PAIA Manual.
SEE Exsensic Privacy Policy and PAIA Manual.pdf
1. Acronyms
| Term | Meaning |
|---|---|
| DIO | Deputy Information Officer |
| IO | Information Officer |
| PAIA | Promotion of Access to Information Act 2 of 2000 |
| POPIA | Protection of Personal Information Act 4 of 2013 |
| Regulator | Information Regulator of South Africa |
| Republic | Republic of South Africa |
2. Purpose of this manual
Section 51 of PAIA requires every private body to compile a manual that helps a person obtain access to the records it holds. This manual tells you what records Exsensic holds, which are available without a formal request, how to request the others, the fees that apply, and how we process personal information.
3. Contact details for access to information
3.1 Information Officer
In terms of section 1 of PAIA read with section 56 of POPIA, the head of a private body is its Information Officer.
| Name | Jean Stemmet |
| Capacity | Founder and director (head of the private body) |
| Telephone | 082 764 7760 |
| jean@exsensic.com |
3.2 Deputy Information Officer
No Deputy Information Officer has been designated at the date of this manual.
3.3 Private body details
| Name | Exsensic (Pty) Ltd |
| Registration number | 2025/198393/07 |
| Registered address | 16 Aristata Avenue, Florida Glen, Roodepoort, Gauteng, 1709 |
| Postal address | 16 Aristata Avenue, Florida Glen, Roodepoort, Gauteng, 1709 |
| Operating from | Cape Town, Western Cape |
| Website | exsensic.com |
4. The Regulator's Guide on how to use PAIA
The Information Regulator has published a Guide in terms of section 10 of PAIA, in all official languages and in braille, explaining the objects of PAIA and POPIA, how to make a request to a public or private body, the assistance available from Information Officers and the Regulator, and the remedies available, including complaints to the Regulator and applications to court. The Guide can be obtained from the Regulator, inspected at our offices during business hours, or requested from our Information Officer.
| Physical address | Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191 |
| Postal address | P.O. Box 31533, Braamfontein, Johannesburg, 2017 |
| Telephone | 010 023 5200 |
| General enquiries | enquiries@inforegulator.org.za |
| PAIA complaints | PAIAComplaints@inforegulator.org.za |
| POPIA complaints | POPIAComplaints@inforegulator.org.za |
| Website | inforegulator.org.za |
5. Records available without a request
No notice has been published in terms of section 52(2) of PAIA. The following records are automatically available in terms of section 52(1):
| Category | Types of record | How to access |
|---|---|---|
| Company information | Name, registration number, address, contact details, services offered | This website; on request |
| Policies | Privacy Policy, Cookie Policy, Website Terms of Use, this PAIA Manual | This website; on request |
| Marketing material | Service descriptions, portfolio and case studies, social media content, published price guides | This website and our social media channels |
| Public records held by CIPC | Company registration records and directors | Companies and Intellectual Property Commission |
6. Records available in terms of other legislation
| Category of records | Applicable legislation |
|---|---|
| Company statutory records, resolutions, registers | Companies Act 71 of 2008 |
| Tax and VAT records, financial statements | Income Tax Act 58 of 1962; Value-Added Tax Act 89 of 1991; Tax Administration Act 28 of 2011 |
| Employment and contractor records | Basic Conditions of Employment Act 75 of 1997; Labour Relations Act 66 of 1995; Employment Equity Act 55 of 1998; Unemployment Insurance Act 63 of 2001 |
| Consumer and client contracts | Consumer Protection Act 68 of 2008; Electronic Communications and Transactions Act 25 of 2002 |
| Personal information and access records | Protection of Personal Information Act 4 of 2013; Promotion of Access to Information Act 2 of 2000 |
| Intellectual property, brand and content assets | Copyright Act 98 of 1978; Trade Marks Act 194 of 1993 |
7. Subjects and categories of records held
| Subject | Categories of records |
|---|---|
| Clients and projects | Proposals and quotes, contracts and scopes of work, briefs, brand assets, website source files, campaign plans, ad account and social media records, content calendars, performance reports, correspondence |
| Leads and marketing | Enquiry records, lead form submissions, prospect lists, outreach and follow-up records, consent and opt-out records, website analytics, advertising campaign data, newsletters and social content |
| Finance and administration | Invoices and statements, bank and payment records, accounting records, tax returns, supplier and contractor agreements, insurance |
| Company and governance | Memorandum of incorporation, registration documents, resolutions, share register, policies and compliance records |
| Personnel and contractors | Employment and freelance agreements, remuneration records, applications and CVs, confidentiality undertakings |
| Content production | Photographs, video footage, audio, model and location release forms, licences for stock, music and fonts |
| Information technology | Account and access registers, device inventory, software licences, security and backup logs |
8. Processing of personal information
8.1 Purposes
We process personal information to respond to enquiries and quotes; to deliver marketing, website, branding, advertising, reporting and content services under contract; to run our own marketing with consent; to manage suppliers and contractors; to recruit; to invoice and keep financial and tax records; to secure our systems; and to comply with the law. Full particulars are in our Privacy Policy, which forms part of this manual.
8.2 Categories of data subjects and personal information
| Data subjects | Personal information that may be processed |
|---|---|
| Website visitors and ad audiences | IP address, device and browser data, cookie and pixel identifiers, pages viewed, interactions, approximate location |
| Leads and prospective clients | Name, company, job title, email, phone and WhatsApp number, enquiry content, service interest, budget indication |
| Clients and their representatives | Contact and billing details, company registration and VAT numbers, bank details, platform logins and access tokens, briefs and correspondence |
| Client audiences (processed as operator) | Customer and lead lists, follower and engagement data, pixel and conversion data, audience lists |
| Suppliers, freelancers and contractors | Name, contact details, identity or registration numbers, bank details, invoices, portfolios |
| Job applicants | CV, qualifications, work history, references, contact details |
| People featured in content | Images, video, voice, name and role, release form details |
8.3 Recipients
| Recipient | Personal information |
|---|---|
| Advertising and social platforms (Meta, Google, LinkedIn, TikTok) | Pixel and conversion data, hashed contact lists for audience matching, campaign data |
| Operators and service providers (hosting, email and CRM, cloud storage, design and production tools, accounting, e-signature, scheduling) | Contact details, project files, financial records and campaign data as needed to provide the service |
| Clients | Lead and campaign data generated on their behalf |
| Freelancers and contractors under confidentiality | Only the information needed for their task |
| Accountants, auditors, attorneys, banks | Financial and contractual records |
| SARS, CIPC, the Regulator, courts and law enforcement | Records required by law or lawful order |
8.4 Transborder flows
Personal information is stored and processed by service providers outside the Republic, including in the United States, the European Union and the United Kingdom. Transfers take place under section 72 of POPIA on the basis of the recipients' binding data processing terms and standard contractual clauses, the performance of a contract with the data subject, or the data subject's consent.
8.5 Security measures
We apply reasonable technical and organisational measures to protect the confidentiality, integrity and availability of personal information, including unique credentials and two-factor authentication on all accounts, delegated rather than shared access to client platforms, encrypted storage and transmission, need-to-know access with confidentiality undertakings, regular updates and backups, prompt revocation of access when engagements end, and a documented breach response procedure. These measures are reviewed at least annually.
9. How to request access to a record
- Complete Form 2 (Request for Access to Record of Private Body), available from the Regulator at inforegulator.org.za/paia-forms or from our Information Officer.
- Send it to the Information Officer at jean@exsensic.com or the postal address in section 3, identifying the record sufficiently for us to locate it.
- Under section 50(1) of PAIA, identify the right you seek to exercise or protect and explain why the record is required for that purpose.
- State the form of access you need and how you wish to be informed of our decision. If you request on behalf of someone else, provide proof of your authority and proof of identity.
- Pay the prescribed request fee when we notify you to do so. A person requesting their own personal information does not pay a request fee.
We will decide within 30 days of receipt and may extend once by up to 30 days where PAIA allows, with reasons. If a record contains third-party information, the third-party notification procedure in sections 71 to 73 applies. If we refuse access we will give reasons and the provision relied on. If we do not respond in time the request is deemed refused (section 58).
Grounds for refusal
Chapter 4 of Part 3 of PAIA (sections 62 to 70) sets out when a private body must or may refuse access, including to protect the privacy of a third party (section 63), third-party commercial and confidential information (sections 64 and 65), the safety of individuals (section 66), legally privileged records (section 67) and our own commercial information (section 68). Where a ground applies to part of a record only, the rest is disclosed (section 57).
Remedies
There is no internal appeal against the decision of a private body. Within 180 days of the decision you may lodge a complaint with the Information Regulator on the prescribed form at PAIAComplaints@inforegulator.org.za, or apply to a court under section 78 of PAIA.
10. Prescribed fees
Fees are set in Annexure B to the PAIA Regulations, 2021 and published by the Regulator. They may change from time to time.
| Item | Fee |
|---|---|
| Request fee (not payable by a person requesting their own personal information) | R140,00 |
| Photocopy or printed copy, per A4 page or part thereof | R2,00 |
| Printed copy of a record held in electronic form, per A4 page | R2,00 |
| Copy in computer-readable form, transcription or copy of audio or visual images | As prescribed in Annexure B |
| Search for and preparation of the record, per hour after the first hour | R145,00 (not exceeding R435,00 in total) |
| Deposit, where search and preparation is expected to exceed six hours | Not more than one third of the access fee |
| Postage, email or other electronic transfer | Actual expense, if any |
11. Availability and updating of this manual
This manual is available on this page, at our offices for inspection during business hours, to any person on request (on payment of the prescribed copy fee, if any), and to the Information Regulator on request. The Information Officer updates it whenever there is a material change and reviews it at least once a year.