PAIA Manual

1. List of Acronyms and Abbreviations

2. Purpose of this PAIA Manual

This manual is useful for the public to —

• check the categories of records held by the Company which are available without a person having to submit a formal PAIA request;
• have a sufficient understanding of how to make a request for access to a record of the Company, by providing a description of the subjects on which it holds records and the categories of records held on each subject;
• know the description of the records of the Company which are available in accordance with any other legislation;
• access the contact details of the Information Officer who will assist the public with the records they intend to access;
• know the description of the guide on how to use PAIA, as updated by the Regulator, and how to obtain access to it;
• know whether the Company processes personal information, the purpose of that processing, and the categories of data subjects and of the information relating to them;
• know the recipients or categories of recipients to whom the personal information may be supplied;
• know whether the Company has planned to transfer or process personal information outside the Republic, and the recipients to whom it may be supplied; and
• know whether the Company has appropriate security measures to ensure the confidentiality, integrity and availability of the personal information processed.

3. Key Contact Details

3.2 Deputy Information Officer: The Company has not designated a Deputy Information Officer. Section 56 of POPIA permits, but does not require, a private body to do so.

4. Guide on How to Use PAIA

The Regulator has, in terms of section 10(1) of PAIA, updated and made available a Guide on how to use PAIA, in an easily comprehensible form and manner, as may reasonably be required by a person who wishes to exercise any right contemplated in PAIA and POPIA. The Guide is available in each of the official languages and in braille.

The Guide contains a description of, among other things, the objects of PAIA and POPIA; the contact details of information officers and deputy information officers; the manner and form of a request for access to a record of a public or private body; the assistance available from the Regulator; the remedies available in law, including how to lodge a complaint with the Regulator or bring an application to court; the obligation on bodies to compile a manual; the notices regarding fees; and the regulations made under section 92.

The Guide may be obtained —

• upon request to the Information Officer of the Company;
• from the website of the Regulator at inforegulator.org.za; and
• by inspection or copying at the offices of public and private bodies, including the office of the Regulator, during normal working hours.

A copy of the Guide is available at the Company's head office for public inspection during normal office hours in the following two official languages: English and Afrikaans.

5. Records Available Without a Request

The following categories of records are available without a person having to submit a formal PAIA request.

6. Records Available in Terms of Other Legislation

7. Subjects and Categories of Records Held

8. Processing of Personal Information

8.1 Purpose of processing

The Company develops and operates software products used by other organisations. It processes personal information in two distinct capacities.

As a responsible party, for its own business purposes: employing and paying staff; meeting its obligations under tax, labour and company law; contracting with and invoicing customers; procuring from suppliers; and responding to enquiries.

As an operator, on behalf of its customers, for the purpose of delivering the software they have licensed. In this capacity the customer — the church, school or business — is the responsible party and determines the purpose of processing. The Company processes that information only in accordance with the customer's instructions and does not use it for its own purposes.

8.2 Categories of data subjects and personal information

The Company processes special personal information in two respects: information concerning religious belief, which is inherent in membership of a church, and the personal information of children. Both are processed on behalf of the responsible party and, in the case of children, on the basis of the consent of a competent person.

8.3 Recipients of personal information

8.4 Planned transborder flows of personal information

The Company processes personal information outside the Republic as follows.

These transfers are permitted under section 72 of POPIA on the basis that the recipients are bound by agreements that provide an adequate level of protection. Each provider's data processing terms form part of the Company's agreement with it and are the binding agreement relied on for the purposes of section 72(1)(a). Information held in the European Union is additionally protected by the General Data Protection Regulation. Payment processing by PayFast takes place within the Republic.

8.5 Security measures

The Company implements the following measures to secure the confidentiality, integrity and availability of personal information:

• encryption of data in transit using TLS, and encryption of data at rest;
• separation between customers, currently enforced by the application, with that enforcement progressively being moved into the database itself so that it is guaranteed at the data layer;
• role-based access control within each product, limiting what a given user may see and do;
• private storage for photographs and uploaded documents, reachable only through short-lived signed links issued to authenticated users;
• authentication through a managed identity provider, with credentials and keys held outside the source code;
• audit logging of privileged actions and of changes affecting money or permissions;
• access granted on a least-privilege basis and reviewed when roles change; and
• review of changes affecting access to personal information before they are released.

9. Availability of this Manual

A copy of this manual is available —

• on the Company's website at biztrack.church/paia-manual.html;
• at the head office of the Company for public inspection during normal business hours;
• to any person upon request, on payment of the prescribed fee; and
• to the Information Regulator upon request.

A fee for a copy of this manual, as contemplated in Annexure B of the Regulations, is payable for each A4-size photocopy made.

10. Updating of this Manual

The head of the Company will update this manual on a regular basis, and whenever there is a material change to the records held, the personal information processed, or the contact details recorded in it. This includes the launch of any new product that processes personal information, which must be reflected here before it goes live.