PAIA Manual

1. Introduction

Untapped Potential TCG (Pty) Ltd ("Untapped Potential TCG", "the Company", "we") is a trading card game retailer and hobby store operating in South Africa. We sell trading card games, accessories and related products in-store and online, and host organised play events and tournaments.

This Manual is published in accordance with section 51 of PAIA. It informs members of the public of the types of records we hold and explains how to request access to those records. It also describes how we process personal information in compliance with POPIA.

2. Company and Information Officer contact details

All PAIA requests and POPIA enquiries should be addressed to the Information Officer at the details above.

3. Guide of the Information Regulator

The Information Regulator has, in terms of section 10 of PAIA, published a Guide on how to use PAIA. The Guide is available in all official languages and explains how to complete request forms, the fees payable, and the remedies available if a request is refused. The Guide can be obtained from:

• The Information Regulator's website: https://inforegulator.org.za
• The Information Regulator: JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001; PO Box 31533, Braamfontein, 2017
• Email: enquiries@inforegulator.org.za / PAIAComplaints@inforegulator.org.za
• A copy may also be requested from our Information Officer.

4. Records available without a formal PAIA request

The following categories of records are automatically available and may be accessed without submitting a formal PAIA request:

• Product information, pricing and promotional material published on our website and social media
• Event and tournament schedules, formats and entry information
• Our POPIA Privacy Notice, website terms and conditions, and returns policy
• This PAIA Manual

5. Records available in terms of other legislation

Where applicable, records are also available in terms of the following legislation, subject to the conditions in each Act:

• Companies Act 71 of 2008 (company statutory records)
• Income Tax Act 58 of 1962 and Value-Added Tax Act 89 of 1991 (tax records)
• Consumer Protection Act 68 of 2008 (sales and warranty records)
• Electronic Communications and Transactions Act 25 of 2002 (online sales records)
• Basic Conditions of Employment Act 75 of 1997 and Labour Relations Act 66 of 1995 (employment records)
• Unemployment Insurance Act 63 of 2001 and Compensation for Occupational Injuries and Diseases Act 130 of 1993
• Protection of Personal Information Act 4 of 2013

6. Subjects and categories of records held

6.1 Company and statutory records

• Incorporation documents, share register, minutes and resolutions
• Licences, permits and lease agreements

6.2 Financial records

• Accounting records, annual financial statements, tax returns, banking records, invoices and asset registers

6.3 Customer records

• Customer account details, online order and delivery records, payment records
• Tournament and event registrations, results and player IDs (e.g. Pokémon Player ID, Wizards Event Link / Companion records)
• Marketing and newsletter subscriber lists, loyalty programme records
• CCTV footage of the store premises

6.4 Supplier and distributor records

• Supplier contracts, distributor agreements, purchase orders and correspondence
• Records relating to the purchase of second-hand goods (including trade-ins of cards), where applicable

6.5 Employee records

• Employment contracts, payroll, leave, disciplinary and performance records, PAYE/UIF/SDL records

6.6 Information technology

• Website and e-commerce platform records, point-of-sale data, email records

7. Processing of personal information (POPIA)

7.1 Purposes of processing

We process personal information for the following purposes:

• Processing and delivering online and in-store orders, and administering payments, returns and warranties
• Registering and administering tournaments, leagues and organised play events, including reporting results to game publishers' official event platforms
• Operating our loyalty programme and sending marketing communications and newsletters (with the data subject's consent or as otherwise permitted by POPIA)
• Maintaining the safety and security of our premises, staff and stock through CCTV surveillance
• Complying with legal and regulatory obligations

7.2 Categories of data subjects and personal information

• Customers: name, contact details, delivery address, payment details, purchase history, player/membership IDs
• Event participants: name, contact details, player IDs, event results; where a participant is a child, the name and contact details of a parent/guardian (competent person)
• Website users: account details, order history, device and usage information collected via cookies
• Visitors to premises: CCTV images
• Employees and job applicants: employment-related personal information
• Suppliers and service providers: business contact details, contract and payment information

7.3 Recipients of personal information

• Payment processors and banks
• Couriers and delivery service providers
• Game publishers and their official event/organised-play platforms (for sanctioned tournament reporting)
• IT, website hosting and marketing service providers acting as operators on our behalf
• Regulators, law enforcement and other parties where required by law

7.4 Cross-border transfers

Some service providers (for example e-commerce platforms, email marketing services and game publishers' event platforms) store or process information outside South Africa. We only transfer personal information across borders in accordance with section 72 of POPIA, including to recipients subject to laws or binding agreements providing an adequate level of protection.

7.5 Security measures

We have implemented reasonable and appropriate technical and organisational measures to secure personal information, including access controls, password protection, secure payment processing through accredited providers, restricted access to CCTV footage, and staff confidentiality obligations. Retention periods are determined by legal requirements and the purposes described above, after which records are deleted or de-identified.

7.6 Data subject rights

Data subjects have the right to request access to, correction of, or deletion of their personal information; to object to processing; to withdraw consent; to opt out of direct marketing; and to lodge a complaint with the Information Regulator. Requests may be directed to the Information Officer.

8. How to request access to records

A request for access to a record must be made on Form 2 (Request for Access to Record) prescribed under the PAIA Regulations, 2021, available from the Information Regulator's website or from our Information Officer. The requester must:

• Complete Form 2 in full and submit it to the Information Officer at the contact details in section 2
• Identify the record(s) requested and the right the requester seeks to exercise or protect, and explain why the record is required for that right
• Provide proof of identity, and proof of authority if acting on behalf of another person
• Pay the prescribed request fee of R100.00 (not payable where the requester seeks access to their own personal information), plus any prescribed access and reproduction fees

We will respond to a request within 30 days as required by PAIA. Access may be refused on the grounds set out in Chapter 4 of Part 3 of PAIA (for example protection of third-party privacy, commercial information, or legally privileged records). If a request is refused, the requester may lodge a complaint with the Information Regulator or apply to court.

9. Availability of this Manual

This Manual is available on our website at https://untappedpotentialtcg.co.za, at our store during business hours, and on request from the Information Officer, free of charge. It will be updated as and when necessary.

The Information Officer
Untapped Potential TCG (Pty) Ltd

This is the web edition of the Manual. The signed original, dated 26 July 2026 and naming the Information Officer, is held at our store and is available on request at no charge.