1. Introduction and Legal Basis

BridgeFin Solutions (Pty) Ltd ("BridgeFin") is a private body for purposes of PAIA. This Manual has been prepared in accordance with section 51 of PAIA and should be read together with POPIA, the PAIA Regulations and other applicable South African law.

PAIA gives effect to the constitutional right of access to information. A requester seeking a record of a private body must satisfy the requirements of PAIA, including showing that the record is required for the exercise or protection of a right, complying with the prescribed procedure, and establishing that access is not lawfully refused.

This Manual is intended to promote transparency while preserving confidentiality, legal privilege, commercial sensitivity, data protection and the rights of third parties.

2. Purpose and Scope

This Manual explains the categories of records held by BridgeFin and the procedures by which a person may request lawful access to those records. It also describes BridgeFin’s processing of personal information for purposes of POPIA and provides a general description of the security safeguards used to protect information.

• records that may be available without a formal PAIA request;
• records maintained in terms of applicable legislation;
• categories of records and information held by BridgeFin;
• how to submit a PAIA access request;
• fees, timeframes and possible grounds for refusal;
• how BridgeFin processes personal information;
• categories of recipients of personal information;
• planned transborder information flows; and
• general information-security safeguards.

3. Definitions

Data Subject: A person to whom personal information relates, as defined in POPIA.

Information Officer: The person responsible for BridgeFin’s duties under PAIA and POPIA.

Deputy Information Officer: A duly designated person who assists with PAIA and POPIA responsibilities.

Operator: A person who processes personal information for BridgeFin in terms of a mandate or contract without being under BridgeFin’s direct authority.

PAIA: The Promotion of Access to Information Act 2 of 2000, as amended.

Personal Information: Information relating to an identifiable living natural person and, where applicable, an identifiable existing juristic person, as defined in POPIA.

POPIA: The Protection of Personal Information Act 4 of 2013.

Record: Recorded information in any form or medium in BridgeFin’s possession or under its control, whether or not created by BridgeFin.

Requester: A person seeking access to a record in terms of PAIA.

Responsible Party: The person who determines the purpose of and means for processing personal information, as defined in POPIA.

Regulator: The Information Regulator of South Africa.

4. Details of the Private Body

5. Information Officer and Deputy Information Officer

BridgeFin has confirmed Nancy as its legally appointed and registered Information Officer and Deputy Information Officer for purposes of PAIA and POPIA.

All PAIA access requests, POPIA data-subject requests, objections, correction requests and related privacy correspondence should be submitted to the above email address.

6. Information Regulator PAIA Guide

The Information Regulator publishes a PAIA Guide explaining how PAIA may be used, the prescribed forms, fees, remedies and complaint procedures. The current Guide and prescribed forms are available from the Information Regulator’s official PAIA resources at inforegulator.org.za.

A person who requires assistance identifying the appropriate procedure may also contact BridgeFin’s Information Officer.

7. Records Automatically Available

The following categories may be available without a formal PAIA request, subject to applicable law, confidentiality and the terms on which they are published:

8. Records Maintained Under Other Legislation

BridgeFin may maintain records in terms of legislation that applies to its activities. The inclusion of an Act below does not mean that every provision applies to every BridgeFin activity.

9. Categories of Records Held by BridgeFin

9.1 Corporate and governance records

• incorporation and registration records
• Memorandum of Incorporation and statutory records
• director and governance records
• resolutions, policies and delegations
• corporate correspondence and insurance records

9.2 Finance and accounting records

• banking and accounting records
• invoices, receipts, journals and reconciliations
• management accounts and financial statements
• tax and statutory financial records
• fees, interest and settlement records
• debtor and creditor records

9.3 Bridging-finance application records

• draft and submitted applications
• supporting documents and applicant information
• assessment, review and risk records
• approval, decline and further-information records
• quotes, calculations and transaction histories

9.4 Seller Bridging records

• seller and property information
• sale and transfer information
• municipal clearance and compliance requirements
• approved transaction-related expenses
• funding, repayment and settlement records

9.5 Estate Agent Commission Bridging records

• estate agent and agency information
• sale and commission information
• commission statements, mandates and transfer records
• applications, approvals, funding and settlement information

9.6 Property and conveyancing records

• property descriptions and title-related information
• purchase price and transfer information
• bond and cancellation information
• deeds-office, lodgement and registration information
• expected proceeds and transaction-status information

9.7 Attorney and law-firm records

• firm registrations and contact details
• branches, attorneys, secretaries and authorised staff
• firm codes, subcodes, roles and permissions
• onboarding, applications, matters and communications

9.8 Client, FICA and compliance records

• identity and contact information
• proof of address and banking details
• company, trust and authority-to-act documentation
• beneficial ownership and verification information where applicable
• risk and compliance records

9.9 Agreements and e-signature records

• finance agreements and terms
• mandates, undertakings and amendments
• electronic-signature authentication and audit trails
• signed documents and completion records

9.10 Funding, repayment and settlement records

• approved amounts and payment instructions
• payment confirmations and proofs of payment
• repayment and allocation records
• settlement requests, calculations and confirmations

9.11 Portal and technology records

• user accounts, roles and permissions
• authentication, login and session records
• system events and audit trails
• application, document and status activity
• notifications, integration logs and support records

9.12 Privacy, PAIA and security records

• PAIA and POPIA policies
• data-subject requests and objections
• access requests and decisions
• privacy assessments and operator arrangements
• security incidents, logs and investigations

9.13 Suppliers, employees and professional advisers

• supplier contracts and banking records
• service-level and confidentiality agreements
• employment, payroll and personnel records where applicable
• professional-adviser correspondence

9.14 Marketing and communications records

• website enquiries
• professional contacts and communications
• consent and opt-out records
• public brochures and marketing materials

10. Procedure for Requesting Access

A requester seeking access to a BridgeFin record must submit the prescribed PAIA Form 2 - Request for Access to Record, or such replacement form as may be prescribed by law from time to time.

The requester must provide sufficient information to identify the requester and the record, indicate the form in which access is required, identify the right to be exercised or protected, and explain why the requested record is required for that purpose.

Requests must be submitted electronically to: nancy@bfsolutions.co.za

Complete the prescribed request form accurately and completely.

Identify the record or category of records sought with sufficient detail.

State the right that the requester seeks to exercise or protect.

Explain why the requested record is required for that purpose.

Indicate the preferred form of access.

Attach proof of identity and, where applicable, proof of authority to act for another person.

Submit the request to the Information Officer.

Pay any prescribed fee if required by law.

11. Identity, Authority and Personal Requests

11.1 Requests for a requester’s own personal information

BridgeFin may require reasonable proof of identity before releasing personal information. This safeguard protects information from unauthorised disclosure.

11.2 Requests made on behalf of another person

Where a request is made for another natural person, company, trust, estate, minor, legal practice or other entity, BridgeFin may require written authority, proof of appointment or other evidence establishing the requester’s authority.

12. Fees

BridgeFin will apply the fees prescribed under PAIA and the applicable regulations. Depending on the request, fees may relate to reproduction, preparation, search time, copies, electronic media or other prescribed items.

Where a prescribed fee is payable, BridgeFin may require payment before continuing with the request or providing access. BridgeFin will not publish fixed fee amounts in this Manual because statutory fees may change.

13. Timeframes and Decisions

BridgeFin will process a valid PAIA request within the statutory period prescribed by PAIA. A decision is ordinarily required within 30 days after receipt of a properly completed request, subject to any lawful extension.

BridgeFin will notify the requester whether access is granted, partially granted or refused and will provide reasons where required by law. If access is granted, BridgeFin may specify the form of access and any prescribed fees payable.

14. Grounds for Refusal

Access is not automatic. BridgeFin may or must refuse access where a ground for refusal under PAIA applies. These may include:

• unreasonable disclosure of personal information of a third party;
• confidential commercial or financial information of a third party;
• information supplied in confidence;
• information that could endanger the safety of a person, property or security system;
• records protected by legal professional privilege;
• BridgeFin trade secrets, confidential financial information or commercially sensitive information;
• research or proprietary information protected by PAIA;
• records whose disclosure is prohibited or restricted by law; and
• any other mandatory or discretionary ground for refusal recognised by PAIA.

BridgeFin will not use refusal provisions merely to avoid legitimate access rights.

15. Severability and Third-Party Notifications

15.1 Severability

Where a record contains information that may be disclosed together with information that must or may lawfully be withheld, BridgeFin may provide access to the disclosable portion and redact or withhold the protected portion.

15.2 Third-party consultation

Where a request concerns a third party and PAIA requires or permits third-party notification, BridgeFin may notify the affected party, receive representations and consider those representations before deciding the request.

15.3 Records not found

If BridgeFin conducts a reasonable search and cannot locate a requested record, or reasonably believes the record does not exist, the Information Officer will deal with the request in the manner required by PAIA.

16. Remedies and Complaints

There is generally no internal appeal procedure against the decision of a private body under PAIA. A requester who is dissatisfied with a decision, or who does not receive a response within the statutory period, may lodge a complaint with the Information Regulator and may seek relief from a competent court where permitted by law.

Current PAIA forms and complaint procedures are available from the Information Regulator at inforegulator.org.za.

17. Protection of Personal Information - POPIA

BridgeFin processes personal information as part of its property-transaction bridging-finance activities. BridgeFin will process personal information only for lawful, specific and compatible purposes and subject to the safeguards required by POPIA.

The detailed rules governing BridgeFin’s collection, use, disclosure, retention and security of personal information are contained in BridgeFin’s Privacy and POPIA Policy, which should be read with this Manual.

18. Categories of Data Subjects and Information

19. Purposes of Processing

• responding to enquiries and registering legal practices;
• creating and administering authorised user accounts;
• receiving, assessing and managing bridging-finance applications;
• verifying information and requesting supporting documentation;
• processing Seller Bridging and Estate Agent Commission Bridging matters;
• preparing quotes, agreements and transaction documentation;
• facilitating electronic signatures;
• making, administering and recording funding;
• monitoring property transactions and settlement events;
• receiving, allocating and reconciling repayments;
• maintaining accounting, tax, legal, audit and compliance records;
• detecting fraud and protecting systems and funds;
• dealing with disputes and exercising or defending legal rights;
• communicating with attorneys, applicants, suppliers and professional advisers;
• complying with lawful regulatory, statutory or court requirements; and
• maintaining security logs, audit trails and operational records.

20. Recipients of Personal Information

Where lawful and necessary, personal information may be disclosed to categories of recipients including:

• participating attorneys and conveyancing practices;
• authorised BridgeFin personnel;
• banks and payment providers;
• accounting systems, accountants and auditors;
• electronic-signature providers;
• hosting, cloud-storage and technology providers;
• identity, verification and compliance service providers where applicable;
• authorised credit-information providers where applicable;
• fraud-prevention and cyber-security providers;
• legal advisers, debt-recovery providers and professional advisers;
• courts, tribunals, law-enforcement agencies, regulators and statutory bodies where lawful; and
• other recipients where disclosure is required or authorised by law or necessary for a lawful contractual purpose.

BridgeFin does not sell personal information as a commercial product.

21. Planned Transborder Flows

BridgeFin may use technology, cloud, email, electronic-signature, security, analytics or software providers whose infrastructure is located outside South Africa. Personal information may therefore be stored, backed up, transmitted, processed or accessed outside the Republic where lawful and necessary.

BridgeFin will take reasonable steps to ensure that any cross-border transfer complies with POPIA, including through adequate protection, binding agreements, contractual safeguards, consent where appropriate, contractual necessity or another lawful basis.

22. Information Security Safeguards

BridgeFin recognises that its activities may involve highly sensitive identity, FICA, financial and property-transaction information. Appropriate safeguards may include:

• HTTPS/SSL and secure transmission;
• role-based access control and least-privilege permissions;
• unique user accounts and multi-factor authentication where appropriate;
• strong password and session controls;
• private and restricted document storage;
• secure API and integration credentials;
• web-application firewall and brute-force protection;
• malware and vulnerability monitoring;
• activity logs and audit trails;
• security updates and change management;
• backups and recovery procedures;
• confidentiality and operator agreements;
• incident-response procedures; and
• periodic security and access reviews.

Security measures are reviewed in light of changing technology, risks and the sensitivity of the information processed.

23. Records Relating to the BridgeFin Portal

The BridgeFin portal may contain records relating to law firms, users, roles, permissions, applications, client information, property matters, supporting documentation, agreements, electronic signatures, funding, repayments, settlements, notifications, user activity, audit history and security events.

The existence of a record in the portal does not mean that a requester is automatically entitled to access it. Access remains subject to PAIA, POPIA, confidentiality, contractual obligations, legal privilege and third-party rights.

24. Confidentiality and Legal Privilege

BridgeFin recognises that information supplied by attorneys and law firms may contain confidential client information and legally privileged material. Nothing in this Manual waives legal professional privilege, contractual confidentiality, privacy rights, POPIA protections or any lawful ground for refusing access under PAIA.

A PAIA request is not a mechanism through which one party automatically acquires another party’s confidential transaction file.

25. Availability of this Manual

This Manual will be made available in accordance with PAIA:

• on BridgeFin’s website at bfsolutions.co.za;
• for inspection at BridgeFin’s physical address during reasonable business hours, subject to prior arrangement; and
• by electronic request to nancy@bfsolutions.co.za.

No fee will be charged merely to inspect the Manual. Any fee for copies will be subject to the applicable statutory rules.

26. Updating the Manual

BridgeFin will review and update this Manual on a regular basis and when reasonably necessary due to changes in law, regulatory guidance, services, technology, processing activities, service providers, security measures, record categories or responsible officers.

The current version published by BridgeFin replaces earlier versions.

27. Contact for PAIA and POPIA Matters

All PAIA requests, requests for access to personal information, privacy enquiries, correction or deletion requests, objections and related correspondence should be directed to:

Nancy
Information Officer / Deputy Information Officer
nancy@bfsolutions.co.za

Annexure A - PAIA Request Checklist

Before submitting a request, a requester should ensure that the following are included:

• the current prescribed Form 2 or equivalent prescribed request form;
• full requester details and reliable contact details;
• sufficient particulars of the record requested;
• the preferred form of access;
• identification of the right to be exercised or protected;
• an explanation of why the record is required for exercising or protecting that right;
• proof of identity;
• proof of authority where acting for another person; and
• payment of any fee lawfully requested.

Prescribed PAIA forms should be obtained from the Information Regulator’s current official PAIA resources to ensure the latest version is used.

Annexure B - Record Categories Summary

Legal basis note: This Manual was prepared with reference to section 51 of PAIA, the applicable PAIA Regulations, POPIA and the Information Regulator’s current private-body PAIA guidance and prescribed forms as available in September 2026. If the law or prescribed forms change, the current legal requirements prevail.