PAIA manual for Thwipe AI.

1.1In this Manual, unless the context clearly indicates a contrary intention, the following expressions bear the meanings assigned to them below and cognate expressions bear corresponding meanings:

1.1.1"Act" or "PAIA" means the Promotion of Access to Information Act 2 of 2000, as amended, together with the regulations promulgated thereunder;

1.1.2"Data Subject" bears the meaning assigned to it in section 1 of POPIA;

1.1.3"Firm" means Taylor Torrington Inc (registration number 2018/065247/21; VAT registration number 4950284028), an incorporated firm of legal practitioners in South Africa regulated by the Legal Practice Council;

1.1.4"Information Officer" means the person acting as the head of the Firm as contemplated in section 1 of PAIA and section 1 of POPIA, being Kyle Torrington, director of the Firm;

1.1.5"Information Regulator" means the regulatory body established in terms of section 39 of POPIA, empowered to monitor and enforce compliance with PAIA and POPIA;

1.1.6"Manual" means this access to information manual compiled on 12 October 2026 in accordance with section 51 of PAIA, incorporating the processing matters prescribed by POPIA, as published at https://thwipe.ai/za/paia-manual and updated from time to time;

1.1.7"Operator" bears the meaning assigned to it in section 1 of POPIA;

1.1.8"PAIA Regulations" means the Regulations Relating to the Promotion of Access to Information, 2021, promulgated under section 92 of PAIA;

1.1.9"Personal Information" bears the meaning assigned to it in section 1 of POPIA;

1.1.10"POPIA" means the Protection of Personal Information Act 4 of 2013, as amended, together with the regulations promulgated thereunder;

1.1.11"Private Body" bears the meaning assigned to it in section 1 of PAIA, and includes the Firm;

1.1.12"Processing" bears the meaning assigned to it in section 1 of POPIA;

1.1.13"Record" bears the meaning assigned to it in section 1 of PAIA;

1.1.14"Requester" bears the meaning assigned to it in section 1 of PAIA;

1.1.15"Responsible Party" bears the meaning assigned to it in section 1 of POPIA; and

1.1.16"Thwipe AI" means the proprietary online debt-collection service provided by the Firm via the web portal at https://thwipe.ai.

1.2Clause and section headings in this Manual are inserted for reference purposes only and shall not affect its interpretation or construction.

1.3Any reference to legislation or subordinate legislation refers to South African legislation and includes any amendment, modification, consolidation, re-enactment, or replacement thereof from time to time.

1.4Words and expressions defined in PAIA and POPIA shall, unless otherwise defined in this Manual or unless the context clearly indicates otherwise, bear the statutory meanings assigned to them in those statutes.

1.5In this Manual, unless the context clearly indicates a contrary intention, words importing any one gender include the other genders, and the singular includes the plural and vice versa.

1.6If any provision in a definition is a substantive provision conferring rights or imposing obligations on any person, effect shall be given to it as if it were a substantive provision in the body of this Manual.

1.7Where any number of days is prescribed in this Manual, it shall be calculated in accordance with section 4 of the Interpretation Act 33 of 1957 by excluding the first day and including the last day, unless the last day falls on a Sunday or official South African public holiday, in which event the last day shall be the next succeeding day that is not a Sunday or public holiday.

2.1This Manual is compiled on 12 October 2026 in accordance with section 51 of PAIA, as amended by POPIA, to foster a culture of transparency and accountability by setting out the procedures necessary to facilitate lawful access to Records held by the Firm.

2.2The primary objective of this Manual is to assist Requesters in identifying and requesting access to Records held by the Firm, whether such Records pertain to its legal practice or arise from the operation, maintenance, and provision of Thwipe AI.

2.3In compliance with section 51(1)(c) of PAIA, this Manual details the categories of Data Subjects and Personal Information processed by the Firm, the purposes of such Processing, the recipients to whom Personal Information may be supplied, planned transborder flows, and a general description of the information security measures implemented.

2.4This Manual applies to all Records and Processing activities of the Firm in its capacity as a Private Body and Responsible Party (or Operator, as applicable) across all administrative, professional, and commercial operations.

3.1The Firm is a Private Body and an incorporated legal practice operating in the Republic of South Africa.

3.2In terms of PAIA and POPIA, the head of the Firm and its Information Officer is Kyle Torrington, a director of the Firm.

3.3The Firm has not designated any deputy information officers. All requests for access to Records or queries under PAIA and POPIA must be directed to the Information Officer.

3.4The operational and contact particulars of the Firm and its Information Officer are as follows:

3.4.1Registered Name: Taylor Torrington Inc

3.4.2Registration Number: 2018/065247/21

3.4.3VAT Registration Number: 4950284028

3.4.4Information Officer: Kyle Torrington

3.4.5Contact Telephone Number: 060 018 5165

3.4.6Dedicated Email for PAIA/POPIA Requests: hello@thwipe.ai

3.4.7Website: https://thwipe.ai

4.1The Information Regulator has, in terms of section 10(1) of PAIA and section 110 of POPIA, compiled and made available a guide containing information reasonably required by any person who wishes to exercise any right contemplated in PAIA and POPIA ("the Guide").

4.2The Guide is available in each of the official languages of South Africa and contains details regarding the objects of PAIA and POPIA, how to make a request for access to records, the assistance available from an Information Officer, and the legal remedies available in respect of any breach of rights.

4.3The Firm emails a copy of the Guide to anyone who asks, free of charge.

4.4An electronic copy of the Guide, in each official language, is on the Information Regulator's website at https://inforegulator.org.za/paia.

4.5Any enquiries regarding the Guide or PAIA/POPIA complaints should be directed to the Information Regulator at:

4.5.1Physical Address: Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191

4.5.2Telephone Numbers: 010 023 5200 / Toll-Free: 0800 017 160

4.5.3General Enquiries: enquiries@inforegulator.org.za

4.5.4POPIA Complaints: POPIAComplaints@inforegulator.org.za

4.5.5Website: https://inforegulator.org.za

5.1In terms of section 51(1)(b)(ii) read with section 52 of PAIA, certain categories of Records held by the Firm are available automatically without a Requester having to submit a formal request on Form 2 under the Act.

5.2The following categories of Records are published and freely accessible on the public Thwipe AI website, or available upon direct electronic request, without the need to follow the formal access procedure or pay statutory request fees:

5.2.1pricing schedules, fee structures, and monthly service plan options published at https://thwipe.ai/za/pricing;

5.2.2operational procedures, communication channels, contacting parameters, sending hours, and general questions and answers published at https://thwipe.ai/za/faq;

5.2.3the online contact portal, query forms, and complaint lodgement mechanisms available at https://thwipe.ai/za/contact;

5.2.4standard terms of service, conditions of use, user agreements, and privacy notices governing the use of Thwipe AI;

5.2.5this Manual, as updated from time to time and published at https://thwipe.ai/za/paia-manual; and

5.2.6public marketing, educational, and service descriptive materials made accessible by the Firm from time to time.

5.3In addition to the public Records listed in clause 5.2, certain transactional and operational Records are made automatically accessible to authenticated users without a formal Form 2 request:

5.3.1Data Subjects who are debtors may access their own account details, debt balances, invoice copies, letters of demand, and payment plan histories via the dedicated account resolution page at https://thwipe.ai/resolve by authenticating with their assigned reference number and a one-time verification code sent via electronic mail or SMS; and

5.3.2registered business clients and authorised partners may access their own account ledgers, instructions, uploaded files, and debtor recovery progress directly through their authenticated Thwipe AI user accounts.

5.4While no request fee is payable to view or download Records that are automatically available under this clause 5, the Firm reserves the right to charge the prescribed reproduction and transcription fees set out in the PAIA Regulations where a Requester requests hard copies or physical extracts of such Records to be generated, printed, or dispatched.

6.1In terms of section 51(1)(b)(ii) of PAIA, the Firm maintains Records in accordance with the statutory obligations imposed under the following South African legislation, as may be applicable to its operations, governance, tax compliance, and legal practice from time to time:

6.1.1Basic Conditions of Employment Act 75 of 1997;

6.1.2Companies Act 71 of 2008;

6.1.3Compensation for Occupational Injuries and Diseases Act 130 of 1993;

6.1.4Electronic Communications and Transactions Act 25 of 2002;

6.1.5Employment Equity Act 55 of 1998;

6.1.6Financial Intelligence Centre Act 38 of 2001;

6.1.7Income Tax Act 58 of 1962;

6.1.8Legal Practice Act 28 of 2014 and the South African Legal Practice Council Rules;

6.1.9National Credit Act 34 of 2005;

6.1.10Prescribed Rate of Interest Act 55 of 1975;

6.1.11Protection of Personal Information Act 4 of 2013;

6.1.12Regulation of Interception of Communications and Provision of Communication-Related Information Act 70 of 2002;

6.1.13Skills Development Act 97 of 1998;

6.1.14Tax Administration Act 28 of 2011;

6.1.15Unemployment Insurance Act 63 of 2001; and

6.1.16Value-Added Tax Act 89 of 1991.

6.2The retention periods for Records held under the statutes listed in clause 6.1 are determined by the specific requirements of each applicable enactment, statutory profession rules, and standard retention periods mandated by law.

6.3Although the Firm keeps Records in terms of the aforementioned legislation, the inclusion of a statute in the list above does not mean that all Records kept thereunder are automatically available to a Requester, and any request for access to such Records remains subject to the procedural requirements of PAIA, the payment of prescribed fees, and the statutory grounds for refusal set out in Chapter 4 of Part 3 of the Act.

7.1In terms of section 51(1)(c) of PAIA, the Firm maintains Records across several subjects and operational categories relating to its legal practice and the operation of Thwipe AI, as set out in this clause 7.

7.2Incorporation, Corporate, and Professional Governance Records

7.2.1statutory corporate incorporation records, including the certificate of incorporation, memorandum of incorporation, and company registers;

7.2.2director resolutions, internal board records, and governance registers;

7.2.3professional practice certificates, registrations, and regulatory correspondence with the Legal Practice Council; and

7.2.4professional indemnity and liability insurance cover notes, schedules, and policy records.

7.3Personnel, Human Resources, and Employment Records

7.3.1employment contracts and independent contractor agreements;

7.3.2payroll records, remuneration schedules, and statutory PAYE, UIF, and SDL returns;

7.3.3internal performance reviews, disciplinary records, leave records, and grievance documentation; and

7.3.4employee identity documentation, curricula vitae, professional qualifications, and reference checks.

7.4Financial, Banking, and Operational Accounting Records

7.4.1annual financial statements, accounting ledgers, journals, trial balances, and management accounts;

7.4.2trust accounting records, including dedicated trust bank statements (held with First National Bank), trust cash books, and monthly reconciliation records maintained in terms of the Legal Practice Act 28 of 2014;

7.4.3business bank account records, PayFast merchant settlement records, and transaction logs;

7.4.4corporate tax filings, Value-Added Tax returns, assessments, and statutory tax invoices; and

7.4.5monthly creditor payout statements, commission schedules, fee calculations, and related reconciliation spreadsheets.

7.5Creditor Client, Mandate, and Partner Records

7.5.1creditor client onboarding profiles, business entity details, VAT numbers, designated user particulars, payout bank accounts, and verified own-name collection bank accounts;

7.5.2records of mandate acceptance, click-wrap terms verification logs, timestamps, IP addresses, browser details, and specific collection parameters;

7.5.3partner registration, onboarding details, and authorisation documentation for accounting, bookkeeping, and legal firms acting on behalf of creditor clients; and

7.5.4integration keys, connection credentials, and read-only synchronization ledgers for third-party platforms (such as Xero).

7.6Debt-Recovery, Legal Matter, and Debtor Files

7.6.1uploaded client debt portfolios, original debtor invoices, statements of account, purchase orders, and delivery verifications;

7.6.2communication records, including electronic mail logs, SMS delivery receipts, automated outbound call logs, telephonic voice recordings, and transcribed audio files;

7.6.3formal attorney-approved letters of demand, interest calculation schedules, settlement proposals, dispute documentation, and written litigation fee quotes;

7.6.4electronically signed acknowledgements of debt, including captured audit metadata, timestamps, user identifiers, IP addresses, and session records; and

7.6.5debtor transaction records, PayFast token references, card payment receipts, electronic funds transfer proofs, and direct creditor payment notifications.

7.7Thwipe AI Platform, Technical, and Systems Infrastructure Records

7.7.1non-editable audit trails, system activity logs, administrative access records, and user session monitoring logs;

7.7.2chat logs from the in-app assistant, voice-to-text input processing records, and conversational data transcripts;

7.7.3public chat query logs, hashed IP throttle records, and authentication challenge receipts; and

7.7.4website measurement metrics, cookie consent audit trails, demonstration bookings, and inbound query submissions.

7.8The categorization and listing of any Record in this clause 7 does not signify that such Record will automatically be disclosed or provided to a Requester, and any request for access to any Record remains strictly subject to the evaluation procedures set out in clause 10, the payment of applicable fees in terms of clause 9, and the statutory grounds for refusal set out in Chapter 4 of Part 3 of PAIA and clause 11.

8.1A request for access to a Record held by the Firm must be made by submitting a completed Form 2 (Request for Access to Record of Private Body) as prescribed in Regulation 7 of the PAIA Regulations.

8.2Form 2 must be submitted to the Information Officer by electronic mail to hello@thwipe.ai.

8.3The Requester must provide sufficient detail on Form 2 to enable the Information Officer to identify:

8.3.1the Record or Records requested, including any relevant reference numbers, account identifiers, or system metadata where available;

8.3.2the identity and contact details of the Requester, accompanied by reasonable proof of identity;

8.3.3the form of access required;

8.3.4a postal address, electronic mail address, or fax number of the Requester within the Republic of South Africa;

8.3.5the right that the Requester seeks to exercise or protect, accompanied by an explanation of why the requested Record is required for the exercise or protection of that right; and

8.3.6where the request is submitted on behalf of another person, proof of the capacity in which the agent is acting, to the reasonable satisfaction of the Information Officer.

8.4If an individual Requester is unable to complete Form 2 due to illiteracy or disability, the Information Officer or an authorised representative shall provide reasonable assistance to reduce the request to writing on Form 2 and furnish a copy to the Requester.

8.5The Information Officer shall not process a request for access to Records until all the requirements set out in this clause 8 have been complied with and any applicable statutory fees contemplated in clause 9 have been paid.

9.1In terms of section 54 of PAIA read with the PAIA Regulations, two categories of fees may be payable when requesting access to a Record held by the Firm: the statutory request fee and the access fee.

9.2Statutory Request Fee

9.2.1A Requester who submits a request for access to a Record (other than a Data Subject submitting a request for confirmation or access to Personal Information under section 23 of POPIA) must pay the prescribed request fee of R140.00 before the Information Officer is obliged to process the request, unless legally exempt under regulation 8 of the PAIA Regulations or an applicable ministerial determination.

9.2.2The request fee is non-refundable, irrespective of whether access to the requested Record is granted or refused.

9.3Access Fees

9.3.1Where access to a Record is granted, the Requester must pay the statutory access fee determined in accordance with Annexure B, Part 3 of the PAIA Regulations before the Record is reproduced, transcribed, or released.

9.3.2Access fees cover the costs reasonably incurred in searching for, retrieving, preparing, reproducing and sending the Record, at the rates set out in Part 3 of Annexure B to the PAIA Regulations, which the Information Regulator publishes on its website. The Information Officer tells the Requester each amount before it is paid.

9.4Deposit

9.4.1If the Information Officer estimates that the search for and preparation of the requested Record will exceed six hours, the Information Officer shall issue a notice to the Requester requiring payment of a deposit equal to one-third of the estimated access fee.

9.4.2The notice issued under clause 9.4.1 shall inform the Requester of the right to lodge a complaint with the Information Regulator or an application to a court of competent jurisdiction against the tender or payment of the deposit or the estimated fee calculation.

9.4.3If access to the requested Record is ultimately refused, any deposit paid by the Requester shall be refunded without interest.

9.5Payment Particulars

9.5.1All prescribed fees must be paid via electronic funds transfer into the dedicated bank account of the Firm, the details of which will be provided to the Requester upon receipt of Form 2, or through secure electronic payment facilities approved by the Firm.

9.5.2Proof of payment referencing the assigned request reference number must be transmitted via electronic mail to the Information Officer at hello@thwipe.ai.

9.5.3The Firm shall not deliver, furnish, or grant access to any requested Record until all applicable statutory fees and deposits have been settled in full.

10.1Upon receipt of a properly completed Form 2 submitted in accordance with clause 8 and payment of the applicable request fee or deposit (if required) as contemplated in clause 9, the Information Officer shall assess the request to determine whether the requested Record exists, is held by the Firm, and whether access must or may be granted or refused under PAIA.

10.2Decision Period

10.2.1In terms of section 56(1) of PAIA, the Information Officer shall, as soon as reasonably possible, but in any event within 30 days after the request is received (or, where a deposit is demanded under section 54 of PAIA, within 30 days after such deposit is paid), decide whether to grant or refuse the request and give written notice to the Requester of the decision.

10.2.2The written notification of the decision shall be conveyed to the Requester on Form 3 (Outcome of Request and Fees Payable) as prescribed in the PAIA Regulations, and transmitted to the address, electronic mail address, or contact channel designated by the Requester.

10.2.3If access to the requested Record is granted, the notice on Form 3 shall state the prescribed access fee (if any) payable, the form or manner in which access will be given, and that the Requester may lodge a complaint with the Information Regulator or apply to court against the access fee or the form of access granted, as well as the procedure and period for doing so.

10.2.4If access to the requested Record is refused, the notice on Form 3 shall state adequate reasons for the refusal (referring to the relevant provisions of Chapter 4 of Part 3 of PAIA and clause 11 of this Manual), excluding any reference to the content of the Record, and state that the Requester may lodge a complaint with the Information Regulator or apply to court against the refusal in accordance with the dispute procedures set out in clause 12.

10.3Extension of the Decision Period

10.3.1In terms of section 57(1) of PAIA, the Information Officer may extend the initial 30-day decision period once, for a further single period not exceeding 30 days, if:

10.3.1.1the request is for a large number of Records or requires a search through a large volume of Records and compliance with the original period would unreasonably interfere with the activities of the Firm;

10.3.1.2the request requires a search for Records at or collection from an office, infrastructure, or storage facility not situated in the same city or town as the primary office of the Firm, and the search cannot reasonably be completed within the original 30-day period;

10.3.1.3consultations among components of the Firm, legal practitioners, or with another private body or public body are necessary, and such consultations cannot reasonably be completed within the initial 30 days;

10.3.1.4more than one of the circumstances contemplated in clauses 10.3.1.1 to 10.3.1.3 exist, making compliance within the initial period not reasonably possible; or

10.3.1.5the Requester consents to the extension in writing.

10.3.2If the Information Officer determines that an extension is necessary, written notice of the extension shall be delivered to the Requester within the initial 30-day period.

10.3.3The notice of extension shall state the period of the extension, adequate reasons for the extension, and inform the Requester of their right to lodge a complaint with the Information Regulator or apply to court against the extension, including the applicable procedure and time limits.

10.4Deemed Refusal

10.4.1In terms of section 58 of PAIA, if the Information Officer fails to communicate a decision on a request for access to the Requester within the initial 30-day period, or within the extended period notified in terms of clause 10.3, the Information Officer is regarded as having refused the request.

10.4.2In the event of a deemed refusal, the Requester shall be entitled to seek redress by lodging a complaint with the Information Regulator or submitting an application to a court of competent jurisdiction under section 78 of PAIA, as detailed in clause 12.

10.5Third-Party Notification and Intervention

10.5.1If the Record requested relates to Personal Information, commercial information, research, or confidential records of a third party, the Information Officer shall assess whether the rights of such third party are implicated under Chapter 5 of Part 3 of PAIA.

10.5.2Where required by section 71 of PAIA, the Information Officer shall take all reasonable steps to notify the third party concerned within 21 days of receipt of the request, and afford such third party 21 days from receipt of the notification to make written or oral representations why the request should be refused or grant written consent for disclosure.

10.5.3In terms of section 73 of PAIA, the Information Officer shall, within 30 days after every third party has been notified, make a decision whether to grant or refuse the request and give written notice to the Requester and all third parties concerned. Where access is granted despite a third party's representations, access shall only be provided after the expiry of 30 days from the date notice was given to the third party, or upon final resolution of any complaint or court application initiated by such third party.

11.1The Information Officer shall evaluate every formal request for access to a Record held by the Firm on its merits, strictly in accordance with the mandatory and discretionary grounds for refusal of access set out in Chapter 4 of Part 3 of PAIA (sections 62 to 70).

11.2Mandatory Grounds for Refusal

11.2.1In terms of section 63(1) of PAIA, the Information Officer must refuse a request for access to a Record if its disclosure would involve the unreasonable disclosure of Personal Information about a third party, including a deceased individual, subject to the statutory exceptions set out in section 63(2) of PAIA.

11.2.2In terms of section 64(1) of PAIA, the Information Officer must refuse a request for access to a Record if the Record contains trade secrets of a third party, financial, commercial, scientific, or technical information the disclosure of which would be likely to cause harm to the commercial or financial interests of that third party, or information supplied in confidence by a third party the disclosure of which could reasonably be expected to put that third party at a disadvantage in contractual or other negotiations or prejudice that third party in commercial competition, subject to section 64(2) of PAIA.

11.2.3In terms of section 65 of PAIA, the Information Officer must refuse a request for access to a Record if its disclosure would constitute an actionable breach of a duty of confidence owed to a third party in terms of an agreement.

11.2.4In terms of section 66(a) of PAIA, the Information Officer must refuse a request for access to a Record if its disclosure could reasonably be expected to endanger the life or physical safety of an individual.

11.2.5In terms of section 67 of PAIA, the Information Officer must refuse a request for access to a Record if the Record is privileged from production in legal proceedings, unless the person entitled to the privilege has waived the privilege.

11.2.6In terms of section 69(1) of PAIA, the Information Officer must refuse a request for access to a Record if the Record contains information about research being or to be carried out by or on behalf of a third party, the disclosure of which would be likely to expose the third party, the researcher, or the subject matter of the research to serious disadvantage.

11.3Discretionary Grounds for Refusal

11.3.1In terms of section 66(b) of PAIA, the Information Officer may refuse a request for access to a Record if its disclosure would be likely to prejudice or impair the security of a building, structure or system, including a computer or communication system, a means of transport, or any other property, or methods, systems, plans or procedures for the protection of an individual, property, or system.

11.3.2In terms of section 68(1) of PAIA, the Information Officer may refuse a request for access to a Record if the Record contains trade secrets of the Firm; financial, commercial, scientific, or technical information the disclosure of which would be likely to cause harm to the commercial or financial interests of the Firm; a computer program owned by the Firm or protected by copyright; or information the disclosure of which could reasonably be expected to put the Firm at a disadvantage in contractual or other negotiations or prejudice the Firm in commercial competition.

11.3.3In terms of section 69(2) of PAIA, the Information Officer may refuse a request for access to a Record if the Record contains information about research being or to be carried out by or on behalf of the Firm, the disclosure of which would be likely to expose the Firm, the researcher, or the subject matter of the research to serious disadvantage.

11.4Mandatory Disclosure in the Public Interest (Public Interest Override):

11.4.1In terms of section 70 of PAIA, the Information Officer must grant a request for access to a Record despite any of the grounds for refusal set out in clauses 11.2 and 11.3 if the disclosure of the Record would reveal evidence of a substantial contravention of, or failure to comply with, the law, or an imminent and serious public safety or environmental risk, and the public interest in the disclosure of the Record clearly outweighs the harm contemplated in the provision in question.

11.5Severability

11.5.1In terms of section 59 of PAIA, if a request for access is made to a Record containing information which may or must be refused under this clause 11, but that part can reasonably be severed from any part that does not contain such information, the Information Officer shall disclose the latter part and refuse access only to the severed portion containing the protected information.

12.1Absence of Internal Appeal Procedure

12.1.1The Firm is a Private Body in terms of PAIA. The statutory internal appeal mechanisms contemplated in Part 4, Chapter 1 of PAIA apply exclusively to decisions made by public bodies.

12.1.2The Firm does not provide for an internal appeal procedure in respect of any decision taken by the Information Officer. Any decision made by the Information Officer regarding a request for access to a Record—including a decision to refuse access, a fee determination or deposit requirement under clause 9, an extension of the decision period under clause 10.3, or a deemed refusal under clause 10.4—is final.

12.2Complaint to the Information Regulator

12.2.1In terms of section 77A of PAIA, a Requester or a third party aggrieved by a decision of the Information Officer (including any decision concerning fees, period extensions, or the form of access) may lodge a formal complaint with the Information Regulator.

12.2.2The complaint must be lodged in the prescribed manner and form (Form 5 of the PAIA Regulations) within 180 days of the date on which the Requester or third party received written notice of the Information Officer's decision, or within 180 days of the date on which the request was deemed to have been refused in terms of section 58 of PAIA.

12.2.3The contact particulars and complaints submission channels for the Information Regulator are set out in clause 4.5 of this Manual.

12.3Application to Court

12.3.1In terms of section 78 of PAIA, a Requester or a third party may apply to a High Court or a Magistrates' Court having jurisdiction for appropriate relief.

12.3.2An application to court may be instituted directly against a decision of the Information Officer or following the outcome of a complaint lodged with the Information Regulator in terms of section 77A.

12.3.3An application to court must be instituted within 180 days after: (a) the date on which the Requester or third party received written notice of the Information Officer's decision or the request was deemed refused; or (b) the date on which the Information Regulator communicated its decision on the complaint to the complainant.

12.4Informal Queries and Resolution

12.4.1Without limiting the statutory rights and remedies of a Requester or third party under clauses 12.2 and 12.3, an aggrieved person may communicate directly with the Information Officer using the contact details set out in clause 3.4 in an attempt to clarify or informally resolve any dispute concerning a decision taken in terms of this Manual.

12.4.2Engagement under clause 12.4.1 is voluntary and does not suspend, interrupt, or extend the statutory 180-day limitation periods within which to lodge a complaint with the Information Regulator or apply to court under PAIA.

13.1In accordance with section 51(1)(c) of PAIA read with POPIA, the Firm processes Personal Information across its legal practice and in the operation of Thwipe AI, acting either as an Operator or as a Responsible Party depending on the legal basis, mandate, and nature of the processing activity.

13.2Capacity as an Operator

13.2.1In respect of debtors' Personal Information, the business client is the Responsible Party under POPIA and the Firm acts as its Operator in both methods of collection (whether the attorneys collect or collection proceeds in the business client's own name).

13.2.2In such instances, the business client determines the purpose and means of the processing, and the Firm processes debtor Personal Information strictly on the instructions of the business client, to collect the business client's accounts, to operate Thwipe AI, and to comply with applicable statutory duties.

13.2.3Processing in an Operator capacity is governed by contractual terms compliant with section 21 of POPIA, requiring the Firm to process Personal Information only with the knowledge or authorisation of the Responsible Party, maintain security measures under section 19 of POPIA, promptly notify the Responsible Party of any security compromise under section 22(1)(b), engage sub-operators only on protective terms, and direct any Data Subject requests or objections to the Responsible Party for determination.

13.3Capacity as a Responsible Party

13.3.1The Firm acts as a Responsible Party in respect of all other categories of Data Subjects where the Firm determines the purpose and means of Processing.

13.3.2Without limiting clause 13.3.1, the Firm acts as a Responsible Party in respect of Personal Information relating to: business clients and their individual corporate users; authorised professional partners and their staff; website visitors; persons who submit enquiries via the contact page, schedule demonstrations, join the launch list, or interact with the public conversational chat; and recipients of sales outreach emails identified for commercial communications.

13.4In discharging its statutory obligations under POPIA, the Firm ensures that all Processing adheres to the conditions for lawful processing and the specific processing parameters set out in clauses 14 to 19 of this Manual.

14.1Pursuant to section 51(1)(c) of PAIA read with sections 12, 17, and 18 of POPIA, the Firm processes Personal Information relating to various categories of Data Subjects, collected from the respective direct and indirect sources set out in this clause 14.

14.2Business Clients and Authorised Corporate Users

14.2.1Categories of Personal Information: full names, work email addresses, business names, company registration and Value-Added Tax numbers, business addresses and telephone numbers where given, user designations and roles, bank account particulars (including payout accounts and own-name collection accounts), collection parameters and decision limits, uploaded invoices, statements or debt spreadsheets, records of terms accepted (including stored wording, version, timestamp, IP address, and browser data), sign-in authentication records (code or link requests), platform activity logs, and questions or prompts submitted to the in-app assistant by typing or speaking.

14.2.2Sources: directly from the client or its designated user upon registration, account configuration, or platform interaction, or indirectly from integrated third-party accounting platforms (such as Xero) authorised on a read-only basis by the client in terms of section 12(2)(a) of POPIA, or payment gateway providers (PayFast) regarding transaction status.

14.3Authorised Professional Partners (Accountants, Bookkeepers, and Law Firms):

14.3.1Categories of Personal Information: full names, professional firm names, business email addresses, contact telephone numbers, platform configuration preferences, and system usage logs.

14.3.2Sources: directly from the partner or partner representative during registration, client onboarding, or profile management.

14.4Debtors (Customers of Creditor Clients)

14.4.1Categories of Personal Information: names, email addresses, telephone numbers, any address on the documents, underlying invoice details, account histories, balances owed, transaction records, inbound and outbound electronic correspondence, telephonic voice recordings, call transcriptions, one-time verification access records, electronic acknowledgements of debt (including typed name, timestamp, IP address, browser, and session data), records of automatic card payment consent, and payment gateway token identifiers.

14.4.2Sources: indirectly from creditor clients or partners upon handover of debtor accounts (in accordance with sections 12(2)(d) and 12(2)(e) of POPIA), directly from the debtor during payment processing, account interactions on the dedicated resolution portal (https://thwipe.ai/resolve), electronic communications, or telephonic discussions.

14.5Website Visitors, Public Chat Users, and Enquirers

14.5.1Categories of Personal Information: full names, contact telephone numbers, email addresses, corporate entity names, demonstration booking records, communication contents submitted via web forms, queries submitted to the public conversational tool ("Ask Thwipe AI"), hashed internet protocol address throttles, anti-bot challenge verifications (Google reCAPTCHA), call recordings from calls to 060 018 5165, and online telemetry data collected via approved website measurement tools where accepted.

14.5.2Sources: directly from the individual via the contact portal, demonstration scheduling interfaces (Calendly and Google Meet), conversational chat features, inbound telephonic calls, or automated browser transmission during website navigation.

14.6Business Development and Marketing Prospects

14.6.1Categories of Personal Information: names and work email addresses of people at businesses that may want Thwipe AI, and the names of those businesses.

14.6.2Sources: public South African business directories (pursuant to section 12(2)(a) of POPIA), and Hunter, an email-finding service.

15.1In accordance with section 51(1)(c)(i) of PAIA read with sections 9, 10, 11, 12, and 13 of POPIA, the Firm processes Personal Information for specific, explicitly defined, and lawful purposes directly related to the functions, legal mandates, and operational activities of the Firm and Thwipe AI.

15.2Personal Information is processed for the following operational, professional, contractual, and statutory purposes:

15.2.1Provision of Online Debt-Recovery and Legal Collection Services: authenticating and provisioning user accounts; onboarding creditor clients and authorised partners; ingesting, analyzing, and structuring unpaid accounts; issuing automated and attorney-approved demands, reminders, and legal notices; facilitating debtor engagements, dispute evaluations, and payment arrangements; recording acknowledgements of debt; administering trust receipts and direct payments; calculating statutory interest and collection commission; and preparing written quotations for court litigation where instructed;

15.2.2Accounting, Invoicing, and Trust Account Administration: calculating success fees, subscription tiers, and disbursements; generating statutory tax invoices and monthly creditor statements; disbursing collected funds; reconciling client trust balances maintained in terms of the Legal Practice Act 28 of 2014; and executing merchant settlement reconciliations;

15.2.3Platform Operation, Diagnostic Support, and Service Improvement: administering platform infrastructure; responding to support enquiries and service complaints; conducting automated conversational interactions and voice-to-text processing; analyzing aggregated communication and recovery metrics to optimize collection algorithms; and maintaining the stability, integrity, and security of Thwipe AI;

15.2.4Statutory Compliance and Legal Professional Obligations: discharging duties imposed under the Legal Practice Act 28 of 2014, the Rules of the Legal Practice Council, the National Credit Act 34 of 2005, the Companies Act 71 of 2008, the Value-Added Tax Act 89 of 1991, the Tax Administration Act 28 of 2011, and the Financial Intelligence Centre Act 38 of 2001; cooperating with statutory oversight bodies, courts, or law enforcement authorities; and asserting, exercising, or defending legal claims; and

15.2.5Business Development and Commercial Communications: scheduling system demonstrations; managing launch waitlists; responding to general inbound enquiries; and conducting direct marketing and commercial communications strictly in compliance with section 69 of POPIA.

15.3The lawful bases upon which the Firm relies to process Personal Information for the purposes set out in clause 15.2 comprise: the performance or conclusion of contracts to which the Data Subject is a party; compliance with obligations imposed by law on the Firm; the pursuit of legitimate interests of the Firm, creditor clients, or third parties to whom the information is supplied; and, where legally required, the specific, informed consent of the Data Subject (including for launch list subscriptions and website measurement).

16.1In accordance with section 51(1)(c)(iii) of PAIA read with POPIA, the Firm supplies Personal Information to third-party recipients and categories of third parties strictly as necessary to execute legal collection mandates, operate Thwipe AI, fulfil contractual obligations, and comply with statutory duties.

16.2The Firm shares Personal Information with the following specific vendors, external service providers, and Operators:

16.2.1Hosting and Cloud Infrastructure Providers: third-party data hosting, server infrastructure, and secure database backup providers operating data centre facilities in Johannesburg, South Africa;

16.2.2Telephony, Messaging, and Electronic Communication Vendors: Zoho (electronic mail infrastructure), and Twilio (SMS dispatch, outbound telephonic call routing, and telephonic recording storage);

16.2.3Artificial Intelligence and Language Processing Technologies: OpenRouter and its downstream routed model providers (document analysis, communication drafting, and response comprehension, restricted to providers that retain no copy of request data), OpenAI (speech comprehension in phone calls and in-app chat), and Microsoft (speech generation in phone calls using South African voice synthesis);

16.2.4Payment Gateways, Merchant Processors, and Banking Institutions: PayFast (processing card transactions, card tokenization, and subscription payments), and First National Bank (FNB) (holding the Firm's trust account);

16.2.5Accounting and Financial Integration Services: Xero (read-only financial synchronization of debtor invoices and contact ledgers where integrated by business clients);

16.2.6Scheduling, Demonstration, and Security Verification Platforms: Google (reCAPTCHA bot verification on forms, and web measurement tools where accepted), Calendly (demonstration booking administration), and Google Meet (demonstration video conferencing);

16.2.7Business Development and Lead Intelligence Platforms: Hunter and Winnr (finding work email addresses and sending business-to-business sales emails); and

16.2.8Professional, Legal, and Statutory Bodies: instructing creditor clients and authorised partners (who have visibility over activities on their respective accounts); external auditors, legal practitioners, and professional advisers bound by confidentiality obligations; and the Legal Practice Council, the South African Revenue Service (SARS), the Information Regulator, courts, and sheriffs where disclosure is required by law or legal process.

16.3Where an external recipient acts as an Operator on behalf of the Firm, such Processing is governed by written agreements compliant with section 21 of POPIA, requiring appropriate technical and operational security safeguards, strict mandate adherence, and confidentiality. Any transborder flow of Personal Information to third-party infrastructure outside the Republic of South Africa is conducted in accordance with section 72 of POPIA.

16.4The Firm does not sell, rent, trade, or commercially exploit Personal Information to any third party.

17.1In terms of section 51(1)(c)(iv) of PAIA read with section 72 of POPIA, the Firm may transmit or transfer Personal Information to third-party recipients, Operators, and technical infrastructure located outside the Republic of South Africa.

17.2Planned transborder flows of Personal Information arise primarily in connection with the technical provision, operation, and support of Thwipe AI, where services are hosted, operated, or supported by service providers situated in foreign jurisdictions, predominantly the United States of America and member states of the European Union. These providers include OpenRouter and upstream artificial intelligence model providers for automated document analysis and communication drafting, OpenAI and Microsoft for speech processing, Twilio for telecommunications and messaging routing, Zoho for electronic mail delivery, Google for security verification, telemetry, and virtual meetings via Google Meet, Calendly for demonstration scheduling, and Hunter and Winnr for business-to-business outreach.

17.3The Firm shall not transfer Personal Information to a third party or Operator in a foreign country unless the transfer complies strictly with section 72 of POPIA, ensuring that at least one of the following conditions is satisfied:

17.3.1the recipient is subject to a law, binding corporate rules, or a binding agreement that provides an adequate level of protection that effectively upholds principles for reasonable processing substantially similar to the conditions for lawful processing under POPIA, and includes provisions substantially similar to section 72 relating to the further transfer of Personal Information;

17.3.2the Data Subject has consented to the transfer in accordance with section 72(1)(b) of POPIA;

17.3.3the transfer is necessary for the performance of a contract between the Data Subject and the Firm, or for the implementation of pre-contractual measures taken in response to the Data Subject's request;

17.3.4the transfer is necessary for the conclusion or performance of a contract concluded in the interest of the Data Subject between the Firm and a third party; or

17.3.5the transfer is for the benefit of the Data Subject, it is not reasonably practicable to obtain their consent, and if it were reasonably practicable, the Data Subject would be likely to give it.

17.4Where the foreign recipient acts as an Operator, the Firm shall, pursuant to section 21 of POPIA, conclude a written contract ensuring the recipient establishes and maintains appropriate technical and organisational security safeguards and processes the Personal Information only with the knowledge or authorisation of the Firm.

17.5Where Personal Information is processed across borders by artificial intelligence model integrations or downstream routing operators (including OpenRouter and its routed model providers), the Firm restricts such processing to environments that process data ephemerally and contractually prohibit the retention, copying, or secondary use of request inputs for model training purposes.

18.1In accordance with section 51(1)(c)(v) of PAIA read with section 19 of POPIA, the Firm secures the integrity and confidentiality of Personal Information in its possession or under its control by taking appropriate, reasonable technical and organisational measures to prevent loss of, damage to, or unauthorised destruction of Personal Information, and unlawful access to or processing of Personal Information. To give effect to this duty, the Firm continuously identifies reasonably foreseeable risks, establishes and maintains appropriate safeguards, regularly verifies that the safeguards are effectively implemented, and updates them in response to new risks or identified deficiencies.

18.2Infrastructure and Perimeter Safeguards

18.2.1The core server infrastructure hosting Thwipe AI is run on a server located in Johannesburg, South Africa.

18.2.2All web and API traffic transmitted to and from Thwipe AI is secured using robust, industry-standard cryptographic protocols, including Transport Layer Security (TLS) encrypted connections.

18.2.3Production databases and internal computing services are isolated within private networks, configured to accept connections only from the server, and protected by managed firewall architectures that restrict inbound network traffic strictly to authorised operational web endpoints and the Firm's own secure, authenticated administrative access channels.

18.3Access Control and Authentication

18.3.1User authentication for business clients and authorised partners is administered using secure, passwordless authentication mechanisms, comprising cryptographically generated single-use verification links or time-sensitive codes delivered to verified business email addresses, ensuring that no user passwords are stored.

18.3.2Data Subjects accessing the debt resolution portal authenticate via a unique reference identifier and a time-bound one-time verification PIN transmitted via SMS or email.

18.3.3Strict role-based access controls and logical tenant segregation ensure that each authenticated person, business user, or partner accesses only the specific accounts, Records, and Personal Information within their authorised mandate.

18.4Data Storage, Cryptography, and Integrity

18.4.1Saved-card tokens, accounting-system connection keys (including Xero keys) and backups are encrypted.

18.4.2Payment card numbers are collected and processed exclusively via secure, PCI-DSS compliant third-party payment gateway interfaces operated by PayFast; the Firm does not capture, process, or store primary account numbers or card verification values on its servers.

18.4.3Every change to the records, and every acceptance of terms, is written to a log that cannot be edited.

18.4.4Redundant, encrypted system backups are generated regularly and retained in secure storage repositories for an automated lifecycle not exceeding eight weeks before being securely purged.

18.5Operator Oversight, Incident Management, and Security Compromises

18.5.1In compliance with section 21 of POPIA, where third-party Operators process Personal Information on behalf of the Firm, such processing is governed by written agreements binding the Operator to maintain equivalent technical and organisational security measures.

18.5.2The Firm maintains operational protocols to identify, contain, investigate, and remediate technical anomalies or suspected security compromises without undue delay.

18.5.3Where there are reasonable grounds to believe that the Personal Information of a Data Subject has been accessed or acquired by any unauthorised person, the Firm complies with the statutory notification procedures set out in section 22 of POPIA, providing written notification to the Information Regulator and affected Data Subjects without delay, or, where the Firm processes such data as an Operator on behalf of a business client, notifying the relevant Responsible Party immediately so that it may notify the Information Regulator and affected Data Subjects.

19.1In accordance with section 5 of POPIA, a Data Subject has the right to have their Personal Information processed in accordance with the conditions for lawful processing, including the specific rights detailed in this clause 19.

19.2Right of Access and Confirmation

19.2.1In terms of section 23(1)(a) of POPIA, a Data Subject, having provided adequate proof of identity, has the right to request the Firm to confirm, free of charge, whether the Firm holds Personal Information about the Data Subject.

19.2.2In terms of section 23(1)(b) of POPIA, a Data Subject may request from the Firm the Record or a description of the Personal Information held, including information about the identity of all third parties, or categories of third parties, who have, or have had, access to the information, within a reasonable time, at a prescribed fee (if applicable) quoted in advance, and in a reasonable manner and format that is generally understandable; provided that any such request is subject to the refusal grounds set out in Chapter 4 of Part 3 of PAIA in accordance with section 23(4) of POPIA.

19.3Right to Correction, Deletion, or Destruction

19.3.1In terms of section 24 of POPIA, a Data Subject may request the Firm to correct or delete Personal Information in its possession or under its control that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading, or obtained unlawfully.

19.3.2A Data Subject may request the Firm to destroy or delete a Record of Personal Information that the Firm is no longer authorised to retain under section 14 of POPIA, standard retention practices (including the retention of encrypted backups for up to eight weeks), or applicable statutory retention laws and professional rules governing legal practitioners.

19.3.3Requests for correction, deletion, or destruction must be submitted on Form 2 of the Regulations Relating to the Protection of Personal Information, 2018, directed to the Information Officer at hello@thwipe.ai.

19.4Right to Object to Processing

19.4.1In terms of section 11(3)(a) of POPIA, a Data Subject may object, on reasonable grounds relating to their particular situation, to the processing of their Personal Information where processing is based on section 11(1)(d), (e), or (f) of POPIA.

19.4.2An objection under clause 19.4.1 must be submitted on Form 1 of the Regulations Relating to the Protection of Personal Information, 2018, directed to the Information Officer at hello@thwipe.ai. If the objection is upheld, the Firm shall cease processing the Personal Information concerned, subject to applicable statutory retention requirements.

19.4.3In terms of section 11(3)(b) and section 69 of POPIA, a Data Subject has the right to object at any time to the processing of their Personal Information for purposes of direct marketing, whereupon the Firm shall immediately cease such processing and maintain the contact details on its suppression do-not-contact list to prevent future unsolicited direct marketing communications.

19.5Right to Withdraw Consent: Where processing is based on consent (such as voluntary participation on the launch list or acceptance of non-essential website measurement cookies), the Data Subject has the right to withdraw such consent at any time, without affecting the lawfulness of any processing performed prior to the withdrawal.

19.6Automated Decision Review: In accordance with section 71 of POPIA, where an automated decisioning mechanism within Thwipe AI has produced legal consequences or significantly affected a Data Subject, the Data Subject has the right to be informed of the underlying rationale, to make representations regarding the decision, and to request human intervention by an authorised person to reassess the outcome. A Data Subject may request human review by selecting "Something isn't right" on the account resolution page at https://thwipe.ai/resolve or by using the contact form at https://thwipe.ai/za/contact.

19.7Exercise of Debtor Rights: Where the Firm processes Personal Information of a debtor in the capacity of an Operator on behalf of a creditor business client as contemplated in clause 13.2, the Data Subject must exercise their statutory POPIA rights directly against the creditor business client as the Responsible Party. If a debtor submits an access, correction, deletion, or objection request directly to the Firm, the Firm shall promptly forward the request to the relevant creditor business client and provide reasonable technical and administrative assistance to enable the Responsible Party to respond.

19.8Right to Lodge a Complaint: In terms of section 74 of POPIA, a Data Subject has the right to lodge a complaint with the Information Regulator on Form 5 of the Regulations Relating to the Protection of Personal Information, 2018, if they believe their personal information rights under POPIA have been infringed. The Information Regulator may be contacted at Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191; telephone: 010 023 5200; toll-free: 0800 017 160; email: POPIAComplaints@inforegulator.org.za or enquiries@inforegulator.org.za; website: https://inforegulator.org.za.

20.1This Manual was compiled on 12 October 2026 and is made available in accordance with section 51(3) of PAIA and regulation 4 of the Regulations Relating to the Promotion of Access to Information, 2021:

20.1.1on the public website of the Firm at https://thwipe.ai/za/paia-manual;

20.1.2to the Information Regulator upon request; and

20.1.3to any person who asks, by email, free of charge.

20.2In terms of section 51(2) of PAIA, the Firm shall update this Manual on a regular basis whenever material changes occur to its structure, functions, categories of Records held, or personal information processing activities.

Any updated version of this Manual supersedes all prior versions and takes effect from the date of its publication on the Firm's website.

Privacy notice · Terms and conditions · Contact