PAIA Manual

This manual is for the public.It exists so that a person can, without approaching the Company first: see which categories of record are available without a formal request; understand well enough what the Company holds to be able to ask for a record; find the records available under other legislation; reach the Information Officer; find the Regulator's guide on how to use PAIA; and see what personal information the Company processes, why, who receives it, whether it leaves the Republic, and whether it is secured.

A right of access to a private body's record is not unconditional. Under section 50(1) of PAIA a requester must be given access only where the record is required for the exercise or protection of a right, the procedural requirements in PAIA are met, and no ground of refusal in Chapter 4 applies. This manual neither enlarges that right nor waives a ground of refusal.

The Company revises this manual as its records and its processing change, and the current version is always the one published on this page.

The Regulator has, under section 10(1) of PAIA, compiled and updated a Guide on how to use PAIA, in an easily comprehensible form, for a person who wishes to exercise a right under PAIA or POPIA. It is available in each of the official languages and in braille.

The Guide describes: the objects of PAIA and POPIA; the contact particulars of the information officers and deputy information officers of public and private bodies; the manner and form of a request for access to a record of a public body under section 11 and of a private body under section 50; the assistance available from an information officer and from the Regulator; every remedy in law available in respect of an act or failure to act under PAIA and POPIA, including how to lodge an internal appeal, a complaint to the Regulator and an application to a court; the provisions of sections 14 and 51 requiring a manual; the provisions of sections 15 and 52 on voluntary disclosure; the notices on fees under sections 22 and 54; and the regulations made under section 92.

How to obtain the Guide. Download it from the Regulator at inforegulator.org.za, request it from the Information Officer at privacy@synthro.io, or inspect it at the Company's registered address during normal business hours.

Made available voluntarily under section 52(1) of PAIA. No request, and no fee, is needed for any of these.

Purpose of processing, and two very different roles. The Company processes personal information for two purposes that must not be confused. First, as Responsible Party for its own business: to contract with and support its customers, to bill them, to employ and engage its own people, to market its services lawfully, and to meet its statutory obligations. Second, as Operatorfor the employee information its customers load onto the Platform. For that information the customer is the Responsible Party and decides what happens to it; the Company processes it only on the customer's authorisation, only to provide, operate and support the Platform for that customer and to comply with the law, and treats it as confidential.

A request about a customer's employee record is not the Company's to answer. Where a data subject approaches the Company about information held on the Platform on a customer's behalf, the Company will not respond substantively. It refers the request to that customer without undue delay and assists the customer in answering it. The employer, not the Company, decides that request.

The Company does not use Customer Data to train artificial intelligence.It is not used to train, fine-tune, retrain or otherwise improve any machine-learning or artificial-intelligence model, whether the Company's or a third party's, and no employee record is stored by any artificial-intelligence provider.

8.2 · Categories of data subjects, and the information processed

8.3 · Recipients to whom personal information may be supplied

8.4 · Planned transborder flows of personal information

A general description, as the Regulator's template requires.The Company maintains appropriate, reasonable technical and organisational measures to secure the integrity and confidentiality of the personal information in its care, as sections 19 and 21 of POPIA require. These include: encryption in transit and at rest; database-level row security, so that each customer's data is logically isolated and inaccessible to any other customer; authenticated, role-based access control, with multi-factor authentication available on accounts and required for administrative access; access by Company personnel strictly on a need-to-know basis under a binding duty of confidentiality; audit logging of administrative access; regular encrypted backups, together with an independent encrypted offsite copy held with a separate provider for disaster recovery; and a documented incident-response procedure.

This description is deliberately general. The Act asks for the nature of the safeguards, not their configuration. The Company will not publish detail that would assist a person seeking to defeat them. A customer conducting a governance or procurement review may request fuller detail under confidentiality.

If safeguards are compromised. Where there are reasonable grounds to believe that personal information has been accessed or acquired by an unauthorised person, the Company notifies the affected customer in writing immediately and in any event within twenty-four hours, notifies the Regulator and the data subjects as section 22 of POPIA requires, and contains, investigates and remediates the incident.

Use the prescribed form. A request for access to a record of a private body must be made on the form prescribed by the PAIA Regulations, being Form 2 under the Regulations published in 2021. Download the current form from the Regulator at inforegulator.org.za, or ask us for a copy at privacy@synthro.io.

Send it to the Information Officer at privacy@synthro.io, or by post or delivery to the address in section 3. Give enough particulars for the Company to identify the record and to identify you; state the form of access you want; give an address in the Republic for the reply; and — this is the part most often left out, and the Company cannot decide a request without it — state the right you are seeking to exercise or protect, and explain why the record is required for that.

If you are asking on someone else's behalf, submit proof of your authority in a form satisfactory to the Information Officer. If you cannot read or write, or a disability prevents you completing the form, you may make the request orally, and the Information Officer will reduce it to writing and give you a copy.

Fees. A request fee, and where access is granted an access fee, are prescribed by Annexure B to the PAIA Regulations. The Company charges what is prescribed and nothing more; it levies no fee of its own. Because those amounts are set and changed by Gazette they are not reproduced here: the Information Officer will notify you in writing of the amount payable before the request is processed further, as section 54 requires. A request by a data subject for their own personal information carries no request fee.

Decision and time. The Company will decide within thirty days of receiving a compliant request, and will notify you in writing of the decision and, where access is refused, of adequate reasons and the provisions relied on. That period may be extended by a further thirty days in the circumstances PAIA permits, and you will be told if it is.

Grounds of refusal. The Company may be obliged or entitled to refuse access under Chapter 4 of Part 3 of PAIA, including to protect the privacy of a third party, the commercial information of a third party or of the Company, information held in confidence, and records privileged from production in legal proceedings. A customer's Customer Data is the commercial and confidential information of that customer, and the Company will not disclose it to a third party without that customer's authorisation or a lawful obligation to do so.

If you are dissatisfied. There is no internal appeal against a decision of the head of a private body. You may lodge a complaint with the Regulator under section 77A of PAIA, on the prescribed complaint form, at PAIAComplaints@inforegulator.org.za; or apply to a court under section 78. Nothing in this manual limits either remedy.

Where to find this manual. It is published on this page and downloadable as a PDF; it is available for public inspection at the Company's registered address during normal business hours; it will be sent to any person on request, a reasonable prescribed fee per A4 photocopy applying to a paper copy and no fee to the electronic copy; and it is available to the Regulator on request.

The Company updates this manual whenever its records or its processing change materially, and reviews it at least annually. The date of compilation and the date of the current revision appear at the top of this page.