PAIA manual.

1. Introduction

The Promotion of Access to Information Act, 2000 (“PAIA”) gives effect to the constitutional right of access to information held by private bodies, where that information is required for the exercise or protection of any rights. Servana Pty Ltd (“Servana”, “we”, “us”, “our”) publishes this manual under section 51 of PAIA, as amended by the Protection of Personal Information Act, 2013 (“POPIA”).

This manual tells you what records we hold, how to request access to them, and how we process personal information. It should be read together with our Privacy Policy.

2. Our details

• Legal name: Servana Pty Ltd, a private company
• Registration number: 2025/897026/07
• Physical and postal address: 95 Owl Road, Kikuyu Estate, Midrand, Gauteng, 2090, South Africa
• Telephone: +27 66 229 8451
• Email: [email protected]
• Website: withservana.com

3. Our Information Officer

Requests under PAIA, and questions about how we process personal information, go to our Information Officer:

• Information Officer: Mtha Ngcakani
• Email: [email protected]
• Telephone: +27 66 229 8451
• Address: 95 Owl Road, Kikuyu Estate, Midrand, Gauteng, 2090, South Africa

We have not designated a Deputy Information Officer. If we do, we will add their details here.

4. The Information Regulator’s guide

The Information Regulator has compiled a guide, under section 10 of PAIA, on how to use PAIA and POPIA to exercise your rights. You can get it from the Information Regulator, or ask us for a copy.

• Information Regulator (South Africa) — Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191
• Telephone: 010 023 5200 (toll-free 0800 017 160)
• Email: [email protected]
• Website: https://inforegulator.org.za

5. Records available without a request

Some information is available without a formal request, including:

• the content of our website, including our Privacy Policy, Terms of Service, Refund Policy, Cancellation Policy and this manual;
• service and marketing information we publish; and
• information already in the public domain, such as our company registration details held by the Companies and Intellectual Property Commission (CIPC).

6. Records kept under other legislation

We keep records as required by the legislation that applies to us, which, depending on our circumstances, may include:

• the Companies Act 71 of 2008;
• the Income Tax Act 58 of 1962 and the Tax Administration Act 28 of 2011;
• the Basic Conditions of Employment Act 75 of 1997, the Labour Relations Act 66 of 1995 and the Employment Equity Act 55 of 1998;
• the Unemployment Insurance Act 63 of 2001 and the Unemployment Insurance Contributions Act 4 of 2002;
• the Compensation for Occupational Injuries and Diseases Act 130 of 1993 and the Skills Development Levies Act 9 of 1999;
• the Consumer Protection Act 68 of 2008 and the Electronic Communications and Transactions Act 25 of 2002; and
• the Protection of Personal Information Act 4 of 2013 and the Promotion of Access to Information Act 2 of 2000.

7. Subjects and categories of records we hold

We hold records in the following categories:

• Company records — incorporation documents, memorandum of incorporation, registers, minutes, resolutions and CIPC filings.
• Financial and tax records — accounting records, bank statements, invoices, financial statements and tax returns.
• Personnel records — where we employ or contract people: contracts, payroll, leave and performance records, and recruitment records.
• Client and engagement records — proposals, agreements, correspondence, working papers, deliverables, and information about client systems within an agreed scope.
• Supplier and operator records — agreements, invoices and correspondence with our suppliers and service providers.
• Information technology records — system and security documentation, access records and IT policies.
• Website and communication records — enquiries sent through our website or by email, and aggregate website analytics.
• Policy and compliance records — internal policies, POPIA and PAIA records, and records of requests from data subjects.

Records in these categories are not automatically available. Access is subject to the request procedure and the grounds for refusal set out below.

8. How we process personal information

Purposes. We process personal information to respond to enquiries, deliver and manage client engagements, recruit and manage personnel, make and receive payments, operate and secure our website and systems, and meet our legal obligations. Our Privacy Policy describes these purposes in more detail.

Categories of data subjects and their personal information:

• Clients and prospective clients, including their representatives — names, contact details, job titles, company details, correspondence, and engagement and billing information.
• Website visitors and people who contact us — names, contact details and the content of messages, and technical information such as IP address, browser type and pages visited.
• Personnel and job applicants — identity and contact details, identity numbers, qualifications, employment history, banking and tax details and, where the law requires it, limited special personal information.
• Suppliers and service providers — company and contact details, banking details, agreements and invoices.
• People whose information we encounter in client engagements — information about our clients’ staff, customers or users that falls within an agreed scope, processed on our client’s instructions.

Recipients. We may share personal information with operators who process it on our behalf (such as hosting, email, website content, analytics, AI and payment providers), with professional advisers, with regulators and authorities where the law requires, and as otherwise described in our Privacy Policy. We do not sell personal information.

Cross-border transfers. Some of our operators, including Railway, Cloudflare, Resend and Sanity, store or process information outside South Africa. We transfer personal information across borders only as section 72 of POPIA allows.

Security measures. We protect personal information with reasonable technical and organisational measures, including access controls, encryption in transit, secure configuration of our systems, confidentiality obligations on our people, and due diligence on our operators.

9. How to request access to a record

To request access to a record we hold:

• complete Form 2 (Request for Access to Record) prescribed by the PAIA Regulations, which is available from the Information Regulator’s website or from us on request;
• send it to our Information Officer at [email protected], or deliver it to our physical address above;
• give enough detail for us to identify you and the record, and say in what form you would like access; and
• identify the right you are exercising or protecting, and explain why the record is required for it, as section 53 of PAIA requires.

If you are making a request on behalf of someone else, include proof of the capacity in which you are acting. If you need help completing the form, contact our Information Officer.

If you simply want to see, correct or delete your own personal information, you can also email [email protected], as our Privacy Policy explains.

10. Fees

PAIA allows a private body to charge a request fee and, if access is granted, an access fee for searching for, preparing and reproducing records. Any fees we charge are those prescribed by the PAIA Regulations. We will tell you what is payable before we process your request, and we may withhold access until the fees are paid.

If you are requesting your own personal information, you do not pay the request fee. If finding and preparing a record will take longer than the time the Regulations allow without a deposit, we may ask for a deposit of up to one third of the access fee.

11. Our decision and timelines

We will decide on your request within 30 days of receiving it in the prescribed form, and tell you our decision in writing. Where PAIA allows, we may extend this period once, by up to 30 days, and we will tell you why. If we do not decide within the time allowed, your request is regarded as refused.

12. Grounds for refusing access

PAIA requires or allows us to refuse access to some records, including where access would:

• unreasonably disclose personal information about another person (section 63);
• disclose a third party’s trade secrets or confidential commercial, financial or technical information (section 64);
• breach a duty of confidence we owe to a third party (section 65);
• endanger a person’s life or physical safety, or the security of property (section 66);
• disclose a record that is privileged from production in legal proceedings (section 67);
• disclose our own trade secrets or confidential commercial, financial or technical information, or harm our commercial or financial interests (section 68); or
• disclose research information of a third party or of ours (section 69).

Client engagement records usually contain our clients’ confidential information, and are generally protected by sections 64 and 65. Even where a ground for refusal applies, we must grant access where the public interest override in section 70 requires it.

13. If you disagree with our decision

A private body has no internal appeal process. If you are unhappy with our decision on your request, including a decision about fees or an extension of time, you may lodge a complaint with the Information Regulator within 180 days of the decision, or apply to a court for appropriate relief, as PAIA provides.

14. Availability and updates

This manual is available on our website at withservana.com/paia and, free of charge, from our Information Officer. We will also provide a copy to the Information Regulator on request. We update it when our details or practices change, and the date at the top shows when it was last updated.