South Africa PAIA Manual

·SFDC SOUTH AFRICA PROPRIETARY LIMITED /SFDC IRELAND LIMITED (collectively "SALESFORCE")

·(A PRIVATE BODY)

·MANUAL PREPARED IN ACCORDANCE WITH SECTION 51 OF THE PROMOTION OF ACCESS TO INFORMATION ACT 2 OF 2000

·Contents

11. Introduction and Application

·This Manual has been compiled in accordance with the requirements of the Promotion of Access to Information Act 2 of 2000 (PAIA) and the Protection of Personal Information Act 4 of 2013 (POPIA) in respect of SFDC South Africa Proprietary Limited and SFDC Ireland Limited, which are wholly owned subsidiaries of Salesforce, Inc. (collectively Salesforce).

·This Manual facilitates requests for access to records of Salesforce as provided for in sections 53 and 54 of PAIA and sets out how to access Personal Information held by Salesforce in terms of sections 23 and 25 of POPIA.

·This Manual will be updated from time to time or at such intervals as may be necessary in accordance with the requirements of section 51(2) of PAIA. As soon as any amendments are affected, the latest version of this Manual will be published and distributed in accordance with the requirements of section 51(3) of PAIA.

·A Requester is invited to contact the Information Officer should they require any assistance in respect of the use or content of this Manual.

·The definitions provided in this Manual are solely for the purpose of this Manual and are not to be construed as applicable to PAIA.

·PROMOTION OF ACCESS TO INFORMATION MANUAL FOR SALESFORCE

22. Definitions

·In this Manual, the following words have the meaning set out below:

33. Contact details (section 51(1)(a)(i) of PAIA)

·Marc Benioff has designated David Dempsey as the Information Officer, and Lindsey Finch as the Deputy Information Officer in terms of section 56 of POPIA.

·Lindsey Finch (EVP, AI, Global Privacy, Product & Engineering, Cybersecurity, Marketing Legal) is the Deputy Information Officer, who is registered for this purpose in terms of section 55(2) of POPIA. Requests for access to records or Personal Information in terms of either PAIA or POPIA should be addressed to the Information Officer using the following contact details, indicating that you reside in South Africa: Physical address & Postal address: 415 Mission St, 3rd Floor, San Francisco, CA 94105, USA Email: privacy@salesforce.com

• 44. Section 10 Guide on how to use PAIA (section 51(1)(b)(i) of PAIA)

·The Information Regulator has made available a Guide to assist persons wishing to exercise any rights in terms of PAIA, as required in terms of section 10(1) of PAIA.

·Any person wishing to obtain the Guide may access it through the website of the Information Regulator here or upon request to the Information Regulator.

·Any queries may be directed to:

·The Information Regulator

·Address:

·Woodmead North Office Park 54 Maxwell Dr Woodmead Johannesburg 2191 Telephone: 010 023 5200 Toll Free: 0800 017 160 Email: enquiries@inforegulator.org.za

·Alternatively, the Information Officer has a copy of the Guide available in at least two of the official languages in South Africa at its address available for inspection, at no fee, during normal working hours (regulation 3(3) of the PAIA Regulations). Members of the public can also inspect or make copies of the Guide from the offices of the Information Regulator, at no fee, during normal working hours (regulation 2(3) of the PAIA Regulations).

• 55. Records available in terms of any other legislation (section 51(1)(b)(iii) of PAIA)

·Certain records held by Salesforce are available in terms of legislation other than PAIA. The specific records which are available in terms of such legislation are set out therein and these records may in certain instances only be accessed by the persons specified in the relevant legislation. The legislation includes:

• ·Basic Conditions of Employment Act 75 of 1997 Companies Act 71 of 2008
• ·Compensation for Occupational Injuries and Diseases Act 130 of 1993 Income Tax Act 58 of 1962 Labour Relations Act 66 of 1995 Medical Schemes Act 131 of 1998
• ·Occupational Health and Safety Act 85 of 1993 Pension Funds Act 24 of 1956 Skills Development Levies Act 9 of 1999 Unemployment Insurance Act 63 of 2001
• ·Unemployment Insurance Contributions Act 4 of 2002 Value Added Tax Act 89 of 1991
• ·Description of the subjects on which Salesforce holds records and the categories of records held on each subject (section 51(1)(b)(iv) of PAIA)

·The following is a non-exhaustive list of the subjects on which Salesforce holds records and the broad categories into which these records fall. The procedure in terms of which such records may be requested from Salesforce is set out in Section 9 of this Manual. The records listed below will not in all instances be provided to a Requester who requests them in terms of PAIA. The Requester must show that they have the right in terms of PAIA to be given access to the records in question.

·Categories of records

·Description of records held

·Administration

·Management

·Finance

·Human Resources

• ·Share register Minutes of shareholder meetings Directors' records Minutes of board meetings Shareholder records Internal correspondence
• ·Resolutions of the directors of Salesforce Accounting records Tax records Auditors' reports Annual financial statements Bank statements
• ·Invoices issued in respect of debtors and billing information List of Employees Statistics regarding Employees Employment contracts Conditions of employment
• ·Curriculum vitae of Employees, including qualifications
• ·Information relating to prospective employees, including their curriculum vitae
• ·Personnel records including personal details, disciplinary records, performance and internal evaluation records Employee tax information
• ·Records of Unemployment Insurance Fund contributions

·Suppliers

• ·Records regarding group life assurance and disability income protection Pension fund records Payroll records Health and safety records Workplace skills plans Codes of conduct Disciplinary code and procedure Grievance procedure Appeal procedure Remuneration policy
• ·Internal policies and procedures regarding dismissals, performance appraisal, recruitment, selection, advertising of positions, appointments, retirement, promotions, leave, extended sick leave, study leave, adoption leave and benefits, salaries, overtime, bonuses, medical aid, health and safety, broad-based black economic empowerment (B-BBEE), procurement, loans, working parents, smoking, use of company resources including telephones, motor vehicles and computers, sexual harassment, and HIV/Aids. Training schedules and material Correspondence relating to personnel Lists and details of suppliers

·Information Technology

• ·Records regarding computer systems

·Property

·Miscellaneous

• ·Support and maintenance information
• ·Lease information in respect of immovable property Records regarding property insurance Internal correspondence Salesforce publications

77. Processing of Personal Information by Salesforce (section 51(1)(c) of PAIA)

·Details about the Processing of Personal Information undertaken by Salesforce are set out in Annexure A.

88. Categories of records which are available without request (section 51(1)(b)(ii) of PAIA)

·In accordance with section 52(1) of PAIA, Salesforce has elected not to make any records automatically available without a person having to request access in terms of PAIA.

99. Request procedure in terms of PAIA (section 53 of PAIA)

·A request for access to records held by Salesforce in terms of section 50 of PAIA must be made in the prescribed form (section 53(1) of PAIA). A copy of the form is available here: 'PAIA Manual Form 2 - Request for Access to Record: (https://inforegulator.org.za/wp-content/uploads/2020/07/InfoRegSA-PAIA-Form02-Reg7.pdf) The request must be made to Salesforce at the address, or email address, specified in Section 3 of this Manual above.

·A Requester must provide sufficient detail on the prescribed form to allow Salesforce to identify the record or records which have been requested and the identity of the Requester (section 53(2) of PAIA). If a request is made on behalf of another person or entity, the Requester must submit details and proof of the capacity in which the Requester is making the request, which must be reasonably satisfactory to Salesforce (section 53(2)(f) of PAIA). The Requester is also required to indicate the form of access to the relevant records that is required, and to provide their contact details in the Republic of South Africa (sections 53(2)(b) and (c) of PAIA).

·The Requester must identify the right that they are seeking to exercise by accessing records held by Salesforce and must explain why the particular record or records requested is or are required for the exercise or protection of that right (section 53(2)(d) of PAIA).

·Salesforce may, and must in certain instances, refuse access to records on any of the grounds set out in Chapter 4 of Part 3 of PAIA, which include:

• ·that access would result in the unreasonable disclosure of Personal Information about a third party,
• ·to protect the commercial information of a third party or of Salesforce itself,
• ·that it is necessary to protect the confidential information of a third party or of Salesforce itself,
• ·to protect the safety of individuals or property,
• ·that a record constitutes privileged information for the purpose of legal proceedings, and
• ·to protect the research information of a third party or Salesforce itself.

·Access to documents may also be refused on the basis of professional privilege.

·All data, documents and/or information received by the Requestor from Salesforce, its service providers or agents may only be used for the purposes for which it is provided. Such data, documents and/or information may not be retained or utilised in any format or for any other purpose. Upon completion of the purpose for which the data, documents and/or information were requested, the Requestor must certify in writing and within seven days of completion of the purpose, that it has duly destroyed such data, documents and/or information. Requestors are required to use reasonable means to prevent unauthorized disclosure and to protect the confidentiality of data, documents and/or information provided to them by Salesforce, its service providers or agents.

·Salesforce is required to inform a Requester in writing of its decision in relation to a request (section 56 of PAIA). If the Requester wishes to be informed of Salesforce's decision in another manner as well, this must be set out in the request and the relevant details must be included, to allow Salesforce to inform the Requester in the preferred manner.

·Salesforce will make a decision in relation to a request for records within 30 days of receiving it, unless third parties are required to be notified of the request or the 30-day period is extended as provided for in PAIA. Salesforce will notify the Requester if the 30-day period for processing a request is to be extended.

·Where a request is refused, a Requester may, within 180 days of exhausting the Information Regulator's complaint procedure, apply to the High Court of South Africa for an order compelling the record or records requested to be made available to the Requester or for another appropriate order. The High Court will determine whether the records should be made available or not.

1010. Fees payable (section 54 of PAIA read with regulation 8 and Annexure B of the PAIA Regulations)

·PAIA mandates two distinct types of fees that may apply to your request:

• 11. Request Fee: A standard, flat fee. The Requestor (other than a personal requestor) must pay before submitting the request. Proof of payment must be attached to the PAIA Access Request Form upon submission.
• 22. Access Fee: Charged only if the Requestor's request is granted. This fee covers the actual costs of reproduction, postal delivery, and the time spent searching for and preparing the record.

·Deposits, Refunds, and Withholding

• ·Fee Deposits: If searching for and preparing the Requestor's records is expected to take longer than the legally prescribed baseline hours, Salesforce will require a deposit (a portion of the total estimated access fee) before proceeding.
• ·Refunds: If the Requestor pays a deposit and the request is ultimately refused by Salesforce, the Requestor may ask for a refund of the deposit in full.
• ·Withholding Records: Salesforce reserves the right to withhold access to any requested records until all applicable prescribed fees have been paid.

·Official Rates: Information Regulator's PAIA Regulations.

1111. Request procedure in terms of POPIA (sections 23 and 25 of POPIA)

·A request for access to Personal Information in terms of section 23 of POPIA must be made to Salesforce at the address, or email address, specified in Section 3 of this Manual above and read with Annexure A of this Manual (section 25 of POPIA).

·No fee is payable where a Requester asks Salesforce to confirm whether or not Salesforce holds their Personal Information (section 23(1)(a) of POPIA).

·A prescribed fee, if any, as set by the Minister after consultation with the Information Regulator, may be payable if a Requester asks for a copy of the Personal Information held by Salesforce, or a description of the records held by Salesforce that contain the Requester's Personal Information (section 23(1)(b)(ii), read with section 111(1)(a) of POPIA). Salesforce must give the Requester a written estimate of the fee beforehand and may require the Requester to pay a deposit for all or part of the estimated fee (section 23(3) of POPIA).

1212. Information or records not found (section 55 of PAIA)

·If all reasonable steps have been taken to find a record that is requested under PAIA, and the requested record cannot be found or does not exist, then Salesforce will notify the Requester, by way of an affidavit or affirmation, that it is not possible to give access to the requested record.

·The affidavit or affirmation will provide a full account of all the steps taken to find the record or to determine the existence thereof, including details of all communications by Salesforce with every person who conducted the search.

·If the record in question should later be found, the Requester will be given access to the record in the manner stipulated by the Requester unless access is refused by Salesforce as permitted by PAIA (and as provided for in Section 9 of this Manual above).

1313. Information requested about a third party (Chapter 5 of Part 3 of PAIA)

·Where any information that relates to a third party is requested in terms of PAIA from Salesforce, Salesforce is required to notify the third party of the request (section 71 of PAIA). The third party has an opportunity to grant their consent to the disclosure of the record or to make representations as to why the requested record should not be disclosed to the Requester (section 72 of PAIA). If Salesforce decides to grant access to the record, it will notify the affected third party again (section 73 of PAIA). The third party is entitled to apply to the High Court in relation to that decision. The High Court will then determine whether the record should be disclosed by Salesforce.

1414. Other prescribed information (section 51(1)(a)(ii) of PAIA)

·The Minister has not prescribed that any further information must be contained in this Manual.

·ANNEXURE A: PROCESSING OF PERSONAL INFORMATION

·Salesforce takes the privacy and protection of Personal Information seriously and will only Process Personal Information in accordance with POPIA or any other applicable legislation which deals with privacy rights. Accordingly, the relevant privacy conditions and requirements relating to the Processing of Personal Information (including, but not limited to, the collection, handling, transfer, sharing, correction, storage, archiving and deletion of Personal Information) will be applied to any Personal Information Processed by Salesforce.

·Purpose of Processing Personal Information

·Salesforce uses the Personal Information under its care in the following non-exhaustive ways:

• ·Staff administration, including HR management, recruitment and workplace health and safety
• ·Keeping of accounts and records including financial requirements
• ·Compliance with obligations under applicable laws and other regulations
• ·Furtherance of business activities including general corporate governance and administration To participate in procurement processes For client registration processes
• ·Information technology and information security processing purposes

·Non-exhaustive Categories of Data Subjects and their Personal Information that Salesforce Processes

·Contractors

·Employees/Directors

• ·Beneficiaries; Ultimate beneficial owners
• ·Names of contact persons;
• ·Name of legal entity;
• ·Physical and postal address and contact details;
• ·role;
• ·Financial information;
• ·Registration number;
• ·Founding documents; Tax related information
• ·Authorized signatories;
• ·Beneficiaries; Ultimate beneficial owners
• ·Gender;

·Job candidates

• ·Pregnancy;
• ·Marital status;
• ·Race;
• ·Nationality;
• ·Age;
• ·Language;
• ·Education information;
• ·Financial information;
• ·Employment history;
• ·Identifiers e.g. passport, ID number;
• ·Physical and postal address;
• ·Contact details;
• ·Opinions;
• ·Criminal behavior; Well-being
• ·Employee workplace information such as photographs, videos, and information about access, use and authentication to Salesforce's computers, network, or physical facilities. Contact details

·Office visitors

• ·Interview process details Contact details

·Marketing contacts

• ·Contact details
• ·Employment information such as role and company name

·Categories of recipients to whom Personal Information may be supplied

·Salesforce may supply the Personal Information to, or share the Personal Information with, the following recipients:

• ·Salesforce affiliates;
• ·Management and Employees;
• ·Contractors, service providers or business partners;
• ·Operators;
• ·Stakeholders and shareholders;
• ·Law enforcement agencies and regulators; Financial institutions

·Salesforce will conclude appropriate agreements with any Operators or other service providers that Process Personal Information on its behalf, to require such Operators and/or service providers to protect any Personal Information in compliance with the requirements of POPIA.

·Salesforce does not share the Personal Information of its Data Subjects with any third parties, except if:

• ·It or the third party has a legitimate interest in the Personal Information being shared;
• ·It is necessary to conclude or implement a contract with a Data Subject;
• ·It is obliged to provide such information for legal or regulatory purposes;
• ·It is required to do so for purposes of existing or future legal proceedings;
• ·It is involved in the prevention of fraud, loss, bribery or corruption;
• ·The third party performs services and Processes Personal Information on Salesforce's behalf as its Operator.

·Salesforce will send its Data Subjects appropriate notifications or communications of its Processing of their Personal Information if it is obliged to do so by law, or in terms of its contractual relationship with Data Subjects.

·Actual or planned transfers of Personal Information outside of South Africa

·The personal information we collect and process may be transferred to and stored at a destination outside South Africa. The recipients of this personal information are typically our group companies and third-party service providers located in various countries.

·Salesforce takes steps to ensure that Operators in foreign countries are bound by laws, binding corporate rules or binding agreements that provide an adequate level of protection of Personal Information and uphold the principles for reasonable and lawful processing of Personal Information, in terms of section 72 of POPIA.

·Salesforce has appropriate contracts in place with any Operators and service providers to ensure that Personal Information is appropriately secured.

·Salesforce ensures that any such transborder flow of personal information is done in compliance with the requirements of section 72 of POPIA.

·General description of information security measures implemented by Salesforce

·Salesforce employs up-to-date technology to ensure the confidentiality, integrity and availability of the Personal Information under its care Such measures may include, but are not limited to:

• ·Firewalls;
• ·Secure web gateways;
• ·Regular vulnerability scans of IT networks and systems;
• ·Cybersecurity awareness training for all Employees;
• ·Virus protection software and update protocols;
• ·Logical and physical access control;
• ·Secure setup of hardware and software making up the IT infrastructure

·Salesforce is committed to ensuring that these information security measures which protect the Personal Information are continuously reviewed and updated where necessary.