PAIA Manual

Yorkville Advisors B.V., trading as Struktürs · Version 1 · Final · issued 16 October 2026

Manual under section 51 of the Promotion of Access to Information Act 2 of 2000 (PAIA), as amended by the Protection of Personal Information Act 4 of 2013 (POPIA). Compiled 15 October 2026.

1. About us and this manual#

We are a private limited company incorporated in the Netherlands (KvK 87502151). We provide Struktürs, a finance intelligence platform for businesses, including businesses in South Africa. This manual explains how to ask for records we hold, and how we process personal information under POPIA.

We are a private body under PAIA. Customer Data means the content a customer puts into Struktürs: files, figures, knowledge articles, questions and board packs. It belongs to the customer, and we process it only on the customer's instructions.

2. Contact details#

We have no office and no Deputy Information Officer in South Africa.

3. The Regulator's Guide to PAIA#

The Information Regulator publishes a Guide on how to use PAIA and POPIA, in every official language (section 10 of PAIA). You can get it from the Regulator, or from our Information Officer on request.

4. Records available without a request#

These are on our website, and anyone may read them without a PAIA request:

• Terms of Service and Privacy Policy
• Data Processing Agreement: https://strukturs.ai/legal/dpa
• Sub-processor List: https://strukturs.ai/legal/sub-processors
• this manual: https://strukturs.ai/legal/paia

All of them are listed at https://strukturs.ai/legal.

5. Records we hold#

Records kept because a law requires them#

• South Africa: PAIA (this manual, and records of requests and decisions); POPIA (records of processing, privacy requests, and our Information Officer registration).
• The Netherlands: company records under the Dutch Civil Code, Book 2, and accounting and tax records under Dutch tax law, kept for seven years.

Records by subject#

Customer Data belongs to our customer. We will refer a request for it to that customer.

6. How to request a record#

1. Complete Form 2 (Request for access to record), from https://inforegulator.org.za/paia/ or from us.
2. Email it to privacy@strukturs.ai. Give enough detail to identify the record and yourself, say how you want access (for example a copy by email), and say which right you want to exercise or protect and why the record is needed for it. If you ask on someone else's behalf, show your authority to do so.
3. Fees. Fees are those set by the PAIA Regulations. If you ask for records about yourself, you pay no request fee. Before we do any work, we tell you any fee that applies and how to pay it.
4. Our decision. We decide within 30 days. We may extend that once, by up to 30 days, where PAIA allows, and we tell you why. If we do not answer in time, the request counts as refused.
5. If we refuse. We may refuse only on the grounds in Chapter 4 of Part 3 of PAIA, for example to protect another person's privacy, a third party's commercial or confidential information, or legally privileged records. We give reasons.
6. Your remedies. You can complain to the Information Regulator within 180 days (PAIAComplaints@inforegulator.org.za), or apply to court.

7. How we process personal information (POPIA)#

Why. To provide the platform and our support, to bill customers and keep tax records, to keep the platform secure, and to record what was agreed. For Customer Data we act only on the customer's instructions, under our Data Processing Agreement.

About whom.

Who receives it. The service providers in our Sub-processor List (cloud hosting, sign-in, email, payments and our customer relationship system), our professional advisers under confidentiality, and authorities where the law requires. We do not sell personal information.

Transfers outside South Africa. A South African workspace's files, figures, database and service logs are stored in Johannesburg. Some processing happens elsewhere: chiefly AI features in Belgium and London, and our sign-in, billing, administration and audit services in London. Section 6 of our Privacy Policy lists every location.

We rely on section 72 of POPIA: each recipient is bound by agreements we have assessed as giving adequate protection. AI features in a South African workspace run only after the person using them has agreed to that transfer, and that consent is an additional basis.

Security. Each customer has its own isolated cloud project, storage and database. Data is encrypted in transit and at rest. Sign-in is required, and staff have no routine access to customer workspaces. Annex II of our Data Processing Agreement describes the measures in full.

Your rights about your personal information. You may ask to see, correct or delete the personal information we hold about you, or object to how we use it. Email privacy@strukturs.ai. You may use the forms in the POPIA Regulations: Form 1 to object to processing, and Form 2 to ask for correction or deletion. If the information is Customer Data, we pass your request to the customer that controls it.

8. Availability and updates#

This manual is on our website at https://strukturs.ai/legal/paia, at our principal place of business in The Hague, and free of charge from privacy@strukturs.ai. We give a copy to the Information Regulator on request. We update it whenever our Information Officer, our providers or our processing locations change.

Issued by Graham McGregor, Director and Information Officer, Yorkville Advisors B.V.

Signature: approved electronically by Graham McGregor · Date: 16 October 2026