SmartAlex PAIA Manual (Promotion of Access to Information Act)

Version 1.0 · Effective July 7, 2026 · THERCSGROUP PTE. LTD. (trading as SmartAlex, Singapore Reg. No. 202543608D)

1. Purpose and scope

This document is the information manual (the "Manual") of THERCSGROUP PTE. LTD., trading as SmartAlex ("SmartAlex", "we", "us", or "our"). It is compiled and published under section 51 of the Promotion of Access to Information Act 2 of 2000 ("PAIA"), read with the Protection of Personal Information Act 4 of 2013 ("POPIA"), which inserted additional requirements into the manual a private body must keep. The SmartAlex platform, websites, applications, and APIs are referred to in this Manual as the "Services".

PAIA gives effect to the constitutional right of access to information. It requires every private body to compile a manual that tells a person how the body is arranged, what records it holds, and how a person may ask for access to those records. The general exemption that once relieved many private bodies of the duty to have a manual lapsed on 31 December 2021, so this Manual is a standing requirement, not an optional courtesy. Since 1 July 2021 PAIA has been administered by the Information Regulator (South Africa), not by the South African Human Rights Commission, and it is the Regulator to whom this Manual is submitted and to whom a dissatisfied requester may complain.

This Manual supplements our Privacy Policy, our POPIA Notice, our Information Officer Notice, and, between SmartAlex and a Customer, our Data Processing Addendum. Those documents own the data-protection detail. This Manual deals with the PAIA access-to-records question, and it points to the other documents rather than repeating them. Where there is a conflict between this Manual and any of those documents on a PAIA access question, the more specific provision in this Manual applies.

This Manual is a statement of how SmartAlex meets its PAIA obligations. It is not legal advice, and it does not create a contract or vary any agreement between you and us. It describes the process for requesting a record and does not itself grant a right to any particular record, which remains subject to the grounds of refusal that PAIA allows.

2. About THERCSGROUP PTE. LTD.

The private body to which this Manual relates is THERCSGROUP PTE. LTD., a company incorporated in Singapore under Unique Entity Number 202543608D, trading as SmartAlex. SmartAlex is not registered as an external company in the Republic of South Africa. It operates as a Singapore company providing the Services on a cross-border basis under Singapore Unique Entity Number 202543608D.

The nature of our business is the provision of the SmartAlex AI voice platform: software that runs automated voice agents which speak with people in real time and can, where a Customer enables it, record and transcribe calls and help conclude business, together with the surrounding contact, campaign, billing, and analytics functionality that makes up the Services. We are an application layer. We arrange the underlying telephone carriage through duly licensed telecommunications providers and engage third parties to help provide the Services, whose current identities are published in our Subprocessor List.

3. The head of the private body, Information Officer, and Deputy Information Officers

Section 51(1)(a) of PAIA requires this Manual to give the contact details of the head of the private body and of the officer to whom a request for access must be sent. For SmartAlex those functions are held as follows.

The head of the private body for the purposes of PAIA is the chief executive officer, or the person acting in that capacity from time to time. The head bears ultimate responsibility for the body's compliance with PAIA. The head may, and does, delegate the day-to-day discharge of that responsibility to the Information Officer.

The Information Officer is the officer designated to receive, consider, and decide requests for access to records made under this Manual, and to deal with the Information Regulator on PAIA and POPIA matters. One or more Deputy Information Officers may be designated to assist the Information Officer and to act in the Information Officer's absence. The name, title, postal and physical address, telephone number, and email address of the Information Officer and any Deputy Information Officer are set out, and kept current, in our Information Officer Notice, which is the sibling of this Manual in the SmartAlex legal library. Requests and correspondence about access to records should be directed to the Information Officer at privacy@getsmartalex.com.

4. The Information Regulator's Guide on how to use PAIA

Section 51(1)(b) of PAIA requires this Manual to refer to the guide that the Information Regulator has compiled under section 10 of PAIA. That Guide is written in plain language and explains how a person may exercise the right of access to information, both from public bodies and from private bodies such as SmartAlex. It describes the manner in which a request must be made, the fees that may apply, and the remedies available to a person who is refused access.

The Guide is available, in each of the official languages in which it has been published, from the Information Regulator. A person who wishes to obtain the Guide may do so from the Regulator directly, using the contact details below, or may download it from the Regulator's website.

5. Records automatically available

Section 51(1)(c), read with section 52, allows a private body to give notice of categories of records that are automatically available without a person having to lodge a formal PAIA request. As at the effective date of this Manual, SmartAlex has not issued a notice under section 52(2), and so no category of record is available on that statutory basis. A request for any record described in this Manual must be made in the manner set out in section 9 below.

Separately from the section 52 mechanism, and as a matter of openness, certain information is published and freely available to anyone without a request. This voluntarily available information includes:

• the documents that make up our public legal library, including our Privacy Policy, our POPIA Notice, our Information Officer Notice, this Manual, and our other published notices and policies;
• the content of our public websites, including descriptions of the Services, and our published pricing and product information; and
• this Manual itself, which is available as described in section 13 below.

Making this information freely available does not waive any ground on which access to other records may be refused, and it does not turn the voluntarily available items into records issued under section 52.

6. Records available in terms of other legislation

Section 51(1)(d) of PAIA requires this Manual to describe the records that are available in accordance with other legislation. Access to those records is governed by the specific statute concerned, and a request for them may need to be made under that statute rather than under PAIA. The table below lists the principal categories. It is a guide and is not exhaustive, and the statutes named apply to SmartAlex only to the extent that its activities fall within them.

7. Subjects and categories of records held

Section 51(1)(e) of PAIA requires this Manual to describe, by subject, the categories of records that SmartAlex holds. The table below sets out the main subjects and the record categories under each. Whether any particular record is released remains subject to the grounds of refusal in section 11.

8. Processing of personal information

POPIA inserted into section 51 the requirement that this Manual describe how SmartAlex processes personal information. The five matters below give a general description. The full detail of how personal information is collected, used, secured, retained, and transferred, and the rights of the people concerned, is set out in our Privacy Policy and our POPIA Notice, and this Manual points to them rather than repeating them.

8.1 Purposes of processing

We process personal information to provide and operate the Services, including running voice agents and, where a Customer enables it, recording and transcribing calls; to administer accounts, billing, and support; to secure the Services and prevent abuse; to comply with our legal and regulatory obligations; and for our own business administration, including employment and supplier management. Where SmartAlex processes personal information on behalf of a Customer, it does so as an operator on the Customer's instruction, and the Customer is the responsible party.

8.2 Categories of data subjects and of personal information

The categories of data subjects include our Customers and their staff, the individuals our Customers interact with through the Services, our own employees and contractors, our suppliers, and visitors to our websites. The categories of personal information include identifying and contact details, account and configuration information, call audio and transcripts and information disclosed during calls, financial and billing information, employment information for our own staff, and technical information such as device and log data.

8.3 Recipients or categories of recipients

Personal information may be shared with the Customer on whose behalf it is processed; with the third parties we engage to help provide the Services, being our telephony provider and our speech and language AI providers, whose current identities are published in our Subprocessor List; with our professional advisers, auditors, and payment and banking providers; and with a court, regulator, or other authority where the law requires or permits it.

8.4 Planned transborder flows of personal information

Because SmartAlex is incorporated in Singapore and engages providers located in more than one country, personal information may be transferred outside the Republic of South Africa. Any such transfer is made on a basis that POPIA permits, and the safeguards that apply to cross-border transfers are described in our Privacy Policy and our POPIA Notice.

8.5 Information-security measures

We maintain appropriate, reasonable technical and organisational measures to protect personal information against loss, damage, unauthorised access, and unlawful processing. These include access controls, encryption in transit and at rest, logging and monitoring, tenant isolation so that one Customer's data is kept separate from another's, and contractual controls on the third parties we engage. A general description is given here; the detail is in our Privacy Policy and our POPIA Notice.

9. How to request access to a record

A request for access to a record held by SmartAlex must be made on the prescribed form. The current form is Form 2 of the Regulations Relating to the Promotion of Access to Information, 2021 (the "2021 Regulations"), which is the request form for access to a record of a private body. Form 2 replaced the earlier form that some documents still call "Form C", and the current form should be used.

A request must:

1. be made on Form 2 of the 2021 Regulations, a copy of which can be obtained from the Information Officer or downloaded from the Information Regulator's website;
2. provide sufficient detail to enable the Information Officer to identify the record and the requester, and to locate the record;
3. identify the right the requester seeks to exercise or protect, and explain why the record is required to exercise or protect that right, as PAIA requires for a request to a private body;
4. state the form of access required and the manner in which the requester wishes to be informed of the decision; and
5. be accompanied by proof of the identity of the requester, and, where the request is made on behalf of another person, proof of the capacity in which the requester is making the request.

The completed form and supporting documents should be sent to the Information Officer at privacy@getsmartalex.com, or delivered to our address as set out in section 2.

9.1 Fees

PAIA allows a private body to charge a request fee and, where access is granted, an access fee that covers the cost of searching for, preparing, reproducing, and sending the record. The amounts are fixed by the fee schedule in the Annexure to the 2021 Regulations, as gazetted, and are not set by SmartAlex. Because those amounts are set by regulation and are revised from time to time, this Manual does not state specific rand figures; the applicable request fee, the search-and-preparation fee, and the reproduction and postage charges are those set out in the gazetted Annexure in force when the request is made. The Information Officer will notify the requester of the fee payable, and, where a deposit is required because preparing the record will take longer than the prescribed number of hours, of the deposit payable, before the request is processed further.

10. Decision and timelines

The Information Officer must decide a request, and notify the requester of the decision, as soon as reasonably possible but in any event within 30 days after the request is received, as required by section 56 of PAIA. That period may be extended once, for a further period not exceeding 30 days, in the circumstances set out in section 57, for example where the request is for a large number of records or requires a search through records held at another place, or where consultation with a third party or among offices cannot reasonably be completed within the original period. Where the Information Officer extends the period, the requester will be notified of the extension and the reasons for it before the original period expires.

11. Grounds on which access may be refused

PAIA does not give an unqualified right to every record. Sections 62 to 69 set out grounds on which access to a record of a private body must or may be refused, so that access can be balanced against the rights of others and the legitimate interests of the body. The Information Officer will consider these grounds when deciding a request. They include:

• Mandatory protection of the privacy of a third party who is a natural person, where disclosure would be unreasonable (section 63);
• Mandatory protection of the commercial information of a third party, such as trade secrets, financial or commercial information supplied in confidence, or information whose disclosure could harm the third party's commercial or financial interests (section 64);
• Mandatory protection of confidential information the disclosure of which would breach a duty of confidence owed to a third party (section 65);
• Protection of the safety of individuals and of property, where disclosure could endanger a person or prejudice the security of property or a protection system (section 66);
• Protection of records privileged from production in legal proceedings, that is, records subject to legal professional privilege (section 67);
• Protection of the commercial information of SmartAlex itself, including our own trade secrets, financial and commercial information, and research (section 68); and
• Protection of research information of a third party or of SmartAlex, where disclosure would expose the researcher or the research to serious disadvantage (section 69).

Where a ground of refusal applies to only part of a record, access will be given to the remainder, as PAIA requires. Even where a ground of refusal would otherwise apply, section 70 provides a public-interest override: access must nonetheless be granted if the disclosure would reveal a substantial contravention of the law or an imminent and serious public-safety or environmental risk, and the public interest in disclosure clearly outweighs the harm the ground of refusal is meant to protect against.

12. Remedies

PAIA does not provide for an internal appeal against a decision of a private body, so there is no internal appeal to a higher officer of SmartAlex. A requester who is dissatisfied with a decision of the Information Officer, including a refusal of access, the fee charged, or the form of access given, has two routes.

• Complaint to the Information Regulator. A requester may lodge a complaint with the Information Regulator, which may investigate and seek to resolve the matter, using the contact details in section 4 and at the close of this Manual.
• Application to court. A requester may apply to a court for appropriate relief under Part 4 of PAIA. The application is made to a High Court, or to another court of competent jurisdiction designated under PAIA, which may confirm, set aside, or vary the decision.

These remedies are available to a requester whether or not a complaint to the Regulator has first been made, subject to the requirements PAIA sets for each route.

13. Availability and contact

This Manual is available on our website, at our premises on request, and has been lodged with the Information Regulator in accordance with section 51(3) of PAIA. It is also available, on request, in the manner and languages that the 2021 Regulations require. For a request for access to a record, or any question about this Manual, contact the Information Officer at privacy@getsmartalex.com. A person who is dissatisfied, or who wishes to obtain the Information Regulator's Guide, may contact the Information Regulator at PAIAComplaints@inforegulator.org.za and https://inforegulator.org.za.

This Manual is issued by THERCSGROUP PTE. LTD. (UEN 202543608D), 160 Robinson Road, #14-04 Singapore Business Federation Center, Singapore 068914.

14. Version and effective date

This PAIA Manual is version 1.0 and is effective from 7 July 2026.