PAIA access-to-information manual

1. Purpose and status

This manual explains how to request records from the business trading as Vula Connect under the Promotion of Access to Information Act 2 of 2000 (PAIA), and summarises relevant processing under the Protection of Personal Information Act 4 of 2013 (POPIA). A private-body access request must meet the statutory requirements, including that the record is required to exercise or protect a right.

This is an incomplete review draft. The contact particulars, actual records inventory, applicable legislation and processing details below must be verified by the head or Information Officer before approval. A record’s inclusion in an inventory does not mean it is automatically available.

2. Business and Information Officer particulars

Trading name

Vula Connect

Full legal name / legal form

To confirm

Registration number (if applicable)

To confirm

Head of private body

To confirm

Registered Information Officer

To confirm name, designation and registration

Deputy Information Officer(s)

To confirm appointment or mark not applicable

Physical and postal addresses

To confirm both

Telephone

To confirm

General contact

info@vulaconnect.com

Dedicated PAIA contact / email

To confirm; general enquiries may currently be directed to the contact above

Website

To confirm final production domain and manual URL

3. The Regulator’s guide and assistance

The Information Regulator publishes a guide explaining PAIA, access procedures and remedies, with language versions available through its PAIA guidelines page. You may request help from the Regulator or the business’s Information Officer. The approved manual must confirm arrangements for inspection or obtaining a guide at the business premises.

4. Publicly available records

Published service descriptions, pricing approach, contact information and website policy pages can be read on the website without a formal PAIA request. Published content may be saved or printed using a browser. Other records are not made public merely because their category appears below.

To confirm: any additional voluntary disclosures or section 52 notice, and associated access arrangements.

5. Records held and applicable legislation

The following is a proposed inventory for owner verification; it is not a statement that every listed record exists.

Legislation register to confirm: PAIA and POPIA; the Electronic Communications and Transactions Act 25 of 2002 where applicable; the Companies Act 71 of 2008 if the operator is a company; applicable tax legislation; and employment legislation if the business employs people. The owner must replace this provisional list with the legislation under which this particular business keeps records. Statutory recordkeeping does not itself make a record publicly accessible.

6. How to request a record

1. Use the current PAIA Form 2 — Request for Access to Record from the Regulator.
2. Identify the requested record sufficiently for it to be located. State the right you wish to exercise or protect and explain why the record is required for that purpose.
3. Provide the requested contact details and indicate the form of access and preferred notification method. If acting for someone else, provide evidence of authority. Identity verification must be proportionate and handled securely.
4. Submit to the head or Information Officer using the completed contact particulars above. For routing assistance while those particulars are being confirmed, contact info@vulaconnect.com. Ask for a secure submission route before sending sensitive identity evidence.

If a disability prevents a written request, tell the Information Officer so appropriate assistance can be arranged. A general enquiry or marketing opt-out does not need to be converted into a PAIA request. Requests for your own personal information are also subject to POPIA.

7. Fees, decisions and access

Fees are governed by the applicable PAIA regulations, including relevant exemptions and the distinction between request and access fees. Consult the Regulator’s current PAIA resources. You must be told of applicable fees or any lawful deposit before payment is required, with the relevant outcome and fee notice. No fee amount has been invented for this draft.

A decision is ordinarily required within 30 days of receiving the request. PAIA permits a single extension of up to a further 30 days only in the circumstances it specifies, with notice and reasons. If access is granted, the notice should explain how and when it will be provided and any fees. Failure to decide within the applicable time may constitute a deemed refusal.

PAIA contains grounds for refusing or limiting access, including protection of certain third-party personal, commercial, confidential or privileged information. A refusal must be based on the Act and explained; a general label of “confidential” is not enough. Severability, third-party notice procedures and the public-interest override must be considered where applicable. If a record cannot be found or does not exist, the statutory explanation procedure applies.

8. Remedies and regulator contact

A private body does not have the public-body internal appeal process under PAIA. If dissatisfied with a decision, fees, an extension or a deemed refusal, you may use the applicable statutory remedies. A complaint to the Regulator is generally due within 180 days of the relevant decision or deemed refusal; the Regulator may allow a late complaint on good cause. Use the current PAIA Form 5 and instructions. Court remedies are also available subject to PAIA’s procedural requirements and time limits.

Information Regulator (South Africa)
PAIA: PAIAComplaints@inforegulator.org.za
POPIA: POPIAComplaints@inforegulator.org.za
General: enquiries@inforegulator.org.za
Telephone: 010 023 5200 / 0800 017 160
Physical address: Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191.

Current forms and submission options: PAIA information and the Regulator’s eServices portal.

9. Personal information processing

See the privacy policy for proposed purposes, information categories and rights procedures. The following particulars require business verification:

• Data subjects and categories: enquirers, client and supplier contacts; work contact and correspondence details; relevant contractual and billing information. Confirm personnel and client-controlled identity or support records where applicable.
• Purposes: respond to enquiries, scope and deliver authorised services, administer contracts and accounts, protect systems and handle legal obligations and rights requests.
• Recipients: authorised personnel and necessary hosting, email, delivery, accounting or professional providers. Confirm actual categories and providers, including operator terms.
• Cross-border flows: confirm provider countries, onward transfers and the section 72 basis for each flow before approval.
• Security measures: confirm implemented organisational and technical controls, including access management, transmission safeguards, backups where appropriate, incident response and supplier oversight. This draft is not evidence that specific controls are implemented.

10. Availability, review and approval

The approved manual should be accessible on the website, at the business’s principal place of business for inspection during normal business hours, and to the Regulator on request. Prescribed reproduction charges may apply to copies where permitted. The premises and access arrangements remain to confirm.

The head or Information Officer should keep the manual current when contact details, records or processing change. Approval to complete: name and designation of approving head, signature or approval record, effective date, review date and confirmed public URL.