PAIA Manual

Public availability notice: This manual is available -- (a) on the Company website (www.goodtogoat.ai/paia); (b) at our principal place of business at Basement Flat, 20 Mildmay Grove South, London, England, N1 4R; and (c) on the Information Regulator’s portal at inforegulator.org.za. A copy will be provided to any person upon written request and upon payment of a reasonable fee.

1. Introduction and Purpose

1.1 Legal Basis

This manual is compiled in accordance with:

• Section 51 of the Promotion of Access to Information Act 2 of 2000 (PAIA), as amended by the Promotion of Access to Information Amendment Act 54 of 2002 and the Promotion of Access to Information Amendment Act 31 of 2019; and
• Section 51(1)(c) of PAIA as amended by the Protection of Personal Information Act 4 of 2013 (POPIA), which requires responsible parties to include processing of personal information in this manual.

PAIA gives effect to the constitutional right of access to information as entrenched in section 32 of the Constitution of the Republic of South Africa, 1996. POPIA gives effect to the right to privacy as entrenched in section 14 of the Constitution.

1.2 About the Company

Goodtogoat Ltd is a private body as defined in section 1 of PAIA. The Company is incorporated in England and Wales (Company Number 16713487) and conducts business as a Software-as-a-Service (SaaS) company providing AI-powered voice call simulation and sales coaching platform services to enterprise customers across multiple jurisdictions, including South Africa.

1.3 Purpose of this Manual

This manual is intended to enable any person to:

• Understand their right to request access to records held by Goodtogoat;
• Understand the procedure for submitting a request for access;
• Understand the categories of records held by the Company;
• Understand how the Company processes personal information and the rights of data subjects under POPIA; and
• Identify and contact the Information Officer or Deputy Information Officer.

2. Contact Details of the Information Officer

2.1 Head of the Company (default Information Officer)

2.2 Deputy Information Officer (South Africa)

In accordance with section 55(2) of POPIA, the following person has been designated as Deputy Information Officer with responsibility for South African PAIA and POPIA compliance matters. The Deputy Information Officer is authorised to receive and process PAIA requests and POPIA data subject requests from South African data subjects.

All PAIA requests and POPIA data subject requests must be directed to the Deputy Information Officer (South Africa) at the contact details above.

3. The Section 10 Guide on How to Use PAIA

The Information Regulator has compiled and updated the guide required by section 10 of PAIA (the Guide) to assist persons wishing to exercise any rights in terms of PAIA and POPIA. The Guide contains, among other things:

• Contact details for all information officers of public bodies;
• A description of the subjects and categories of records available;
• The assistance available from the Information Regulator; and
• All remedies available regarding acts or failures to act in respect of rights under PAIA and POPIA.

The Guide is available in English, Sesotho, and Afrikaans. A copy may be obtained from the Information Regulator:

4. Records Available Without a Formal PAIA Request

The following categories of records are voluntarily made available by Goodtogoat without a person having to submit a formal request under PAIA (section 52 of PAIA). These records are publicly accessible at www.goodtogoat.ai or on written request to the Information Officer at no charge.

5. Records Available in Terms of Other Legislation

The following records are held by the Company in accordance with obligations under other legislation and may be accessible under those legislative frameworks. Access to these records remains subject to PAIA and any applicable grounds for refusal.

6. Records Held by Goodtogoat -- Categories and Subjects

The following table describes the subjects on which Goodtogoat holds records, and the categories of records held on each subject, in sufficient detail to facilitate a request for access (section 51(1)(b)(iv) of PAIA).

Note: The inclusion of a category in this table does not imply that access will be granted. All requests will be assessed on a case-by-case basis in accordance with PAIA.

7. Processing of Personal Information (POPIA Requirements -- Section 51(1)(c) of PAIA)

This section fulfils the obligation under section 51(1)(c) of PAIA (as amended by POPIA) for Goodtogoat, as a responsible party, to disclose information about how it processes personal information.

7.1 Goodtogoat as Responsible Party

Goodtogoat Ltd is a responsible party as defined in section 1 of POPIA, meaning it determines the purpose of and means for processing personal information. Goodtogoat’s Designated Information Officer is registered with the Information Regulator (Registration No. 2026-006763).

7.2 Purpose of Processing Personal Information

Goodtogoat processes personal information for the following purposes:

7.3 Lawful Basis for Processing

Goodtogoat processes personal information on the following grounds under section 11 of POPIA:

• Consent (section 11(1)(a)) -- e.g. marketing communications; user consent to recording of voice coaching sessions
• Contract (section 11(1)(c)) -- e.g. fulfilment of customer agreements; employment contracts
• Legal obligation (section 11(1)(d)) -- e.g. statutory employment and tax obligations
• Legitimate interest (section 11(1)(f)) -- e.g. fraud prevention, IT security, analytics, platform improvement at a pseudo-anonymised aggregate level

7.4 Special Personal Information

Goodtogoat does not process special personal information as defined in section 26 of POPIA through its platform or product. This position is supported by a formal legal opinion obtained from Michalsons Giles Inc, POPIA specialists (dated 22 May 2026, ref: John Giles), which confirms that voice recordings on the goodtogoat platform are not biometric information because they are not processed using a personal identification technique based on vocal characteristics -- goodtogoat does not use voice recognition to verify identity. No prior authorisation under POPIA section 57 is required.

The limited exception is employee occupational health information, processed solely in the employment context:

7.5 Recipients of Personal Information

Personal information may be shared with the following categories of recipients:

7.6 Transborder Flows of Personal Information

Goodtogoat transfers personal information outside the Republic of South Africa to the following countries or regions. All transborder transfers are conducted in compliance with section 72 of POPIA. Where the recipient country does not provide an adequate level of protection, Goodtogoat implements appropriate contractual safeguards (executed Data Processing Agreements with each sub-processor).

7.7 Security Measures

Goodtogoat implements appropriate technical and organisational measures to ensure the confidentiality, integrity, and availability of personal information, including:

• Access controls and authentication measures (WorkOS and PropelAuth JWT-based, dual role axes)
• Encryption of personal data in transit (TLS) and at rest (AES-256, Tigris / PostgreSQL)
• Application-layer organisation isolation -- HTTP 403 enforced on all cross-tenant access attempts
• Regular security assessments and internal audits (ISO 27001 programme, target certification August 2026)
• Staff training and awareness
• Incident response and breach notification procedures (POPIA s.22)
• Data Processing Agreements with all third-party sub-processors

A general description of these security measures is available from the Information Officer upon written request. Full detail is set out in the Goodtogoat Security & Data Privacy Overview document (available on request to enterprise customers).

8. Data Subject Rights Under POPIA

Data subjects have the following rights under POPIA, which may be exercised by contacting the Information Officer using the contact details in section 2 above:

9. Procedure for Requesting Access to Records Under PAIA

9.1 Who May Request Access

Any person (natural or juristic) may submit a request for access to a record held by Goodtogoat, subject to:

• Personal requesters (seeking their own personal information): Access will be granted subject to the prescribed reproduction fee.
• Other requesters: Access will be granted only where the requester demonstrates that the record is required for the exercise or protection of a right, and where no grounds for refusal apply (section 50(1) of PAIA).

9.2 How to Submit a Request

1. Complete Form 2 -- Request for Access to Record of Private Body (attached as Annexure A to this manual and available at inforegulator.org.za).
2. Clearly identify the record(s) you are seeking access to.
3. State the right you wish to exercise or protect and explain why the record is necessary for that purpose.
4. Submit the completed form and the prescribed request fee to the Information Officer at the contact details in section 2 above.
5. If you are unable to complete the form due to illiteracy or disability, you may request the Information Officer orally. The Information Officer will reduce the request to writing and provide you with a copy.

9.3 Fees

Fees are prescribed in the Regulations to PAIA (Regulation Gazette No. 11329, 27 August 2021):

Fees are subject to change in line with updated Regulations. Current prescribed fees are available at inforegulator.org.za.

9.4 Response Timeframes

The Information Officer will respond to a request within 30 days of receipt (section 56 of PAIA). This period may be extended by a further 30 days where:

• The request relates to a large number of records;
• Consultation with a third party is required; or
• The search for the records is impeded by the fact that the records were not created by the Company.

The requester will be notified of any extension and the reasons for it.

9.5 Decision and Access

If the request is granted, the Information Officer will notify the requester of the access fee payable (if any) and provide access in the manner indicated by the requester (electronic copy, printout, inspection, etc.) once payment is received.

10. Grounds for Refusal of Access

Goodtogoat may refuse a request for access to records on the following grounds set out in Chapter 4, Part 3 of PAIA:

Goodtogoat will notify the requester of any refusal in writing, with reasons, within the prescribed timeframe.

11. Remedies Available to Requesters

If Goodtogoat refuses a request, or fails to respond within the prescribed period, the requester may:

1. Lodge a complaint with the Information Regulator using Form 5, within 180 days of the refusal or the expiry of the response period (section 74 of PAIA). Contact the Information Regulator at the details in section 3 above.
2. Apply to court for appropriate relief (section 82 of PAIA).

12. Availability of This Manual

This manual is made available:

13. Document Control

The Information Officer is responsible for reviewing and updating this manual at least annually and whenever material changes occur to the Company’s records, processing activities, or key personnel.