PAIA and POPIA manual

PAIA and POPIA Manual for Blacfox Enterprises (Pty) Ltd
Registration number 2017/174079/07
Date of completion: 1 December 2021

This is the web version of the manual. The issued document is the PDF, completed on 1 December 2021. The contact details in sections 4 and 5 below are the current ones (info@blacfox.com and +27 21 493 9327); the PDF carries the details as at the date of completion.

Download the manual (PDF, 254 KB) →

Index

General

• 1. Definitions
• 2. Purpose of the Manual
• 3. Overview and Nature of Blacfox’s Business
• 4. Blacfox Details
• 5. Contact Details of the Information Officer
• 6. Legislation Applicable to Blacfox

Part 1: PAIA

• 7. Introduction
• 8. Requests for Access to Records
• 9. Procedure for a Request for Access
• 10. Decision to Grant Access to Records
• 11. Fees
• 12. Grounds for Refusal of Access to Records
• 13. Remedies Available upon Refusal of a Request for Access
• 14. Information or Records Not Found
• 15. Request Granted
• 16. Availability of the Manual
• 17. Categories of Records Held by Blacfox: Section 51(1)(e)

Part 2: POPIA

• 18. Introduction
• 19. Specific Purpose
• 20. Categories of Data Subjects and Personal Information
• 21. Recipients of Personal Information
• 22. Cross-Border Flows of Personal Information
• 23. Retention of Records
• 24. Security Measures
• 25. Objection to the Processing of Personal Information
• 26. Correction or Deletion of Personal Information

1. Definitions

Unless otherwise expressly stated, or the context otherwise requires, the words and expressions listed below shall, when used in this Manual, including this introduction, bear the meanings ascribed to them:

1.1“Blacfox” means Blacfox Enterprises (Pty) Ltd, registration no. 2017/174079/07, a company with limited liability duly incorporated and registered in accordance with the laws of South Africa, situated at 3C Matrix, Bridgeways Precinct, 8 Bridgeway, Century City, 7441;

1.2“Constitution” means the Constitution of the Republic of South Africa 108 of 1996;

1.3“Data Subjects” has the meaning ascribed to it in terms of POPIA;

1.4“Information Officer” means Blacfox’s appointed information officer and whose details are designated and referred to in clause 5;

1.5“Manual” means this PAIA and POPIA manual and any appendices and schedules attached hereto;

1.6“PAIA” means the Promotion of Access to Information Act, 2000;

1.7“Personal Information” has the meaning ascribed to it in terms of POPIA;

1.8“POPIA” means the Protection of Personal Information Act, 2013;

1.9“Processed” has the meaning ascribed to it in terms of POPIA;

1.10“Request for Access” has the meaning ascribed to it in terms of PAIA;

1.11“Responsible Party” has the meaning ascribed to it in terms of POPIA;

1.12“Website” means www.blacfox.com.

2. Purpose of the Manual

2.1This manual for the purposes of:

1. PAIA, details the procedure to be followed by a requester and the manner in which a request for access will be facilitated; and
2. POPIA, amongst other things, details the purpose for which personal information may be processed; a description of the categories of data subjects for whom Blacfox processes personal information as well as the categories of personal Information relating to such data subjects; and the recipients to whom personal information may be supplied.

3. Overview and Nature of Blacfox’s Business

3.1Blacfox is a service design consulting company that uses its own professionals to develop digital assets.

4. Blacfox Details

4.1The details of Blacfox are as follows:

5. Contact Details of the Information Officer

5.1The information officer’s contact details are as follows:

6. Legislation Applicable to Blacfox

6.1Records of Blacfox and other legal entities in which Blacfox has a direct controlling interest or an indirect controlling interest through its subsidiaries, may be kept by or on behalf of Blacfox in accordance with the following legislation (some of which legislation may not be applicable to Blacfox), as well as with other legislation that may apply to Blacfox and/or its subsidiaries from time to time:

1. Basic Conditions of Employment Act 57 of 1997;
2. Broad-based Black Economic Empowerment Act 53 of 2003;
3. Companies Act 71 of 2008;
4. Compensation for Occupational Injuries and Diseases Act 130 of 1993;
5. Competition Act No. 89 of 1998;
6. Consumer Protection Act 68 of 2008;
7. Copyright Act 98 of 1978;
8. Currencies and Exchanges Act 9 of 1993;
9. Debt Collectors Act 114 of 1998;
10. Electronic Communications and Transactions Act 25 of 2002;
11. Employment Equity Act 55 of 1998;
12. Financial Intelligence Centre Act 38 of 2001;
13. Income Tax Act 58 of 1962;
14. Insolvency Act 24 of 1936;
15. Intellectual Property Laws Amendment Act 38 of 1997;
16. Labour Relations Act 66 of 1995;
17. National Credit Act 34 of 2005;
18. Occupational Health and Safety Act 85 of 1993;
19. Regulation of Interception of Communications and Provision of Communication-Related Information Act 70 of 2002;
20. Prevention of Organised Crime Act 121 of 1998;
21. Prevention and Combating of Corrupt Activities Act 12 of 2004;
22. Promotion of Access to Information Act 2 of 2000;
23. Protected Disclosures Act 26 of 2000;
24. Protection of Constitutional Democracy against Terrorist and Related Activities Act 33 of 2004;
25. Skills Development Act 97 of 1998;
26. Skills Development Levies Act 9 of 1999;
27. Securities Transfer Tax Act 25 of 2007;
28. Securities Transfer Tax Administration Act 26 of 2007;
29. Tax Administration Act No. 28 of 2011;
30. Trade Marks Act 194 of 1993;
31. Trust Property Control Act 57 of 1988;
32. Unemployment Insurance Act 30 of 1966;
33. Unemployment Insurance Contributions Act 4 of 2002;
34. Value Added Tax Act 89 of 1991.

Part 1: PAIA

7. Introduction

7.1PAIA gives third parties the right to approach private bodies and the government to request information held by them, which is required in the exercise and/or protection of any rights.

7.2On request, the private body or government is obliged to release such information unless PAIA expressly states that the records containing such information may or must not be released. This manual informs requestors of procedural and other requirements which a request must meet as prescribed by PAIA.

8. Requests for Access to Records

8.1Records held by Blacfox may be accessed on request only once the requirements for access have been met.

8.2A requester is any person making a request for access to a record of Blacfox and in this regard, PAIA distinguishes between two types of requesters:

1. Personal Requester: who is a requester who is seeking access to a record containing personal information about the requester. Subject to the provisions of PAIA and applicable law, Blacfox will provide the requested information, or give access to any record with regard to the requester’s personal information. The prescribed fee for reproduction of the information requested will be charged by Blacfox.
2. Other Requester: this requester (other than a personal requester) is entitled to request access to information pertaining to third parties. However, Blacfox is not obliged to grant access prior to the requester fulfilling the requirements for access in terms of PAIA. The prescribed fee for reproduction of the information requested will be charged by Blacfox.

9. Procedure for a Request for Access

9.1A requester must comply with all the procedural requirements as contained in section 53 of PAIA relating to a request for access to a record.

9.2A requester must complete the Personal Information Request or Amendment Form (available on the website or in person) and submit the completed form as well as payment of a request fee (if applicable) and a deposit (if applicable), to the information officer at the postal or physical address, facsimile number or electronic mail address stated herein.

9.3The request for access form must be completed with enough detail so as to enable the information officer to identify the following:

1. the record/s requested;
2. the identity of the requester;
3. the form of access that is required, if the request is granted;
4. the postal address or fax number of the requester; and
5. the right that the requester is seeking to protect and an explanation as to why the Record is necessary to exercise or protect such a right.

9.4If a request for access is made on behalf of another person, the requester must submit proof of the capacity in which the requester is making the request to the reasonable satisfaction of the information officer.

9.5If an individual is unable to complete the prescribed form because of illiteracy or disability, such a person may make the request orally.

10. Decision to Grant Access to Records

10.1Blacfox will decide whether to grant or decline the request for access within 30 (thirty) days of receipt of the request for access and must give notice to the requester with reasons (if required) to that effect.

10.2The period referred to above may be extended for a further period of not more than 30 (thirty) days if the request for access is for a large number of records or the request for access requires a search for records held at another office of Blacfox and the records cannot reasonably be obtained within the original 30 (thirty) day period.

10.3Blacfox will notify the requester in writing should an extension of time as contemplated above be required.

10.4If, in addition to a written reply from the information officer, the requester wishes to be informed of the decision on the request for access in any other manner, the requester must state the manner and particulars so required.

11. Fees

11.1PAIA provides for two types of fees, namely:

1. A request fee: (which will be a standard fee) is applicable when a request is received by the information officer of Blacfox, the information officer shall by notice require the requester, other than a personal requester, to pay the prescribed request fee (if any) before further processing of the request.
2. An access fee: is calculated by taking into account reproduction costs, search and preparation time and cost, as well as postal costs where applicable. If a search for the record is necessary and the preparation of the record for disclosure, including arrangement to make it available in the requested form, requires more than the hours prescribed in the regulations for this purpose, the information officer shall notify the requester to pay as a deposit the prescribed portion of the access fee which would be payable if the request is granted.

11.2The information officer shall withhold a record until the requester has paid the fee or fees as indicated. A requester whose request for access to a record has been granted, must pay an access fee for reproduction and for search and preparation, and for any time reasonably required in excess of the prescribed hours to search for and prepare the record for disclosure including making arrangements to make it available in the request form. If a deposit has been paid in respect of a request for access, which is refused, then the information officer shall repay the deposit to the requester.

11.3The information officer will withhold a record until the requester has paid the fees set out above.

12. Grounds for Refusal of Access to Records

12.1The following are the grounds on which Blacfox may, subject to the exceptions contained in Chapter 4 of PAIA, refuse a request for access in accordance with Chapter 4 of PAIA:

1. mandatory protection of the privacy of a third party who is a natural person, including a deceased person, where such disclosure of personal information would be unreasonable;
2. mandatory protection of the commercial information of a third party, if the records contain:
   1. trade secrets of that third party;
   2. financial, commercial, scientific or technical information of the third party, the disclosure of which could likely cause harm to the financial or commercial interests of that third party; and/or
   3. information disclosed in confidence by a third party to Blacfox, the disclosure of which could put that third party at a disadvantage in contractual or other negotiations or prejudice the third party in commercial competition;
3. mandatory protection of confidential information of third parties if it is protected in terms of any agreement;
4. mandatory protection of the safety of individuals and the protection of property;
5. mandatory protection of Records that would be regarded as privileged in legal proceedings;
6. protection of the commercial information of Blacfox, which may include:
   1. trade secrets;
   2. financial/commercial, scientific or technical information, the disclosure of which could likely cause harm to the financial or commercial interests of Blacfox;
   3. information which, if disclosed, could put Blacfox at a disadvantage in contractual or other negotiations or prejudice Blacfox in commercial competition; and/or
   4. computer programs which are owned by Blacfox, and which are protected by copyright and intellectual property laws;
7. research information of Blacfox or a third party, if such disclosure would place the research or the researcher at a serious disadvantage; and
8. requests for records that are clearly frivolous or vexatious, or which involve an unreasonable expenditure of resources.

13. Remedies Available upon Refusal of a Request for Access

13.1Should the requester be unhappy with the decision of the information officer, the requester is entitled to complete a Blacfox Complaint Form (available on the website or in person). Consequently, the information officer will review their decision in concert with the board of directors of Blacfox.

13.2Should the requester be unhappy with this final decision, there are no further remedies available within Blacfox. Accordingly, the decision made by the information officer and the board is final, and a requester will have to exercise such external remedies at their disposal if the request for access is refused.

13.3In accordance with sections 56(3)(c) and 78 of PAIA, a requester may apply to a court for relief within 180 (one hundred and eighty) days of notification of the decision for appropriate relief.

14. Information or Records Not Found

If Blacfox cannot find the records that the requester is looking for despite reasonable and diligent search and it believes either that the records are lost or that the records are in its possession but unattainable, the requester will receive a notice in this regard from the information officer in the form of an affidavit setting out the measures taken to locate the document and accordingly the inability to locate the document.

15. Request Granted

15.1A requester whose request for access to a record has been granted, must pay an access fee for reproduction and for search and preparation, and for any time reasonably required in excess of the prescribed hours to search for and prepare the record for disclosure, including making arrangements to make it available in a requested form provided for in PAIA.

15.2If a deposit has been paid in respect of a request for access which is refused, the information officer will repay the deposit to the requester.

16. Availability of the Manual

16.1The manual is available for inspection, on reasonable prior notice, at the office of Blacfox free of charge.

16.2The Human Rights Commission has been tasked with the administration of the PAIA. Section 10 of the PAIA Act requires the South African Human Rights Commission (“SAHRC”) to publish a guide which is intended to assist users in the interpretation of the PAIA and how to access the records of private and public bodies and the remedies available in law regarding a breach of any of the provisions of the PAIA.

16.3The guide will contain the following information:

1. the objects of the PAIA;
2. particulars of the information officer of every public body;
3. particulars of every private body as are practicable;
4. the manner and form of a request for access to information held by a body;
5. assistance available from both the information officers and the SAHRC in terms of PAIA;
6. all remedies in law regarding acts, omissions, rights and duties, including how to lodge an internal appeal and a court application;
7. schedules of fees to be paid in relation to requests for access to information;
8. regulations made in terms of PAIA.

16.4Copies of this guide are available from SAHRC. Enquiries regarding the guide and relating to the person’s rights and in particular their right to access information from a private or public body can be addressed to the SAHRC, the contact details of which are as follows:

1. Post: The South African Human Rights Commission, PAIA (Promotion of Access to Information Act) Unit, Research and Documentation Department, Private Bag 2700, Houghton, 2041
2. Telephone number: +27 (11) 484 8300 / +27 11 877 3600
3. Fax: +27 (11) 484 7146 / +27 11 403 0625
4. Email: PAIA@sahrc.org.za or section51.paia@sahrc.org.za
5. Website: http://www.sahrc.org.za

17. Categories of Records Held by Blacfox: Section 51(1)(e)

17.1 Corporate, Statutory and Legal

• Documents of incorporation (includes, inter alia, memorandum of incorporation).
• Minutes of board of directors’ meetings.
• Minutes of shareholders meetings.
• Records relating to the appointment of directors, auditor, secretary, public officer and other officers.
• Share register and other statutory registers.
• Legal correspondence and compliance.
• Licences and approvals.
• Policies and Procedures.
• Share Certificates.
• Shareholder Agreements.
• Shareholder Register.
• Statutory Returns to Relevant Authorities.

17.2 Financial & Tax Records

• Accounting records.
• Annual financial statements.
• Audit reports.
• Asset register.
• Banking records (includes, inter alia, bank statements, electronic banking records).
• Foreign Exchange Records.
• Invoices and statements of account.
• Rental agreements.
• PAYE records and returns.
• Tax Records and Returns.
• VAT records and returns.
• Documents issued to employees for income tax purposes.
• Records of payments made to SARS (includes, inter alia, records of payments made on behalf of employees).
• All other statutory compliances:
  • Skills Development Levies;
  • UIF;
  • Workmen’s Compensation.

17.3 Insurance

• Claim records.
• Details of insurance coverage, limits and insurers.
• Insurance declarations.
• Insurance policies.

17.4 Operational and Technical

• Access Control Records;
• Administration Documents;
• Agreements with Contractors and Suppliers;
• Contractor and Supplier Data;
• Incident Reports and Investigations;
• Licences and Approvals;
• Marketing Strategies;
• Production Statistics;
• Resource and Reserve Information;
• Survey Reports;
• Specialist Risk Reports;
• Sustainability Information;
• Security Records;
• Technical Records;
• Vendor’s lists.

17.5 Safety, Health, Environment and Quality

• Emergency response plans.
• Incident registers and IOD claims, if any.
• Quality management programmes and systems.
• Safety management systems, data and audits.
• Safety, Health, Environment and Sustainability Policies.
• SHEQ: Safety, Health, Environmental and Quality Systems and Reports.
• Standards.

17.6 Personnel Documents and Records (Employees, Consultants & Job Applicants)

• BEE Statistics.
• Consultancy agreements.
• Contact details (telephone numbers and e-mail addresses) of clients.
• Correspondence with Employees.
• Criminal background checks.
• Curriculum vitae (includes, inter alia, work history, work experience, skills, qualifications, work references, etc.).
• Details of next of kin for contact purposes.
• Disciplinary code.
• Disciplinary records.
• Education and training records.
• Employment agreements.
• Employee benefit records.
• Employment equity plan (if applicable).
• Financial records (e.g. bank account details, invoices, statement of account).
• Job applications.
• Job offers.
• Leave records (which includes, inter alia, reasons for leave taken which may include medical practitioner letters).
• Medical records.
• Salary and other payments to same records.
• SETA records.
• Skills development plans.
• Reasons for termination of employment and/or consultancy.
• Retirement benefits and medical aid.
• Tax records (e.g. IRP5, etc.).
• Training records.
• Training manuals.
• Workmen’s compensation claims and records.

17.7 Sales and Marketing

• Products.
• Markets.
• Customers.
• Brochures, newsletters and advertising materials.
• Sales.
• Delivery notes.
• Customer Satisfaction Surveys.
• Proposals and Tenders.

17.8 Client Documents and Records

• Client contact details (client contact persons, telephone numbers, cell phone numbers, e-mail addresses, preferred method of contact).
• Client registration and/or identity number details.
• Client addresses, both physical and postal.
• FICA documents of clients.
• Financial records (includes, inter alia, invoices, statement of account, payment history, default history).
• Legal records (includes, inter alia, letters of demand, summons, etc.).

17.9 Supplier Documents and Records

• Supplier contact details (supplier contact persons, telephone numbers, cell phone numbers, e-mail addresses, preferred method of contact).
• Supplier registration and/or identity number details.
• Supplier addresses, both physical and postal.
• Supplier bank account details.
• Financial records (e.g. invoices, statement of account, payment history).

17.10 Information Technology

• Hardware and Operating Systems.
• Telephone Exchange Equipment.
• Telephone lines, leased lines and data lines.
• Disaster recovery policy and systems.
• Internal systems support and programming / development.
• Development or investment plans.
• Contracts and Agreements.
• Licences.
• Policies, procedures, standards, templates and guidelines.
• Faults, Troubleshooting and Reporting.
• Performance of IT Infrastructure.
• Security Access.

Part 2: POPIA

18. Introduction

18.1Chapter 3 of POPIA provides for the minimum conditions for lawful processing of personal information by a responsible party. These conditions may not be derogated from unless specific exclusions apply as outlined in POPIA.

18.2Blacfox needs personal information relating to both individual and juristic persons in order to carry out its business and organisational functions.

18.3The manner in which this information is processed and the purpose for which it is processed is determined by Blacfox.

18.4Blacfox is accordingly a responsible party for the purposes of POPIA and will ensure that the personal information of a data subject:

1. is processed lawfully, fairly and transparently. This includes the provision of appropriate information to data subjects when their data is collected by Blacfox, in the form of privacy or data collection notices. Blacfox must also have a legal basis (for example, consent) to process personal information;
2. is processed only for the purposes for which it was collected;
3. will not be processed for a secondary purpose unless that processing is compatible with the original purpose;
4. is adequate, relevant and not excessive for the purposes for which it was collected;
5. is accurate and kept up to date;
6. will not be kept for longer than necessary;
7. is processed in accordance with integrity and confidentiality principles; this includes physical and organisational measures to ensure that personal information, in both physical and electronic form, is subject to an appropriate level of security when stored, used and communicated by Blacfox, in order to protect against access and acquisition by unauthorised persons and accidental loss, destruction or damage;
8. is processed in accordance with the rights of data subjects, where applicable. Data subjects have the right to:
   1. be notified that their personal information is being collected by Blacfox. The data subject also has the right to be notified in the event of a data breach;
   2. know whether Blacfox holds personal information about them, and to access that information. Any request for information must be handled in accordance with the provisions of this Manual;
   3. request the correction or deletion of inaccurate, irrelevant, excessive, out of date, incomplete, misleading or unlawfully obtained personal information;
   4. object to Blacfox’s use of their Personal Information and request the deletion of such personal information (deletion would be subject to Blacfox’s record keeping requirements);
   5. object to the processing of personal information for purposes of direct marketing by means of unsolicited electronic communications; and
   6. complain to the information regulator regarding an alleged infringement of any of the rights protected under POPIA and to institute civil proceedings regarding the alleged non-compliance with the protection of his, her or its personal information.

19. Specific Purpose

19.1As outlined above, personal information may only be processed by Blacfox for a specific purpose.

19.2Blacfox uses the personal information under its care in the following ways:

1. administration of agreements;
2. business development and marketing of Blacfox’s products and services;
3. conducting credit reference checks and assessments;
4. complying with tax and other laws;
5. complying with legal and regulatory requirements;
6. detection and prevention of fraud, crime, money laundering and other malpractice;
7. discounting and asset funding purposes;
8. in connection with legal proceedings;
9. keeping of accounts and records;
10. providing products and services to customers;
11. marketing and sales;
12. rendering services according to instructions given by clients;
13. staff recruitment and administration.

20. Categories of Data Subjects and Personal Information

20.1Blacfox may possess records relating to suppliers, shareholders, contractors, service providers, staff and clients.

21. Recipients of Personal Information

21.1Blacfox may share the personal information with its agents, affiliates, and associated companies who may use this information to send the data subject information on products and services.

21.2Blacfox may supply the personal information to any party to whom it may have assigned or transferred any of its rights or obligations under any agreement, and/or to service providers who render the following services:

1. accounting and auditing services;
2. capturing and organising of data;
3. conducting due diligence checks (e.g. credit checks);
4. legal and collection services;
5. marketing services;
6. medical aid and pension schemes;
7. sending of emails and other correspondence to clients;
8. storing of data.

22. Cross-Border Flows of Personal Information

22.1Personal information may be transmitted trans-border to Blacfox’s authorised dealers and its suppliers in other countries, and personal information may be stored in data servers hosted outside South Africa, which may not have adequate data protection laws. Blacfox will endeavour to ensure that its dealers and suppliers will make all reasonable efforts to secure said data and personal information.

23. Retention of Records

23.1Blacfox may retain personal information records indefinitely, unless the data subject objects thereto.

23.2If the data subject objects to indefinite retention of its personal information Blacfox shall retain the personal information records to the extent permitted or required by law.

24. Security Measures

24.1Blacfox employs up to date technology to ensure the confidentiality, integrity and availability of the personal information under its care.

24.2Security measures include, inter alia:

1. firewalls;
2. virus protection software and update protocols;
3. logical and physical access control;
4. secure setup of hardware and software making up the IT infrastructure; and
5. outsourced service providers who process personal information on behalf of Blacfox are contracted to implement security controls.

25. Objection to the Processing of Personal Information

Section 11(3) of POPIA and regulation 2 of the POPIA Regulations provides that a data subject may, at any time, object to the Processing of his/her/its Personal Information in the prescribed form. The Blacfox Complaint Form (available on the website or in person) can be used to this effect.

26. Correction or Deletion of Personal Information

Section 24 of POPIA and regulation 3 of the POPIA Regulations provides that a data subject may request for their personal information to be corrected/deleted. This can be accomplished by completing the Personal Information Request or Amendment Form (available on the website or in person).

Manual dated 1 December 2021. Published on this page 24 September 2026.