PAIA Manual
PAIA Manual Provara Group (Pty) Ltd
Prepared in terms of section 51 of the Promotion of Access to Information Act 2 of 2000, as amended. This Manual explains what records Provara Group holds, how access may be requested, and the information required by PAIA and POPIA for a private body.
Purpose of this PAIA Manual
The Promotion of Access to Information Act 2 of 2000 ("PAIA") gives effect to the constitutional right of access to information. In relation to a private body, access may be requested where the record is required for the exercise or protection of a right, the requester complies with PAIA's procedural requirements, and access is not refused on a ground permitted by PAIA.
This Manual is intended to enable members of the public to:
- understand how to request access to records held by Provara Group;
- identify the subjects on which Provara Group holds records and the categories of records held;
- identify records that are generally available without a formal PAIA request;
- understand records maintained under other applicable South African legislation;
- obtain the contact details of the person responsible for PAIA requests;
- understand the Information Regulator's PAIA Guide and where to obtain it;
- understand the purposes for which Provara Group processes personal information, the categories of data subjects and personal information involved, recipients, planned transborder flows and general security safeguards; and
- understand the request procedure, statutory fees, possible grounds of refusal and available remedies.
Important distinction: this Manual explains the statutory access-to-records process. Requests by a data subject for access to their own personal information may also engage section 23 of POPIA and will be handled together with the applicable PAIA process.
Key contacts for access to information
Email: jean@provaragroup.com
Telephone: +27 82 294 2473
Fax: Not applicable
Registration: 2026/029775/07
General email: info@provaragroup.com
Website: provaragroup.com
16 Roos Bolton Crescent
Knysna Heights
Knysna, Western Cape, 6571
South Africa
16 Roos Bolton Crescent
Knysna Heights
Knysna, Western Cape, 6571
South Africa
PAIA requests should preferably be directed to the Information Officer at jean@provaragroup.com so that they can be identified, logged and handled within the statutory timeframes.
Guide on how to use PAIA
The Information Regulator has, in terms of section 10 of PAIA, prepared and made available a Guide explaining how PAIA and relevant POPIA access rights may be exercised. The Guide includes information about PAIA's objects, how requests are made, available assistance, applicable fees and remedies where access is refused.
The Guide is published by the Information Regulator in South Africa's official languages and is also available in accessible formats made available by the Regulator.
Inspection of the Guide: copies of the Regulator's Guide in at least two official languages is available for public inspection at Provara Group's principal place of business during normal business hours. Electronic copies can also be obtained from the Information Regulator's website.
Information Regulator contact details
Information Regulator (South Africa)
Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191
P.O. Box 31533, Braamfontein, Johannesburg, 2017
Telephone: 010 023 5200
Toll Free: 0800 017 160
General enquiries: enquiries@inforegulator.org.za
Website: inforegulator.org.za
Records generally available without Form 2
Provara Group makes certain information publicly available or available on ordinary request without requiring a formal PAIA Form 2. This is intended to reduce unnecessary formal requests. Availability remains subject to the record existing, being current, and not containing confidential or restricted information.
| Category | Examples | Access method |
|---|---|---|
| Corporate information | Public company profile, contact information and website disclosures | Website |
| Products and services | Programme, workspace, pricing and consulting-service descriptions | Website |
| Privacy and access information | Privacy & Cookie Notice and this PAIA Manual | Website |
| Customer legal information | Terms of Service and Refund & Cancellation Policy, where published | Website |
| Marketing and educational material | Public insights, articles, brochures and other published material | Website or ordinary request |
This table is not a formal notice under section 52 unless Provara Group separately elects to publish such a notice in the prescribed manner.
Records available in terms of other legislation
Provara Group creates, maintains or may be required to retain records under South African legislation applicable to its business. The legislation that may apply includes the following, to the extent relevant to the organisation's activities and circumstances:
| Legislation | Examples of relevant records |
|---|---|
| Companies Act 71 of 2008 | Company registration, constitutional, director, shareholder, accounting and corporate-governance records |
| Income Tax Act 58 of 1962 | Income-tax and related financial records |
| Tax Administration Act 28 of 2011 | Tax administration, returns, supporting records and correspondence |
| Promotion of Access to Information Act 2 of 2000 | PAIA Manual, request records, decisions, correspondence and access records |
| Protection of Personal Information Act 4 of 2013 | Privacy governance, data-subject requests, processing, security and compliance records |
| Electronic Communications and Transactions Act 25 of 2002 | Electronic transaction, website and e-commerce records where applicable |
| Consumer Protection Act 68 of 2008 | Consumer-facing transaction, service, refund and customer-communication records where the Act applies |
Inclusion of legislation in this section does not mean that every listed category of record exists at all times. Applicability depends on Provara Group's actual activities, staffing, transactions and legal obligations.
Subjects on which records are held and categories of records
| Subject | Categories of records that may be held |
|---|---|
| Corporate governance | MOI, CIPC records, director and shareholder records, resolutions, governance decisions and statutory registers |
| Finance and tax | Accounting records, invoices, bank records, financial statements, tax records, expense records and supporting documents |
| Customers and orders | Customer contact information, orders, purchase records, billing records, licences, fulfilment records, customer support and related correspondence |
| POPIA Compliance Programme | Programme content, workspace resources, templates, procedures, registers, user documentation, licensing records and product-development records |
| Consulting engagements | Proposals, scopes of work, contracts, project correspondence, deliverables, advisory records and engagement administration |
| Suppliers and service providers | Contracts, terms, due diligence, invoices, contact details, service records, confidentiality and data-protection arrangements |
| Website and e-commerce | Website content, Shopify records, website configuration, order administration, cookie-consent records, analytics records and security-related records where available |
| Marketing and business development | Marketing content, campaign records, enquiries, demo bookings, communication preferences and public insights |
| Privacy and compliance | Privacy notices, PAIA records, ROPA and processing records, risk assessments, operator records, incidents, data-subject requests, training and compliance evidence |
| Legal and contractual | Contracts, legal correspondence, intellectual-property records, licence terms, dispute records and professional-adviser correspondence |
| Shareholders | Shareholder identity and contact information, shareholding records, securities-register information, shareholder resolutions, statutory corporate records and related governance correspondence |
| General administration | Business correspondence, meeting records, insurance, operational administration and other records generated in the ordinary course of business |
The categories above are descriptive rather than exhaustive. A record is not excluded from PAIA merely because it is not specifically named in this Manual.
Processing of personal information
7.1 Purposes of processing
Provara Group may process personal information for purposes including:
- operating its website and Shopify store;
- processing orders, payments, programme licences and digital-product delivery;
- responding to enquiries, demo bookings and support requests;
- preparing proposals and delivering consulting services;
- administering shareholder, customer, supplier and service-provider relationships;
- maintaining financial, tax, corporate and statutory records;
- operating privacy, security, risk and compliance processes;
- protecting the organisation, its customers and its systems against fraud, misuse and security incidents;
- improving products, services and website functionality;
- direct marketing where permitted by law; and
- establishing, exercising or defending legal rights and complying with legal obligations.
7.2 Categories of data subjects and personal information
| Data subject category | Personal information that may be processed |
|---|---|
| Customers and customer contacts | Name, business contact details, organisation, role, billing details, order and licence information, support records and communications |
| Prospective customers and enquirers | Name, email address, telephone number, organisation, enquiry details, demo-booking information and communications |
| Consulting clients and client contacts | Business contact details, engagement information, correspondence and information reasonably necessary to perform the agreed consulting services |
| Website visitors | IP address, browser or device data, cookie identifiers, consent preferences, referral and website-usage information where collected |
| Suppliers and service-provider contacts | Name, organisation, contact details, contractual information, invoices, banking or payment information and service records where required |
| Shareholders | Identity and contact details, shareholding information, statutory corporate information, banking or payment information where required, and correspondence relating to the administration and governance of the company |
| Business and professional contacts | Name, organisation, role, contact details and business correspondence |
| Requesters, complainants and regulatory contacts | Identity, contact details, request or complaint information, correspondence, verification material and decision records |
In some consulting engagements Provara Group may process limited personal information on behalf of a client as an Operator. Such processing is governed by the applicable engagement terms, confidentiality obligations and POPIA requirements.
7.3 Recipients or categories of recipients
Depending on the purpose and applicable legal requirements, personal information may be supplied to:
- Shopify and its authorised service providers and sub-processors, for operation of the online store, order administration, digital-product delivery and related e-commerce functionality;
- Google Workspace and its authorised service providers and sub-processors, for business email, document storage and collaboration, calendar, communications and related productivity services;
- payment-service providers used to process transactions, where applicable;
- professional advisers such as accountants, tax advisers or legal advisers where required;
- banks and financial institutions for payment and financial administration;
- regulators, revenue authorities, courts, law-enforcement agencies or other competent authorities where required or permitted by law;
- contractors or specialist service providers engaged for a defined business purpose; and
- other recipients authorised by the data subject or permitted under applicable law.
7.4 Planned transborder flows
Provara Group uses cloud-based services that may involve the transfer, storage, access or other processing of personal information outside South Africa. Its principal cloud and e-commerce platforms are Google Workspace and Shopify.
| Service / recipient | Planned transborder flow | Categories of personal information that may be involved |
|---|---|---|
| Google Workspace | Personal information used in Google Workspace may be stored, accessed or otherwise processed outside South Africa. Depending on the Google Workspace service, account configuration, applicable data-region settings and the location of Google's authorised sub-processors, processing may occur in the United States, countries within the European Union or European Economic Area, and other jurisdictions in which Google or its authorised sub-processors operate. | Business contact information, email and other communications, documents and files, calendar and meeting information, supplier and customer correspondence, consulting records, support information, administrative records and other personal information contained in material created, received or stored through Google Workspace. |
| Shopify | Shopify services used by Provara Group may involve processing outside South Africa. For merchants in Africa, Shopify identifies Shopify International Limited in Ireland as the primary contracting entity. Shopify may also transfer or process merchant and customer personal information in Canada, the United States, Singapore and other jurisdictions in which Shopify group companies or authorised sub-processors operate. | Customer and prospective-customer contact information, order and transaction information, billing and fulfilment information, programme-licence information, website and device information, customer-support communications and other information required to operate and support the online store. |
Provara Group manages planned cross-border transfers in accordance with section 72 of POPIA. Depending on the circumstances, appropriate safeguards may include contractual protections, service-provider data-processing terms, assessments of applicable privacy protections and other measures required by POPIA.
The precise infrastructure location used by a cloud service may change over time or vary according to service configuration and authorised sub-processor arrangements. Provara Group therefore reviews material service-provider and cross-border processing arrangements as part of its privacy and supplier-governance processes.
7.5 General description of information-security measures
Provara Group applies reasonable and appropriate technical and organisational safeguards having regard to the nature of the information and the risks involved. Depending on the system and context, safeguards may include:
- access controls and authentication controls;
- role-appropriate access and least-privilege practices where supported;
- secure configuration and use of reputable hosted technology providers;
- endpoint, device and account-security measures;
- secure storage, backup and recovery measures appropriate to the relevant records;
- confidentiality and contractual safeguards for service providers and contractors;
- security and privacy incident-management procedures;
- retention and secure deletion practices; and
- periodic review of material privacy and security risks.
The description above is intentionally general and does not disclose security information that could itself create a security risk.
How to request access to a record
A requester seeking access to a record of Provara Group under PAIA must comply with section 50 and the prescribed request procedure. The current prescribed request form is Form 2: Request for Access to Record under Regulation 7.
Describe the record sufficiently and identify the right to be exercised or protected, including why the requested record is required for that purpose.
Use the Information Regulator's current prescribed Form 2 and complete the required requester, record, access and rights information.
Attach proof of identity. If acting for another person, also provide proof of authority or capacity to act.
Email the completed request and supporting documents to jean@provaragroup.com, or deliver them to Provara Group's principal place of business.
Where a prescribed request fee, deposit or access fee is applicable, Provara Group will notify the requester in accordance with PAIA and the Regulations.
Decision, notification and statutory timeframes
Except where PAIA's third-party notification provisions apply, Provara Group must decide a properly submitted request as soon as reasonably possible and, in any event, within 30 days after receiving the request or the particulars required to process it.
The 30-day period may be extended once for a further period of no more than 30 days where one of the circumstances permitted by section 57 of PAIA applies. If extended, the requester will be notified of the extension, its duration and the reasons.
Provara Group will communicate the outcome in the prescribed manner, including through Form 3: Outcome of Request and of Fees Payable where applicable. If access is granted, the notice will identify any access fee and the form of access. If access is refused, adequate reasons will be provided without disclosing the protected content of the record.
No decision within the statutory period: PAIA provides for a deemed refusal where the private body fails to give a decision within the applicable period. The requester may then use the remedies available under PAIA.
Grounds on which access may be refused
Access is not automatic merely because Provara Group holds a record. A request may be refused only where PAIA permits or requires refusal. Grounds may include:
- protection of the privacy of a third party who is a natural person;
- protection of commercial information of a third party;
- protection of information supplied in confidence by a third party;
- protection of the safety of individuals and certain property interests;
- protection of records privileged from production in legal proceedings;
- protection of Provara Group's commercial information, trade secrets, financial, commercial, scientific or technical information, or information whose disclosure could cause commercial disadvantage;
- protection of certain research information; and
- any other mandatory or discretionary ground of refusal provided for in Chapter 4 of Part 3 of PAIA.
Where only part of a record is protected, Provara Group will consider whether reasonably severable portions can be disclosed in accordance with PAIA.
Prescribed PAIA fees
Fees are prescribed by the Regulations Relating to the Promotion of Access to Information, 2021. The schedule below reflects the prescribed private-body fees applicable at the date of this Manual. If the statutory fee schedule is amended, the amended prescribed fees prevail.
| Item | Description | Prescribed amount |
|---|---|---|
| 1 | Request fee payable by every requester | R140.00 |
| 2 | Photocopy / printed black-and-white copy of an A4-size page | R2.00 per page or part thereof |
| 3 | Printed copy of an A4-size page | R2.00 per page or part thereof |
| 4 | Copy in computer-readable form on a flash drive supplied by the requester | R40.00 |
| 4 | Copy on compact disc supplied by the requester | R40.00 |
| 4 | Copy on compact disc supplied to the requester | R60.00 |
| 5 | Transcription of visual images per A4-size page | Outsourced service - quotation dependent |
| 6 | Copy of visual images | Outsourced service - quotation dependent |
| 7 | Transcription of an audio record, per A4-size page | R24.00 |
| 8 | Audio copy on flash drive supplied by the requester | R40.00 |
| 8 | Audio copy on compact disc supplied by the requester | R40.00 |
| 8 | Audio copy on compact disc supplied to the requester | R60.00 |
| 9 | Search and preparation for each hour or part thereof, excluding the first hour | R145.00 per hour or part thereof |
| 9 | Maximum search-and-preparation charge | R435.00 |
| 10 | Deposit if search exceeds 6 hours | One third of the amount per request calculated in accordance with the prescribed schedule |
| 11 | Postage, email or other electronic transfer | Actual expense, if any |
A record may be withheld until applicable prescribed fees have been paid. A requester may challenge a fee or deposit through the remedies provided in PAIA.
Complaints and other remedies
A private body does not have the same compulsory internal-appeal process that applies to certain public bodies. If a requester is dissatisfied with Provara Group's decision, or no response is received within the statutory period, the requester may lodge a complaint with the Information Regulator in accordance with PAIA.
The Information Regulator currently requires PAIA complaints to be lodged using Form 5. For private-body requests, the Regulator states that a complaint should generally be lodged within 180 days of the refusal or non-response.
A requester or third party may also seek appropriate relief from a competent court in accordance with PAIA. Where the complaints procedure applies, the applicable statutory complaint process must be exhausted before a court application is pursued.
Email: PAIAComplaints@inforegulator.org.za
Telephone: 010 023 5200
Toll Free: 0800 017 160
Address: Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191
Availability of this Manual
A current copy of this PAIA Manual is made available:
- on the Provara Group website at provaragroup.com;
- at Provara Group's principal place of business for public inspection during normal business hours;
- to any person on request, subject to any reasonable prescribed copying charge that lawfully applies; and
- to the Information Regulator upon request.
Requests for an electronic copy of this Manual may be sent to jean@provaragroup.com.
Updating, governance and document control
Provara Group will review this Manual regularly and update it when material changes occur to the organisation, its records, processing activities, service providers, contact details, applicable legislation, prescribed forms, fees or Information Regulator guidance.
PAIA request records, decisions and related correspondence will be managed as part of Provara Group's broader privacy and information-governance framework. Provara Group will also comply with applicable PAIA reporting obligations to the Information Regulator.
Information Officer · Provara Group (Pty) Ltd
Revision date: 11 September 2026
This Manual supersedes the previous Provara Group PAIA Manual to the extent of any inconsistency. Statutory provisions, regulations and prescribed forms prevail if they are amended after the revision date shown above.