Purpose of this PAIA Manual

The Promotion of Access to Information Act 2 of 2000 ("PAIA") gives effect to the constitutional right of access to information. In relation to a private body, access may be requested where the record is required for the exercise or protection of a right, the requester complies with PAIA's procedural requirements, and access is not refused on a ground permitted by PAIA.

This Manual is intended to enable members of the public to:

• understand how to request access to records held by Provara Group;
• identify the subjects on which Provara Group holds records and the categories of records held;
• identify records that are generally available without a formal PAIA request;
• understand records maintained under other applicable South African legislation;
• obtain the contact details of the person responsible for PAIA requests;
• understand the Information Regulator's PAIA Guide and where to obtain it;
• understand the purposes for which Provara Group processes personal information, the categories of data subjects and personal information involved, recipients, planned transborder flows and general security safeguards; and
• understand the request procedure, statutory fees, possible grounds of refusal and available remedies.

Key contacts for access to information

PAIA requests should preferably be directed to the Information Officer at jean@provaragroup.com so that they can be identified, logged and handled within the statutory timeframes.

Guide on how to use PAIA

The Information Regulator has, in terms of section 10 of PAIA, prepared and made available a Guide explaining how PAIA and relevant POPIA access rights may be exercised. The Guide includes information about PAIA's objects, how requests are made, available assistance, applicable fees and remedies where access is refused.

The Guide is published by the Information Regulator in South Africa's official languages and is also available in accessible formats made available by the Regulator.

Information Regulator contact details

Information Regulator (South Africa)
Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191
P.O. Box 31533, Braamfontein, Johannesburg, 2017
Telephone: 010 023 5200
Toll Free: 0800 017 160
General enquiries: enquiries@inforegulator.org.za
Website: inforegulator.org.za

Records generally available without Form 2

Provara Group makes certain information publicly available or available on ordinary request without requiring a formal PAIA Form 2. This is intended to reduce unnecessary formal requests. Availability remains subject to the record existing, being current, and not containing confidential or restricted information.

This table is not a formal notice under section 52 unless Provara Group separately elects to publish such a notice in the prescribed manner.

Records available in terms of other legislation

Provara Group creates, maintains or may be required to retain records under South African legislation applicable to its business. The legislation that may apply includes the following, to the extent relevant to the organisation's activities and circumstances:

Inclusion of legislation in this section does not mean that every listed category of record exists at all times. Applicability depends on Provara Group's actual activities, staffing, transactions and legal obligations.

Subjects on which records are held and categories of records

The categories above are descriptive rather than exhaustive. A record is not excluded from PAIA merely because it is not specifically named in this Manual.

Processing of personal information

7.1 Purposes of processing

Provara Group may process personal information for purposes including:

• operating its website and Shopify store;
• processing orders, payments, programme licences and digital-product delivery;
• responding to enquiries, demo bookings and support requests;
• preparing proposals and delivering consulting services;
• administering customer, supplier, contractor and employment relationships;
• maintaining financial, tax, corporate and statutory records;
• operating privacy, security, risk and compliance processes;
• protecting the organisation, its customers and its systems against fraud, misuse and security incidents;
• improving products, services and website functionality;
• direct marketing where permitted by law; and
• establishing, exercising or defending legal rights and complying with legal obligations.

7.2 Categories of data subjects and personal information

In some consulting engagements Provara Group may process limited personal information on behalf of a client as an Operator. Such processing is governed by the applicable engagement terms, confidentiality obligations and POPIA requirements.

7.3 Recipients or categories of recipients

Depending on the purpose and applicable legal requirements, personal information may be supplied to:

• Shopify and payment-service providers used to operate the online store and process transactions;
• email, productivity, scheduling, hosting, cloud, IT, security and communications service providers;
• professional advisers such as accountants, tax advisers or legal advisers where required;
• banks and financial institutions for payment and financial administration;
• regulators, revenue authorities, courts, law-enforcement agencies or other competent authorities where required or permitted by law;
• contractors or specialist service providers engaged for a defined business purpose; and
• other recipients authorised by the data subject or permitted under applicable law.

7.4 Planned transborder flows

Provara Group uses technology and service providers whose infrastructure or authorised sub-processors may process personal information outside South Africa. This may include Shopify and Google-related services and infrastructure in jurisdictions such as Canada, the United States and other countries in which those providers or their authorised sub-processors operate, depending on the service configuration.

Categories of information that may be transferred include customer and order information, business contact information, website and device information, communications, demo-booking information and other information necessary to provide the relevant technology or business service.

Cross-border transfers will be managed in accordance with section 72 of POPIA and applicable contractual or other transfer safeguards.

7.5 General description of information-security measures

Provara Group applies reasonable and appropriate technical and organisational safeguards having regard to the nature of the information and the risks involved. Depending on the system and context, safeguards may include:

• access controls and authentication controls;
• role-appropriate access and least-privilege practices where supported;
• secure configuration and use of reputable hosted technology providers;
• endpoint, device and account-security measures;
• secure storage, backup and recovery measures appropriate to the relevant records;
• confidentiality and contractual safeguards for service providers and contractors;
• security and privacy incident-management procedures;
• retention and secure deletion practices; and
• periodic review of material privacy and security risks.

The description above is intentionally general and does not disclose security information that could itself create a security risk.

How to request access to a record

A requester seeking access to a record of Provara Group under PAIA must comply with section 50 and the prescribed request procedure. The current prescribed request form is Form 2: Request for Access to Record under Regulation 7.

Decision, notification and statutory timeframes

Except where PAIA's third-party notification provisions apply, Provara Group must decide a properly submitted request as soon as reasonably possible and, in any event, within 30 days after receiving the request or the particulars required to process it.

The 30-day period may be extended once for a further period of no more than 30 days where one of the circumstances permitted by section 57 of PAIA applies. If extended, the requester will be notified of the extension, its duration and the reasons.

Provara Group will communicate the outcome in the prescribed manner, including through Form 3: Outcome of Request and of Fees Payable where applicable. If access is granted, the notice will identify any access fee and the form of access. If access is refused, adequate reasons will be provided without disclosing the protected content of the record.

Grounds on which access may be refused

Access is not automatic merely because Provara Group holds a record. A request may be refused only where PAIA permits or requires refusal. Grounds may include:

• protection of the privacy of a third party who is a natural person;
• protection of commercial information of a third party;
• protection of information supplied in confidence by a third party;
• protection of the safety of individuals and certain property interests;
• protection of records privileged from production in legal proceedings;
• protection of Provara Group's commercial information, trade secrets, financial, commercial, scientific or technical information, or information whose disclosure could cause commercial disadvantage;
• protection of certain research information; and
• any other mandatory or discretionary ground of refusal provided for in Chapter 4 of Part 3 of PAIA.

Where only part of a record is protected, Provara Group will consider whether reasonably severable portions can be disclosed in accordance with PAIA.

Prescribed PAIA fees

Fees are prescribed by the Regulations Relating to the Promotion of Access to Information, 2021. The schedule below reflects the prescribed private-body fees applicable at the date of this Manual. If the statutory fee schedule is amended, the amended prescribed fees prevail.

A record may be withheld until applicable prescribed fees have been paid. A requester may challenge a fee or deposit through the remedies provided in PAIA.

Complaints and other remedies

A private body does not have the same compulsory internal-appeal process that applies to certain public bodies. If a requester is dissatisfied with Provara Group's decision, or no response is received within the statutory period, the requester may lodge a complaint with the Information Regulator in accordance with PAIA.

The Information Regulator currently requires PAIA complaints to be lodged using Form 5. For private-body requests, the Regulator states that a complaint should generally be lodged within 180 days of the refusal or non-response.

A requester or third party may also seek appropriate relief from a competent court in accordance with PAIA. Where the complaints procedure applies, the applicable statutory complaint process must be exhausted before a court application is pursued.

Availability of this Manual

A current copy of this PAIA Manual is made available:

• on the Provara Group website at provaragroup.com;
• at Provara Group's principal place of business for public inspection during normal business hours;
• to any person on request, subject to any reasonable prescribed copying charge that lawfully applies; and
• to the Information Regulator upon request.

Requests for an electronic copy of this Manual may be sent to jean@provaragroup.com.

Updating, governance and document control

Provara Group will review this Manual regularly and update it when material changes occur to the organisation, its records, processing activities, service providers, contact details, applicable legislation, prescribed forms, fees or Information Regulator guidance.

PAIA request records, decisions and related correspondence will be managed as part of Provara Group's broader privacy and information-governance framework. Provara Group will also comply with applicable PAIA reporting obligations to the Information Regulator.

This Manual supersedes the previous Provara Group PAIA Manual to the extent of any inconsistency. Statutory provisions, regulations and prescribed forms prevail if they are amended after the revision date shown above.