PAIA Manual

Version 1.0, effective 10 November 2026

We, Lisacars (Pty) Ltd, publish this manual. We are a private company registered in South Africa (registration number 2016/057790/07), and we trade as LisaCars (also written Lisa Cars). Lisacars (Pty) Ltd is an authorised financial services provider (FSP 32023). Section 51 of the Promotion of Access to Information Act 2 of 2000 (PAIA) requires us to publish this manual.

In this manual, "we", "us" and "our" mean Lisacars (Pty) Ltd, and "you" means the person reading it.

In short

• PAIA lets you ask for records we hold, if you need them to use or protect a right.
• Send the official request form to our Information Officer at sales@lisacars.co.za (see part 7).
• Asking whether we hold your personal information is free. Other requests may carry a request fee, and fees for copies and search time, all set by law. We tell you the amount in writing before you pay.
• We must decide within 30 days, unless PAIA allows more time, and may refuse only on grounds PAIA allows.
• If you disagree, you can complain to the Information Regulator, and after that go to court. You must complain within 180 days after our decision, or after the time for our decision runs out. The Regulator may accept a late complaint if you explain why it is late.
• Part 11 explains how we use personal information under the Protection of Personal Information Act 4 of 2013 (POPIA).

1. About this manual

This manual explains who to contact, what records we hold, how to ask for them, the fees, and how we use personal information.

• A "record" is information we keep or control in any form, such as a paper document, an email or a computer file, whether or not we created it.
• "Personal information" is information about you that can identify you, such as your name, ID number, contact details or income. POPIA also protects information about companies.

2. Who to contact

Our Information Officer is the head of our business and is responsible for this manual. The Information Officer handles PAIA requests and privacy questions. Use the details below.

Our branch's opening hours are Monday to Friday 08:00 to 17:00, Saturday 08:30 to 13:00, and public holidays 09:00 to 13:00. It is closed on Sundays.

3. The Information Regulator's guide

The Information Regulator publishes a guide on how to use PAIA and POPIA (PAIA section 10). It explains:

• what the two Acts are for;
• how to ask a government body or a business for a record;
• the help the Regulator can give;
• the fees;
• what you can do if a request is refused.

Get it free from the Regulator's website or offices. You can also read a copy at our branch during opening hours, or ask our Information Officer for a free copy.

Information Regulator (South Africa)

• Address: Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191
• Phone: 010 023 5200, or toll-free 0800 017 160
• Email: enquiries@inforegulator.org.za
• Website: inforegulator.org.za

4. Records you can get without a request

Anything on our website is free to read, and you do not need a PAIA request for it. This includes:

• the cars we have for sale, with their prices and details;
• our contact details, address and opening hours;
• information about applying for vehicle finance through us, and about rent to own;
• our Terms and Conditions, our Privacy Policy (including how we use cookies) and this manual.

5. Records we keep under other laws

Some laws require us to keep records, and some give certain people or authorities, such as the South African Revenue Service (SARS) or the police, a right to see them. If one of these laws gives you a right to a record, you can ask for it under that law. These laws include:

• Companies Act 71 of 2008
• Consumer Protection Act 68 of 2008
• Electronic Communications and Transactions Act 25 of 2002
• Financial Advisory and Intermediary Services Act 37 of 2002
• Income Tax Act 58 of 1962
• National Road Traffic Act 93 of 1996
• Promotion of Access to Information Act 2 of 2000
• Protection of Personal Information Act 4 of 2013
• Second-Hand Goods Act 6 of 2009
• Tax Administration Act 28 of 2011
• Value-Added Tax Act 89 of 1991
• Basic Conditions of Employment Act 75 of 1997 and other employment laws, for staff records

This list is not complete.

6. The records we hold

Even if a record is listed here, you may not get access to it. We decide each request under PAIA, as parts 7 to 9 of this manual explain.

7. How to ask for a record

7.1 Who can ask

Anyone can ask. We must give access if you need the record to use or protect a right, you follow the steps below, and no ground for refusal in part 9 applies.

If you need a record for a court case that has already started, and the court rules or another law let you get it in that case, ask for it that way. PAIA does not apply then (PAIA section 7).

7.2 Your own personal information

You can ask us, free of charge, whether we hold personal information about you (POPIA section 23(1)(a)). A simple message is enough, but we may first ask you to prove who you are.

To get a copy of your information, use the form in part 7.3. You can also ask who outside LisaCars has had your information, or what kinds of organisations have had it, such as a bank or a rental partner. The fees in part 8 may apply. If a fee applies, we give you a written estimate before we do the work, and may ask you to pay part of it in advance (POPIA section 23(3)).

When we give you your information, we also tell you how to ask us to correct or delete it (POPIA sections 23(2) and 24). Our Privacy Policy explains this, and how to object.

7.3 The request form

Use Form 2, called "Request for Access to Record", from the PAIA Regulations. Get it from the Regulator's website or from our Information Officer.

Make sure you use the PAIA form with that name. The POPIA Regulations also have a Form 2, but that one is for asking us to correct or delete your information, not for getting a copy.

On the form, give these details (PAIA section 53):

• enough detail to identify you and the record you want;
• how you want to get it, such as a paper or electronic copy, or looking at it at our branch;
• a postal address or fax number in South Africa (and an email address, if you have one), and any other way you want us to tell you our decision;
• the right you want to use or protect, and why you need the record for it;
• if you ask for someone else, proof that you may act for them.

Send it to our Information Officer by email to sales@lisacars.co.za, by hand at our branch during opening hours, or by post to our postal address in part 2. You can ask for help by phone or WhatsApp, but please send the access request form itself in one of these three ways. A request to correct or delete your information, or an objection, can be sent by email, WhatsApp, post or by hand, or in any other reasonable written way (see our Privacy Policy).

7.4 What happens next

1. If a request fee applies, we tell you in writing, and process your request once it is paid (PAIA section 54(1)).
2. We decide as soon as reasonably possible, and within 30 days after we receive your request (PAIA section 56). Steps 3 and 4 explain when it can take longer.
3. We may extend this once, by up to 30 days, only for a reason PAIA allows, such as a request for many records. We tell you in writing, with reasons, before the 30 days end (PAIA section 57).
4. If the record is about another person or business and might be protected (see part 9), we may first have to tell them and let them respond (PAIA sections 71 to 73). We must tell them within 21 days after we receive your request. We must then decide within 30 days after we tell them. So this can take longer. If we decide to give you access, we must first give them time to complain about our decision. You get the record once that time has passed or, if they complain, once the complaint is decided in your favour.
5. We give you our decision in writing. If we give access, we tell you the access fee and how you will get the record. If we refuse, we give our reasons and your options (see part 10). If only part of a record is protected, you get the rest, as far as it can reasonably be separated (PAIA section 59).
6. If we cannot find a record after all reasonable steps, or it does not exist, we tell you in a sworn statement (an affidavit or affirmation). It sets out the steps we took (PAIA section 55). This counts as a refusal, so you can complain about it (see part 10).

If we do not decide in time, your request is treated as refused (PAIA section 58). You can then complain to the Information Regulator (see part 10).

7.5 Laws and forms referred to

• PAIA Regulations: the Regulations relating to the Promotion of Access to Information, 2021 (GN R757 of 2021).
• POPIA Regulations: the Regulations relating to the Protection of Personal Information (GN R1383 of 2018, as amended by GN 6126 of 2025, GG 52523, 17 April 2025).

8. Fees

The PAIA Regulations set the fees, and we charge only what they allow. Ask the Regulator or our Information Officer for the current fees, how much search time is free and when a fee deposit is due.

• Request fee: paid before we process a request for a record (PAIA section 54(1)). It applies to every request for a record, including a request for a copy of your own personal information. Asking only whether we hold personal information about you is free (POPIA section 23(1)(a)).
• Access fee: paid if we give access. It covers copies, sending them to you, and the time we spend finding and preparing the record after the free search time the PAIA Regulations allow (PAIA section 54(6)).
• Fee deposit: if finding and preparing the record will take longer than the time the PAIA Regulations set before a deposit is due, we must ask you to pay up to one third of the access fee in advance (PAIA section 54(2)). That time is not the same as the free search time. If we then refuse your request, we pay the fee deposit back (PAIA section 54(4)).
• A copy of your own personal information: we first give you a written estimate of the fee, and may ask you to pay part of it in advance (POPIA section 23(3)).

We always tell you in writing what you must pay before you have to pay it. We may hold back the record until you have paid the fees you owe (PAIA section 54(5)). If you think a fee is wrong, you can complain to the Information Regulator (see part 10).

9. When we may refuse access

PAIA requires or allows us to refuse access in these cases, and we will tell you which applies:

• Another person's privacy: access would unreasonably reveal another person's personal information, including someone who has died (PAIA section 63).
• Someone else's business information: access would reveal their trade secrets, or financial, commercial or technical information that could harm them or put them at a disadvantage (PAIA section 64).
• Confidential information: access would break a promise of confidentiality we made to someone in an agreement (PAIA section 65).
• Safety and security: access could endanger someone's life or safety, or the security of a building, system, vehicle or property (PAIA section 66).
• Legal privilege: access would reveal a record that is protected from being shown in court, such as advice from our attorney, unless the person entitled to that protection agrees to give it up (PAIA section 67).
• Our own business information: access would reveal our trade secrets, a computer program we own, or information likely to harm our business or finances, or weaken our position in negotiations or against competitors (PAIA section 68).
• Research information: access would seriously disadvantage a researcher or the subject of the research (PAIA section 69).

When we must give access anyway

Even if a ground above applies, we must still give access if the record would show evidence of:

• a substantial breach of the law, or a substantial failure to comply with it; or
• a serious risk to public safety or the environment that is about to happen.

This applies only if the public interest in access clearly outweighs the harm (PAIA section 70).

10. If you disagree with our decision

10.1 Complaints about a request for a record

PAIA does not give you an appeal to us, so you go straight to the Information Regulator. If you are unhappy with our decision, a fee, an extension or how we give you access, you can complain to the Regulator (PAIA section 77A). Use the PAIA complaint form (Form 5 of the PAIA Regulations), and send it to PAIAComplaints@inforegulator.org.za. The Regulator's website explains any other ways to submit it.

You must complain within 180 days after our decision, or after the time for our decision runs out. If you are late, you can ask the Regulator to accept your complaint anyway, and explain why you are late.

You can go to court only after the Regulator's complaints process is finished. PAIA section 78 sets a strict 180-day time limit for applying to court, so get legal advice early about when it starts in your case.

10.2 Complaints about how we use your personal information

You are welcome to contact our Information Officer first, but you do not have to. You can complain directly to the Information Regulator, using the POPIA complaint form (Form 5 of the POPIA Regulations), through the Regulator's eServices complaints page. You may also be able to go to court (POPIA section 99).

11. How we process personal information

"Processing" means anything we do with personal information, such as collecting, storing, using, sharing or deleting it. This part summarises our processing, as PAIA and POPIA require. Our Privacy Policy explains how long we keep information and your rights.

11.1 Why we process it

We process personal information:

• to answer enquiries, arrange viewings and test drives, and help you find a car;
• to contact you if you start our online finance application but do not finish it;
• to buy cars offered to us, sell cars, prepare offers to purchase and sale agreements, and complete the sale;
• to send your application to banks and finance houses, to our rental partners, or to both, if you ask us to;
• to run our automatic rent-to-own income check. You can ask a person to review your result: WhatsApp us on 082 513 7342, email sales@lisacars.co.za or phone 010 600 0415.
• if you did not qualify on income, to follow up on your request for a car, for example by telling you about vehicle finance. If you do not want this, tell us and we will not contact you about it again;
• to have a credit check done, with your consent;
• to keep our branch, customers, staff and cars safe, including with CCTV;
• to keep the records the law requires;
• to protect our website and forms against spam and misuse;
• to record which ads bring people to us and how our website is used, with Google Analytics. We do this when you use our website, which you agree to by using it. You can switch it off at any time with the "Cookie settings" link on our website;
• to use cookies to measure our ads and show them to you on other websites. We do this when you use our website, which you agree to by using it. You can switch it off at any time with the "Cookie settings" link on our website;
• to show our ads, through customer lists on Google and Meta (Facebook and Instagram), to people who send us a form or buy a car from us, unless they tell us not to;
• to manage our staff, work with business partners and service providers, and deal with requests, complaints and legal claims.

We do not currently send marketing messages by email, SMS, WhatsApp, phone or social-media message.

11.2 What information we hold, and about whom

• Website visitors: pages and cars viewed, how you reached us, device and browser details, and your IP address (the number that identifies your internet connection) in our web host's server logs.
• Enquirers, including people who ask to view or test-drive a car: your name, contact details and message, the car you want, how you reached us and, for the rent-to-own income check, the nett monthly income band you choose (the range your income falls in) and the result of the check. For a test drive, we also keep a copy of your driver's licence.
• Visitors to our branch: images on our CCTV cameras.
• Sellers and trade-in customers: your car's details, whether it is financed, and your name and contact details. If we buy your car or take it in trade, we also keep the identity and vehicle details the Second-Hand Goods Act requires, and a copy of your ID.
• Buyers: identity and contact details, including a copy of your ID where the law requires it, your offer to purchase or sale agreement, and payment records.
• People on our customer lists on Google and Meta: your email address and mobile number, if you sent us a form or bought a car from us. If you tell us not to use them for ads, we keep a note of that, so that we leave you out.
• Finance applicants:
  • identity details, including your ID number, date of birth and marital status;
  • contact and address details;
  • employment, income, expense and bank details;
  • the deposit you plan to pay on the car, and your declaration answers;
  • if you choose, how you heard about us and the name of a salesperson you have spoken to;
  • if you choose, documents such as your ID, driver's licence, proof of address, payslips and bank statements or, if you are self-employed, CK or CIPC documents (your close corporation or company registration documents) and business or personal bank statements.

  If you finish step 1 and go on to step 2, we save your step-1 details, even if you never send the application. These are what you are applying for, your name, mobile number, income band and the car you want. We keep them so that we can contact you.

  If you use "save and continue later", we keep what you have filled in so far, and any documents you have uploaded, for 30 days so that you can finish. If you ask, we email you a link to continue.

• Rent-to-own applicants:
  • identity details, including your ID number;
  • contact and address details;
  • employment and income details, including whether it is a joint income;
  • the upfront payment you can make, the car you want and, if you choose, how you heard about us and the name of a salesperson you have spoken to;
  • if you choose, documents such as your ID, driver's licence, payslips, bank statements, proof of address, or CK or CIPC documents.
• Finance and rent-to-own applicants: your credit check consent and, if we receive a credit report for your application, your credit information.
• People named in an application: a spouse's or partner's income, expenses and documents (such as their ID, payslips and bank statements), a co-applicant's name, mobile number, relationship to the applicant and documents, and the details of next of kin. If you give us someone else's details, you must have their permission and tell them.
• Staff: identity and contact details, and the employment, pay and tax records the law requires us to keep.
• Contacts at business partners and service providers: names and business contact details.

Our forms do not ask about your health, religion, race, trade union membership or criminal record, or about children. The finance declaration asks only whether a court has ever declared you mentally unfit. It does not ask for any medical information. Payslips and bank statements may show some special personal information (the sensitive information the law protects more strictly), such as union dues or medical aid payments. We use them only for your application. If a bank, finance house or rental partner ever needs special personal information, we will first ask for your separate, specific consent.

11.3 Who receives it

We share personal information with:

• our staff who need it;
• banks and finance houses, when our staff send them your finance application, as you asked (each makes its own decision and has its own privacy policy);
• WheelWish, which is part of the same group of companies as LisaCars, and sometimes other rental partners. Our staff send them your rent-to-own application, or your application if you asked to be considered for both;
• credit bureaus, if a credit check is run with your consent;
• the insurer and tracking company for a rent-to-own car, if they need your details to cover or track the car, or to handle a claim;
• our service providers:
  • Xneelo, our web host, in South Africa, which stores our website and what you send through it;
  • Afrihost, in South Africa, for our email and domain;
  • Twilio SendGrid, in the United States, which delivers our website's emails;
  • South African providers that host the systems we use to manage enquiries and applications;
  • anyone who builds, maintains or backs up our website. They may see what you send through our website, including copies in backups;
• Google (including YouTube), Meta (Facebook, Instagram and WhatsApp) and Cloudflare, as part 11.4 explains;
• authorities, such as SARS, the police, the Financial Sector Conduct Authority or vehicle licensing authorities, when the law requires it;
• our professional advisers, such as our attorneys.

11.4 Sending information outside South Africa

We send personal information to these providers outside South Africa:

• Twilio SendGrid (United States). In use now. SendGrid delivers every email our website sends to our staff or to you. These emails carry:
  • your contact details and the details of your enquiry, such as the car and, for the rent-to-own income check or an unfinished finance application, your income band;
  • for an application on our online finance application (for vehicle finance, rent to own or both), every answer you give, including your ID number, bank details, income and expenses, and your spouse's or partner's and next of kin's details;
  • for an application on our separate rent-to-own application form, every answer you give, including your ID number, income and employment details, and your co-applicant's details.

  They never attach your documents.

• YouTube, run by Google (United States and other countries). In use now. When a page shows one of our video preview pictures, YouTube receives your IP address and browser details. When you press Play, YouTube also sees what you watch and sets its own cookies.
• Google Analytics and Google Ads (United States and other countries). In use when you use our website.
  • By using our website, you agree to this, as our cookie notice says. If you switch off analytics and advertising cookies under "Cookie settings", Google receives nothing more through them. Our Privacy Policy explains this.
  • Google also receives how you use our website, including the forms you send and your rent-to-own income check result. That result shows Google whether your income is above or below R35 000 a month, but not your income band.
  • Google also receives the ad click code (a code added to the link when you click one of our ads). When you send us a form, Google also receives your email address and phone number in scrambled (hashed) form.
• Google Ads and Meta (Facebook and Instagram) customer lists (United States and other countries). If you send us a form or buy a car from us, and do not tell us not to, our staff may upload your email address and mobile number, in scrambled (hashed) form, to our customer lists on Google and Meta, so that we can show you our ads. Google and Meta say they delete scrambled details that do not match one of their users. You can ask us to take you off at any time.
• Cloudflare Turnstile, our spam check (United States and other countries). Not in use yet: once we switch it on, Cloudflare receives your IP address and information about your browser and device on pages that show one of our forms.
• WhatsApp, run by Meta (United States and other countries). In use now. WhatsApp receives your phone number, and your messages to us and our replies, which pass through WhatsApp's systems.

Other countries may protect personal information less well than POPIA does. We send it abroad only where POPIA section 72 allows: with your consent, where it is needed to deal with a request you made, or where the provider is bound by data protection terms similar to POPIA. Our Privacy Policy gives the reason for each provider.

11.5 How we protect it

• Our forms are sent over an encrypted connection.
• Our staff receive what you send us in two places: by email in our sales mailbox, sales@lisacars.co.za, and on our website. Finance and rent-to-own application emails include every answer you give, such as your ID number and, for finance, your bank details.
• On our website, only signed-in staff with access to form entries, and the people who maintain our website for us, can see what you send. Our staff may also work with it in the systems we use to manage enquiries and applications, which are hosted in South Africa.
• Our website's emails never attach your documents. They link to them instead. Uploaded documents stay on our website, stored privately, and cannot be opened with a direct link or by anyone who is not signed in. Only signed-in staff, the people who maintain our website for us, and the systems we use to manage enquiries and applications can open them. Website backups also contain them.
• We do not store your IP address with your form. Spam checks use a scrambled (hashed) version, kept for 10 minutes.
• We delete entries and documents from our website once they reach the periods set out in our Privacy Policy. Copies in our mailbox, in our WhatsApp chats, in these systems, in website backups and with the providers that deliver or store emails for us are kept as that policy explains.

No website, email or storage system is completely secure. We take reasonable steps to protect your information, as the law requires, but cannot guarantee that no one will ever access it without permission. This does not reduce our legal duty to keep it safe, or your rights if we do not.

If we believe someone has accessed your personal information without permission, we will report it to the Information Regulator through its eServices portal. We will also tell you in writing, with enough detail for you to protect yourself (POPIA section 22). We cannot do this if we cannot tell whose information was affected. We may delay telling you only if the police or the Regulator decide that telling you would harm a criminal investigation.

12. Where to find this manual

This manual is on our website at lisacars.co.za/paia-manual and at our branch, where you can read it during opening hours. Our Information Officer will give you a copy on request, and we may charge a reasonable fee for a printed copy. We also give it to the Information Regulator on request.

13. Updates

We review this manual regularly. We also update it whenever our records change, or the way we process personal information changes. We publish each new version on our website and at our branch, with a new version number and the date it takes effect. You can ask our Information Officer for an earlier version.