PAIA Manual

1. Purpose of this manual

PAIA gives effect to the constitutional right of access to information held by a private body where that information is required for the exercise or protection of any right. This manual explains what records Compliance Radar (Pty) Ltd holds, which of them are available without a request, how to request the rest, and how we process personal information under POPIA. As section 51(3) of PAIA requires, it is published on our website, can be inspected at our principal place of business by appointment during business hours, will be supplied to any person on request, and will be provided to the Information Regulator on request.

2. Particulars of the private body

3. Information Officer

In terms of section 1 of PAIA read with section 1 of POPIA, the head of a private body is its Information Officer unless the head authorises another person in writing to act in that capacity. The director of Compliance Radar (Pty) Ltd has designated the person below as Information Officer. The Information Officer's registration with the Information Regulator, required by section 55(2) of POPIA, is being completed. The Information Officer is responsible for handling requests for access to records and for compliance with POPIA. No Deputy Information Officer has been designated.

4. The Regulator's guide on how to use PAIA (section 10)

The Information Regulator has compiled a guide, in each official language and in braille, on how to use PAIA. It explains the objects of the Act, how to make a request, the fees payable, the remedies available if a request is refused, and the contact details of the Information Officers of public bodies. The guide is available from the Regulator free of charge:

The guide may also be inspected or copied, in English or Afrikaans, at our office at 37 Hares Road, Salt River, Cape Town, Western Cape, 7925 by appointment during business hours, and we will send a copy on request to [email protected].

5. Records available in terms of other legislation

Where a record is held for the purposes of, or is available under, another law, access is given in terms of that law. We keep records in terms of, among others:

• Companies Act, 71 of 2008
• Income Tax Act, 58 of 1962; Value-Added Tax Act, 89 of 1991; Tax Administration Act, 28 of 2011
• Basic Conditions of Employment Act, 75 of 1997; Labour Relations Act, 66 of 1995; Employment Equity Act, 55 of 1998
• Unemployment Insurance Act, 63 of 2001; Compensation for Occupational Injuries and Diseases Act, 130 of 1993; Skills Development Levies Act, 9 of 1999
• Electronic Communications and Transactions Act, 25 of 2002; Consumer Protection Act, 68 of 2008
• Protection of Personal Information Act, 4 of 2013

6. Records available without a formal request

The following are available on our website without a PAIA request:

• Product information and pricing on complianceradar.co.za
• Privacy Policy
• Terms of Service
• Data Processing Agreement
• Refund Policy
• Security overview
• This manual

7. Subjects and categories of records we hold

Access to the records below is subject to the grounds for refusal in Chapter 4 of Part 3 of PAIA.

• Company records: founding documents, statutory registers, minutes, shareholder and director records.
• Financial and tax records: accounting records, bank records, invoices, tax returns and assessments.
• Our own employment records: contracts, payroll, leave, disciplinary and performance records of our staff.
• Customer records: subscription agreements, account and billing details, support correspondence.
• Records processed on behalf of customers: employee, vehicle, equipment and company compliance records, credentials, documents, payslips, disciplinary records and hearing recordings that our customers load into the platform. We hold these as an operator under POPIA section 20 for the customer, who is the responsible party. They are nonetheless records in our possession for PAIA purposes, and a request for them is decided by our Information Officer within the period section 56 allows. Because they concern the customer and its employees, we notify them as third parties under section 71 and consider the grounds for refusal in sections 63 to 65 and 68 before deciding. Employees may also ask their employer directly under POPIA section 23.
• Operational and security records: audit logs, access logs, backups and incident records.
• Marketing and sales records: enquiries, leads, and correspondence with prospective customers.
• Supplier records: contracts and correspondence with hosting, email, messaging, AI, error-monitoring and payment providers.

8. Processing of personal information (PAIA section 51(1)(c))

Purpose of processing. Providing the Compliance Radar service to customers: tracking compliance credentials, renewals and statutory deadlines; sending reminders and payslips; managing customers' disciplinary matters, including transcribing and summarising hearing recordings; account management and billing; security, audit and fraud prevention; and complying with our own legal obligations.

Categories of data subjects and information. Our customers' staff and their administrators (names, contact details, roles); our customers' employees, drivers and contractors (identity numbers, contact details, employment and licensing details, compliance documents, payslips, disciplinary records, and hearing recordings and transcripts); others who take part in our customers' disciplinary hearings, such as representatives; our own staff and suppliers; and prospective customers (business contact details).

Recipients. Our database and document storage provider (Amazon Web Services); application hosting (Render); website and front-end hosting and content delivery (Vercel); email delivery (Resend); WhatsApp delivery of payslips (Meta Platforms) and of reminders (Meta Platforms, or Twilio through the customer's own Twilio account, as the customer selects); payment processing (Paystack, billing data only); error monitoring (Sentry, technical error details only); and AI model providers: Anthropic, which extracts data from uploaded documents, payroll files and spreadsheets, answers assistant questions (including by looking up employee and vehicle records in the customer's account) and summarises disciplinary hearing transcripts; OpenAI, which transcribes disciplinary hearing recordings; and Voyage AI, which creates search embeddings of assistant questions, legal texts and the policies, handbooks, contract templates and other documents customers add to their knowledge library. Anthropic and OpenAI act under their API terms, which do not permit use of the data to train their models, and Voyage AI under its API terms. Each acts under contract and only to the extent needed to provide the service. We do not sell personal information.

Cross-border flows. Records and uploaded documents are stored on Amazon Web Services in the af-south-1 (Cape Town) region. The application runs on Render in Frankfurt, Germany (EU). Assistant, extraction, embedding and transcription processing by Anthropic, Voyage AI and OpenAI may happen in the United States. The website and the application's front end are served by Vercel, messages are sent through Meta Platforms (WhatsApp Cloud API), Twilio and Resend, error monitoring runs through Sentry, and payments are processed by Paystack; these providers may also process data outside South Africa. Transfers are made under POPIA section 72 to recipients bound by contractual protections.

Security measures. Encryption in transit and at rest, encryption of identity numbers and integration secrets, role-based access, audit logging, and the measures set out on our Security page.

9. How to request a record

• Complete the prescribed Form 2 (Request for access to record, regulation 7 of the PAIA Regulations, 2021), available from the Regulator's website. Give enough detail for us to identify the record, state which right you are exercising or protecting and why the record is required for it, and say in what form you want access.
• Send the form to the Information Officer at [email protected] or to the postal address above.
• If you are acting on someone else's behalf, include proof of the capacity in which you act.
• Fees. A request fee of R140 is payable on submission, unless the request is for a record containing personal information about you. Access fees for reproduction, searching and preparation are charged as prescribed in Annexure B to the PAIA Regulations, 2021 (currently R2 per A4 page and R145 per hour or part of an hour for search and preparation beyond the first hour); we will quote them before any work is done and may require a deposit of one third where preparation will exceed six hours.
• Timing. We respond within 30 days of receiving a complete request, or, where a third party must be notified, within 30 days of that notice. The period may be extended once by up to 30 days where the request is for a large number of records, requires a search at another office, requires consultation, or where you consent in writing. We will notify you of any extension and the reason for it.
• Third parties. Where a record might contain personal, commercial or confidential information about a third party, we will notify that party under section 71 and allow them to make representations before deciding.
• Refusal and remedies. A request may be refused on the grounds in Chapter 4 of Part 3 of PAIA, including the protection of other people's privacy, commercial information, and legally privileged records. If we refuse, we will give reasons. PAIA does not provide an internal appeal against a private body. If you are dissatisfied with our decision, including a decision on fees or an extension, you may lodge a complaint with the Information Regulator on Form 5 within 180 days of the decision, at [email protected] or the Regulator's postal address above. Once the Regulator's complaint process is complete you may apply to a court within 180 days.

10. Requests about your own personal information

Under POPIA sections 23 and 24 you may, on proof of identity, ask free of charge whether we hold personal information about you, request a copy or description of it (no request fee applies; we currently provide copies free of charge), and ask for it to be corrected or deleted. Email [email protected] with enough detail to identify yourself. If your information was loaded by your employer as a Compliance Radar customer, we will involve your employer as the responsible party and help them respond.

11. Availability of this manual

This manual is published at complianceradar.co.za/paia-manual, is available for public inspection at 37 Hares Road, Salt River, Cape Town, Western Cape, 7925 by appointment during business hours, will be sent to any person on request by email at no charge (a printed copy may be charged at the per-page rate in Annexure B to the PAIA Regulations, 2021), and will be provided to the Information Regulator on request. It is reviewed at least annually and whenever the particulars above change.