PAIA Manual

TerraCelest Group of Companies (Pty) Ltd ("TerraCelest", "we", "us") is a private body as defined in the Promotion of Access to Information Act 2 of 2000 ("PAIA").

This manual is published in terms of section 51 of PAIA and describes the records held by TerraCelest and the procedure by which a requester may obtain access to those records.

This manual also fulfils the additional disclosure requirements introduced by the Protection of Personal Information Act 4 of 2013 ("POPIA"), including the categories of personal information processed and the recipients of that information.

A copy of this manual is filed with the Information Regulator (South Africa).

Registered name

TerraCelest Group of Companies (Pty) Ltd

Registration number

Registered with CIPC — number available on request

Registered address

6690 Mala Street, Daveyton, Benoni, 1520, Gauteng, South Africa

Postal address

6690 Mala Street, Daveyton, Benoni, 1520

Website

https://terracelest.com

Primary business

Residential, commercial and event cleaning services

In terms of section 17 of POPIA and section 51 of PAIA, the following person has been designated as Information Officer:

Name

Halandi Joy Madalane

Position

Information Officer

Email

hello@terracelest.com

Postal address

6690 Mala Street, Daveyton, Benoni, 1520, Gauteng

Telephone / WhatsApp

084 864 2597

All requests made in terms of PAIA or POPIA should be directed to the Information Officer using the contact details above.

A guide on how to use PAIA is available from the South African Human Rights Commission ("SAHRC"):

• Website: www.sahrc.org.za
• Telephone: 011 877 3600

The Information Regulator (South Africa) publishes guidance on PAIA and POPIA compliance:

• Website: inforegulator.org.za
• Email: complaints@inforegulator.org.za

The following categories of records are available automatically on TerraCelest's public website without the need for a formal PAIA request:

• Legal terms and conditions — /legal/terms
• Privacy notice — /legal/privacy
• Cookie policy — /legal/cookies
• Payment terms — /legal/payment-terms
• Refund and cancellation policy — /legal/refund
• Artificial intelligence policy — /legal/ai-policy
• Promotional terms — /legal/promotions
• Public company information, service offerings, pricing and contact details
• Careers information and current open positions

TerraCelest maintains records under the following legislation, among others:

• Companies Act 71 of 2008 — statutory company records
• Income Tax Act 58 of 1962 — tax records, VAT records, PAYE records
• Value-Added Tax Act 89 of 1991 — tax invoices and VAT returns
• Compensation for Occupational Injuries and Diseases Act 130 of 1993 — COIDA records
• Basic Conditions of Employment Act 75 of 1997 — where applicable to direct employees
• Labour Relations Act 66 of 1995 — where applicable to direct employees
• Broad-Based Black Economic Empowerment Act 53 of 2003 — B-BBEE verification records
• Consumer Protection Act 68 of 2008 — customer transaction and complaint records
• Electronic Communications and Transactions Act 25 of 2002 — electronic transaction records
• Protection of Personal Information Act 4 of 2013 — personal information processing records
• Occupational Health and Safety Act 85 of 1993 — workplace safety records

7.1 Clients and prospective clients

• Names, contact details, email addresses, telephone numbers and physical service addresses
• Booking records, service dates, service types and job history
• Payment records, invoices, and transaction references
• Property access details, gate codes and any information the client voluntarily provides
• Service-related photographs and completion evidence
• Communications (email, WhatsApp, chat logs) relating to bookings

7.2 Cleaning partners and applicants

• Names, contact details, identity numbers, dates of birth
• Banking details for payout purposes
• KYC documentation and verification records
• Onboarding and training records
• Independent contractor agreement and Partner Policy acceptance records
• Job acceptance history and earnings records

7.3 Investors

• Names, contact details, KYC documentation
• Investment records, revenue-share agreements, deposits and payouts

7.4 Employees

• Personnel files, employment contracts, tax records, leave and payroll records
• Where TerraCelest engages independent contractors, those records are held under section 7.2 above

7.5 Commercial and corporate contacts

• Business contacts, procurement leads, tender submissions, and RFP responses
• Correspondence with commercial clients and property managers

7.6 Operational, financial and technical records

• Financial statements, management accounts, bank records
• Audit logs, activity logs, system access records
• Intellectual property records (trademarks, source code, brand assets)
• Insurance, compliance and regulatory filings

TerraCelest processes personal information for the following purposes:

• To deliver cleaning services, including scheduling, dispatch and completion verification
• To process bookings, payments, refunds and re-cleans
• To onboard, verify and pay cleaning partners
• To communicate with clients, partners, applicants and investors
• To comply with tax, labour, corporate and consumer-protection obligations
• To detect and prevent fraud, abuse and security incidents
• To improve our services and provide customer care, including AI-assisted support
• To send promotional offers where the data subject has provided consent (or where permitted under POPIA section 69(2))

TerraCelest shares personal information with the following categories of recipients, always on a need-to-know basis:

• Cloud data storage: Airtable (US-based) stores booking, client, partner, payment and operational records
• Email transmission: Google Workspace (US-based) provides email services
• Payment processing: Yoco and Ozow process card and EFT payments
• Hosting: Namecheap / cPanel-based shared hosting for the terraреlest.com website
• AI services: Groq (transcription) and NVIDIA (vision services) — used only where the data subject initiates the interaction
• Assigned cleaning partners: limited booking details required to perform the service
• Professional advisers: attorneys, accountants and auditors, under confidentiality
• Regulators and authorities: where legally required — Information Regulator, SARS, CIPC, SAPS and courts

Certain personal information is transferred to and processed outside the Republic of South Africa. In terms of section 72 of POPIA, such transfers are carried out only where the recipient is subject to laws, binding rules or contractual obligations that provide an adequate level of protection substantially similar to POPIA.

Current transborder flows involve:

• Airtable — United States
• Google Workspace (email) — United States
• Groq — United States
• NVIDIA — United States

Further details on international transfers are provided in section 17 of our Privacy Notice.

TerraCelest implements reasonable technical and organisational measures to protect personal information, including:

• HTTPS/TLS encryption in transit for all website and API traffic
• Password hashing using bcrypt with cost factor 12
• Session hardening — HttpOnly, Secure, SameSite=Lax cookies and periodic session regeneration
• Role-based access control across administrative functions
• Rate limiting on authentication endpoints
• Webhook signature verification for all payment events
• Activity logging and audit trails for sensitive operations
• Restricted file access and directory protection via server configuration

Where a security compromise occurs, TerraCelest will notify the Information Regulator and affected data subjects in accordance with section 22 of POPIA.

A requester must submit a request on the prescribed form, Form 2 of the PAIA Regulations, to the Information Officer.

The request must include:

• Sufficient particulars to identify the record requested
• Sufficient particulars to identify the requester
• The form of access requested (copy, inspection, electronic transmission)
• An indication of the right the requester seeks to exercise or protect
• The requester's contact details
• Payment of the prescribed request fee, where applicable

Requests may be submitted by email to hello@terracelest.com or by post to the address in section 3.

Requests relating to another person's personal information, or involving a third party's privacy rights, will be assessed under section 34 of PAIA and, where relevant, section 63 of PAIA.

The following fees apply in terms of the PAIA Regulations:

• Request fee: R50 (payable by a requester who is not a personal requester)
• Access fee: determined by the volume of pages, the form of access, and whether the record must be copied, transcribed or posted
• Deposit: where the access fee is likely to exceed R100, a deposit of one-third may be required before the record is prepared
• Personal requesters (requesting access to their own personal information) are exempt from the request fee

Fees are subject to change by regulation. Current fee schedules are available on request or from the Information Regulator.

TerraCelest will respond to a PAIA request within 30 calendar days of receiving a valid request and, where applicable, the request fee.

Where the request concerns a large volume of records or requires consultation with third parties, TerraCelest may extend the response period by up to 30 further days and will notify the requester in writing.

The requester will be notified in writing of the decision, the reasons for any refusal, and the fees payable before access is granted.

TerraCelest may refuse access to a record where one or more of the grounds in Chapter 4 of PAIA apply, including:

• Protection of the privacy of a third-party natural person (section 34)
• Protection of commercial information of a third party (section 36)
• Protection of confidential information of a third party (section 37)
• Protection of the safety of individuals and property (section 38)
• Protection of records privileged from production in legal proceedings (section 40)
• Protection of commercial information of TerraCelest (section 42)
• Protection of research information (section 43)
• Mandatory refusal where disclosure would constitute a breach of a duty of confidence owed to a third party or where disclosure would be likely to prejudice a legitimate commercial interest

Where a record can be disclosed after severing exempt material, TerraCelest will disclose the remainder.

A requester who is dissatisfied with the outcome of a PAIA request may:

• Apply to a court for appropriate relief under section 78 of PAIA
• Lodge a complaint with the Information Regulator in terms of section 77A of PAIA

Complaints to the Information Regulator may be lodged by email at complaints@inforegulator.org.za or through the Regulator's online portal.

Nothing in this manual limits any right a data subject has under POPIA, including the rights set out in our Privacy Notice.

This manual is available:

• On the TerraCelest website at /legal/paia
• On request from the Information Officer
• At the offices of the Information Regulator (South Africa), where a copy has been filed

This manual will be reviewed at least annually and updated where there are material changes to the categories of records held, the recipients of personal information, or applicable law.