PAIA and POPIA Manual

1. List of acronyms and abbreviations

• Company — Mas Vuka (Pty) Ltd
• IO — Information Officer
• Minister — Minister of Justice and Correctional Services
• PAIA — Promotion of Access to Information Act 2 of 2000, as amended
• POPIA — Protection of Personal Information Act 4 of 2013
• Regulator — Information Regulator (South Africa)
• Republic — Republic of South Africa

2. Purpose of this manual

This manual helps a requester to:

• check what categories of records the Company holds and which are available without a formal request;
• understand how to request access to a record of the Company, and the fees involved;
• know the grounds on which a request may be refused, and the remedies available;
• understand how the Company processes personal information, the categories of data subjects and recipients, any planned cross-border transfers, and the security measures in place;
• know who to contact at the Company.

3. Company details and Information Officer

• Company — Mas Vuka (Pty) Ltd, a private company
• Nature of business — Developer and operator of the Mas Vuka (Vuka) labour-law and HR compliance software platform (web and mobile application), and related HR compliance services
• Head of private body / Information Officer — Tapiwanashe Lindson Chagonda
• Deputy Information Officer — None designated
• Postal and physical address — 1 Acacia Ln, Riverglen, Midrand, Gauteng, 2191
• Telephone — 076 362 7404
• Email for PAIA and POPIA requests — admin@masvuka.com
• Website — masvuka.com

4. Guide on how to use PAIA

The Regulator has published a Guide in each official language on how to exercise rights under PAIA and POPIA. It explains, among other things, the objects of PAIA and POPIA, contact details of information officers, the request procedure, the help available from the Regulator, and the remedies and fees that apply.

The Guide is available for inspection at the Company’s office during normal working hours and on the Regulator’s website, www.inforegulator.org.za. A copy can be requested from the Information Officer.

• Information Regulator — Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191
• Email — enquiries@inforegulator.org.za
• Telephone — 010 023 5200

5. Records automatically available (section 52)

The following records are available without a formal PAIA request:

• Public company information — registered name, registration number, registered address, director names (on request, and from CIPC);
• Product information — website content, pricing, terms of use, privacy policy, refund policy (on masvuka.com);
• This manual — on masvuka.com and at the office.

6. Records available in terms of other legislation

The Company keeps records as required by, among others, the following laws (where applicable to its activities):

• Basic Conditions of Employment Act 75 of 1997
• Broad-Based Black Economic Empowerment Act 53 of 2003
• Companies Act 71 of 2008
• Compensation for Occupational Injuries and Diseases Act 130 of 1993
• Consumer Protection Act 68 of 2008
• Electronic Communications and Transactions Act 25 of 2002
• Employment Equity Act 55 of 1998
• Income Tax Act 58 of 1962
• Labour Relations Act 66 of 1995
• Protection of Personal Information Act 4 of 2013
• Skills Development Act 97 of 1998 and Skills Development Levies Act 9 of 1999
• Tax Administration Act 28 of 2011
• Unemployment Insurance Act 63 of 2001 and Unemployment Insurance Contributions Act 4 of 2002
• Value-Added Tax Act 89 of 1991

7. Subjects and categories of records held

• Company secretarial — MOI, CIPC certificates, securities register, register of directors, resolutions, beneficial ownership records, annual returns
• Finance and tax — accounting records, bank statements, invoices, financial statements, SARS registrations and returns, payment-provider records
• Human resources (when employing) — employment contracts, personnel files, payroll, leave, disciplinary and performance records, EE and skills records
• Customers and users — account and subscription records, support correspondence, documents generated on the platform, consents
• Suppliers and service providers — contracts, service agreements, invoices, due-diligence records
• Technology and security — system logs, access records, security incident records, data-processing agreements
• Marketing and procurement — company profile, tender submissions, B-BBEE certificate, CSD records

8. Processing of personal information (POPIA)

8.1 Purpose of processing

• to register users, provide the Mas Vuka platform and its features (AI compliance assistant, document generation, HR and labour-relations tools) and manage subscriptions;
• to process payments and prevent fraud;
• to respond to queries, provide support and send service communications;
• to meet legal, tax, labour and regulatory obligations;
• to employ and manage staff, and to procure goods and services;
• to improve, secure and analyse the platform, using de-identified data where possible;
• to market the Company’s services, subject to POPIA section 69 and the user’s consent or opt-out.

8.2 Categories of data subjects and personal information

• Platform users (workers, employers, HR practitioners) — name, contact details, login details, ID number where needed, employer or company details, subscription and payment status, usage data, content uploaded or generated;
• Employees of employer clients (processed on behalf of the client) — names, ID numbers, job details, remuneration, disciplinary, performance, attendance and EE demographic information, which may include special personal information (race, health) uploaded by the employer;
• Company employees and applicants — identity, contact, banking, tax, qualifications, employment history, demographic data for EE reporting, health information where legally required;
• Suppliers and service providers — names, contact persons, banking, tax and B-BBEE details;
• Website visitors — IP address, device and cookie data, enquiries submitted.

Where an employer client uploads its employees’ information, the employer is the responsible party and the Company acts as its operator under a written agreement (POPIA sections 20 and 21).

8.3 Recipients or categories of recipients

• cloud hosting, database and authentication providers that host the platform;
• AI model providers used to power the compliance assistant, under contractual confidentiality and data-protection terms;
• payment processors and app stores (for example Payfast, Apple App Store, Google Play and subscription-management providers);
• professional advisers, auditors and accountants;
• regulators and authorities where required by law (for example SARS, CIPC, the Department of Employment and Labour, the Information Regulator, the CCMA or courts).

8.4 Planned trans-border flows

Some service providers (for example cloud hosting, AI and app-store providers) may store or process personal information outside the Republic. The Company only transfers personal information across borders in line with POPIA section 72: where the recipient is subject to laws, binding corporate rules or an agreement giving an adequate level of protection, where the data subject consents, or where the transfer is necessary to perform a contract with the data subject.

8.5 Security measures

• encryption of data in transit (TLS) and at rest through the hosting provider;
• role-based access controls and row-level security, so that each user and employer can only access their own records;
• strong authentication for administrator accounts, and least-privilege access for the Company’s personnel;
• secure storage of secrets and API keys; no sharing of credentials;
• regular back-ups, logging and monitoring of access;
• written data-processing terms with operators and service providers;
• a security-compromise response procedure, including notification to the Regulator and affected data subjects under POPIA section 22.

9. How to request access to a record

1. Complete Form 2 (Request for Access to Record) prescribed under the PAIA Regulations, available from the Regulator’s website or from the Information Officer.
2. Submit the form to the Information Officer by email to admin@masvuka.com or by hand at the registered office.
3. Provide enough detail to identify the record, state the form of access required, and, if you are asking on behalf of someone else, provide proof of your authority.
4. Pay the prescribed request fee (if applicable) before the request is processed. An access fee may also be payable before access is given.
5. The Company will decide on the request within 30 days, which may be extended once by up to 30 days in the circumstances set out in PAIA section 57.
6. Requests by data subjects for their own personal information under POPIA section 23, and for correction or deletion under section 24, may be made using Form 2 under the PAIA Regulations or Form 2 under the POPIA Regulations, as applicable.

10. Fees

Fees are payable as prescribed in the PAIA Regulations, as amended from time to time. At the date of this manual these include:

• Request fee (not payable by a requester seeking their own personal information) — R140.00;
• Photocopy or printed A4 page (black and white) — R2.00 per page;
• Search and preparation, per hour or part, after the first hour — as prescribed;
• Copy on USB or other electronic media — as prescribed;
• Deposit (if search exceeds 6 hours) — one third of the access fee.

11. Grounds for refusal and remedies

The Company may refuse access on the grounds set out in Chapter 4 of Part 3 of PAIA, including protection of the privacy of third parties, commercial information of the Company or a third party, confidential information, safety of persons and property, legally privileged records, and research information.

The Company does not have an internal appeal procedure. A requester who is dissatisfied with a decision may, within 180 days, lodge a complaint with the Information Regulator or apply to court for relief.

12. Availability and updating of this manual

This manual is available on masvuka.com, at the registered office for inspection during normal business hours, and to the Regulator on request. Copies may be provided at the prescribed fee. The Information Officer will review and update this manual when material changes occur and at least once a year.