PAIA Manual

Document code: RJ-LS-13

Version: 4.3

Version date: 29 September 2026

Effective date: 1 October 2026

Issued by: Ralph Jacobs SA (Pty) Ltd, registration number 2019/101093/07 — this Manual applies to the South African company only

Supersedes: all earlier published versions of this document

Prepared in terms of section 51 of the Promotion of Access to Information Act 2 of 2000, as amended by the Protection of Personal Information Act 4 of 2013.

This Manual tells you what records Ralph Jacobs holds, how to ask for one, what it costs, and what to do if we say no.

You can use it to:

• see which records you can get from us without making a formal request;
• understand how to make a request, and what to put in it;
• find the contact details of our Information Officer and Deputy Information Officer;
• find the Information Regulator’s guide on how to use PAIA;
• see why we process personal information, whose information we process, and what kinds;
• see who we may pass personal information to;
• see whether we send personal information outside South Africa, and where; and
• see what security measures we apply to it.

This Manual covers Ralph Jacobs SA (Pty) Ltd only. It is the private body for PAIA purposes.

Ralph Jacobs NZ Limited is a New Zealand company and sells to every country except South Africa. It does not carry on business in South Africa, so PAIA does not apply to it and it has no PAIA Manual. If you dealt with Ralph Jacobs NZ Limited, your access and correction rights come from the New Zealand Privacy Act 2020 and are set out in our Privacy Notice. See Where We Sell and Who You Buy From to work out which company you dealt with.

Records of Ralph Jacobs SA (Pty) Ltd are part of this private body’s records wherever they are held, including where a Ralph Jacobs group company or a service provider holds them on our behalf.

We were registered as Coscoroba Group Holdings (Pty) Ltd until 16 September 2026. Records created under the former name are records of this same private body — same company, same registration number.

3.1 Head of the private body and Information Officer

3.2 Deputy Information Officer

Both are registered with the Information Regulator under registration number 2026-067180, issued 19 September 2026. The registration records both appointments as effective from 25 February 2025.

3.3 Where to send a request

All PAIA and POPIA requests: online at privacy.ralphjacobs.org (recommended), or by email to privacy@ralphjacobs.org

Please use this address rather than a sales, showroom or help-centre channel. It is monitored for these requests, and it starts the statutory clock.

3.4 Head office

The Information Regulator has published a guide explaining how to exercise your rights under PAIA and POPIA. You do not need our permission or our help to use it, and it is free.

The Guide describes the objects of PAIA and POPIA; the contact details of information officers and deputy information officers; the manner and form of a request to a public body under section 11 and to a private body under section 50; the assistance available from information officers and from the Regulator; the remedies available to you, including internal appeal, complaint to the Regulator and application to court; the duty on public and private bodies to compile manuals; voluntary disclosure of records; the notices on fees under sections 22 and 54; and the regulations made under section 92.

The Guide is published in each official language and in braille.

You can get it:

• from the Information Regulator’s website at https://inforegulator.org.za/paia-guidelines/;
• by asking the Information Regulator for a copy; or
• by asking our Information Officer for a copy, using Form 1 of Annexure A to the PAIA Regulations.

A copy of the Guide is kept at our showroom in English and Afrikaans for inspection during normal business hours.

You do not need to make a PAIA request for any of these. They are published, or we will send them to you if you ask.

This list is our voluntary disclosure under section 52 of PAIA. It does not limit what you may request under section 50.

This list is not exhaustive.

All of these are subject to the grounds for refusal in section 12 below and in Chapter 4 of PAIA.

8.1 Why we process personal information

We process personal information to sell and deliver jewellery and related services, and to meet the legal duties that come with doing so. Specifically: to create and manage accounts; to give quotes and conclude contracts; to manufacture, source, resize, repair and deliver items; to take payment and process refunds and chargebacks; to run customer service, returns, warranty and complaint processes; to send service messages and, where you have allowed it, marketing; to verify identity, authority, beneficial ownership and, where required, source of funds; to screen against sanctions and politically exposed person lists; to prevent and investigate fraud; to secure our premises, systems and stock; to keep the records that company, tax, customs, consumer, second-hand goods and financial intelligence law require us to keep; to respond to regulators, ombuds and courts; and to defend legal claims.

The full detail is in our Privacy Notice.

8.2 Whose personal information we process, and what kinds

Where we deal in high-value goods we may also process identity, authority, beneficial-ownership, source-of-funds and source-of-wealth information because the Financial Intelligence Centre Act requires it. This is explained in Payments and Verification.

8.3 Who we may give personal information to

Service providers who process personal information on our behalf are operators. They are bound by contract to process it only on our instruction and to keep it secure.

8.4 Personal information sent outside South Africa

Some of your information stays in South Africa. Some of it does not. This is where it actually goes, system by system.

We transfer personal information out of South Africa only where section 72 of POPIA allows it — because the recipient is subject to a law, binding corporate rules or a binding agreement that provides substantially similar protection; because the transfer is necessary to perform our contract with you; or because you have consented. Our contracts with service providers carry those protections.

8.5 How we secure personal information

We apply technical and organisational safeguards proportionate to the sensitivity of the information, including:

• access control on systems and premises, limited to staff who need it for their role;
• password and authentication controls on business systems;
• encryption in transit for the website, checkout and payment pages, and at rest in our cloud systems;
• a dedicated secure upload for identity and verification documents at kyc.ralphjacobs.org/upload, and a refusal to accept those documents by email;
• no storage of full card numbers — card payments are handled by approved payment providers;
• contractual security obligations and due diligence on operators and service providers;
• retention rules, so information is not kept longer than the purpose or the law requires;
• staff confidentiality obligations, and training on POPIA and FIC duties;
• backup and recovery arrangements;
• physical security at the showroom and stock areas, including CCTV and access control; and
• an incident response and breach assessment process, including notification to the Information Regulator and to affected data subjects where section 22 of POPIA requires it.

There are two routes. Which one applies decides what you must give us, and what it costs.

How to send us a request

A request about your own personal information is never charged, whichever way you send it.

9.1 If you want your own personal information

If you are asking what we hold about you, or asking us to correct it, delete it or stop using it, that is a POPIA request. These are free.

The POPIA forms are published by the Information Regulator at https://inforegulator.org.za/popia-forms/.

9.2 If you want a record of the company

This is a PAIA request under section 50, and different rules apply.

We must give you access to a record if three things are true: the record is required for the exercise or protection of a right; you follow the procedure PAIA sets; and no ground of refusal in Chapter 4 of PAIA applies.

The second and third of those are ours to apply. The first is yours to establish — you have to tell us which right you are exercising or protecting, and why you need this particular record in order to do it. A request that does not do this will be refused, and it is the most common reason a PAIA request to a private body fails.

Your request must be on a form that corresponds substantially with Form 2 of Annexure A to the PAIA Regulations, 2021 (Regulation 7). Use our online form at privacy.ralphjacobs.org (recommended), or our fillable PAIA Form 2 (Route B), or download Form 2 from https://inforegulator.org.za/paia/.

You must give us:

• your full name, identity number, postal address, street address, email address and contact numbers;
• if you are requesting on behalf of someone else, their details, the capacity in which you act, and proof of that authority;
• proof of your identity;
• enough detail to let us find the record, including a reference number if you have one;
• the type of record — written or printed, images, sound, or held electronically;
• the form of access you want — printed copy, transcription, flash drive, compact disc, or cloud storage;
• how you want it delivered — inspection in person, post, courier, email or file transfer;
• your preferred language, understanding that we can only give you a record in a language it exists in;
• the right you are exercising or protecting, and why the record is needed for it; and
• how you want us to correspond with you.

9.3 Proof of identity

We ask for proof of identity because the alternative is handing someone else’s records to a stranger. A clear copy of a valid identity document, passport or driving licence is enough. Upload it through the online form, or through the secure link we send you. Please do not send it as an ordinary e-mail attachment. If you act for someone else, send a power of attorney, a resolution or other written authority as well.

10.1 Requests that are free

• Confirmation of whether we hold personal information about you — free by law, under section 23(1)(a) of POPIA.
• Access to your own personal information — we do not charge you for this, although PAIA would permit us to.
• Correction, deletion, destruction or objection under POPIA — free.
• Direct marketing opt-out — free.
• Reading this Manual, or any published document on our legal hub — free.

10.2 Fees for a PAIA request

These are the fees prescribed for private bodies in Annexure B to the PAIA Regulations, 2021. We may not charge more, and we may not charge something different.

The first hour of searching is free. Search and preparation can never exceed R435.00, however long it takes.

10.3 How fees work in practice

1. You send us the request.
2. The R140.00 request fee is payable, and we do not start work until it is paid (section 54(1) of PAIA). If you use the online form, it tells you this and you may pay the fee there. If you email a form, we tell you in writing and send you payment details. If you claim an exemption from fees, you do not pay until we have decided your claim, and if the request fee turns out not to be payable, we refund it.
3. We search for and prepare the record.
4. We tell you our decision and, where we are granting access, the access fee and any deposit, on a notice corresponding to Form 3 of the PAIA Regulations.
5. You pay the access fee.
6. We release the record.

We do not release a record before the fees are paid in full.

If you believe you qualify for an exemption from fees, say so in your request and give your reason. We will consider it and tell you in writing.

We decide within 30 days of receiving a request that complies with PAIA.

We may extend that where PAIA allows it — for example where the request covers a large number of records, or where the records are held elsewhere. If we extend, we tell you in writing and give reasons.

If your request affects someone else, PAIA requires us to tell that person within 21 days. They then have 21 days to make representations to us on whether we should grant access. This is why third-party requests take longer.

If we do not respond in time, PAIA treats that as a refusal, and the remedies in section 13 are available to you.

PAIA allows, and in some cases requires, us to refuse access. The grounds that arise most often for us are:

• another person’s personal information, where disclosure would be unreasonable;
• someone else’s commercial information — trade secrets, or financial, commercial, scientific or technical information whose disclosure would harm them;
• a breach of a duty of confidence owed to another person;
• safety of an individual, or protection of property — this one matters in a business that holds high-value stock and knows where customers keep valuable items;
• our own commercial information, including trade secrets, information that would harm us in negotiations, or information that would prejudice us competitively;
• legally privileged records, unless privilege has been waived;
• records of research being carried out on our behalf or on behalf of a third party;
• records another law forbids us to disclose, including the confidentiality provisions of the Financial Intelligence Centre Act — there are reports we are legally prohibited from discussing with you, and we will say so plainly rather than mislead you;
• records we cannot find, or which do not exist, in which case we give you an affidavit describing the steps we took to look for them; and
• manifestly frivolous or vexatious requests, or requests that would involve a substantial and unreasonable diversion of resources.

Where only part of a record is protected, we give you the rest.

Section 70 of PAIA overrides most of these. We must disclose a record, even where a ground of refusal applies, if it reveals a substantial contravention of or failure to comply with the law, or an imminent and serious public safety or environmental risk, and the public interest in disclosure clearly outweighs the harm. That override binds us, and we apply it.

If we refuse, we tell you in writing, with reasons, and with the remedies available to you.

There is no internal appeal against a decision of a private body — PAIA provides internal appeals only against public bodies. Your routes are:

Complain to the Information Regulator. Use Form 5 of Annexure A to the PAIA Regulations. There is no charge.

Apply to court. You may apply to a court against our decision, in the circumstances and within the periods PAIA sets.

Ask the Regulator to assess us. Under section 77H of PAIA you may ask the Information Regulator to assess whether we generally comply with PAIA. Use Form 13.

For a consumer complaint that is not about access to information, see Complaints and CGSO instead. The Consumer Goods and Services Ombud handles those, and it is also free.

This Manual is available:

• on our legal hub at https://ralphjacobs.org/paia/, free of charge;
• at our showroom, for inspection during normal business hours;
• to any person on request — electronically at no charge, or as a printed copy at R2.00 per A4 page under item 2 of the fee table above; and
• to the Information Regulator on request.

It is published in English.

We review this Manual at least annually, and whenever our records, systems, service providers, officers or legal obligations change materially.

Every version we have published, with the dates it applied, is kept at ralphjacobs.org/versions/. The version that applies to your request is the one published on the day we received it.

Rikus Kotzé

Director and Information Officer

Ralph Jacobs SA (Pty) Ltd

22 September 2026