PAIA Manual

VukaHustle PAIA Manual

vukahustle.com | UlulaLabs (Pty) Ltd, Registration number 2026/107064/07 | Effective date: 09 October 2026

---

Prepared in terms of section 51 of the Promotion of Access to Information Act 2 of 2000 ("PAIA"), as amended by the Protection of Personal Information Act 4 of 2013 ("POPIA").

1. Introduction

UlulaLabs (Pty) Ltd, trading as VukaHustle ("VukaHustle", "we", "us" or "our"), is a private company that operates the VukaHustle platform at vukahustle.com, a software service that enables independent merchants to build and run online stores.

PAIA gives effect to the constitutional right of access to information held by private bodies where that information is required for the exercise or protection of any right. This manual explains:

• how to contact us about a request for access to a record;
• the categories of records we hold, and which of them are automatically available;
• how to make a request and the fees that may apply;
• the grounds on which a request may be refused; and
• how we process personal information, as required by section 51(1)(c) of PAIA.

2. Contact details (section 51(1)(a))

The Information Officer is responsible for dealing with all requests for access to records under PAIA and for VukaHustle's compliance with POPIA. The Information Officer may designate one or more Deputy Information Officers, whose details will be added to this manual when appointed.

3. Guide on how to use PAIA (section 10)

The Information Regulator has published a guide in each official language on how to use PAIA and POPIA. It explains, among other things, the purpose of PAIA, how to make a request, the assistance available from Information Officers, the remedies available and the fees payable.

The guide is available on the Information Regulator's website and can be inspected at the Regulator's offices:

Information Regulator (South Africa)
Physical address: Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191
Website: https://inforegulator.org.za/
General enquiries: enquiries@inforegulator.org.za
PAIA complaints: PAIAComplaints@inforegulator.org.za
Telephone: 010 023 5200 or 0800 017 160

A copy of the guide can also be requested from our Information Officer.

4. Records automatically available (section 52)

No notice has been published under section 52(2) of PAIA. The following records are, however, available without a formal PAIA request, free of charge, on vukahustle.com:

• Terms and Conditions;
• Privacy Policy;
• Refund Policy and Cancellation Policy;
• Security Policy;
• Data Processing Agreement;
• Disclosure Requests Policy;
• Sub-processors and Service Providers list;
• Shipping Terms;
• this PAIA manual; and
• plan and pricing information displayed on the Platform.

5. Records available in terms of other legislation (section 51(1)(b)(iii))

We keep records in accordance with the following legislation, where applicable to us. Some of these records may be available to the persons entitled to them under that legislation:

• Companies Act 71 of 2008
• Consumer Protection Act 68 of 2008
• Electronic Communications and Transactions Act 25 of 2002
• Income Tax Act 58 of 1962
• Promotion of Access to Information Act 2 of 2000
• Protection of Personal Information Act 4 of 2013
• Tax Administration Act 28 of 2011

This list is not exhaustive. If a record is not listed here but a requester believes we hold it under another law, the request will still be considered.

6. Subjects and categories of records held (section 51(1)(b)(iv))

Records are available only on request in terms of this manual and subject to the grounds of refusal in PAIA.

7. Processing of personal information (section 51(1)(c))

7.1 Purposes of processing

We process personal information to:

• create, administer and secure merchant accounts and stores;
• provide the Platform, including store hosting, order, customer-account, billing, delivery and support functions;
• process and manage payments for VukaHustle subscriptions and plans;
• prevent fraud, misuse and security incidents, and maintain audit records;
• communicate with merchants, shoppers and other contacts;
• comply with tax, accounting, consumer-protection and other legal obligations;
• manage our relationships with suppliers and service providers; and
• conduct direct marketing where permitted by law.

Where we host stores on behalf of merchants, the merchant is the responsible party for its own customers' personal information and we act as the merchant's operator.

7.2 Categories of data subjects and their personal information

7.3 Recipients or categories of recipients

Personal information may be shared, only as reasonably necessary, with:

• merchants and shoppers, to process, fulfil and support orders;
• the independent payment provider that processes a payment for VukaHustle subscriptions and plans (we have selected Peach Payments, subject to activation of its payment service), and banks;
• the payment provider a merchant has connected to its store, such as PayFast or Yoco, for payments made by shoppers to merchants;
• courier and delivery providers, including PUDO and The Courier Guy, where a merchant uses Provider Shipping;
• hosting, cloud, email, communications, security, analytics and professional-service providers acting as our operators;
• SARS, the CIPC and other regulators, courts and law-enforcement bodies, where required by law; and
• professional advisers, auditors and insurers.

7.4 Planned transborder flows

Our hosting, databases, backups and email are provided by xneelo in South Africa, and merchants' customer information is hosted in South Africa. Some service providers process personal information outside South Africa: WhatsApp (Meta), for communications with merchants, and, only where a website visitor has given consent, Google Analytics 4, Microsoft Clarity and Meta advertising measurement on vukahustle.com. Our Sub-processors and Service Providers page at https://vukahustle.com/sub-processors lists each provider and where it processes information. We transfer personal information outside South Africa only in accordance with section 72 of POPIA, for example where the recipient is subject to a law, binding agreement or binding corporate rules that provide an adequate level of protection.

7.5 Security measures

We implement reasonable technical and organisational measures to secure the integrity and confidentiality of personal information, including:

• access controls and role-based permissions;
• authentication controls and hashing of passwords;
• encryption of data in transit and, where appropriate, at rest;
• logging and monitoring of system access and security events;
• regular backups and incident-management procedures;
• written agreements, including our service providers' data-processing terms, requiring any operator that processes personal information on our behalf to keep it confidential and secure, as required by section 21 of POPIA; and
• payment card details being handled by the payment provider and not stored by us.

8. How to request access to a record (sections 51(1)(b)(iv) and 53)

1. Complete the prescribed form. Requests must be made on Form 2 (Request for Access to Record) prescribed under the PAIA Regulations, 2021, available from the Information Regulator's website or from our Information Officer.
2. Submit it to the Information Officer by email to hello@vukahustle.com or by delivery to Dynamic Technologies House, 2 Venus Rd, Melrose Estate, Johannesburg, South Africa.
3. Give enough detail. The requester must provide sufficient detail to identify the record and the requester, state the form of access required, and give an email or postal address for our reply. Under section 53 of PAIA, the requester must also identify the right they are seeking to exercise or protect and explain why the record is required for that purpose.
4. Requests on behalf of another person must be accompanied by proof of the capacity in which the requester is acting.
5. Pay the request fee (see section 9). Our response time starts once the request fee has been paid, where it is payable.

Response time. We will decide on a request within 30 days of receiving it and will notify the requester of our decision. We may extend this period once, by up to a further 30 days, where section 57 of PAIA permits it, and we will notify the requester of the extension and the reasons for it.

Third parties. If a request concerns a record containing information about a third party, we will notify that third party as required by section 71 of PAIA and consider any representations before deciding.

Requests for your own personal information. A data subject may ask us, free of charge, to confirm whether we hold personal information about them. Requests for access to that personal information are handled under section 23 of POPIA and this manual. Requests to correct or delete personal information may be made on Form 2 prescribed under the POPIA Regulations, and objections to processing on Form 1, although we will also accept a clear written request.

9. Fees

The following fees apply to requests to private bodies, as prescribed under the PAIA Regulations and published by the Information Regulator. Fees are subject to change by regulation.

If a request is refused, any deposit paid will be refunded. Access will be given only once all applicable fees have been paid.

10. Grounds for refusal of access

We may, and in some cases must, refuse access to a record on the grounds set out in Part 3, Chapter 4 of PAIA, including where access would:

• involve the unreasonable disclosure of personal information about a third party (section 63);
• disclose a third party's trade secrets or confidential commercial, financial, scientific or technical information (section 64);
• breach a duty of confidence owed to a third party under an agreement (section 65);
• endanger the life or physical safety of an individual, or prejudice the security of property or systems (section 66);
• disclose records privileged from production in legal proceedings (section 67);
• disclose VukaHustle's own trade secrets or commercial, financial or technical information whose disclosure would likely harm our commercial or financial interests (section 68); or
• disclose research information of VukaHustle or a third party where disclosure would expose the researcher or the subject of the research to serious disadvantage (section 69).

If the record cannot be found or does not exist, we will notify the requester by affidavit or affirmation as required by section 55 of PAIA.

Despite these grounds, we must grant access where disclosure would reveal evidence of a substantial contravention of, or failure to comply with, the law, or an imminent and serious public safety or environmental risk, and the public interest in disclosure clearly outweighs the harm (section 70).

11. Remedies

VukaHustle does not have an internal appeal procedure. A requester or third party who is dissatisfied with our decision may, within 180 days of being notified of it:

• lodge a complaint with the Information Regulator under section 77A of PAIA (PAIAComplaints@inforegulator.org.za); or
• apply to a court with appropriate jurisdiction for relief under section 78 of PAIA.

12. Availability and updating of this manual

This manual is available:

• on our website at vukahustle.com;
• at our office at Dynamic Technologies House, 2 Venus Rd, Melrose Estate, Johannesburg, South Africa, for inspection during normal business hours; and
• from the Information Regulator, on request.

A copy may be requested from the Information Officer free of charge, or for the prescribed reproduction fee for a printed copy. We will review and update this manual regularly, and whenever our records, processing activities or contact details change.

Approved by: Mr G. Schoeman, Information Officer, UlulaLabs (Pty) Ltd
Date: 09 October 2026

---

UlulaLabs (Pty) Ltd t/a VukaHustle | Reg. 2026/107064/07 | Dynamic Technologies House, 2 Venus Rd, Melrose Estate, Johannesburg, South Africa | hello@vukahustle.com | +27 010 040 1090 | vukahustle.com