PAIA Manual

1. List of acronyms and abbreviations

2. Purpose of this PAIA Manual

This PAIA Manual is compiled in terms of Section 51 of the Promotion of Access to Information Act 2 of 2000 (PAIA), as amended. It enables members of the public to:

1. Check categories of records held by Capital Five Consulting (Pty) Ltd that are available without a formal PAIA request;

2. Understand how to submit a formal request for access to records;

3. Identify records available under other legislation;

4. Access full contact details of the Information Officer;

5. Understand how personal information is processed in terms of POPIA;

6. Know the security measures in place to protect personal information.

3. Key contact details

3.1 Information Officer

Full Name:

Lauren Thompson

Title:

Chief Executive Officer

Organisation:

Capital Five Consulting (Pty) Ltd (trading as Lumora)

Email:

info@capitalfive.co.za

Telephone:

+27 76 523 1057

Postal Address:

57 Holly Oaks Estate, 105 Hyperion Drive, Northriding, Johannesburg, 2169

Physical Address:

57 Holly Oaks Estate, 105 Hyperion Drive, Northriding, Johannesburg, 2169

IO Appointment Date:

25 July 2025

IR Registration Number:

2026-016985

3.2 Deputy Information Officer

Capital Five Consulting (Pty) Ltd has not designated a Deputy Information Officer at this time. All access-to-information requests are handled directly by the Information Officer above.

3.3 General access to information contacts

Email:

info@capitalfive.co.za

Privacy / POPIA queries:

privacy@capitalfive.co.za

Website:

www.lumora.co.za

3.4 National / head office

Postal Address:

57 Holly Oaks Estate, 105 Hyperion Drive, Northriding, Johannesburg, 2169

Physical Address:

57 Holly Oaks Estate, 105 Hyperion Drive, Northriding, Johannesburg, 2169

Telephone:

+27 76 523 1057

Email:

info@capitalfive.co.za

Website:

www.capitalfive.co.za

4. Guide on how to use PAIA

The Information Regulator has, in terms of Section 10(1) of PAIA, updated and made available a revised Guide on how to use PAIA ("the Guide") in an easily comprehensible form, as reasonably required by persons wishing to exercise rights under PAIA and POPIA.

The Guide is available in all official languages and in braille. Members of the public may:

1. Inspect or obtain a copy from the offices of the Information Regulator during normal business hours;

2. Download the Guide from: https://www.justice.gov.za/inforeg/;

3. Request a copy from the Information Officer of Capital Five Consulting (Pty) Ltd.

A copy of the Guide is available for public inspection in English and Zulu during normal business hours at the registered office of Capital Five Consulting (Pty) Ltd.

5. Categories of records available without a PAIA request

The following records are available without requiring a formal PAIA request and may be accessed via the website or upon request:

6. Records available under other legislation

The following records are held or created in terms of applicable South African legislation:

7. Subjects and categories of records held

Capital Five Consulting (Pty) Ltd holds records in the following subject areas:

8. Processing of personal information

8.1 Purpose of processing personal information

Capital Five Consulting (Pty) Ltd (trading as Lumora) operates a digital mental wellness platform that connects employer organisations with mental health and wellness service providers. Personal information is processed for the following purposes:

1. Registering and managing employer organisation accounts;

2. Registering and managing employee beneficiary accounts;

3. Registering, vetting, and managing provider (therapist / wellness practitioner) profiles;

4. Facilitating the booking and delivery of mental wellness services;

5. Processing payments to providers and from employers;

6. Communicating with users regarding platform updates, bookings, and wellness content;

7. Complying with legal obligations under PAIA, POPIA, tax legislation, and labour law;

8. Anonymised or aggregated analytics to improve platform services (no individual is identifiable).

8.2 Categories of data subjects and personal information processed

8.3 Recipients of personal information

Personal information may be shared with the following categories of recipients:

8.4 Planned transborder flows of personal information

Capital Five Consulting (Pty) Ltd uses the following international service providers, which may result in personal information being stored or processed outside the Republic of South Africa:

Capital Five Consulting (Pty) Ltd ensures that appropriate safeguards are in place for all transborder transfers, in compliance with Section 72 of POPIA.

8.5 Information security measures

Capital Five Consulting (Pty) Ltd implements the following security measures to protect the confidentiality, integrity, and availability of personal information:

1. Data encryption in transit (TLS 1.2+) and at rest (AES-256) for all stored personal data;

2. Row-Level Security (RLS) enforced at the database layer: users can only access records they are authorised to view;

3. Password hashing using industry-standard bcrypt algorithms; plaintext passwords are never stored;

4. Role-based access control (RBAC): platform access is segmented by role (Employee, Employer, Provider, Admin);

5. Multi-factor authentication (MFA) available for administrative accounts;

6. Regular automated security dependency scanning and vulnerability patching;

7. Access logs and audit trails maintained for administrative actions;

8. Data minimisation: only personal information necessary for the stated purpose is collected and retained.

9. Availability of this manual

A copy of this PAIA Manual is available:

1. On the Lumora website: www.lumora.co.za (downloadable PDF in the footer);

2. For public inspection at the registered office of Capital Five Consulting (Pty) Ltd during normal business hours (Monday to Friday, 08:00 to 17:00);

3. To any person upon written request to the Information Officer, subject to payment of the prescribed copy fee as set out in the PAIA Regulations (R1.10 per A4 page);

4. To the Information Regulator upon request.

10. Updating of this manual

The Information Officer of Capital Five Consulting (Pty) Ltd will review and update this Manual at least annually, or whenever there is a material change to the organisation's data processing activities, structure, or applicable legislation. The date of each revision will be recorded on the cover page.