PAIA Manual

1. Definitions and abbreviations

2. Purpose of this manual

2.1 PAIA gives effect to the constitutional right of access to information held by public and private bodies, where that information is required for the exercise or protection of any right.

2.2 Section 51 of PAIA requires every private body to compile and make available a manual describing the records it holds and how a person may request access to them.

2.3 This manual sets out:

• who to contact at the Company to request access to a record;
• what categories of records the Company holds;
• how the Company processes personal information, as required by section 51 as amended by POPIA;
• the procedure, fees and timelines for making a request; and
• what a requester can do if a request is refused.

2.4 Providing information in this manual beyond what PAIA and POPIA require does not create any contractual or other entitlement to that information.

3. Particulars of the Company

Information Officer

Under section 1 of PAIA, the head of a private body is automatically the Information Officer.

Deputy Information Officer

The Company has not designated a Deputy Information Officer. All requests should be directed to the Information Officer.

4. The Regulator’s guide on how to use PAIA

4.1 The Regulator has compiled a guide, in terms of section 10 of PAIA, to help members of the public exercise their rights under PAIA and POPIA.

4.2 The guide is available from:

The Information Regulator (South Africa)
Website: inforegulator.org.za
Physical: Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg
Postal: P.O. Box 31533, Braamfontein, Johannesburg, 2017
PAIA complaints: PAIAComplaints@inforegulator.org.za
POPIA complaints: POPIAComplaints@inforegulator.org.za
General compliance: POPIACompliance@inforegulator.org.za

5. Records available without a PAIA request

The following are freely available on the Company’s websites and do not require a formal request:

• Product, service and pricing information for DigitalFlyer SA, DigitalFlyer Growth and KatisoBiz
• Terms of service and privacy policies
• Public marketplace entries created and published by businesses themselves
• Publicly published customer reviews
• Publicly listed events
• Blog, help and support content
• This PAIA manual

6. Records available under other legislation

Records may also be accessible in terms of, among others:

• Companies Act 71 of 2008
• Consumer Protection Act 68 of 2008
• Protection of Personal Information Act 4 of 2013
• Tax Administration Act 28 of 2011
• Value-Added Tax Act 89 of 1991
• Income Tax Act 58 of 1962
• Electronic Communications and Transactions Act 25 of 2002

This list may be incomplete. The Company will update it as it becomes aware of other legislation permitting access.

7. Categories of records held by the Company

Access to these records is subject to the grounds of refusal in Chapter 4 of Part 3 of PAIA.

7.1 Company and governance records

Founding documents, CIPC filings, shareholder and director records, board or member resolutions, statutory registers, licences and registrations, insurance policies.

7.2 Financial and tax records

Management accounts, annual financial statements, bank records, invoices issued and received, payment records, VAT records, SARS correspondence and returns, payroll records.

7.3 Customer and member records, DigitalFlyer SA and DigitalFlyer Growth

Account and contact details of businesses using the platform, subscription and billing records, marketplace entry content, onboarding submissions, uploaded brand assets and logos, support correspondence, referral and commission records for agents.

7.4 Reviewer records

Reviewer account details, email addresses used for verification, submitted reviews.

7.5 KatisoBiz module records

Member business details, member banking details, member subscription and topup records, and personal information of the member’s own customers including names, contact details, addresses and records of work performed. See section 8.6 below, which explains that the Company holds this last category as an operator and not as a responsible party.

7.6 Shop, book and event records

Order records, delivery details and payment references for purchases made through the Company’s shop, including sales of the book Standing 365. Event registration records.

7.7 Marketing and communication records

Email subscriber records, consent and unsubscribe records, delivery, bounce and complaint records, campaign performance data.

7.8 Technical and operational records

Application logs, error and security logs, access and audit logs, analytics data, backup records.

7.9 Supplier and contractor records

Agreements, contact details and payment records for suppliers, contractors and service providers.

8. Processing of personal information

Required by section 51 of PAIA as amended by POPIA.

8.1 Purposes of processing

• Providing, operating and supporting the Company’s products and services
• Creating and maintaining accounts and subscriptions
• Processing payments and maintaining billing records
• Publishing marketplace entries and reviews at the request of the business or reviewer concerned
• Enabling KatisoBiz members to create, send and store quotes, invoices and related records
• Fulfilling orders for goods and events
• Communicating with customers, including service messages and, where consent has been given, marketing
• Meeting legal, tax and regulatory obligations
• Detecting and preventing fraud and abuse
• Improving the Company’s products and services

8.2 Categories of data subjects and their personal information

8.3 Recipients of personal information

Personal information may be shared with the following categories of recipient, in each case only as necessary:

The Company does not sell personal information.

8.4 Cross-border transfers

Personal information is stored and processed outside the Republic of South Africa, principally in the European Union (Frankfurt, Germany), which has data protection laws substantially similar to POPIA. Certain sub-processors listed above are established in the United States and process personal information there.

Transfers are made in accordance with section 72 of POPIA, on the basis that the recipients are subject to laws or binding agreements providing an adequate level of protection, or that the transfer is necessary for the performance of a contract with the data subject.

8.5 Security measures

The Company applies appropriate, reasonable technical and organisational measures, including:

• Encryption of data in transit
• Encryption at rest of particularly sensitive fields, including banking details, with decryption logged
• Role-based access controls and database-level access restrictions separating each customer’s data
• Restricted administrative access, with support functions unable to view customer lists or banking details in the ordinary course of support
• Authentication controls on all accounts
• Logging and monitoring, including error and security monitoring
• Regular backups
• Contractual obligations imposed on sub-processors

The Company does not employ zero-knowledge encryption. Technical administrators may access data where necessary to maintain the service and resolve faults. This access is restricted, logged, and governed by internal policy.

8.6 Where the Company acts as an operator, not a responsible party

For the KatisoBiz module, personal information relating to a member’s own customers is processed by the Company solely as an operator under POPIA, on the documented instructions of that member.

The member is the responsible partyfor their customers’ personal information. A request by one of those customers to access, correct or delete their information should be directed to the member, not to the Company. Where such a request reaches the Company, it will be referred to the relevant member.

9. How to request access to a record

9.1 Form

A request must be made on the prescribed form, Form 2 of Annexure B to the PAIA Regulations (GNR 757 of 27 August 2021), available from inforegulator.org.za or from the Information Officer on request.

9.2 Where to send it

To the Information Officer at the addresses in section 3 above.

9.3 What the request must contain

• Sufficient detail to identify the record and the Information Officer
• The requester’s identity, with acceptable proof of identity
• The form of access required
• Postal, email or other address for a reply
• The right the requester is seeking to exercise or protect, and an explanation of why the record is required to exercise or protect that right. This is a requirement of section 53(2)(d) of PAIA and a request that omits it is likely to be refused.
• Where the request is made on behalf of another person, proof of the authority to do so

9.4 Fees

A personal requester, meaning someone requesting a record containing their own personal information, is not required to pay a request fee. Access fees may still apply.

The Information Officer will notify the requester of any fee payable before processing the request, and may require payment before access is given.

9.5 Timelines

The Information Officer will decide within thirty (30) days of receiving the request, and will notify the requester in writing. This period may be extended by a further thirty days in the circumstances allowed by section 57 of PAIA, in which case the requester will be notified.

9.6 Grounds for refusal

Access may be refused on the grounds in Chapter 4 of Part 3 of PAIA, including the mandatory protection of:

• the privacy of a third party who is a natural person (section 63)
• commercial information of a third party (section 64)
• information supplied in confidence (section 65)
• research information (section 69)
• legally privileged records (section 67)
• the Company’s own commercial information (section 68)

Section 70 of PAIA provides that access must nevertheless be granted where disclosure would reveal a substantial contravention of the law or an imminent and serious public safety or environmental risk, and the public interest in disclosure clearly outweighs the harm.

Reasons for any refusal will be given in writing.

10. Remedies if a request is refused

10.1 There is no internal appeal against a decision of the head of a private body.

10.2 A requester may:

• lodge a complaint with the Information Regulator, using the prescribed form, at PAIAComplaints@inforegulator.org.za; or
• apply to a court with jurisdiction, in terms of section 78 of PAIA, within 180 days of the decision.

11. Availability of this manual

11.1 This manual is available:

• on the Company’s website at https://growth.digitalflyersa.co.za/paia;
• at the Company’s principal place of business for inspection during normal business hours; and
• to any person on request, on payment of the prescribed fee.

11.2 It is available in English.

11.3 It will be updated on a regular basis as required by section 51(2) of PAIA.