PAIA & POPIA Manual

Masoom Training Solutions (Pty) Ltd — administrators of the CRICE® Programme

1. About Masoom Training Solutions

Masoom Training Solutions (Pty) Ltd ("MTS", registration number 2011/000057/07, B-BBEE Level 1) administers the CRICE® Programme — Company Representative in the Clinical Environment — which credentials company representatives for access to participating South African healthcare facilities. This manual explains what records MTS holds, how to request access to them under PAIA, and how MTS processes personal information under POPIA.

2. Contact details and Information Officer

3. The Information Regulator's Guide (section 51(1)(b))

The Information Regulator has published a Guide on how to use PAIA, in all official languages. It is available from the Regulator at inforegulator.org.za, by email to the Regulator, or for inspection at the Regulator's office (details in section 9 below).

4. Records automatically available

The following records are available without a PAIA request:

• Public content of masoom.co.za and crice.co.za, including programme structure and pricing, FAQs and CABS information;
• The Privacy Notice (current version published at masoom.co.za/privacy-notice/);
• This PAIA Manual;
• Marketing and programme information brochures provided on request.

5. Categories of records held by MTS

6. Records held in terms of legislation

MTS holds records as required by, among others: the Companies Act 71 of 2008; the Income Tax Act 58 of 1962; the Value-Added Tax Act 89 of 1991; the Basic Conditions of Employment Act 75 of 1997; the Labour Relations Act 66 of 1995; the Unemployment Insurance Act 63 of 2001; the Compensation for Occupational Injuries and Diseases Act 130 of 1993; the Skills Development Act 97 of 1998; the Electronic Communications and Transactions Act 25 of 2002; PAIA; and POPIA.

7. Processing of personal information (POPIA)

7.1 Categories of data subjects and personal information

MTS does not collect identity numbers at all.

7.2 Purposes and legal bases

Hepatitis B vaccination status is special personal information (health information). MTS does not require any person to be vaccinated; no CR is obliged to give a medical reason for declining. Companies submit an access declaration only — not medical information.

7.3 Recipients of personal information

• The data subject's Point of Contact / employer;
• Facilities at which the CR checks in;
• Trusted service providers under written agreements.

MTS does not sell, rent, licence or barter personal information.

7.4 Cross-border transfers and hosting

CRICE is hosted on Amazon Web Services in the Africa (Cape Town) region, keeping personal information within South Africa. Where any transfer to a third party is necessary, MTS obtains written assurances requiring a level of protection equivalent to its own.

7.5 Retention

7.6 Security measures

MTS applies reasonable technical and organisational measures to secure personal information, including access control, encryption in transit, hosting within the AWS Africa (Cape Town) region, and contractual safeguards with service providers.

7.7 Data subject rights

Data subjects may request details of the personal information MTS holds about them, request correction or deletion, object to processing, withdraw consent, and complain to the Information Regulator. Requests go to info@masoom.co.za.

8. How to request access to records

1. Complete Form 2 (Request for Access to Record) prescribed under the PAIA Regulations, available from inforegulator.org.za.
2. Submit it to the Information Officer at info@masoom.co.za or the postal address in section 2, providing sufficient particulars, the form of access required, and proof of identity (and authority, if requesting on another's behalf).
3. Pay the prescribed request fee and, where applicable, access and reproduction fees per the fee schedule in Annexure 4 of the PAIA Regulations (currently a R140.00 request fee for private bodies, with per-page and search/preparation fees as prescribed — confirm current amounts with the Regulator).
4. MTS will respond within 30 days as required by PAIA, subject to lawful extension or refusal grounds, which will be given in writing.

9. Complaints and the Information Regulator

Complaints may be lodged with MTS at info@masoom.co.za, or with the Information Regulator (South Africa):

JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001
PO Box 31533, Braamfontein, 2017
inforegulator.org.za

10. Learnership programmes — candidates, mentors and coaches

In addition to the CRICE® Programme, MTS recruits for and administers accredited learnership programmes, including the Medical Sales Representative Learnership (Unit Standard 63669). Applications are made through medsalesrep.co.za. This section describes the records held for that activity.

Whose information we hold

• Learnership candidates — people accepted onto and enrolled in a learnership programme.
• Potential candidates — people who apply or register an interest but are not (or not yet) enrolled, including applicants who do not meet the minimum entrance requirements.
• Mentors and coaches — workplace mentors, coaches and assessors who support learners during the programme.
• Referees — the people a candidate nominates as references.

Information obtained from candidates and potential candidates (collected on the application form at medsalesrep.co.za):

• Application reference number, title, first name, middle name(s), surname and maiden name where applicable;
• Telephone number, cellphone number and email address;
• Residential address and postal address, with postal codes;
• Date of birth and identity number, and whether a certified copy of the SA identity document is held;
• Driver’s licence details;
• Home language, gender, race, disability status and socio-economic status — collected for statutory reporting to the Sector Education and Training Authority (SETA), for B-BBEE reporting and for employment-equity purposes;
• Highest tertiary qualification and other qualifications, education and work experience;
• Two references: referee name, contact number and email address;
• Programme records once enrolled: assessment and moderation results, attendance, portfolios of evidence, workplace logbooks, mentor and coach reports, and certification records.

Information obtained from mentors and coaches: name, employer, work contact number and work email address, professional registration or qualification where relevant, and the reports and assessments they complete for the learners they support.

Consent and legal basis. Learnership information is obtained directly from the data subject with their consent, given when the application form is submitted. Race, disability status and socio-economic status are collected only because SETA registration, B-BBEE verification and employment-equity reporting require them; where a candidate declines to provide them, MTS explains the consequence for the application rather than compelling disclosure. Processing is also necessary for the performance of the learnership agreement and to comply with the Skills Development Act and SETA requirements. Consent may be withdrawn at any time by writing to the Information Officer, subject to records MTS is obliged by law to retain.

Note on identity numbers. Identity numbers are collected for learnership candidates because SETA registration and certification require them. This differs from the CRICE® Programme, where identity numbers are not collected at all.

Who the information is shared with. The relevant SETA and the QCTO for registration, verification and certification; the employer or host workplace where a learner is placed; accredited assessors and moderators; and trusted service providers who host or support our systems. It is not sold or used for marketing.

Retention. Learner and assessment records are retained for five years, in line with SETA, QCTO and National Qualifications Framework record-keeping requirements, and thereafter destroyed or de-identified. Applications from potential candidates who are not enrolled are retained only for as long as the recruitment cycle requires, unless the applicant asks to be kept on file for future opportunities.

11. Availability of this manual

This manual is published at masoom.co.za and crice.co.za, and is available for inspection at the MTS offices during business hours. It is reviewed whenever the Privacy Notice materially changes, and at least annually.