PAIA Manual

1. Our contact details

2. The Information Regulator's guide

1. The Information Regulator has published a guide on how to use PAIA and POPIA, as required by section 10 of PAIA. It explains your rights and the remedies available to you.
2. The guide is available in every official language and in braille. You can download it from inforegulator.org.za, or ask our Information Officer for a copy.
3. You can contact the Information Regulator at:

   Physical address	Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191
   General enquiries	enquiries@inforegulator.org.za
   PAIA complaints	PAIAComplaints@inforegulator.org.za
   Website	inforegulator.org.za

3. Records available without a request

1. We have not published a notice under section 52 of PAIA.
2. You do not need to make a formal request for information that we publish, such as the content of our website, our Terms and Conditions, our Privacy Policy, this manual and our published marketing material.
3. Our company information filed with CIPC is also publicly available from CIPC.

4. Records kept under other laws

We keep records as required by the following laws, where they apply to us. This list is not complete, and we will update it as laws change.

• Basic Conditions of Employment Act 75 of 1997
• Companies Act 71 of 2008 and the Companies Regulations, 2011
• Compensation for Occupational Injuries and Diseases Act 130 of 1993
• Consumer Protection Act 68 of 2008
• Electronic Communications and Transactions Act 25 of 2002
• Financial Intelligence Centre Act 38 of 2001
• Income Tax Act 58 of 1962
• Promotion of Access to Information Act 2 of 2000
• Protection of Personal Information Act 4 of 2013
• Tax Administration Act 28 of 2011
• Unemployment Insurance Act 63 of 2001
• Unemployment Insurance Contributions Act 4 of 2002
• Value-Added Tax Act 89 of 1991

5. Records we hold

We hold records on the subjects below. Access to any record is subject to the grounds for refusal in section 8. Many of the records we hold belong to our clients and contain their confidential and personal information.

6. How to request access

1. Use Form 2, "Request for Access to Record", published by the Information Regulator under the PAIA Regulations. You can download it from inforegulator.org.za or ask us for a copy. Please check that you use the latest version.
2. Send the completed form to our Information Officer at info@libelulaconsult.com, or deliver it to our street address.
3. Your request must:
   • give enough detail for us to identify the record and you as the requester,
   • state the form of access you want, such as a copy by email,
   • state the right you want to exercise or protect, and explain why you need the record for that purpose, and
   • include your postal address, email address or other contact details.
4. If you request on behalf of someone else, you must provide proof of your authority to do so.
5. We may ask for proof of your identity before we release any record.
6. We will decide on your request within 30 days of receiving it with all the required details. We may extend this period once, by up to 30 days, in the circumstances section 57 of PAIA allows. We will tell you in writing if we do.
7. If we do not respond within the required time, PAIA treats your request as refused.
8. If your request concerns a record about another person or organisation, we may first need to notify them and give them a chance to make representations, as Chapter 5 of Part 3 of PAIA requires.

7. Fees

The fees below are prescribed for private bodies by the PAIA Regulations, as published by the Information Regulator.

1. The request fee does not apply if you request records containing only your own personal information.
2. We tell you in writing what access fee is payable. You must pay it before we give you access.
3. We pay back any deposit if your request is refused.

8. Grounds for refusal

PAIA sets out when a private body must or may refuse access. We may refuse a request, or part of it, where access would, among other things:

• involve the unreasonable disclosure of personal information about another person (section 63),
• disclose a third party's trade secrets or confidential commercial, financial or scientific information (section 64),
• breach a duty of confidence we owe to a third party, including our clients (section 65),
• endanger the safety of a person or the security of property (section 66),
• disclose records that are privileged from production in legal proceedings (section 67),
• disclose our own trade secrets or commercial information, or harm our commercial or financial interests (section 68), or
• disclose research information of a third party or of our own (section 69).

We will not refuse access where section 70 of PAIA requires disclosure in the public interest. If a record contains information we must refuse, we will give access to the rest of the record where we can.

9. If you disagree with our decision

1. We do not have an internal appeal procedure. The decision of our Information Officer is final within Libelula.
2. If you disagree with our decision to refuse access, or with a decision about fees, an extension of time or the form of access, you may lodge a complaint with the Information Regulator within 180 days of the decision. Section 77A of PAIA provides for this.
3. You may also apply to court for relief, as provided for in PAIA.

10. How we process personal information

Section 51 of PAIA requires this manual to describe how we process personal information. Our Privacy Policy gives full details.

Purpose of processing

We process personal information to provide company secretarial and statutory compliance services, to file documents with CIPC, to keep statutory records for clients, to verify identity and ownership, to invoice and receive payment, to meet our legal and tax obligations, to run our business and to communicate with clients and enquirers.

Categories of data subjects and their information

Recipients of personal information

• CIPC and other regulators and authorities, including the South African Revenue Service and the Financial Intelligence Centre, where the law requires it or a filing needs it
• Service providers who process information for us, including our email and document storage, form, payment, accounting, company secretarial software, electronic signature, website hosting and courier providers
• Professional advisers, such as attorneys, auditors and accountants
• Any other person a client asks us to share information with

Planned transfers outside South Africa

Some of our service providers store or process information on servers outside South Africa, such as cloud email, document storage, payment and software services. We transfer personal information across borders only as section 72 of POPIA allows, for example where the recipient is subject to laws, binding corporate rules or an agreement giving substantially similar protection.

Security measures

We use appropriate, reasonable technical and organisational measures to protect personal information. These include password-protected business systems with restricted access, reputable cloud providers with strong security controls, secure methods for sharing documents, written agreements requiring our operators to protect personal information, and card payments processed only on PayFast's PCI DSS certified payment page. If personal information is compromised, we notify the Information Regulator and the people affected, as section 22 of POPIA requires.

11. Objections and corrections under POPIA

1. To object to the processing of your personal information, use Form 1 under the POPIA Regulations, 2018.
2. To ask us to correct or delete your personal information, use Form 2 under the POPIA Regulations, 2018.
3. Both forms are available from inforegulator.org.za or from our Information Officer. Send them to info@libelulaconsult.com. You may also contact us by email without a form, and we will help you.

12. Availability and updates

1. This manual is available on our website at libelulaconsult.com/paia.html. You may also inspect it at our street address during office hours, by appointment.
2. We will email you a copy free of charge. A printed copy costs R2.00 per A4 page.
3. We will provide a copy to the Information Regulator on request.
4. We review this manual at least once a year and update it when our details or practices change.