VASCO DE OLIVEIRA INCORPORATED

(REGISTRATION NUMBER: 2015/175221/21)

(“the Company”)

MANUAL IN TERMS OF SECTION 51 OF

THE PROMOTION OF ACCESS TO INFORMATION ACT 2 OF 2000

(“PAIA”)

As amended by

THE PROTECTION OF PERSONAL INFORMATION ACT 4 OF 2013

(“POPI”)

Date of Compilation: 27 June 2021

Updated version: 24 June 2025

INDEX

1. Introduction to the Company
2. Company Contact Details
3. Introduction to PAIA
4. Guidance on submitting a PAIA request
5. Records kept by the Company in terms of Legislation
6. Schedule of Records
7. Form of Request
8. Prescribed Fees
9. Remedies when PAIA request is denied
10. Records to which access must be refused
11. Records that cannot be located
12. Protection of Personal Information Act 4 of 2013 (“POPIA”)
    1. Information on how you can request your personal information under POPIA
    2. Purpose of Processing
    3. Undertaking by the Company
    4. How does the Company protect the personal information which it processes
    5. What are the information protection principles?
    6. Retention of processed information
    7. Measures to ensure protection of the processed personal information?
13. Incident Response
14. Availability of this manual

1. INTRODUCTION TO THE COMPANY

   Vasco de Oliveira Incorporated is a law firm based in Sandton, Gauteng. It is a firm with a unique, direct and succinct vision to provide its clients with high quality, specialized and above all professional legal solutions which meets their specific needs and requirements.

   At Vasco de Oliveira Incorporated, great value is placed on all the commercial imperatives of modern target- driven corporate entities, small business owners as well as individuals. We are acutely aware that each client is different and through the assembly and utilisation of a network of experts garnered over a number of years, we are optimally positioned to offer our clients a wide spectrum of specialised legal services tailored to each client to meet their diverse and specific needs and desired outcomes with a view to resolving their matters as expeditiously as possible not only in South Africa but abroad too. 

   Having been classified as one of GlobalLaw Experts’ Recommended Firms in Internet and E-Commerce Law, Vasco de Oliveira Incorporated is a front runner amongst the Internet and E-Commerce law giants, offering our clients a fresh and modern approach to this ever-growing field of law.

   Numerous commendations from our vast array of top tier clients consisting of South African political figures, global and local companies, finance institutions, trade unions and mining giants, international fraud authorities, senior members of the bar and leading technology and other experts confirm that Vasco de Oliveira Incorporated is a leader in the industry and a force to be reckoned with.

2. COMPANY CONTACT DETAILS

   Business Address	23C Sandton View Office Park, Conduit Street, Lyme Park, Sandton, 2196
   Postal Address	PO Box 4, Cramerview, 2060
   Fax No.	011 326 2507 / 086 650 5798
   Email	info@oliveira.co.za
   Head	Vasco de Oliveira Managing Director vasco@oliveira.co.za
   Information Officer	Vasco de Oliveira vasco@oliveira.co.za
   Deputy Information Officer	Paroshini Govender paro@oliveira.co.za

3. INTRODUCTION TO PAIA

   The South African Constitution places an obligation upon both public and private bodies to allow access to records held by them. For private bodies, this is conditioned upon the demonstration that the information is needed for the exercise or protection of other rights.

   The Promotion of Access to Information Act 2 of 2000 (“PAIA”) was established “to give effect to the constitutional right of access to any information held by the State and any information that is held by another person and that is required for the exercise or protection of any rights; and to provide for matters connected therewith”. 

   You are therefore entitled to make a request to the Company in terms of PAIA for a document or information which has been processed by the Company in order to exercise the above constitutional right.

4. GUIDANCE ON SUBMITTING A PAIA REQUEST

   PAIA grants a requester access to records of a private body, if the record is required for the exercise or protection of any rights. If a public body lodges a request, the public body must be acting in the public interest.

   Requests in terms of PAIA shall be made in accordance with the prescribed procedures, at the rates provided in PAIA.

   Requesters are referred to the Guide in terms of Section 10 of PAIA which has been compiled by the South African Human Rights Commission (“SAHRC”), which contains information for the purposes of exercising Constitutional Rights. The Guide is available on the SAHRC’s offices or on their website.

   The contact details of the Commission are as follows:

   Physical Address:	Forum 3 Braampark, 33 Hoofd Street, Braamfontein
   Postal Address:	Private Bag 2700, Houghton, 2041
   Telephone Number:	+27-11-877 3600
   Fax Number:	+27-11-403 0625
   Website:	www.sahrc.org.za

5. RECORDS KEPT BY THE COMPANY IN TERMS OF LEGISLATION

   The legal profession is a highly regulated industry and is therefore subject to various legislations. Vasco de Oliveira Inc, where applicable, holds information in terms of inter alia the following legislation:

   • Legal Practice Act 28 of 2014
   • Attorneys Act 53 of 1979
   • Financial Intelligence Centre Act 38 of 2001
   • Basic Conditions of Employment Act 75 of 1977
   • Labour Relations Act 66 of 1978
   • Employment Equity Act 55 of 199
   • Income Tax Act 68 of 1962
   • Value Added Tax Act 89 of 1991
   • Companies Act 71 of 2008
   • Electronic Communications and Transactions Act 25 of 2002
   • Unemployment Contribution Act 4 of 2002
   • Unemployment Insurance Act 30 of 1966
   • National Credit Act 34 of 2005
   • Prescription Act 68 of 1969
   • Promotion of Access of Information Act 2 of 2000
   • Protection of Personal Information Act 4 of 2013

6. SCHEDULE OF RECORDS

   The following is a schedule of the records which are kept by the Company

   RECORDS	SUBJECT	AVAILABILITY
   1. Employment	Employment contracts Disciplinary records Salaries and wages Disciplinary code Leave records Banking details PAYE records Documents issued to employees for income tax purposes Records of payments made to SARS on behalf of employees UIF records	Not available.    Request in terms of   PAIA.
   2. Client Records	Mandate & Fee Agreements, and other records provided by clients, including FICA documentation Records provided by third parties Records generated within Vasco de Oliveira Inc. Client files	Not available.    Request in terms of   PAIA.
   3. Financial	Financial Statements  Financial and Tax Records (Company & Employees) Asset Register Management Accounts	Not available.    Request in terms of   PAIA.
   4. Service Providers	Service provider agreements and invoices	Not available.    Request in terms of   PAIA.

7. FORM OF REQUEST

   To facilitate the processing of your request, kindly:

   1. Use the prescribed form attached to this manual as Annexure 1;
   2. Address your request to the Information Officer or Deputy Information Officer listed under section 2 of this manual and email your request form as per details provided.
   3. Provide sufficient details to enable the Company to identify:
      1. The record(s) requested;
      2. The requester (and if an agent is lodging the request, proof of capacity);
      3. Requester must indicate which form of access is required, e.g. hard copy, electronic copy, etc;
      4. Specify a postal address or fax number of the requester in the Republic;
      5. If the requester wishes to be informed of the decision in any manner (in addition to written) state the manner and particulars thereof;
      6. The right which the requester is seeking to exercise or protect with an explanation of the reason the record is required to exercise or protect the right.
   4. Please note that all requests which we receive, will be evaluated and considered in accordance with PAIA. It is important to remember that, even though we have published this manual and described the categories and subject matter of information or records that we hold, this does not give you any rights to access such information or records, except in terms of PAIA. Please refer to section 10 of this manual for records which the Information Officer must refuse access to.
   5. The Information Officer/ Deputy Information Officer of the Company shall respond to your request within 30 days after receiving the request. The information officer may re

8. PRESCRIBED FEES

   The following applies to requests (other than personal requests):

   1. The fee structure is attached to this manual as Annexure 2.
   2. A requestor is required to pay the prescribed fees R50.00 before a request will be processed.
   3. If the preparation of the record requested requires more than the prescribed hours (six), a deposit shall be paid (of not more than one third of the access fee which would be payable if the request were granted);
   4. A requestor may lodge an application with a court against the tender/payment of the request fee and/or deposit.
   5. The actual postage is payable when a copy of a record must be posted to a requester.
   6. Records may be withheld until the fees have been paid.

9. REMEDIES WHEN PAIA REQUEST IS DENIED

   If you are not satisfied with a decision made by the Information Officer, such as, for denying access to a record, for imposing access fees, or for extending the time period within which the record is due, you may apply to court within 180 days of receiving the decision that has caused the grievance.

10. RECORDS TO WHICH ACCESS MUST BE REFUSED

    In terms of PAIA, request of records relating to the following information must be refused by the Information Officer:

    • Privacy of a third party who is a natural person: if its disclosure would involve the unreasonable disclosure of personal information about a third party, including a deceased individual.
    • Certain records of the South African Revenue Service (SARS): if it contains information that was obtained or is held by SARS for the purposes of enforcing legislation concerning the collection of revenue as define.
    • commercial information of third party: the Deputy Information Officer must refuse a request if the record contains:
      • trade secrets of a third party;
      • financial, commercial, scientific or technical information other than trade secrets of a third party, of which the disclosure could likely cause harm to the commercial or financial interests of that third party; or information supplied in confidence by a third party and the disclosure could put that third party at a disadvantage in contractual or other negotiations, or prejudice that third party in commercial competition.
    • Confidential information of a third party: if the disclosure of the record would constitute an action for breach of a duty of confidence owed to a third party in terms of an agreement.
    • Safety of individuals and protection of property: if its disclosure could reasonably be expected to endanger the life or physical safety of an individual.
    • Police dockets in bail proceedings, and protection of law enforcement and legal proceedings: if access to that record is prohibited in terms of section 60 (14) of the Criminal Procedure Act, 1977 (Act 51 of 1977).
    • Records privileged from production in legal proceedings: if the record is privileged from production in legal proceedings unless the person entitled to the privilege has waived the privilege.
    • Research information of third party, and protection of research information of public body: if the record contains information about research being or to be carried out by or on behalf of a third party, the disclosure of which would be likely to expose:
      • the third party;
      • a person that is or will be carrying out the research on behalf of the third party; or
      • the subject matter of the research to serious disadvantage.

11. RECORDS THAT CANNOT BE LOCATED

    If the Company cannot find a document which the requester has requested despite reasonable and diligent search and the Company believes that the record has been lost or that the record is in its possession but unattainable, then the Information Officer will furnish the requester with an affidavit setting out the measures taken to locate the record and his/her inability to locate the document.

12. PROTECTION OF PERSONAL INFORMATION ACT 4 OF 2013 (“POPIA”)

    The Constitution of the Republic of South Africa guarantees the right to privacy. In addition to the constitution, there are other legislation which regulate the manner in which personal information is processed. Protection of Personal Information Act 4 of 2013 (POPIA) was promulgated into law on 26 November 2013, and is by far the most substantial piece of legislation which protects the personal information of both living natural persons and existing entities. POPIA amends PAIA in a number of ways. One of the keys ways in which this Act changes PAIA relates to the role of the SAHRC. Under POPIA the SAHRC’s functions in terms of PAIA will be transferred to the Information Regulator, a new independent body which set up to monitor both the POPIA and PAIA, and to handle complaints relating to access to information and the protection of personal information. However, the SAHRC will still retain its Constitutional obligation to promote, protect and monitor the right of access to information as with all other rights enshrined in the Bill of Rights.

    1. Information on how you can request your personal information under POPIA

        

       1. Requests for personal information under POPIA must be made in accordance with the provisions of PAIA.
       2. If we provide you with your personal information, you have the right to request the correction, deletion or destruction of your personal information, in the prescribed form attached hereto as Annexure 3.
       3. You may also object to the processing of your personal information in the prescribed form.
       4. We will give you a written estimate of the fee for providing you with your personal information, before providing you with the services. We may also require you to provide us with a deposit for all or part of the fee prior to giving you the requested personal information.
    2. Purpose of Processing

        

       1. POPIA provides that personal information may only be processed lawfully and in a reasonable manner that does not infringe your (the data subject’s) privacy.
       2. The type of personal information that we process will depend on the purpose for which it is collected. We will disclose to you why the personal information is being collected and will process the personal information for that purpose only.
    3. Undertaking by the Company

        

       1. Vasco de Oliveira Inc. undertakes to comply with the provisions of POPIA and to ensure that there are necessary measures in place to protect the personal information which it processes.
       2. Vasco de Oliveira Inc. undertakes to enter into written agreements to ensure that other contracting parties comply with our confidentiality and privacy requirements.
       3. Personal information may also be disclosed where we have a legal duty or a legal right to do so.
    4. How does the Company protect the personal information which it processed

        

       1. Chapter 3 of POPIA sets out the conditions which a responsible party would have to comply with in order to lawfully process personal information. These conditions may not be derogated from unless specific exclusions in terms of POPIA apply.
       2. In order to properly conduct its business as a law firm, the Company needs to obtain personal information of both individuals and juristic persons.
       3. All legal practitioners who are practising for their own account within the Republic are obliged to comply with the requirements of the Financial Intelligence Centre Act 38 of 2001 (FICA). The Financial Intelligence Centre (FIC) is South Africa’s national centre for the receipt of financial data, analysis and dissemination of financial intelligence to the competent authorities. The FIC was established by FICA and has the mandate to identify the proceeds of crime, combat money laundering and terror financing.
       4. Section 43B of FICA requires a legal practice to register with the FIC as an accountable institution. Schedule 1 to FICA lists accountable institutions, and legal practitioners are included on the list.
       5. Section 21A requires of the accountable institution, when establishing a business relationship with a prospective client, to obtain information to reasonably enable the accountable institution to determine whether future transactions, which will be performed during the course of the business relationship concerned are consistent with the institution’s knowledge of that prospective client.
       6. Moreover, legal proceedings contain information of individuals, some of which are personal.
       7. Accordingly, Vasco de Oliveira Inc is a “responsible party” for the purposes of POPIA and is required to and undertakes to comply with the information protection principles of POPIA
    5. What are the information protection principles?

        

       There are eight information processing principles which form the core of POPI. These are –

       • accountability: the responsible party must ensure that the eight information processing principles are complied with.
       • processing limitation: processing must be lawful and personal information may only be processed if it is adequate, relevant and not excessive given the purpose for which it is processed.
       • purpose specification: Personal information must be collected for a specific, explicitly defined and lawful purpose related to a function or activity of the responsible party. The responsible party must take steps to ensure that the data subject is aware of the purpose for which his/her personal information is being collected.
       • further processing limitation: this is where personal information is received from a third party and passed on to the responsible party for further processing. In these circumstances, the further processing must be compatible with the purpose for which it was initially collected.
       • information quality: the responsible party must take reasonably practicable steps to ensure that the personal information is complete, accurate, not misleading and updated where necessary, taking into account the purposes for which it was collected.
       • openness: Personal information may only be processed by a responsible party that has notified the Information Protection Regulator. Further certain prescribed information must be provided to the data subject by the responsible party including what information is being collected, the name and address of the responsible party, the purpose for which the information is collected and whether or not the supply of the information by that data subject is voluntary or mandatory.
       • security safeguards: the responsible party must secure the integrity of personal information in its possession or under its control by taking prescribed measures to prevent loss of, damage to or unauthorised destruction of personal information and unlawful access to or processing of personal information.
       • data subject participation: A data subject has the right to request a responsible party to confirm, free of charge, whether or not the responsible party holds personal information about the data subject and request from a responsible party the record or a description of the personal information held, including information about the identity of all third parties, or categories of third parties, who have, or have had, access to the information.
         • A data subject may request a responsible party to –
         • correct or delete personal information about the data subject in its possession or under its control that is inaccurate, irrelevant, excessive, misleading or obtained unlawfully; or
         • destroy or delete a record of personal information about the data subject that the responsible party is no longer authorised to retain.
    6. Retention of processed information

        

       Subject to exemptions provided for in POPI, personal information must not be retained any longer than is necessary for achieving the purpose for which the information was collected. The responsible party must retain the record for such period as may be required or prescribed by law or a code of conduct. If there is no law or code of conduct prescribing a retention period, it must retain the record for a period which will afford the data subject a reasonable opportunity to request access to the record.

       A responsible party must destroy or delete a record of personal information as soon as reasonably practicable after the responsible party is no longer authorised to retain the record.

       Rule 54.9.2 of the LPC’s rules provides that a firm shall retain its accounting records, and all files and documents relating to matters dealt with by the firm on behalf of client for at least 7 years from date of the last entry recorded in each particular book or other document of record or file.Upon expiry of the 7-year period, the Company will discard all documents or files by way of shredding the documents or file. With regards to FICA documentation, the Company will destroy all FICA documentation if that particular client has not been an active client for a period of 7 years.

    7. Measures to ensure protection of the processed personal information?

        

       The Company undertakes to abide by the POPIA regulations and to implement and maintain the data protection measures contained hereunder. The Company may also make use of alternative data protective measures which are not listed hereunder and adapt to technological security development, as needed, to ensure protection of the personal information is protected.

       • • Fee and Mandate Agreements & FICA documentation:
           • The attorney or candidate attorney that deals with a particular client will request and receive the Fee and Mandate Agreement and FICA documents from the client, and shall thereafter deliver the documents to the allocated FICA officer and the accountant of the Company.
           • The Accountant of the Company will upload the documentation onto the Company’s billing system in order for the system to generate an invoice for a particular client.
           • The FICA Officer will file the Fee and Mandate Agreement and FICA documents in a locked cupboard which only the FICA Officer, Information Officer or Deputy Information Officer, and/or the relevant attorney/candidate attorney who was instructed by that particular client, have access to.
           • The Company shall conclude an Operator’s Agreement with the Billing System Service Provider to ensure compliance with the regulations of POPIA.
         • File controls

           All employees of the Company have access to client files for purposes of handling of matters of clients. The Company shall ensure that there will be no unauthorised access to files by third parties.

         • Data Memory Control

           The Company undertakes to implement suitable measures to prevent unauthorized input into data memory and the unauthorized reading, alteration or deletion of stored data.

         • Data stored on electronic devices
           • Each staff member has his or her own laptop which he/she utilises for work purposes. Each laptop is password protected with only the user of the laptop and the employer having knowledge of the password.
           • Electronic emails are protected by way of Mimecast email security.
         • Internet Protection
           • The Company utilises various internet, malware, virus protection such as:
             • Avg antivirus;
             • Firewall;
             • Malware protection;
             • Mimecast email security
             • Domain Protection (DMARC)
         • The Company shall conclude non-disclosure agreements with each employee.
         • The Company shall conclude Operator Agreements with relevant sub-contractors or service providers of the company that process personal information of its clients.
         •  

       The Company shall conduct training for all its employees to ensure that every employee understands the POPIA regulations and undertakes to adhere to the POPIA regulations as well as this manual.

       • The Company shall not transfer personal information about a data subject to a third party who is in a foreign country unless certain protections are in place. Such protections include:
         • The foreign country has a law that provides adequate protection;
         • There are binding corporate rules that provide adequate protection;
         • There is an agreement between sender and the receiver that provides adequate protection;
         • The data subject consents;
         • The transfer is necessary for the responsible party to perform in terms of a contract.

13. INCIDENT RESPONSE

    In the event of an anticipated breach or an actual breach incident the following procedure will be followed:

    • The Information Officer will inform the data-subject of the breach;
    • The Information Officer will conduct an investigation regarding the incident; and
    • Upon completion of investigation, the Information Officer will provide the date-subject with a report of the investigation

14. AVAILABILITY OF THIS MANUAL

    1. This manual is available on the Company website: www.oliveira.co.za.
    2. A copy of this manual is also available at the offices of the Company at its business address listed under section 3 above. A fee for copies of the manual will be levied in accordance with Annexure 2 of this manual.