DRAFT. Have this manual reviewed by a South African attorney, fill in every highlighted field, then delete this box. Keep a copy at your principal place of business, and make sure your Information Officer is registered on the Information Regulator’s eServices portal.
01Purpose of this manual
PAIA gives everyone the right to request access to records held by a private body where the record is needed to exercise or protect a right. This manual explains how to make such a request to Dynepta. It also contains the information about our processing of personal information that POPIA requires to be included.
02Contact details
- Name of private body
- [Registered company name], trading as Dynepta
- Registration number
- [CIPC registration number]
- Head of the private body
- [Full name, title]
- Information Officer
- [Full name]
- Deputy Information Officer
- [Full name, or delete this row]
- Street address
- [Physical business address]
- Postal address
- [Postal address]
- Phone
- [+27 phone number]
- [privacy@ email address]
- Website
- www.dynepta.com
03The Information Regulator’s guide
Under section 10 of PAIA, the Information Regulator has published a guide on how to use PAIA and POPIA. It is available in all official languages on the Information Regulator’s website, and copies may be inspected at the Regulator’s office:
- Address
- Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191
- Phone
- 010 023 5200
On request, we will also make a copy of the guide available for inspection at our offices during normal business hours.
04Records available without a request
We have not published a notice under section 52 of PAIA. The following information is freely available on this website without a formal request: information about our services, our Privacy notice, our Terms of use, our Client data protection statement, our Company information and this manual.
05Records kept under other legislation
Where applicable to our business, we keep records in terms of the following laws:
- Basic Conditions of Employment Act 75 of 1997
- Companies Act 71 of 2008
- Compensation for Occupational Injuries and Diseases Act 130 of 1993
- Consumer Protection Act 68 of 2008
- Electronic Communications and Transactions Act 25 of 2002
- Employment Equity Act 55 of 1998
- Income Tax Act 58 of 1962
- Labour Relations Act 66 of 1995
- Promotion of Access to Information Act 2 of 2000
- Protection of Personal Information Act 4 of 2013
- Skills Development Levies Act 9 of 1999
- Tax Administration Act 28 of 2011
- Unemployment Insurance Act 63 of 2001 and Unemployment Insurance Contributions Act 4 of 2002
- Value-Added Tax Act 89 of 1991
06Subjects and categories of records we hold
| Subject | Categories of records |
|---|---|
| Company and statutory | Memorandum of incorporation, CIPC registration documents, registers of directors and shareholders, minutes and resolutions. |
| Finance and tax | Financial statements, accounting records, invoices, bank statements, tax and VAT returns and related correspondence. |
| Clients | Master services agreements, scope sheets, data processing agreements, proposals, correspondence, project documentation, and pass/fail summaries of data checks (which contain no personal information). |
| Suppliers and service providers | Agreements, operator agreements, invoices and correspondence. |
| Personnel | Employment contracts, payroll, leave, tax and statutory records, where we have employees or contractors. |
| Information technology and security | Policies, access register, access reviews, system and audit logs, incident records. |
| Intellectual property | The Dynepta toolkit source code, templates and documentation, and trademarks. |
| Marketing | Website content, marketing materials and records of marketing consent and opt-outs. |
Client data is held by our clients, not by us. The data in a client’s platform belongs to that client and is stored in their own Google Cloud organisation, with Dynepta acting only as their operator. Requests for access to that data should be sent to the client, who is the responsible party. If we receive such a request, we will refer it to the client.
07How to request access
- Complete PAIA Form 2 (Request for Access to Record), which is available on the Information Regulator’s website. If you need help completing the form, our Information Officer will assist you.
- Describe the record you want in enough detail for us to find it, say how you want to receive it (for example, an emailed copy), and give your contact details.
- Identify the right you want to exercise or protect, and explain why you need the record for that purpose (section 53(2)(d) of PAIA).
- If you are asking on behalf of someone else, attach proof of your authority to do so.
- Send the form to our Information Officer by email or deliver it to our street address, together with proof of payment of the request fee where one applies.
We will decide on your request within 30 days of receiving it, and tell you the outcome in writing. We may extend this period once, by up to a further 30 days, in the circumstances set out in section 57 of PAIA, and we will tell you if we do.
08Fees
Fees are set out in Annexure B of the PAIA Regulations, 2021:
- Request fee: R140.00. It is not payable if you are asking for personal information about yourself.
- Access fees: payable if access is granted, for example R2.00 per A4 page for a photocopy or printed copy, plus the prescribed fees for searching for and preparing the record and for postage where applicable.
- Deposit: if searching for and preparing the record will take more than the prescribed number of hours, we may ask for a deposit of up to one third of the access fee before we start.
We will tell you in writing of any fee before it becomes payable.
09Grounds for refusal
We may, and in some cases must, refuse access on the grounds set out in Chapter 4 of Part 3 of PAIA, including where access would:
- unreasonably disclose personal information about a third party (section 63);
- disclose a third party’s trade secrets, or commercial or confidential information (sections 64 and 65);
- endanger the life or safety of an individual, or the security of property or systems (section 66);
- disclose a record that is privileged from production in legal proceedings (section 67);
- disclose our own trade secrets or commercial information, such as the toolkit source code (section 68);
- disclose research information of a third party or of Dynepta (section 69).
If we refuse a request, we will give our reasons and tell you how to challenge the decision. If a record cannot be found or does not exist, we will tell you so by affidavit or affirmation.
10Remedies
Dynepta has no internal appeal procedure. If you are not satisfied with our decision, or we do not respond in time:
- You may lodge a written complaint with the Information Regulator within 180 days, using PAIA Form 5, at PAIAComplaints@inforegulator.org.za (sections 77A and 77B of PAIA).
- Once you have used the Regulator’s complaint procedure, you may apply to a court for relief within 180 days (section 78 of PAIA).
11Processing of personal information
Purpose of processing
We process personal information to respond to enquiries, to provide our services and manage our client and supplier relationships, to employ and pay personnel, to keep our systems secure, and to comply with our legal obligations. As an operator, we also process personal information on behalf of our clients, only on their written instructions.
Categories of data subjects and their information
| Data subjects | Personal information |
|---|---|
| Prospective clients and website enquirers | Name, contact details, company, job title, correspondence. |
| Client and supplier contact people | Name, contact details, job title, contract and billing records, correspondence. |
| Personnel and contractors | Identity details, contact details, banking and tax details, employment records. |
| Website visitors | IP address and browser information in server logs and, only with their consent, analytics cookie identifiers and usage information. |
| Our clients’ data subjects (as operator) | Whatever the client’s source systems contain, processed only in the client’s own Google Cloud organisation and on their instructions. |
Recipients
Our operators (website host, email and productivity provider, website analytics provider, accounting software provider), our professional advisers, and authorities where the law requires disclosure. See our Privacy notice for details.
Planned transfers outside South Africa
Some of our service providers store or process information outside South Africa. We transfer personal information across borders only in line with section 72 of POPIA. Client platforms are deployed in the client’s own Google Cloud organisation, by default in Google Cloud’s europe-west1 region (Belgium).
Security measures
Our safeguards include encryption in transit, two-step login on all company accounts, least-privilege access granted to groups rather than to individuals, an access register reviewed every quarter, no service account keys, secrets kept in a secrets manager, and fake data only in non-production environments. More detail is in our Client data protection statement.
12Availability of this manual
This manual is available on our website and for inspection at our street address during normal business hours, free of charge. We will provide a copy to the Information Regulator on request. We review it at least once a year and whenever our processing changes.