PAIA Manual

Hey Lullae! operates an online AI styling concierge, digital wardrobe and multi brand fashion commerce platform. Users may create style and silhouette profiles, upload photographs, body measurements, wardrobe and inspiration content, receive AI assisted curation and virtual try on outputs, discover real products supplied by established fashion brands, designers, boutiques and retailers, and purchase selected products through a unified checkout experience.

Hey Lullae! works with independent fashion brands, designers, boutiques and retailers ("Retail Fashion Partners"), as well as technology, cloud, AI, payment, communications and other service providers. In operating the Platform, Hey Lullae! creates, receives, stores and processes corporate, commercial, customer, styling, order, technology, privacy and other records.

Section 32 of the Constitution of the Republic of South Africa, 1996 recognises the right of access to information. PAIA gives effect to this right and section 51 requires private bodies to prepare and make available a manual containing prescribed information relating to records held by the body and the manner in which those records may be accessed.

This Manual should be read with POPIA, the regulations issued under PAIA and POPIA, and the Hey Lullae! Privacy Policy, as amended from time to time. Its purpose is to describe the records held by Hey Lullae!, the process for requesting access, the circumstances in which access may be refused and the rights available to Data Subjects.

"Account" means a user account registered on the Hey Lullae! Platform.

"AI Feature" means an artificial intelligence enabled styling, curation, matching, sizing, concierge or virtual try on feature.

"Data Subject", "Operator", "Personal Information", "Responsible Party" and "Special Personal Information" have the meanings assigned under POPIA.

"Digital Wardrobe" means the private digital area in which a user may save or upload garments, style preferences, measurements, photographs, silhouette or contour information, inspiration and related styling information.

"Hey Lullae!" means the South African entity operating the Hey Lullae! platform. The registered legal entity details are set out in clause 4.

"Information Officer" means the person appointed or deemed to be the Information Officer for purposes of PAIA and POPIA.

"Platform" means heylullae.co.za, any associated domain, web application, Digital Wardrobe, Silhouette Vault, AI concierge, virtual try on, membership, checkout and connected services.

"Requester" means a person requesting access to a record under PAIA.

"Retail Fashion Partner" means an independent fashion brand, designer, boutique, retailer or supplier whose products are displayed, curated, sold or fulfilled through or in connection with the Platform.

This Manual assists members of the public to understand what records Hey Lullae! holds, which records may be available without a formal PAIA request, how to request access, the role of the Information Officer, and the remedies available where access is refused. It also describes categories of Personal Information processed by Hey Lullae!, the purposes of processing, recipients, transborder flows, security measures and Data Subject rights.

Registered name: Hey Lullae! (Pty) Ltd

Registration number: 2026/399808/07

Website: www.heylullae.co.za

Hey Lullae! has appointed or recognises an Information Officer responsible for overseeing compliance with PAIA and POPIA, receiving and considering access requests, assisting Requesters where appropriate, administering Personal Information requests, overseeing security compromise notifications and maintaining Hey Lullae!'s access to information and privacy governance.

Email: legal@heylullae.co.za

Physical address: Midrand, Gauteng, South Africa 1687

Hey Lullae! may designate Deputy Information Officers. Formal PAIA and POPIA requests should be directed to the Information Officer or a duly designated Deputy Information Officer.

This Manual is made available on the Hey Lullae! website and may be requested electronically from the Information Officer. It may be amended to reflect changes in law, the Platform, technology, Retail Fashion Partner arrangements or the categories of records and Personal Information processed.

The Information Regulator has prepared a Guide under section 10 of PAIA explaining how rights under PAIA and POPIA may be exercised, applicable fees and remedies. The Guide is available from the Information Regulator through its official channels.

Certain information deliberately made public through the Platform or other public channels may be available without a formal PAIA request. This may include the Terms and Conditions, Privacy Policy, PAIA Manual, Cookie Notice, returns and cancellation information, membership information, publicly displayed Retail Fashion Partner and product information, FAQs, public marketing material, press releases and general contact information.

The inclusion of a category in this clause does not mean that every record in that category is public. Confidential, commercial, personal, proprietary or otherwise protected information remains subject to PAIA.

Depending on Hey Lullae!'s operations from time to time, records may be created or retained under legislation including the Companies Act 71 of 2008, Consumer Protection Act 68 of 2008, Electronic Communications and Transactions Act 25 of 2002, POPIA, PAIA, Income Tax Act 58 of 1962, Value Added Tax Act 89 of 1991, Tax Administration Act 28 of 2011 and applicable employment, intellectual property, competition and anti corruption legislation. Inclusion does not mean that Hey Lullae! necessarily holds records under every provision of each statute.

10.1 Corporate, governance and legal records

Hey Lullae! may hold incorporation and statutory records, shareholder and director records, resolutions, governance policies, contracts, legal opinions, disputes, litigation, intellectual property, compliance documentation, privacy records and PAIA/POPIA requests.

10.2 Customer, account and membership records

Hey Lullae! may hold registration and profile information, contact details, authentication information, membership tier, subscription status, communication choices, consent records, correspondence, complaints and support records.

10.3 Digital wardrobe, style profile and curation records

Hey Lullae! may hold saved garments, preferred brands, colours, sizes, fit and style preferences, lookbooks, favourites, wardrobe items, searches, curation history, recommendations, feedback and other information used to personalise styling.

10.4 Silhouette, body measurement and biometric related records

Hey Lullae! may hold height, clothing and shoe sizes, body measurements, body shape selections, proportions, fit preferences, silhouette or contour photographs and other photographs showing a user's body or likeness. Where processing constitutes biometric information under POPIA, or produces biometric like inferences, the information is treated as Special Personal Information and subject to enhanced controls.

10.5 AI concierge, virtual try on and generated content records

Hey Lullae! may hold AI prompts, concierge conversations, garment references, styling requests, silhouette driven curation inputs, generated try on renders, AI outputs, user feedback, model routing records and technical logs. Records may show transmission of limited images and prompts to authorised AI Operators for the requested output.

10.6 Inspiration and social integration records

Hey Lullae! may hold uploaded inspiration images, Pinterest boards and pins selected by a user, OAuth tokens and permissions, connected account identifiers, integration status, revocation and deletion records. Hey Lullae! does not require third party account passwords for OAuth integrations.

10.7 Retail fashion partner and product catalogue records

Hey Lullae! may hold partner corporate and contact information, onboarding and due diligence records, agreements, catalogue and product feeds, prices, stock and size information, imagery, fulfilment rules, order hand offs, returns, settlement and reconciliation records, APIs and technical integrations.

10.8 Order, fulfilment, return and refund records

Hey Lullae! may hold orders, products purchased, checkout references, shipping and delivery information, boutique fulfilment instructions, courier events, returns, exchanges, refund approvals, payment reversals, customer service records and dispute or chargeback information.

10.9 Payment, wallet, voucher and referral records

Hey Lullae! may hold payment references, invoices, transaction status, membership billing, wallet ledger entries, vouchers, referral codes, attribution, qualifying conversions, redemption records and, where an optional payout feature exists, the limited banking details supplied for that purpose.

10.10 Marketing, cookie and attribution records

Hey Lullae! may hold marketing preferences, opt ins, opt outs, cookie consent logs, cookie identifiers, advertising events, referral source, campaign attribution, hashed identifiers where lawfully used, conversion events and preference centre selections.

10.11 Information technology and security records

Hey Lullae! may hold system architecture, source and configuration documentation, databases, access controls, authentication logs, APIs, cloud and storage records, backups, incident records, security assessments, vulnerability management, disaster recovery and audit logs.

10.12 Supplier and operator records

Hey Lullae! may hold service provider contracts, data processing and Operator agreements, security assessments, cloud, AI, payment, communications, analytics and infrastructure provider records, invoices, due diligence and performance records.

10.13 Financial and accounting records

Hey Lullae! may hold financial statements, management accounts, invoices, tax records, budgets, forecasts, banking records, audit records, Partner settlement and reconciliation records.

10.14 Human resources records

Hey Lullae! may hold where applicable, recruitment, employment, remuneration, payroll, leave, performance, training, disciplinary, benefits and termination records.

Requests may be made by a person seeking records about themselves, an authorised representative, a person requesting third party records where PAIA permits access, or a public body or other person where access is required for the exercise or protection of a right.

Hey Lullae! processes Personal Information relating principally to customers, prospective customers, website visitors, members, representatives of Retail Fashion Partners, suppliers, service providers, contractors, employees, prospective employees, directors, shareholders, complainants and other persons interacting with the business.

Customer information may include identity and contact information, Account and authentication information, style and fit preferences, Digital Wardrobe information, body measurements, silhouette or contour photographs, likeness information, inspiration content, social integration data, AI prompts and outputs, transaction and order information, payment references, delivery information, referral and wallet information, online identifiers, cookie choices, usage information and correspondence.

12.1 Silhouette, body measurement and biometric information

Hey Lullae! may process body measurements, body shape information and uploaded silhouette or contour photographs to personalise styling, sizing and curation and to provide virtual try on functionality. Where such processing constitutes biometric information under POPIA, or creates biometric like inferences from physical characteristics, Hey Lullae! treats the information as Special Personal Information and applies the additional requirements of POPIA.

Silhouette photographs and body measurements are not used for facial recognition, identity authentication or surveillance unless a separate lawful feature and notice are introduced. Hey Lullae! does not sell or licence a user's likeness or silhouette data.

12.2 AI processing and virtual try on

Where a user requests image based AI styling or virtual try on, Hey Lullae! may transmit the user's uploaded silhouette or contour photograph, garment reference imagery and a limited prompt to authorised third party AI providers solely to generate the requested output. Hey Lullae!'s current public facing provider disclosures identify the Lovable AI Gateway and Google Gemini image and text models. Hey Lullae! will maintain appropriate contractual and security controls according to the actual role of each provider.

Hey Lullae! does not use silhouette photographs or generated renders to train its own foundation model and requires relevant AI Operators, contractually where applicable, not to use those materials for unrelated foundation model training.

12.3 Cookie, pixel, consent and attribution records

Hey Lullae! may process strictly necessary, functional, analytics and marketing cookie information. Optional third party analytics, marketing, advertising or attribution technologies that transmit Personal Information or online identifiers are disabled by default and are subject to prior affirmative consent where required.

The consent banner or preference centre acts as a technical gatekeeper: non essential tracking must not load, drop a cookie, fire or transmit an event before the required consent. Consent is not inferred from silence, continued browsing or pre selected choices. Consent logs may record the categories accepted or rejected, notice version, timestamp and later withdrawal or amendment.

Where social advertising technologies are used, records may include PageView, ViewContent, AddToCart, InitiateCheckout and Purchase events, product identifiers, page URL, order value, currency, event identifiers, technical signals and lawfully configured hashed identifiers. Hey Lullae! does not use silhouette photographs, body shape information or Pinterest derived styling data for third party behavioural advertising.

• register and authenticate users and administer Accounts and memberships;
• maintain Digital Wardrobes, style profiles, Silhouette Vaults and saved preferences;
• generate personalised styling, sizing, curation, product matching and virtual try on outputs;
• match inspiration and selected Pinterest content to products offered by Retail Fashion Partners;
• operate the AI concierge and improve service quality within the limits disclosed in the Privacy Policy;
• process unified checkout orders and coordinate fulfilment, delivery, returns and refunds with Retail Fashion Partners;
• administer subscription billing, vouchers, wallet credits, referrals and promotions;
• provide transactional and opted in communications and customer support;
• protect Platform security and prevent fraud or abuse;
• perform lawful analytics, marketing measurement and attribution;
• manage Retail Fashion Partner, supplier and Operator relationships; and
• comply with legal, tax, accounting, regulatory, dispute and evidential obligations.

Personal Information may be disclosed to Retail Fashion Partners where necessary to fulfil a user's order; cloud, hosting, security and infrastructure providers; authorised AI providers; payment providers; communications and workflow providers; analytics or marketing providers subject to applicable consent requirements; professional advisers; auditors; banks; regulators; courts; tax authorities and law enforcement bodies where permitted or required by law.

Retail Fashion Partners ordinarily receive only information necessary for fulfilment, such as the customer's name, delivery address, telephone number and order details. Participation as a Retail Fashion Partner does not confer unrestricted access to a customer's Digital Wardrobe, Silhouette Vault, body measurements, photographs or unrelated styling information.

14.1 Operators, Responsible Parties and contractual controls

Where a third party acts as an Operator, Hey Lullae! will maintain appropriate Data Processing or Operator Agreements requiring processing only with authorisation, confidentiality, security safeguards, security compromise notification and assistance with applicable POPIA obligations. Where a third party acts as an independent or joint Responsible Party, Hey Lullae! will use an appropriate data sharing or commercial arrangement reflecting the parties' actual roles.

Hey Lullae! may use global cloud, AI, security, communications, social integration and payment providers whose systems or personnel are outside South Africa. Personal Information may therefore be transferred to, stored in or accessed from other jurisdictions. Such transfers will be undertaken in accordance with section 72 of POPIA and subject to appropriate contractual, legal, technical or organisational safeguards where required.

Hey Lullae! implements reasonable and appropriate technical and organisational safeguards having regard to the nature and sensitivity of the information and the risks of processing. Measures may include TLS/HTTPS, encryption at rest where supported, secure authentication, least privilege access, owner only storage paths for sensitive profile assets, server side token storage, logging, monitoring, vulnerability management, backups, retention controls and incident response procedures.

Silhouette and contour photographs, biometric related information, authentication tokens, optional banking details and other high sensitivity records are subject to enhanced access, security and retention controls.

16.1 Security compromise and incident response

Where there are reasonable grounds to believe that Personal Information has been accessed or acquired by an unauthorised person, Hey Lullae! will investigate and contain the incident, assess affected information and risks, preserve appropriate evidence, implement corrective measures and review relevant controls. The Information Officer will oversee notifications to the Information Regulator and affected Data Subjects where and in the manner required by POPIA. Operators are required, where applicable, to notify Hey Lullae! and cooperate with incident response.

A person wishing to request access to a record must submit the prescribed PAIA request to the Information Officer with sufficient information to identify the Requester and locate the record. Where required, the request must identify the right to be exercised or protected and explain why access is necessary. Proof of identity or authority may be required.

Requests should be sent to legal@heylullae.co.za or another address published by the Information Officer. Sensitive identification information should be provided through a secure method specified by Hey Lullae!.

Hey Lullae! will decide PAIA requests within the periods prescribed by law, subject to any lawful extension. Where access is granted, the Requester will be informed of the form of access and applicable fees. Where refused, Hey Lullae! will provide reasons and information about available remedies to the extent required by PAIA.

Access may be refused where PAIA requires or permits refusal, including where disclosure would unreasonably reveal another person's Personal Information, disclose trade secrets or confidential commercial information, breach a duty of confidence, prejudice commercial interests, compromise Platform or information security, reveal legally privileged information or otherwise fall within a statutory ground for refusal. Severable non protected portions will be considered for disclosure where appropriate.

Where reasonable steps have been taken to locate a requested record and it cannot be found or there are reasonable grounds to believe it does not exist, the Information Officer will notify the Requester in accordance with PAIA. If later found, the request will be considered under PAIA.

Where a request concerns a third party, Hey Lullae! may be required to notify that party and allow representations before deciding the request. The decision remains subject to PAIA and its applicable grounds for refusal.

Fees payable for PAIA requests are determined under the applicable PAIA Regulations and prescribed fee schedule. Hey Lullae! may require payment of a lawful request, reproduction, access or deposit fee before processing further or providing access.

Subject to POPIA, a Data Subject may request confirmation and access, correction of inaccurate or excessive information, deletion or destruction where retention is no longer authorised, object to certain processing, withdraw consent where consent is the basis, object to direct marketing, disconnect optional integrations and lodge a complaint with the Information Regulator.

A user may request deletion of uploaded silhouette or contour photographs, saved AI renders, Digital Wardrobe content and connected Pinterest derived information, subject to lawful retention, backup and evidential requirements. Withdrawal of consent applies prospectively and may disable a feature that depends on the relevant information.

A Data Subject wishing to exercise a POPIA right should submit the relevant request to the Information Officer. Where a prescribed form is required, the applicable form under the POPIA Regulations should be used, including forms for objection and correction or deletion. Reasonable proof of identity or authority may be required.

A Requester or Data Subject dissatisfied with the handling of a PAIA request or Personal Information matter may lodge a complaint with the Information Regulator where permitted by PAIA or POPIA.

A person dissatisfied with a decision concerning access to a record may, subject to PAIA and applicable time periods, apply to a competent court for appropriate relief. Additional remedies may exist under POPIA or other law.

Hey Lullae! retains records for periods determined by applicable law, contractual and evidential obligations and legitimate operational needs. Financial, tax, accounting and transaction records may be subject to statutory retention periods. Customer and Platform records are retained only for as long as authorised under POPIA.

Silhouette and contour photographs are retained while maintained by the user in the Silhouette Vault or until deletion is requested, subject to reasonable deletion and backup cycles. Saved AI renders are retained only where the user chooses to save them or another lawful purpose applies. Pinterest derived and inspiration data is removed or de identified when no longer required after disconnection or deletion, subject to lawful retention.

Where Hey Lullae! is no longer authorised or required to retain Personal Information, it will delete, destroy or de identify it in accordance with POPIA and internal retention procedures.

Hey Lullae! will review this Manual periodically and may amend it where PAIA, POPIA or their regulations change, where guidance is issued by the Information Regulator, or where Hey Lullae! materially changes its business model, AI or technology stack, Retail Fashion Partner arrangements, record categories or Personal Information processing. The Information Officer is responsible for overseeing maintenance and review.

Related documents: Privacy Policy, Terms and Conditions and Messaging Opt In Disclaimer & Consent.