PAIA Manual

1. Introduction

The Promotion of Access to Information Act, 2000 (Act No. 2 of 2000) ("PAIA") gives effect to the constitutional right of access to information held by both public and private bodies where such information is required for the exercise or protection of any rights. The Act promotes transparency, accountability, and effective governance by providing a mechanism through which individuals and organisations may request access to records held by institutions.

Arnot OpCo (Pty) Ltd recognises the importance of transparency, responsible corporate governance, and compliance with legislative requirements. As a private body operating within the South African mining sector, the company is committed to maintaining records in a manner that supports accountability, operational effectiveness, and compliance with applicable legal and regulatory obligations.

This Manual has been prepared in accordance with Section 51 of PAIA and serves as a guide to the records held by Arnot OpCo (Pty) Ltd. It outlines the categories of information available, the procedures to be followed when requesting access to records, and the manner in which the company processes personal information in accordance with the Protection of Personal Information Act, 2013 (POPIA).

The Manual seeks to facilitate access to information while balancing the need to protect confidential information, commercially sensitive information, personal information, and information that may be exempt from disclosure in terms of applicable legislation.

2. Purpose of the PAIA Manual

The purpose of this Manual is to provide transparency regarding the records maintained by Arnot OpCo (Pty) Ltd and to assist members of the public in exercising their rights under PAIA.

Specifically, this Manual aims to:

Provide information regarding the structure and operations of Arnot OpCo (Pty) Ltd.

Explain how requests for access to records may be submitted.

Identify the Information Officer responsible for handling requests.

Describe the categories of records maintained by the company.

Outline the legal requirements applicable to requests for information.

Describe how personal information is processed in accordance with POPIA.

Promote accountability and transparency within the organisation.

Facilitate lawful access to information while protecting confidential and sensitive information.

The Manual should be read together with applicable legislation, organisational policies, and guidance issued by the Information Regulator.

3. Company Information

Arnot OpCo (Pty) Ltd is a South African mining company involved in the operation and management of coal mining activities and associated business functions. The company maintains records required for operational, regulatory, financial, environmental, employment, procurement, safety, and governance purposes.

As part of its operations, Arnot OpCo (Pty) Ltd collects, creates, stores, and processes information relating to employees, contractors, suppliers, customers, business partners, regulators, and other stakeholders. These records may exist in physical or electronic form and are maintained in accordance with applicable legal, regulatory, contractual, and operational requirements.

The company is committed to ensuring that information is managed responsibly, securely, and in compliance with applicable legislation.

4. Contact Details of the Information Officer

In terms of the Protection of Personal Information Act, 2013 and the Promotion of Access to Information Act, 2000, every private body is required to appoint an Information Officer responsible for overseeing compliance with information access and privacy obligations.

The Information Officer is responsible for:

Facilitating requests for access to information.

Ensuring compliance with PAIA requirements.

Overseeing compliance with POPIA.

Managing requests relating to personal information.

Coordinating responses to information requests.

Ensuring records management practices support legal compliance.

Acting as a liaison with the Information Regulator where necessary.

The Information Officer may be supported by Deputy Information Officers or authorised representatives who assist with the administration of PAIA and POPIA responsibilities.

Requests for information, complaints, enquiries, or concerns relating to access to information may be directed to:

Name of the Information Officer; Lizzy Moletsane

Position/Designation: Communication Specialist

Email Address: lizzy@arnotopco.com

Telephone Number: 0832563918

Company address: Farm Rietkuil 491 JS, Private Bag X3, Rietkuil, Mpumalanga, 1097

The Information Officer shall ensure that requests are processed fairly, lawfully, and within the prescribed timeframes established by legislation.

5. Guide on How to Use PAIA

The Information Regulator has published a guide explaining the rights available under PAIA and the procedures to be followed when requesting access to records held by public and private bodies.

The guide is intended to assist individuals who may not be familiar with the requirements of PAIA and provides practical information regarding:

The purpose and objectives of PAIA.

How to submit a request for information.

The rights of requesters.

The obligations of organisations responding to requests.

Available remedies where access is refused.

Applicable fees and procedures.

The role of the Information Regulator.

The guide is available in multiple official languages and may be obtained directly from the Information Regulator.

Information Regulator Contact Details

Name of the Information Officer; Lizzy Moletsane

Position/Designation: Communication Specialist

Email Address: lizzy@arnotopco.com

Telephone Number: 0832563918

Company address: Farm Rietkuil 491 JS, Private Bag X3, Rietkuil, Mpumalanga, 1097

Individuals seeking guidance regarding their rights under PAIA are encouraged to consult the Information Regulator's guide before submitting a request for access to records.

6. Records Available in Terms of Other Legislation

Arnot OpCo (Pty) Ltd maintains records in accordance with various legislative, regulatory, contractual, and operational requirements applicable to its business activities. Access to such records may be governed by the specific legislation under which they are created, maintained, or retained.

The existence of records in terms of the legislation listed below does not automatically entitle a requester to access such records. Requests for access shall be considered in accordance with PAIA and any other applicable legal requirements.

The company may maintain records in terms of, but not limited to, the following legislation:

Promotion of Access to Information Act, 2000 (Act No. 2 of 2000)

Protection of Personal Information Act, 2013 (Act No. 4 of 2013)

Companies Act, 2008 (Act No. 71 of 2008)

Mine Health and Safety Act, 1996 (Act No. 29 of 1996)

Mineral and Petroleum Resources Development Act, 2002 (Act No. 28 of 2002)

Occupational Health and Safety Act, 1993 (Act No. 85 of 1993)

Labour Relations Act, 1995 (Act No. 66 of 1995)

Basic Conditions of Employment Act, 1997 (Act No. 75 of 1997)

Employment Equity Act, 1998 (Act No. 55 of 1998)

Skills Development Act, 1998 (Act No. 97 of 1998)

Compensation for Occupational Injuries and Diseases Act, 1993 (Act No. 130 of 1993)

Income Tax Act, 1962 (Act No. 58 of 1962)

Value Added Tax Act, 1991 (Act No. 89 of 1991)

Financial Intelligence Centre Act, 2001 (Act No. 38 of 2001)

National Environmental Management Act, 1998 (Act No. 107 of 1998)

National Water Act, 1998 (Act No. 36 of 1998)

Electronic Communications and Transactions Act, 2002 (Act No. 25 of 2002)

Broad-Based Black Economic Empowerment Act, 2003 (Act No. 53 of 2003)

The above list is not exhaustive and may be updated as legislative requirements evolve.

7. Categories of Records Held by Arnot OpCo (Pty) Ltd

Arnot OpCo (Pty) Ltd maintains a wide range of records in support of its operational, legal, financial, environmental, governance, and business activities. Records may exist in both physical and electronic formats and may be stored internally or through authorised service providers.

The categories below provide a general indication of records that may be maintained by the company.

7.1 Corporate Governance Records

Corporate governance records support the management, oversight, and strategic direction of the organisation. Examples include:

Company registration documentation

Memorandum of Incorporation (MOI)

Board and committee meeting minutes

Governance charters

Delegations of authority

Strategic plans

Corporate policies and procedures

Internal audit reports

Risk management documentation

Compliance reports

Shareholder information

Annual reports

These records assist in ensuring accountability, transparency, and effective governance across the organisation.

7.2 Human Resources Records

Human resource records relate to the management of employees, contractors, and recruitment activities.

Examples include:

Employment contracts

Employee personnel files

Recruitment and selection records

Curriculum vitae and application forms

Qualifications and certifications

Training and development records

Payroll information

Performance management records

Leave records

Disciplinary records

Medical fitness records where applicable

Employment equity documentation

Skills development records

Such records are maintained in accordance with labour legislation and organisational requirements.

7.3 Financial Records

Financial records support the management of the organisation's financial activities and statutory obligations.

Examples include:

Annual financial statements

Accounting records

Tax submissions

VAT records

Banking records

Invoices

Purchase orders

Payment records

Budget information

Audit reports

Asset registers

Procurement expenditure records

Financial records are maintained in accordance with applicable accounting standards and statutory requirements.

7.4 Procurement and Supplier Records

As part of its mining operations, Arnot OpCo (Pty) Ltd engages with suppliers, contractors, consultants, and service providers.

Examples of records maintained include:

Supplier registration documentation

Tender documentation

Bid evaluation records

Contracts and agreements

Procurement approvals

Supplier compliance records

B-BBEE certificates

Tax compliance documentation

Vendor performance assessments

Procurement correspondence

These records support fair, transparent, and accountable procurement processes.

7.5 Mining and Operational Records

Mining operations require the maintenance of numerous operational records that support regulatory compliance and effective resource management.

Examples include:

Mining licences and permits

Production reports

Geological reports

Resource and reserve information

Operational performance reports

Equipment maintenance records

Operational procedures

Contractor management records

Site inspection reports

Regulatory submissions

Such records support operational efficiency, compliance, and decision-making.

7.6 Health, Safety and Environmental Records

Health, safety, and environmental management are critical components of mining operations.

Examples include:

Safety policies and procedures

Incident investigation reports

Occupational health records

Risk assessments

Environmental impact assessments

Environmental monitoring reports

Safety training records

Emergency response plans

Compliance inspection reports

Waste management records

Water management records

These records support compliance with mining, environmental, and occupational health and safety legislation.

7.7 Information Technology Records

Information technology records support the secure operation of the company's information systems and digital infrastructure.

Examples include:

System configuration records

Security logs

Access control records

User account records

Network diagrams

Backup records

Incident response records

Website administration records

Cybersecurity monitoring reports

Software licensing records

Access to such records may be restricted where disclosure could compromise security.

7.8 Legal and Contractual Records

The company maintains records relating to legal matters, contractual obligations, and dispute resolution activities.

Examples include:

Contracts and agreements

Legal opinions

Litigation records

Insurance documentation

Compliance reports

Regulatory correspondence

Settlement agreements

Intellectual property records

Certain legal records may be subject to legal privilege and confidentiality restrictions.

8. Processing of Personal Information in Terms of POPIA

Arnot OpCo (Pty) Ltd is committed to protecting personal information and ensuring that all processing activities are conducted in accordance with the Protection of Personal Information Act, 2013 (POPIA).

The company processes personal information lawfully, transparently, and only for legitimate business purposes.

Personal information may be collected directly from data subjects, through contractual relationships, recruitment processes, supplier engagements, website interactions, regulatory requirements, or other lawful means.

The company processes personal information for purposes that include:

Recruitment and employment administration

Payroll and benefits administration

Contractor management

Supplier management

Procurement activities

Regulatory compliance

Security management

Occupational health and safety administration

Website administration

Business operations

Contract management

Legal and governance activities

Arnot OpCo (Pty) Ltd undertakes to process personal information in accordance with the conditions for lawful processing prescribed by POPIA, including:

Accountability

Processing limitation

Purpose specification

Further processing limitation

Information quality

Openness

Security safeguards

Data subject participation

The company implements appropriate technical and organisational safeguards to protect personal information against unauthorised access, disclosure, loss, destruction, or misuse.

9. Categories of Data Subjects and Personal Information

Arnot OpCo (Pty) Ltd processes personal information relating to various categories of individuals and organisations.

Categories of data subjects may include:

Employees

Prospective employees

Contractors

Suppliers

Customers

Business partners

Visitors

Website users

Regulatory representatives

Community stakeholders

Depending on the nature of the relationship, personal information may include:

Full names

Identification numbers

Passport information

Contact details

Physical addresses

Employment information

Qualifications

Financial information

Banking information

Tax information

Security access information

Website usage information

Contractual information

Health and safety information where legally required

The collection and processing of personal information are limited to information necessary for legitimate business purposes.

10. Categories of Recipients of Personal Information

Personal information may be shared with:

Regulatory authorities

Auditors

Legal advisors

Service providers

Recruitment partners

Technology providers

Such disclosure will occur only where legally permissible and necessary.

11. Cross-Border Transfers of Personal Information

Where personal information is transferred outside South Africa, Arnot OpCo (Pty) Ltd will ensure that appropriate safeguards are implemented and that such transfers comply with POPIA requirements.

12. Security Measures

Arnot OpCo (Pty) Ltd implements appropriate technical and organisational measures to protect personal information, including:

Access controls

Authentication controls

Encryption technologies

Security monitoring

Network security controls

Secure storage mechanisms

Incident response procedures

13. Procedure for Requesting Access to Information

A requester seeking access to records must:

Complete the prescribed PAIA Request Form.

Submit the request to the Information Officer.

Provide sufficient information to identify the requested records.

Pay any prescribed fees where applicable.

Requests will be assessed and responded to in accordance with PAIA requirements.

14. Grounds for Refusal of Access

Access to records may be refused where permitted by PAIA, including where disclosure would:

Violate personal privacy rights.

Reveal confidential commercial information.

Compromise legal privilege.

Jeopardise security measures.

Contravene statutory restrictions.

15. Availability of the Manual

This Manual is available:

On the company website.

From the Information Officer upon request.

In electronic format where applicable.

16. Approval and Review

This PAIA Manual shall be reviewed periodically to ensure ongoing compliance with applicable legal and regulatory requirements.

Approved by: Tumelo Baloyi

Authorised Representative: Cybersec Clinique

Date: 17 July 2026

Document Control