribing minimum threshold requirements for the lawful Processing of Personal Information by a Responsible Party. POPIA also grants individuals enforceable rights and remedies, enabling them to protect their Personal Information from Processing that is not in accordance with these minimum threshold requirements.

This Policy serves as YUCCA's Privacy Policy and outlines the categories of Personal and Special Personal Information collected from its Data Subjects, as well as the manner in which such information is Processed and safeguarded against unauthorised access, loss, or misuse in compliance with its obligations under POPIA.

3. PERSONAL INFORMATION COLLECTED BY YUCCA

3.1. The nature and extent of Personal Information and Special Personal Information processed by YUCCA is determined by the specific relationship the Data Subject has with YUCCA, as well as the specific purpose for which the information needs to be collected, Processed and (possibly) stored.

3.2. In conducting its operations, YUCCA collects Personal Information and Special Personal Information from various categories of individuals, including its Personnel, prospective employees, customers, representatives, contractors, website users, and individuals visiting YUCCA's premises.

3.3. YUCCA collects, Processes and stores Personal Information and Special Personal Information through the following means: -

3.3.1. voluntary disclosure by the Data Subject;

3.3.2. automatic collection through the use of cookies; and

3.3.3. disclosure by authorised third parties.

3.4 YUCCA collects and Processes the following Personal Information: - 

TYPE OF PERSONAL INFORMATION		PURPOSE OF COLLECTION, PROCESSING & STORAGE
	Users of YUCCA's official website
Voluntary Disclosure
Contact information and messages: -  full name and surname;  email address; contact details; and  messages.		Users of YUCCA's official website may submit enquiries via the 'Contact Us' page. In doing so, they are required to provide certain Personal Information to enable YUCCA's authorised              representatives to respond to their queries or requests. To fulfil its legitimate business purposes and respond to queries and requests, YUCCA may Process and retain Records of certain messages submitted by the Data Subject.
Account Credentials: -  full name, surname, identity number and physical address (in the case of a natural person);  company name, registration number, physical address and VAT number (in the case of a juristic person); contact detail; delivery address; and login details and password.		When the Data Subject registers an account with YUCCA on its official website, YUCCA collects certain Personal Information from the Data Subject in order to create and manage the user's account, provide customer support, send order confirmations and updates, collect customer feedback and testimonials, manage marketing and promotional communications (subject to the Data Subject's consent as contemplated in section 69 of POPIA), and to ensure website reliability and security.
Payment Information: -  credit and/or debit card details;  banking details; and  payment references (if Recorded).		When a customer purchases products on YUCCA’s official Website, they consent to and will be redirected to PayFast, a secure third-party payment platform, to provide the necessary personal and banking information required to authorise payments and prevent fraud. YUCCA does not have access to, collect, or store the customer’s payment card or banking details processed through PayFast. However, in the event of a refunds, the Customer may be required to provide YUCCA with their banking details solely for the purpose of processing such refund.
Credit Information: -  company name and/or trading name, registration number, VAT number, postal, physical, registered, and delivery address, contact information, banking details, and information relating to any holding company;  full name and surname, identity number and residential address of directors/ members / partners / sole proprietor; references (company name and contact number);  a copy of credit application and credit agreement;  property details of properties owned by Principals (full name and surname of Principals, value of property, value of bond registered over property, bondholder, stand number and township, principal name (s); and nature of business conducted by credit applicant.		To enable customers to purchase products on credit, YUCCA provides a credit application form on its official website. The credit applicant is required to disclose certain Personal Information in order for YUCCA to assess the applicant's creditworthiness, conduct a risk analysis, verify the applicant’s identity and banking details and manage and administer any credit facilities granted in compliance with legal requirements under the National Credit Act 34 of 2005.
Feedback and Testimonials		Testimonials and client feedback are collected and Processed for the purpose of improving YUCCA's products and services, monitoring customer satisfaction, and promoting YUCCA's offerings through published reviews or testimonials (subject to the Data Subject’s consent).
Purchase History: -  full name and surname and/or company name;  items purchased;  quantity of items purchased;  contact details;  delivery address; and date of purchase.		When placing an online order on YUCCA's official website, YUCCA Processes the Data Subject's purchase history to process and fulfil orders, manage returns and calculate loyalty points.
Automatic Collection
Technical information:  -  device type;  unique device identification numbers; browser type; and  broad geographical location.		When users access YUCCA's official website, certain technical information about their device may automatically be collected. The purpose of collecting this information is to ensure the website functions properly across different devices and browsers, improve the website’s performance and usability, detect and prevent security threats, unauthorised access, or abuse, generate aggregated statistics to understand user interaction and improve content delivery, and assist in the technical troubleshooting and maintenance of the website. See the Cookie Policy within the Yucca Terms and Conditions at https://yucca.co.za/terms-conditions/.
Social Media Platforms
Social Media Interaction: -  public likes, follows and comments linked to the social media platform of the Data Subject.		Depending on the Data Subject's social media platform privacy settings, YUCCA may Process Personal Information of the Data Subject for the purpose of engagement tracing, responding to queries and marketing.

Third Party Sources
In certain instances, YUCCA may collect Personal Information from publicly accessible sources or from third parties who are lawfully authorised to disclose such information. This may include information obtained through the Data Subject’s authorised representatives, affiliated service providers, or contractors engaged by the Data Subject to perform functions on its behalf. Where a Data Subject displays interest in employment opportunities with YUCCA, YUCCA may collect and Process relevant Personal Information and Special Personal Information (with the consent of the Data Subject) from recruitment consultants, Human Resources personnel, or internal decision-makers involved in the appointment and onboarding process. All such collection and Processing is conducted in accordance with applicable privacy legislation and for legitimate organisational purposes.
Visitors to YUCCA's Offices
Information obtained:-  contact information; identity number; and  physical address.		To ensure the safety and security of YUCCA’s personnel and visitors to its offices, YUCCA may collect the listed Personal Information from individuals entering its premises.

4. ADDITIONAL DATA COLLECTION

4.1. YUCCA may Process other Personal or Special Personal Information ("information") that the Data Subject provides to YUCCA voluntarily in order to support its operational needs or meet legal and regulatory obligations.

4.2. Insofar as it is required in terms of POPIA, YUCCA undertakes to obtain the written consent of the Data Subject/s before Processing such information and will clearly identify the information collected and the purpose for collection, Recording and (where applicable) storage.

5. EXTERNAL WEBSITE DISCLAIMER

YUCCA's official website may contain hyperlinks to external websites and social media platforms operated by third parties, and YUCCA does not control, endorse or assume responsibility for the content or privacy practices of external sites or entities.

6. GENERAL

Third Party Sources

In certain instances, YUCCA may collect Personal Information from publicly accessible sources or from third parties who are lawfully authorised to disclose such information. This may include information obtained through the Data Subject’s authorised representatives, affiliated service providers, or contractors engaged by the Data Subject to perform functions on its behalf.

Where a Data Subject displays interest in employment opportunities with YUCCA, YUCCA may collect and Process relevant Personal Information and Special Personal Information (with the consent of the Data Subject) from recruitment consultants, Human Resources personnel, or internal decision-makers involved in the appointment and onboarding process.

All such collection and Processing is conducted in accordance with applicable privacy legislation and for legitimate organisational purposes.

Visitors to YUCCA's Offices

Information obtained:-

- contact information;

- identity number; and

- physical address.

To ensure the safety and security of YUCCA’s personnel and visitors to its offices, YUCCA may collect the listed Personal Information from individuals entering its premises.

6.1. YUCCA and its authorised Personnel undertake to treat all Personal Information collected from Data Subjects as strictly confidential and in accordance with POPIA.

6.2. No Personal Information concerning any Data Subject, or the contents of any related communication or documentation, may be disclosed to any unauthorised third party by YUCCA Personnel unless:-

6.2.1. YUCCA is legally required to disclose such Personal Information; or

6.2.2. disclosure is in the interest of protecting a legal right or interest; or

6.2.3. disclosure is reasonably necessary for YUCCA to perform and further its business operations, fulfil purchases and deliveries, and provide client support; or

6.2.4. the express consent of the Data Subject has been obtained prior to disclosing such Personal Information.

6.3. YUCCA may share the Personal Information of the Data Subject with authorised third parties, to the extent necessary, including:-

6.3.1. PayFast, in order to authorise and process online payments;

6.3.2. advertising and analytics service providers, for marketing and website performance purposes;

6.3.3. IT and data storage service providers; and

6.3.4. logistics and courier service providers, in order to process, dispatch and deliver orders.

All third parties shall be contractually obligated to Process the Data Subject's Personal Information in accordance with POPIA and only for specified purposes.

6.4. YUCCA Personnel may only collect, Process or store Personal Information relating to the Data Subject: -

6.4.1. if it is necessary for the execution of YUCCA’s functions or obligations;

6.4.2. with the full knowledge of the Data Subject; and

6.4.3. insofar as required by POPIA, with the informed (and where necessary, written) consent of the Data Subject.

Such information will be used strictly for the purposes stated at the time of collection. Should a further purpose arise during the execution of its mandate and/or duties, YUCCA will obtain the further, necessary consent from the Data Subject before proceeding.

7. REQUESTS UNDER POPIA

7.1. YUCCA undertakes to grant the Data Subjects access to their Personal Information upon written request, subject to verification of identity and in accordance with the provisions of POPIA and PAIA. YUCCA does not charge a fee for confirming whether Personal Information is held on a Data Subject.

7.2. If a Data Subject wishes to update or correct their Personal Information, YUCCA may require supporting documentation as proof of the changes. A record of the request, the date of the request and the nature of the update will be Recorded.

7.3. If applicable and where necessary, YUCCA will notify relevant third parties of any amendments to the Data Subject’s Personal Information to ensure that Records are accurate and up to date, especially where this affects ongoing operations or services.

7.4. Should a Data Subject request a copy or description of the Personal Information YUCCA holds, including disclosures to third parties, YUCCA will respond within a reasonable time, in an accessible format, and may charge a prescribed fee in accordance with the Regulations.

7.5. Should a Data Subject wish to “opt out” of receiving marketing communications, the Data Subject may either click the 'Unsubscribe' hyperlink contained in YUCCA’s marketing emails, email YUCCA directly at marketing@yucca.co.za and/or submit a request in the prescribed form to the Information Officer.

7.6. A request made under POPIA must be submitted to the Information Officer (where applicable) in the prescribed form available on the Regulator’s official website (https://inforegulator.org.za/popia/):-

7.6.1. Form 1 – Objection to the Processing of Personal Information;

7.6.2. Form 2 – Request for Correction or Deletion of Personal Information or Destroying of Record of Personal Information;

7.6.3. Form 3 – Application for the Issue of a Code of Good Conduct;

7.6.4. Form 4 – Application for the Consent of a Data Subject for the Processing of Personal Information for the Purpose of Direct Marketing;

7.6.5. Form 5 – Complaint Regarding Interference with the Protection of Personal Information / Complaint Regarding Determination of an Adjudicator; and

7.6.6. Form 20 – Request for an Internal Review in the rules of procedure relating to the manner in which a complaint must be submitted and handed by the Information Regulator.

8. PROCESSING OF PERSONAL INFORMATION OF MINOR CHILDREN

8.1. YUCCA does not knowingly Process the Personal Information of minor children without obtaining the prior consent of a competent person, as contemplated in sections 34 and 35 of POPIA.

8.2. YUCCA acknowledges, and the Data Subject accepts, that YUCCA’s official website may be accessed by minor children. Should a Data Subject become aware that Personal Information of a minor child has been Processed without the necessary consent of a competent person, the Data Subject must immediately notify the Information Officer.

8.3. Upon becoming aware of such Processing, YUCCA undertakes to take all reasonable and appropriate steps to investigate the matter, ensure compliance with POPIA, and remedy any unauthorised Processing of the Personal Information of minor children.

9. INFORMATION OFFICER

9.1. Information Officer-

For Attention: REYNARDT BESTER

Telephone: 021 949 2296

Email: admin@yucca.co.za

9.2. Access to information general contacts: -

Email: admin@yucca.co.za

For Attention:

9.3. Head Office: -

Postal Address: Unit 1 Reserve 5, Capricorn Way, Brackenfell, Western Cape

Physical Address: Unit 1 Reserve 5, Capricorn Way, Brackenfell, Western Cape

Telephone: 021 949 2296

Email: admin@yucca.co.za

Website: https://yucca.co.za/

9.4. For any queries, requests or complaints related to the Processing of Personal information, please contact our Information Officer or Deputy Information Officer.

10. INCIDENT MANAGEMENT PROCESS

10.1. YUCCA acknowledges that the Processing of Personal Information by electronic or other means carries inherent security risks.

10.2. While YUCCA implements appropriate and reasonable technical and organisational measures to maintain the integrity and confidentiality of the Personal Information in its possession, the possibility of unauthorised access, disclosure, or loss due to security breaches cannot be entirely excluded.

10.3. In the event that YUCCA becomes aware of, or has reasonable grounds to believe that any unauthorised access to or disclosure of Personal Information ("Data Breach") exists, YUCCA undertakes, as soon as practically possible, to notify both the Information Regulator and the affected Data Subject(s). The notification will include sufficient information to enable the Data Subject to take protective measures, mitigate potential adverse effects, and exercise their rights under POPIA.

11. EMPLOYEE AWARENESS ON THE POPIA POLICY

11.1. To facilitate that confidential and Personal Information of clients is secured from unauthorised access and data breaches, YUCCA actively promotes and encourages security awareness to mitigate potential security threats.

11.2. All YUCCA Personnel, as a condition of their employment and onboarding with YUCCA, are made aware of their obligations in relation to the lawful Processing and protection of Personal Information, through regular training and awareness sessions with the Information Officer and / or Deputy Information Officer.

11.3. YUCCA Personnel are, therefore, cognisant of the principles of lawful Processing and are committed to treating all Personal Information as strictly confidential, both during the course of their employment or engagement and thereafter.

12. INFORMATION SECURITY AND ACCESS CONTROL

12.1. Access to YUCCA systems and data

12.1.1. YUCCA utilises Secure Sockets Layer encryption ("SSL") to encrypt and secure connections between its official website and the browser used by the Data Subject.

12.1.2. Access to Personal Information of clients and Personnel is restricted to authorised YUCCA Personnel and/or management, who are granted access through individual usernames and passwords.

12.1.3. Should it be necessary for Personnel to work remotely, client information on electronic devices is secured by office authentication protocols.

12.2. Security measures implemented to protect Personal Information

1. YUCCA has identified security risks associated with the Personal Information Processed by it and, accordingly, implemented various security measures to ensure reasonable protection against the risk of loss, misuse, unauthorised access and disclosure, alteration and destruction ("data breach") of Personal Information.

2. YUCCA takes reasonable steps to ensure that employees, service providers and any other contracted parties that Process Personal Information on behalf of YUCCA apply adequate and reasonable security measures to protect the Personal Information from a data breach.

3. YUCCA ensures that devices and/or systems designated to protect the network are regularly updated and tested to maintain optimal performance and security.

2. RESTRICTION OF ACCESS TO PERSONAL INFORMATION

In terms of section 14 of POPIA, YUCCA will not retain the Personal Information and Special Personal Information of the Data Subject without their consent for any longer than is necessary to achieve the purpose for which the information was originally collected.

Should a valid reason exist and/or arise that requires an extension of retention of the Personal Information / Special Personal Information, this will be clearly communicated to the Data Subject(s) concerned and, where necessary, further consent will be obtained.

3. DATA BACK-UP

3.1. All data stored on YUCCA’s central server is automatically backed up on a daily basis to ensure the integrity and availability of critical information, including Personal Information.

3.2. The primary back-up device is securely stored in a locked cabinet within YUCCA’s main office, with access restricted to authorised Personnel only.

3.3. Monthly integrity tests are conducted by YUCCA’s appointed IT service provider to confirm that the back-up system is functioning correctly and that all data is retrievable.

3.4. A secondary encrypted back-up is stored in a secured cloud.

4. ADMINISTRATIVE SECURITY

4.1. YUCCA has developed a comprehensive incident response plan to mitigate potential disruption of its service or a security threat to the data maintained by it in the event of a system failure and/or disruption.

5. RISK ANALYSIS

5.1. The Information Officer conducts an annual review and update of YUCCA's risk analysis report and data security measures, covering physical, digital, operational, and administrative safeguards.

5.2. When necessary, YUCCA's security protocols are revised and updated to ensure that the highest standards of protection are maintained.

6. UPDATING OF THE MANUAL

The Information Officer will update this Policy on a regular basis.

PAIA Manual

1. LIST OF ACRONYMS AND ABBREVIATIONS

1. "Data Subjects" means the persons to whom Personal Information relates, including customers, employees, operators, suppliers, other persons and third parties;

2. "Guide" means the guide on how to use PAIA by any person who wishes to exercise any right contemplated in the PAIA and the POPIA, as contemplated in section 10 of PAIA;

3. "Manual" means this document;

4. "PAIA" means the Promotion of Access to Information Act No. 2 of 2000 (as amended);

5. "Personal Information" means personal information as defined under section 1 of the POPIA;

6. "POPIA" means the Protection of Personal Information Act No.4 of 2013;

7. "Prescribed Fee" means a prescribed request fee published by the Regulator and levied to a Requestor for processing the request for information or records;

8. "Processing" means any operation or activity, whether or not by automatic means, concerning Personal Information as defined in section 1 of POPIA;

9. "Record" means any recorded information, regardless of form or medium in the possession or under the control of YUCCA, whether or not it was created by YUCCA;

10. "Regulations" means the Promotion of Access to Information Act No. 2 of 2000: Regulations Relating to the Promotion of Access to Information of 2021;

11. "Regulator" means the Information Regulator of South Africa, established in terms of section 39 of the POPIA;

12. "Requester" means a natural person or juristic person seeking access to information; and

13. "YUCCA" means Yucca Holdings (Proprietary) Limited, a private company duly incorporated in terms of the laws of the Republic of South Africa under registration number: 2001/028529/07.

2. INTRODUCTION

PAIA came into effect on 9 March 2001, giving practical implementation to the right of access to information under section 32(2) of the Constitution.

A key requirement of PAIA is that private bodies must compile an information manual detailing the types and categories of records they hold.

This document serves as YUCCA's information Manual and outlines the records in its possession, along with the procedures to follow when requesting access to these records.

3. PURPOSE

3.1. This Manual is intended to assist members of the public in understanding and exercising their rights in terms of PAIA and POPIA. Specifically, this Manual enables the public to: -

3.1.1. identify the categories of records held by YUCCA which are available without the need to submit a formal request in terms of PAIA;

3.1.2. understand how to make a request for access to a record of YUCCA, by providing a description of the subjects on which YUCCA holds records, and the categories of records held on each subject;

3.1.3. know the description of the records of YUCCA which are available in accordance with any other legislation;

3.1.4. access all the relevant contact details of the Information Officer and Deputy Information Officer, who are responsible for assisting members of public with access to records;

3.1.5. know where to access the Guide on how to use PAIA, as updated by the Regulator and how to obtain access to it;

3.1.6. know if YUCCA will process Personal Information, the purpose of such processing, the description of the categories of Data Subjects and of the information or categories of information relating thereto;

3.1.7. know the recipients or categories of recipients to whom the Personal Information may be supplied;

3.1.8. know if YUCCA intends to transfer or Process Personal Information outside the Republic of South Africa and the recipients or categories of recipients to whom the Personal Information may be supplied; and

3.1.9. determine whether YUCCA has appropriate security safeguards to ensure the confidentiality, integrity and availability of the Personal Information which is to be processed.

4. KEY CONTACT DETAILS FOR ACCESS TO INFORMATION OF YUCCA

4.1. Information Officer-

For Attention: REYNARDT BESTER

Telephone: 021 949 2296

Email: admin@yucca.co.za

4.2. Access to information general contacts: -

Email: admin@yucca.co.za

For Attention: REYNARDT BESTER

4.3. Head Office: -

Postal Address: Unit 1 Reserve 5, Capricorn Way, Brackenfell, Western Cape

Physical Address: Unit 1 Reserve 5, Capricorn Way, Brackenfell, Western Cape

Telephone: 021 949 2296

Email: admin@yucca.co.za

Website: https://yucca.co.za/

4.4. For any queries, requests or complaints related to the Processing of Personal information, please contact our Information Officer or Deputy Information Officer.

5. GUIDE ON HOW TO USE PAIA AND HOW TO OBTAIN ACCESS TO THE GUIDE

5.1. The Regulator has, in terms of section 10(1) of the PAIA, updated and made available revised Guide, in an easily comprehensible form and manner. The purpose of the Guide is to provide information that is needed by any person who wishes to exercise any right contemplated in the PAIA and the POPIA.

5.2. This Guide will specifically assist the Data Subjects, on how to access his/her or its Personal Information in terms of section 23 of the POPIA. The Regulator has made available the Guide which can be obtained:

5.2.1. upon request to the Information Officer by completing Form 01 and submitting same via conventional mail or email using the address indicated in clause 4.1 above; or

5.2.2. from the website of the Regulator being https://inforegulator.org.za/.

5.3. A copy of the Guide is also available in the following two official languages, for public inspection during normal office hours: -

5.3.1. Afrikaans; and

5.3.2. English.

6. CATEGORIES OF RECORDS OF YUCCA WHICH ARE AVAILABLE WITHOUT A PERSON HAVING TO REQUEST ACCESS

In accordance with PAIA, the following categories of records held by YUCCA are readily available to any person, without the need to submit a formal request for access in terms of PAIA. Such information may be accessed through YUCCA's website or obtained upon informal request via telephone or email ("Informal Request"):

Category of Records	Types of Records	Available on Website	Available upon Informal Request
Company profile	Company profile;	x	x
	Product catalogue (product description, stock availability in real time, prices, sizes, and packaging detail);	x	x
	General information;	x	x
	Contact details;	x	x
	Physical address;	x	x
	Overview of services offered by YUCCA;	x	x
	Social media hyperlinks;	x	x
	Delivery and return policy;	x	x
	General terms and conditions of sales;	x	x
	Promotions and loyalty programme information; and	x	x
	Overview of partnerships including a link to the affiliate’s website.	x	x
Policies and Guidelines	PAIA Manual;	x	x
	POPIA Policy; and	x	x
	Cookie Policy.	x	x
Account Information	Account dashboard;	x	x
	Customer details;	x	x
	Order history;	x	x
	Loyalty cash back balance;	x	x
	Delivery address (if saved);	x	x
	Personalised offers and promotions (based on purchase history and loyalty points);	x	x
	Delivery tracking; and		x
	Payment history (if saved).		x
Credit Application	Credit application portal; and	x	x
	Credit application form and agreement.	x	x

7. DESCRIPTION OF THE RECORDS YUCCA WHICH ARE AVAILABLE IN ACCORDANCE WITH ANY OTHER LEGISLATION

YUCCA holds the following records in accordance with the following legislation: -

Category of Records	Applicable Legislation
Statutory company documents and company secretarial documents	Companies Act 71 of 2008 Competition Act 89 of 1998 Copyrights Act 98 of 1978 Customs and Excise Act 91 of 1964 Electronic Communications and Transactions Act 25 of 2002 Protected Disclosures Act 26 of 2000 Regulation of Interception of Communications and Provision of Communication-related Information Act 70 of 2002
PAIA Manual	Promotion of Access to Information Act 2 of 2000
POPIA Policy	Protection of Personal Information Act 4 of 2013
Employment records	Basic Conditions of Employment Act 75 of 1997 Broad Based Black Economic Empowerment Act 53 of 2003 Compensation for Occupational Injuries and Transaction Act 130 of 1993 Employment Equity Act 55 of 1998 Immigration Act 13 of 2002 Labour Relations Act 66 of 1995 Occupational Health and Safety Act 85 of 1993 Pension Funds Act 24 of 1956 Skills Development Act 97 of 1998 Skills Development Levies Act 9 of 1999 Trade Marks Act 194 of 1993 Unemployment Insurance Contributions Act 4 of 2002 Unemployment Insurance Fund Act 63 of 2001
Financial and accounting records	Income Tax Act 58 of 1962 South African Revenue Services Act 34 of 1997 Tax Administration Act 28 of 2011 Value Added Tax Act 89 of 1991
Consumer and credit compliance	Consumer Protection Act 68 of 2008 National Credit Act 34 of 2005
Anti-money laundering and regulatory reporting records	Prevention of Organised Crime Act 121 of 1998 Prevention and Combating of Corrupt Activities Act 12 of 2004 Protection of Constitutional Democracy Against Terrorist and Related Activities Act 33 of 2004

8. DESCRIPTION OF THE SUBJECT ON WHICH YUCCA HOLDS RECORDS AND CATEGORIES OF RECORDS HELD ON EACH SUBJECT BY YUCCA

8.1. In terms of POPIA, Personal Information must be Processed for a specific, lawful, and explicitly defined purpose. The purpose for which Personal Information is processed by the Data Subject depends on the nature of the information and the specific category of Data Subject involved.

8.2. YUCCA Process the following categories of information: -

9. PROCESSING OF PERSONAL INFORMATION

9.1. YUCCA Processes the Personal Information of the following categories of persons: -

9.1.1. stakeholders;

9.1.2. employees;

9.1.3. website users;

9.1.4. prospective employees; and

9.1.5. customers;

9.1.6. clients;

9.1.7. creditors; and

9.1.8. service providers.

9.2. YUCCA Processes Personal Information for purposes reasonably necessary to carry out its functions and objectives as the supplier of packaging material. These purposes include, but are not limited to: -

9.2.1. ensuring that customer orders are fulfilled, including but not limited to the linking of Personal Information to specific orders, shipments, senders and/or receivers;

9.2.2. delivering products to customers;

9.2.3. arranging for delivery by third party service providers;

9.2.4. managing relationships with customers, employees and stakeholders;

9.2.5. complying with legal and regulatory obligations;

9.2.6. communicating with customers, employees, stakeholders or any other Data Subjects, including sending service updates, notices, and marketing communications;

9.2.7. ensuring the safety and security of goods transported, information systems, and employees;

9.2.8. electing and communicating with directors, shareholders and regional representatives;

9.2.9. handling enquiries received via the website;

9.2.10. administering statutory levy collection, compliance, and reporting;

9.2.11. maintaining records of correspondence, transactions, stakeholder interactions, and operational statistics;

9.2.12. recruiting and selecting employees or stakeholders (for example receiving and evaluating CVs and conducting background checks);

9.2.13. keeping record of employees (drafting employment contracts and maintaining employee records);

9.2.14. keeping record of credit applications;

9.2.15. managing invoicing, credit agreements, refunds and loyalty reward programmes;

9.2.16. administering payroll and employee benefits; and

9.2.17. complying with labour laws and tax regulations.

9.3. A detailed description of the categories of Data Subjects and of the Personal Information Processed by YUCCA is available in the POPIA Policy which can be accessed at https://yucca.co.za/privacy-policy/

9.4. The recipients or categories of recipients to whom the Personal Information may be supplied: -

Category of Personal Information	Recipient or category of recipients to whom the Personal Information may be supplied
Identity numbers and names and surname, for criminal background checks	South African Police Services
Credit and payment history, for credit information	Credit Bureaus
Client information, to service providers	Personal Information may be shared with third-party service providers only to the extent that the customer has provided consent for such sharing, or where disclosure is necessary for YUCCA to carry out its business operations, including fulfilling orders, arranging deliveries, or providing customer support.

9.5 Planned transborder flow of Personal Information: - 

9.5.1 YUCCA may transfer to, and store Personal Information about the Data Subject in countries other than South Africa, if the relevant business transaction requires trans-border Processing.

9.5.2 These countries may not have the same data protection laws as South Africa, and in this instance, YUCCA will only transfer Personal Information with the Data Subjects consent, or when it is necessary for the performance or conclusion of an agreement or transaction between YUCCA and the Data Subject.

9.5.3 Adequate security safeguards, measures and controls have been implemented by YUCCA to ensure the confidentiality and integrity of Personal Information, and to minimise the risk of loss, unauthorised access, disclosure, interference, modification or destruction of Personal Information.

10. REQUEST PROCEDURE

It is important to note that the completion and submission of Form 02 does not automatically allow the Requester access to the requested record. An application for access to a record is subject to certain limitation if the requested record falls within a certain category as specified within Part 3 Chapter 4 of PAIA (see clause 10.6 and 10.7 below).

10.1. Who may request information?

10.1.1. Any person, whether a South African citizen or not, may submit a request for access to information under PAIA (the "Requester"). The Requester may be either a natural person or a juristic person.

10.1.2. A Requester who seeks access to records held by YUCCA must clearly indicate the right they are seeking to protect or exercise by means of the requested information.

10.1.3. A public body is considered a juristic person and may make a request for access to records held by private bodies, but only if the public body: -

10.1.3.1. is acting in the interest of the public; and

10.1.3.2. if the records are required to fulfil or protect any rights other than those of the public body.

10.2 Notification

YUCCA will within 30 (thirty) days of receipt decide whether to grant or decline the request and give notice using Form 03 (or a form that corresponds substantially with Form 03) with reasons (if required) to that effect. The 30 (thirty) day period within which YUCCA has to decide whether to grant or refuse the request maybe extended for a further period of not more than 30 (thirty) days, if the request is for a large volume of information, or he request requires a search for information held at another office and the information cannot reasonably be obtained within the 30 (thirty) day period. Should an extension be required, YUCCA will notify the Requester in writing, together with reasons explaining why the extension is necessary.

10.3. How is the request made?

In order to facilitate a timely response to request for access, all Requesters should take note of the following:

10.3.1. A request to access information is made by completing the prescribed Form 02 available on the Regulator’s website at https://inforegulator.org.za/paia/.

10.3.2. Proof of identity is required to authenticate the identity of the Requester.

10.3.3. If the request is made on behalf of another person, the Requester must submit proof of the capacity in which the Requester is making the request.

10.3.4. Every question in the Form 02 should be answered in BLOCK LETTERS.

10.3.5. If there is insufficient space on a printed form, additional information may be provided on an additional attached folio.

10.3.6. When the use of an additional folio is required, precede each answer with the applicable title.

10.3.7. In addition to Form 02, the following Forms are also available on the Regulator’s website at https://inforegulator.org.za/paia/ :-

10.3.7.1. Form 01: Request for a Guide from the Regulator;

10.3.7.2. Form 01: Request for a Copy of the Guide from an Information Officer;

10.3.7.3. Form 03: Outcome of request and of fees payable;

10.3.7.4. Form 04: Internal Appeal Form;

10.3.7.5. Form 05: Complaint Form; and

10.3.7.6. Form 13: PAIA Request for Compliance Assessment Form.

10.4. Submission of Request for Access to Record Form

10.4.1. The completed Form 02, together with a copy of the identity document of the Requester, and the additional folio’s (if applicable), must be addressed to the Information Officer and submitted either via conventional mail or the email address indicated in clause 4 above.

10.4.2. A request fee (based on the Prescribed Fee) is payable on submission. This fee is not applicable to Data Subjects seeking access to records that contain their Personal Information.

10.4.3. If it is reasonably suspected that the Requester obtained access to records through the submission of materially false or misleading information, legal proceedings may be instituted against such Requester.

10.5. Fees

YUCCA may require the Requester to pay a fee or a deposit fee. These fees must be reasonable and may only cover the time and resources needed to locate and prepare the requested record.

10.6. Grounds for refusal

10.6.1. The Information Officer must refuse a request for information if the following grounds apply: -

10.6.1.1. Mandatory protection of the privacy of a third party (natural person), unless consent is given or the information is already public knowledge.

10.6.1.2. Mandatory protection of certain South African Revenue Services ("SARS") records.

10.6.1.3. Mandatory protection of commercial information of a third party (for example trade secrets).

10.6.1.4. Mandatory protection of certain confidential information of a third party if a duty of confidentiality is owed to a third party in terms of an agreement.

10.6.1.5. Mandatory protection of an individual's safety and the protection of property.

10.6.1.6. Mandatory protection of police dockets and law enforcement procedures.

10.6.1.7. Mandatory protection of information which is regarded as privileged in legal proceedings.

10.6.1.8. Mandatory protection of research information of third party, and protection of research information of public or private body.

10.6.1.9. The commercial activities of YUCCA which may include trade secrets or financial, commercial, scientific or technical information which disclosure could likely cause harm to the financial or commercial interest of YUCCA.

10.7. Discretionary grounds for refusal

10.7.1. The Information Officer may refuse a request for information if one or more of the following grounds apply: -

10.7.1.1. Protection of South Africa’s defence, security, or international relations.

10.7.1.2. Protection of the Republic’s economic, financial, or commercial interests.

10.7.1.3. Where disclosure would hamper the operations of public bodies.

10.7.1.4. Frivolous or vexatious requests.

11. AVAILABILITY OF MANUAL

11.1. A copy of this Manual is available –

11.1.1. at https://yucca.co.za/privacy-policy/;

11.1.2. at Unit 1, Reserve 5, Capricorn Way, Brackenfell for public inspection during normal business hours;

11.1.3. to any person upon request made and submitted to the Information Officer on Form 02 and upon the payment of the Prescribed Fee; and

11.1.4. to the Information Regulator upon request.

11.2. The Prescribed Fee for a copy of the Manual shall be payable per each size A4 photocopy made.

12. UPDATING OF THE MANUAL

The Information Officer will update this Manual on a regular basis.