PAIA & POPIA Manual

This manual is published by Solution House Software (Pty) Ltd, a private body as defined in PAIA. It applies to Solution House Software and to all Products we develop, host and operate. It is intended to:

• Describe the categories of records we hold and those that are available without a formal request.
• Explain how to request access to a record and the fees payable.
• Describe the personal information we process, the purposes, the recipients, any planned transfers outside South Africa and our security measures.
• Tell you how to obtain the Information Regulator's Guide on how to use PAIA and POPIA.

The Regulator has, in terms of section 10(1) of PAIA, updated and made available a Guide on how to use PAIA and POPIA. The Guide is available in each official language from the Regulator's website (https://inforegulator.org.za). A copy may also be inspected at our offices during normal business hours or requested from our Information Officer.

The Guide explains, among other things, the objects of PAIA and POPIA, how to request access to a record, the assistance available from the Regulator and information officers, the remedies available, and the prescribed fees.

The following records are automatically available, free of charge, on our website:

• Privacy Statement, Cookie Policy and Terms of Use
• This PAIA & POPIA Manual
• Facial Recognition, CCTV & Licence Plate Notice
• Operator Data Processing Terms
• Company information and product descriptions
• Marketing materials and news published on our websites

Where applicable, we keep records in terms of the following legislation. These records are available only to the persons and in the manner prescribed by each Act:

• Basic Conditions of Employment Act 75 of 1997
• Broad-Based Black Economic Empowerment Act 53 of 2003
• Companies Act 71 of 2008
• Compensation for Occupational Injuries and Diseases Act 130 of 1993
• Consumer Protection Act 68 of 2008
• Copyright Act 98 of 1978
• Cybercrimes Act 19 of 2020
• Electronic Communications and Transactions Act 25 of 2002
• Employment Equity Act 55 of 1998
• Income Tax Act 58 of 1962
• Labour Relations Act 66 of 1995
• Occupational Health and Safety Act 85 of 1993
• Protection of Personal Information Act 4 of 2013
• Skills Development Levies Act 9 of 1999
• Tax Administration Act 28 of 2011
• Unemployment Insurance Act 63 of 2001 and Unemployment Insurance Contributions Act 4 of 2002
• Value-Added Tax Act 89 of 1991

7.1 Purpose of processing

We process personal information to develop, host, operate and support our Products on behalf of our clients; to manage our relationships with clients, suppliers, employees and job applicants; to secure our systems; to market our services; and to comply with the law. Full details are in our Privacy Statement.

7.2 Categories of data subjects and personal information

7.3 Recipients of personal information

7.4 Planned transfers outside South Africa

Some of our cloud hosting, email and processing service providers may store or process information outside South Africa. Such transfers take place only as permitted by section 72 of POPIA, as set out in our Privacy Statement.

7.5 Security measures

We apply the technical and organisational measures required by section 19 of POPIA, including encryption, logical separation of client data, role-based access controls, multi-factor authentication where available, audit logs, backups, security monitoring, staff confidentiality undertakings and written agreements with sub-operators.

1. Complete Form 2 (Request for Access to Record) of the PAIA Regulations, 2021, available from the Regulator's website or from our Information Officer.
2. Submit the form to our Information Officer by email (info@solutionhouse.co.za), by post or by hand at the addresses above.
3. Provide proof of identity and, if you are acting on behalf of someone else, proof of your authority to do so.
4. Describe the record in enough detail for us to identify it, and state the form and language in which you want access.
5. State which right you want to exercise or protect, and explain why the record is needed for that purpose (section 53(2)(d) of PAIA).
6. Pay the request fee, where applicable. If you cannot read or write, or have a disability, you may make the request orally and our Information Officer will help you complete the form.

We will decide on a request within 30 days. This period may be extended once by up to 30 days in the circumstances set out in section 57 of PAIA, and we will tell you if it is. If we do not respond within the required period, the request is regarded as refused. Where a request concerns a third party, we will notify that third party in terms of section 71 of PAIA.

Requests for records that we hold as an operator on behalf of a client will be referred to, or handled together with, that client.

Fees are as prescribed in Annexure B of the PAIA Regulations, 2021. If the prescribed fees are amended, the amended fees apply. A requester may apply to the Regulator or a court if they disagree with a fee.

We may, or must, refuse access to a record on the grounds set out in Chapter 4 of Part 3 of PAIA, including:

• Mandatory protection of the privacy of a third party who is a natural person (section 63)
• Mandatory protection of the commercial information of a third party (section 64)
• Mandatory protection of confidential information of a third party (section 65)
• Mandatory protection of the safety of individuals and the protection of property (section 66)
• Mandatory protection of records privileged from production in legal proceedings (section 67)
• Commercial information of SHS, including trade secrets and source code (section 68)
• Mandatory protection of research information (section 69)

Despite these grounds, we must grant access if disclosure would reveal evidence of a substantial contravention of the law or an imminent and serious public safety or environmental risk, and the public interest clearly outweighs the harm (section 70).

PAIA does not provide for an internal appeal against a decision of a private body. A requester or third party who is dissatisfied with our decision may, within 180 days, lodge a complaint with the Information Regulator in terms of section 77A of PAIA, or apply to a court of competent jurisdiction in terms of sections 78 to 82 of PAIA.

• Objection to the processing of personal information: Form 1 of the POPIA Regulations.
• Request for correction or deletion of personal information, or destruction or deletion of a record: Form 2 of the POPIA Regulations.
• Consent to direct marketing by electronic communication: Form 4 of the POPIA Regulations.

Completed forms can be submitted to our Information Officer. There is no charge for these requests.

This manual is available on our website at https://shs.myincidentdesk.com/legal/paia-manual, may be inspected at our principal place of business during normal business hours, and can be provided to the Regulator on request. A printed copy is available on payment of the prescribed fee. We review and update this manual regularly, and at least once a year.