Manual on the Promotion of Access to Information Act.

PAIA gives you a right of access to a record held by a private body where that record is required for the exercise or protection of any right. Section 51 obliges that body to publish a manual describing what it holds and how to ask for it.

The exemption that once relieved small businesses of this duty lapsed on 31 December 2021. So it applies to a one-person studio exactly as it applies to a bank.

Trueline is the trading name of Jarrod Hinde, sole proprietor. There is no separate legal entity, so the natural person and the private body are the same.

Address: 8 Viscount Road, Bedfordview, Gauteng, South Africa.
Telephone: 082 329 7662
Email: jarrod@trueline.systems
Website: trueline.systems

Jarrod Hinde, jarrod@trueline.systems.

Under POPIA the Information Officer of a private body is its head by operation of law, so for a sole proprietor it is the proprietor whether or not an appointment is made. No Deputy Information Officer is designated, because there is nobody else to designate. Requests go directly to the Information Officer.

The Information Regulator has compiled a plain-language guide on how to use PAIA. It is available in the official languages and in braille, from inforegulator.org.za.

No notice under section 52 has been published. In practice these records are public anyway:

• ·The privacy notice, /privacy.
• ·This manual, /paia.
• ·Marketing material and the published pricing bands, at trueline.systems.
• ·The one-page case study, on request by email.

This business has no employees, so it keeps no employment, payroll, provident fund, UIF, COIDA, employment equity or skills development records. If that changes, this manual changes with it.

The substance below is the same as the privacy notice, stated once so the two documents cannot drift apart.

• ·Purposes. To read an enquiry, answer it, and have the conversation that follows. If that becomes work, to run the engagement. There is no marketing list, no profiling and no automated decision-making.
• ·Categories of data subject and of information. People who send an enquiry, clients, and suppliers. The information is a name, a company, an email address, the current system, an optional budget band, a free-text description, and a one-way hash of the sender's IP address used only to rate limit the form.
• ·Recipients. Nothing is sold or shared for marketing. Three suppliers process it on my instructions, under contract, and may not use it for their own purposes: Supabase, which hosts the database; Lovable and its hosting provider, which serve the website; and the email provider used by that platform, which transmits the enquiry to me in transit and does not keep it for its own purposes.
• ·Transborder flows. The database sits on Amazon Web Services in us-east-1, Northern Virginia, United States, and the website is served from a global edge network, so the information is processed outside South Africa. The basis is section 72 of POPIA: the recipient is bound by an agreement giving effect to principles substantially similar to POPIA.
• ·Security safeguards. The database rejects reads, updates and deletes from the public internet, enforced in the database with row level security forced. Only the server can write an enquiry. Field limits and content rules are constraints on the table. Submissions are rate limited using the hashed address. Everything travels over TLS, the site sets a content security policy, denies framing and sends the usual hardening headers. Access to the database is limited to me.

Form 2 of the PAIA Regulations is the prescribed form for a request to a private body. Ask and I will email it to you, or get it from inforegulator.org.za. Send it to jarrod@trueline.systems or to the postal address above.

Give enough detail to identify the record, and enough to reach you with the answer.

State which right you are exercising or protecting, and how the record is required for it. This is the part most requests get wrong, and section 50 requires me to refuse a request that does not say it.

I decide within 30 days and tell you in writing. That can be extended once, by up to 30 days, where a large number of records is involved. No response in time is regarded as a refusal.

Where search and preparation will exceed six hours, a deposit of one third of the access fee is payable before work starts, and is refunded if access is then refused. Search and preparation charges are capped at R435.00.

The grounds for refusal are set out in Chapter 4 of Part 3 of PAIA:

• ·Another person's privacy. Section 63.
• ·Commercial information of a third party, or of this body. Sections 64 and 68.
• ·Information held in confidence. Section 65.
• ·Danger to a life or to property. Section 66.
• ·Privileged material. Section 67.
• ·Research information. Section 69.

Where a ground applies to part of a record only, the rest of it is released.

A private body has no internal appeal. You can complain to the Information Regulator under section 77A, or apply to a court under section 78 within 180 days.

JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001
PO Box 31533, Braamfontein, Johannesburg, 2017
PAIA complaints: PAIAComplaints@inforegulator.org.za
General enquiries: enquiries@inforegulator.org.za
inforegulator.org.za

• ·Free on request by email, and published at /paia.
• ·For inspection at the address above, by arrangement.
• ·As a printed copy, at the photocopy rate in the fees table.

This manual is reviewed at least annually, and immediately whenever the categories of record, the suppliers or the contact details change.