PAIA manual

1. Purpose of this manual

The Promotion of Access to Information Act 2 of 2000 (PAIA) gives effect to the constitutional right of access to information held by a private body, where that information is required to exercise or protect a right. Section 51 requires every private body to publish a manual explaining what records it holds and how to ask for them. This is Pullin’s manual.

If what you want is your own personal information, you do not need PAIA at all: the Privacy policy explains how to see, correct or delete it directly, and section 23 of POPIA entitles you to a copy of it for free.

2. Contact details (section 51(1)(a))

Pullin has no deputy information officer. The Information Officer handles PAIA requests, POPIA access and complaints, and any question about this manual.

3. The section 10 guide (section 51(1)(b))

The Information Regulator has published a guide, in each official language, on how to use PAIA and how to exercise your rights under it. The guide is available on the Regulator’s website, from the Regulator’s offices, and from the Information Officer on request.

4. Records available without a request (section 51(1)(c))

The following are published and can be read by anyone, without a PAIA request or fee:

• Everything on the public website, including the Privacy policy, the Terms of service, the Acceptable use policy, the pricing page and this manual.
• The public page of any event whose host has shared its link, with whatever the host chose to show on it.
• Your own RSVP, bring-list claims, lift arrangements and photos, through the personal link you received or the WhatsApp bot.
• For account holders: their own events, guest lists, billing history and receipts, through their account.

No notice under section 52(2) has been published; the list above is maintained in this manual instead.

5. Records available under other legislation (section 51(1)(d))

Where another law gives you access to a record, you may use that law instead of PAIA. The ones that apply to Pullin are:

• Protection of Personal Information Act 4 of 2013: your own personal information (sections 23 and 24).
• Consumer Protection Act 68 of 2008 and Electronic Communications and Transactions Act 25 of 2002: records of transactions you entered into with us.
• Companies Act 71 of 2008: company records of SMRJ, to the extent the Act makes them available.

6. Records we hold (section 51(1)(e))

To help you frame a request, these are the subjects on which Pullin holds records, and the categories of record under each. Personal information in them is held for the purposes, and for as long, as the Privacy policy describes.

Pullin does not hold records under the Promotion of Equality and Prevention of Unfair Discrimination Act, employment records (it has no employees), or records on behalf of any public body.

7. Processing of personal information (regulation 4(1)(d))

The 2021 PAIA Regulations require this manual to describe how the private body processes personal information. The Privacy policy is the full statement; in summary:

Purpose

Coordinating the specific event a person is attending or organising: RSVPs, headcounts, reminders and updates about that event, lift and bring-list coordination, photo sharing, and billing hosts for paid plans.

Data subjects and categories of information

Hosts and co-hosts (name, email address, sign-in identifier, optional WhatsApp number, billing records). Guests (chosen name, RSVP status and headcount, email address or WhatsApp number where given, optional dietary note and note to the host, lift details, photos, and messages exchanged with the bot). Visitors (cookieless, aggregated usage statistics and a short-lived rate-limiting record).

Recipients

The host and co-hosts of the event a guest RSVP’d to, and the operators listed in the privacy policy: cloud hosting and database, content delivery, WhatsApp messaging (Meta), email delivery, payments, host sign-in, error monitoring, analytics and AI models. No personal information is sold or shared for marketing.

Transborder flows

Hosting and the database are in the European Union (Germany), with AI models in the Netherlands, under section 72(1)(a) of POPIA on the basis that the GDPR provides substantially similar protection. Sign-in, error monitoring and part of email delivery run in the United States under the providers’ contractual safeguards. WhatsApp messages are processed on Meta’s global network under its terms.

Security measures

Encryption in transit and at rest, access to production limited to the Information Officer, per-event authorisation on every read and write, minimal data collection, automatic retention limits (chat text erased after 90 days, guest details anonymised twelve months after an event), and an audit trail of administrative actions. A security compromise is reported to the Regulator and the people affected as section 22 of POPIA requires.

8. Requests from public authorities for personal information

A public authority (the police, a court, a regulator or another organ of state) may ask Pullin for personal information about a host or a guest. Pullin discloses personal information to a public authority only on a lawful request that states its legal basis and the specific information sought, and only to the extent that section 11(1)(c) of POPIA or another law requires or permits. The Information Officer handles every such request as follows:

• Legality review. The request must be in writing, come from an authority with the power to make it, cite the law it relies on, and be specific about the person, the records and the period. A request that does not meet this standard is not acted on until it does.
• Challenge. A request that appears unlawful, overbroad or outside the authority’s powers is refused or narrowed, with legal advice taken and the matter referred to the Information Regulator or a court where the circumstances warrant it.
• Data minimisation. Only the specific records the request lawfully requires are disclosed, never a full export, and a request about one person never yields information about another.
• Record keeping. Every request, the response, the legal reasoning and the officials involved are recorded and kept for at least five years. The person concerned is told about the request unless the law prohibits it or the request itself lawfully requires confidentiality.

A request involving an imminent threat to someone’s life or safety is handled under the same rules on an urgent basis.

9. How to request access (sections 53 to 57)

• Complete Form 2 (Request for access to a record of a private body), published by the Regulator and available from the Information Officer on request, and email it to hello@pullin.co.za.
• Give enough detail for us to identify the record, say which form of access you want (for example an electronic copy), give an address or email for our reply, and, unless you are asking for your own personal information, explain which right the record is required to exercise or protect.
• If you are asking on someone else’s behalf, say in what capacity and attach proof that you are entitled to.
• We acknowledge the request and decide on it within 30 days. Where a request involves a large volume of records or consultation with others, we may extend once by up to 30 days and will tell you why in writing. If we refuse, in whole or in part, we tell you the grounds under the Act for the refusal.
• A request is refused where the Act requires it, for example where a record contains someone else’s personal information, commercial information of a third party, or information privileged in legal proceedings, and where no public-interest override applies.

10. Fees (section 54 and the 2021 regulations)

The fees are those prescribed in Annexure B of the PAIA Regulations of 2021. Someone asking for their own personal information pays no request fee. Where a search is expected to take more than six hours, a deposit of one third of the access fee may be asked for before the search begins.

In practice most records Pullin holds are electronic, and we send them by email at no cost beyond the request fee where one applies.

11. Remedies if a request is refused (section 51(1)(f))

Pullin has no internal appeal procedure: the Information Officer is the head of the private body and the decision is final within Pullin. If you are not satisfied with a decision, or with the fees charged, or with a failure to decide in time, you may:

• Lodge a complaint with the Information Regulator on Form 5, within 180 days of the decision, at PAIAComplaints@inforegulator.org.za. The Regulator may investigate and make a recommendation or an enforcement order.
• Apply to a court under section 78 of the Act, within 180 days of the decision or of the Regulator’s finding, for appropriate relief.

12. Availability of this manual (section 51(3))

This manual is published at www.pullin.co.za/paia-manual, is available for inspection on request to the Information Officer, and is supplied to the Information Regulator on request. A copy can be emailed to anyone who asks the Information Officer for one. It is reviewed whenever the way Pullin processes information changes, and at least once a year.