VIRGIN ACTIVE SOUTH AFRICA (PTY) LTD

PROMOTION OF ACCESS TO INFORMATION MANUAL

Prepared in terms of section 51 of the Promotion of Access to Information Act 2 of 2000, as amended

Company registration number: 2005/041060/07

Information Regulator registration number: 2024-016067

CONTENTS

1. ACRONYMS AND ABBREVIATIONS

2. PURPOSE, LEGAL BASIS AND SCOPE

This Manual is issued by Virgin Active South Africa (Pty) Ltd (“VASA”) as a private body for purposes of section 51 of PAIA and as a responsible party for purposes of POPIA.

Each separate South African Virgin Active group company remains a separate private body and responsible party. A group company may adopt this Manual only if its exact legal name, company registration details, address, Information Regulator registration number, Information Officer and any Deputy Information Officer details are included in an entity-specific schedule or equivalent published manual.

This Manual is intended to help the public understand the records VASA holds, the records that are available without a formal request, how to request access to a record, the applicable fees, grounds on which access may be refused, available remedies, and how VASA processes personal information.

A requester seeking access to a record of a private body must comply with the procedural requirements of PAIA, show that the record is required for the exercise or protection of a right, and the request must not be refused under a ground of refusal in PAIA.

3. ABOUT VIRGIN ACTIVE SOUTH AFRICA

VASA operates health, fitness and wellness clubs and related member services in South Africa, including digital and mobile-app services, class bookings, membership administration, customer support, marketing, partner services and, where available, rewards and engagement programmes.

4. KEY CONTACT DETAILS FOR ACCESS TO INFORMATION

Information Officer:  Mark Lee Barrett

Appointment and registration: Appointed and authorised with effect from 14 May 2026; Information Regulator registration number 2024-016067; registration date 21 June 2024; certificate issued 14 May 2026.

Deputy Information Officer(s):  VASA may designate and register one or more Deputy Information Officers where necessary. Requests may be submitted directly to the Information Officer. Where a Deputy Information Officer is designated and registered, the current details will be reflected in the latest published version of this Manual.

5. GUIDE ON HOW TO USE PAIA

The Regulator has updated and made available a Guide on how to use PAIA. The Guide is available in all official languages and in Braille and explains the rights, procedures, forms, fees, remedies and assistance available under PAIA and POPIA.

The Guide and the prescribed PAIA forms may be obtained from the Regulator’s website. A requester may also ask VASA’s Information Officer for reasonable assistance with a request.

6. RECORDS AVAILABLE WITHOUT A FORMAL REQUEST

The following records are generally available without a formal PAIA request, subject to availability, applicable website terms and any lawful restriction:

The inclusion of a category above does not require VASA to create a record that does not exist, provide access to information that is no longer publicly available, or disclose information protected by law.

7. RECORDS AVAILABLE UNDER OTHER LEGISLATION

VASA maintains records required by or available under the following legislation, as amended and to the extent applicable to its operations. The list is indicative and not exhaustive:

8. SUBJECTS AND CATEGORIES OF RECORDS HELD

VASA holds records relating to the subjects below. Listing a category does not mean access will automatically be granted; every request is assessed under PAIA, including the grounds of refusal and third-party notification requirements.

9. PROCESSING OF PERSONAL INFORMATION

9.1 Purposes of processing

• administer memberships, club access, bookings, facilities and member services;
• operate websites, the App, digital services and rewards or engagement programmes;
• process payments, manage accounts, prevent fraud and recover lawful debts;
• provide fitness, wellness, health-adjacent and safety services where requested or required;
• communicate operational information and, where permitted, direct marketing;
• manage enquiries, complaints, disputes, requests and service quality;
• recruit, employ, remunerate, develop and manage employees and other workers;
• manage suppliers, partners, tenants, contractors, advisers and other business relationships;
• protect people, premises, systems and information, and investigate incidents;
• comply with law, regulatory requirements, litigation, audit, insurance and governance obligations; and
• analyse and improve services, operations and member experience, using aggregated or de-identified information where reasonably practicable.

9.2 Categories of data subjects and personal information

9.3 Recipients or categories of recipients

9.4 Transborder flows of personal information

VASA may transfer or permit access to personal information outside South Africa where group companies, shared-service teams, cloud or technology providers, professional advisers, commercial partners or other recipients are located outside the Republic. VASA will apply section 72 of POPIA and use an applicable transfer condition, such as adequate protection through binding contractual or corporate rules, consent where appropriate, necessity for a contract or the benefit of the data subject, or another lawful basis. Transfers will be limited to what is reasonably necessary and subject to security, access and onward-transfer controls.

9.5 General information-security measures

• role-based access controls, least-privilege access and authentication controls;
• encryption or other appropriate protection for data in transit and at rest;
• logging, monitoring, vulnerability management and security testing;
• back-up, resilience, disaster-recovery and business-continuity controls;
• operator due diligence, written processing terms and incident-notification requirements;
• information-classification, retention, deletion and secure-disposal controls;
• employee confidentiality, training and awareness; and
• incident response, investigation and notification processes.

Security measures are risk-based and are reviewed as systems, threats, technology and legal requirements change.

10. HOW TO REQUEST ACCESS TO A RECORD

10.1 A PAIA request must substantially correspond with Form 2 prescribed under regulation 7 of the PAIA Regulations. The requester must provide enough information to identify the requester, the requested record, the preferred form of access, the right to be exercised or protected, and why the record is required for that purpose.

10.2 The request must be submitted to the Information Officer using the contact details in section 4. A requester acting on behalf of another person must provide satisfactory proof of authority.

VASA may ask for proportionate proof of identity or authority to prevent unauthorised disclosure. A certified identity document will not be required automatically where identity can be verified by a less intrusive method. Where a request is incomplete, VASA will provide reasonable assistance to enable the requester to correct it.

10.3 A data subject seeking access to their own personal information may also make a request under section 23 of POPIA. Requests to object to processing, or to correct, delete or destroy personal information, must use the applicable POPIA process and prescribed form where required. Further information is available in VASA’s privacy notices.

10.4 PAIA may not be used to obtain a record for criminal or civil proceedings after those proceedings have commenced where section 7 of PAIA applies.

10.5 VASA will keep an auditable record of the request, identity-verification steps, searches, correspondence, decision, fees and disclosure or refusal.

11. FEES

The fees prescribed under PAIA and the Regulations apply. The current private-body fees are summarised in Schedule 1 and may change when the Minister or Regulator publishes an updated fee schedule.

11.1 A request fee is payable by a requester other than a personal requester, subject to PAIA and any applicable exemption. The current request fee is R140.

11.2 Where access is granted, VASA may require payment of the prescribed reproduction, search, preparation, media, postage or electronic-transfer costs before access is provided.

11.3 If the search and preparation is expected to exceed six hours, VASA may require a deposit of one-third of the prescribed access fee. VASA will issue a written notice of fees and any deposit.

11.4 A requester may complain to the Regulator or approach a court regarding a fee decision, subject to PAIA.

12. DECISION, TIMELINES, THIRD-PARTY CONSULTATION AND SEVERABILITY

12.1 VASA will decide a properly submitted request as soon as reasonably possible and ordinarily within 30 days of receipt, subject to a lawful extension of up to a further 30 days. The requester will be notified of the extension and reasons.

12.2 The outcome and fees payable will be communicated substantially in Form 3 prescribed under regulation 8.

12.3 Where the requested record contains information about a third party, VASA will follow the consultation and notification requirements in PAIA. This may include notifying the third party within 21 days and allowing the third party 21 days to make representations or consent.

12.4 If a record contains information that may lawfully be withheld and information that may be disclosed, VASA will provide access to the severable portion where reasonably possible.

12.5 Access will be provided in the form requested where reasonably possible, unless doing so would unreasonably interfere with VASA’s operations, damage the record or infringe copyright not owned by VASA.

13. GROUNDS FOR REFUSAL AND PUBLIC-INTEREST OVERRIDE

Access may be refused only on a ground recognised by PAIA. Depending on the record, relevant grounds include:

• mandatory protection of the privacy of a third-party natural person;
• mandatory protection of commercial information of a third party;
• confidential information protected by an enforceable duty of confidence;
• safety of individuals and protection of property;
• records privileged from production in legal proceedings;
• commercial information, trade secrets or research information of VASA or a third party;
• records whose disclosure is prohibited by another law; and
• requests that are otherwise excluded or refused under PAIA.

Section 70 of PAIA may require disclosure despite a ground of refusal where the record would reveal evidence of a substantial contravention of, or failure to comply with, the law or an imminent and serious public-safety or environmental risk, and the public interest in disclosure clearly outweighs the harm contemplated by the ground of refusal.

14. REMEDIES AND COMPLAINTS

There is no internal appeal against a decision of the head of a private body. A requester or affected third party may, subject to PAIA, lodge a written complaint with the Information Regulator using Form 5 and/or apply to a court of competent jurisdiction.

15. AVAILABILITY, PUBLICATION AND ACCESSIBILITY

A current copy of this Manual is available:

• on VASA’s website at https://www.virginactive.co.za/;
• for public inspection during normal business hours at VASA’s head office, subject to reasonable security and access arrangements;
• from the Information Officer on request, subject to any prescribed copying fee; and
• to the Information Regulator on request and, where supported, through the Regulator’s eServices portal.

This Manual is published in English. VASA will provide reasonable assistance to persons who need an accessible format or support in another official language. Additional language versions will be published where required by law or Information Regulator guidance. The Regulator’s Guide is available in all official languages and in Braille.

16. GOVERNANCE, ANNUAL REPORTING AND UPDATING

16.1 The Information Officer will review this Manual at least annually and whenever there is a material change to VASA’s legal entity details, registered officers, operations, records, processing activities, legislation, prescribed forms, fees or Regulator guidance.

16.2 VASA will maintain a PAIA request register and supporting decision records. The responsible officer will submit PAIA annual reporting through the Regulator’s eServices portal when required. The Regulator currently opens the annual reporting window from 1 April to 30 June.

16.3 Changes to the Information Officer, Deputy Information Officer, contact details or entity details must be updated with the Regulator and reflected promptly in this Manual, relevant privacy notices and internal procedures.

16.4 The current Manual should be uploaded to the VASA website, made available at head office and, where applicable, uploaded to the Regulator’s PAIA Manual service.

17. ISSUE AND APPROVAL

Issued for and on behalf of Virgin Active South Africa (Pty) Ltd by the registered Information Officer.

SCHEDULE 1: CURRENT PRESCRIBED PRIVATE-BODY FEES

The amounts below reflect the Information Regulator’s PAIA Fee Structure and Exemptions publication dated March 2026. They remain subject to PAIA, the Regulations and any later amendment or exemption.

A personal requester is not liable for the request fee where PAIA provides an exemption. VASA will provide written notice of any fee or deposit before requiring payment.

SCHEDULE 2: OFFICIAL FORMS AND RESOURCES

Current PAIA forms and guidance: Information Regulator PAIA resources

Information Regulator contact and complaints: Information Regulator contact page

VASA privacy information: Virgin Active South Africa Privacy Policy

AUTHORITATIVE SOURCES USED FOR THIS REVISION

• Promotion of Access to Information Act 2 of 2000, as amended;
• Protection of Personal Information Act 4 of 2013;
• Regulations Relating to the Promotion of Access to Information, 2021;
• Information Regulator, PAIA Manual Template: Private Body;
• Information Regulator, Guide on how to use PAIA and prescribed forms;
• Information Regulator, Guidance Note on Information Officers and Deputy Information Officers;
• Information Regulator, 2024/25 Annual PAIA Compliance Assessment Report; and
• Information Regulator, PAIA Fee Structure and Exemptions, March 2026.