PAIA manual
Prepared under section 51 of the Promotion of Access to Information Act 2 of 2000 (PAIA), as amended by the Protection of Personal Information Act 4 of 2013 (POPIA).
Compiled [date]. Version 1.0.
1. About this manual
PAIA gives everyone the right to ask for records held by a private body when they need them to exercise or protect a right. This manual explains what records [Company name] (Pty) Ltd, trading as Mennula, holds, how to ask for them, what it costs and how we process personal information.
The manual is available free of charge on our website at mennula.com/paia and at our office. We will give the Information Regulator a copy on request, and we update it whenever something important changes.
2. Our details
| Company | [Company name] (Pty) Ltd, trading as Mennula |
| Registration number | [registration number] |
| Head of the body | [director's name], director |
| Information Officer | [Information Officer's name] |
| Deputy Information Officer | [name, or "None appointed"] |
| Street address | [physical address] |
| Postal address | [postal address] |
| Phone | [phone number] |
| privacy@mennula.com | |
| Website | mennula.com |
3. The Information Regulator's guide
The Information Regulator publishes a guide on how to use PAIA and POPIA, in each official language. You can get it from the Regulator:
- Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191
- enquiries@inforegulator.org.za
- 010 023 5200 (toll free 0800 017 160)
- inforegulator.org.za
4. Records available without a request
These records are available on our website without a PAIA request: our privacy policy, terms of service, operator agreement, candidate privacy notice, this manual, our prices and our company information. We have not published a notice under section 52(2) of PAIA.
5. Records kept under other laws
Where they apply to us, we keep records under these laws: the Companies Act 71 of 2008; the Income Tax Act 58 of 1962; the Tax Administration Act 28 of 2011; the Basic Conditions of Employment Act 75 of 1997; the Labour Relations Act 66 of 1995; the Employment Equity Act 55 of 1998; the Unemployment Insurance Act 63 of 2001; the Compensation for Occupational Injuries and Diseases Act 130 of 1993; the Skills Development Levies Act 9 of 1999; the Protection of Personal Information Act 4 of 2013; the Electronic Communications and Transactions Act 25 of 2002; and the Consumer Protection Act 68 of 2008.
6. The records we hold
| Subject | Categories of records |
|---|---|
| Company | Registration documents, memorandum of incorporation, share register, directors' records, resolutions and minutes |
| Finance and tax | Financial statements, accounting records, bank statements, invoices, tax returns |
| Agreements | Agreements with agencies (terms of service, operator agreements, Enterprise quotes), agreements with suppliers and sub-operators, test agreements |
| Customers | Agency account details, users, plans, billing and payment records, support messages and call notes |
| Marketing and leads | Website enquiries, early-access sign-ups and marketing consents |
| Technology and security | Security policies, access and audit logs, incident records, backup records |
| Staff (if any) | Employment contracts, payroll, leave, tax and benefits records |
Records we hold for agencies. Candidate and client information in Mennula belongs to the agency that put it there. We hold it only as the agency's operator. If you want access to that information, please ask the agency. If you ask us, we will pass your request to the agency.
7. How we process personal information
Why we process it: to provide Mennula to agencies, bill them, support them, keep our systems secure, reply to enquiries, send product news to people who asked for it, run our company and meet our legal duties.
| Data subjects | Personal information |
|---|---|
| Agency users | Name, work email, mobile number, role, sign-in records, audit log entries |
| Agency billing contacts | Name, email, plan, invoices, payment status |
| People who contact us or sign up for early access | Name, agency, email, mobile number, message, marketing choice |
| Phase 1 testers | Name, email, agency, feedback |
| Website visitors | IP address and browser details in server logs |
| Candidates and client contacts (as operator for agencies) | Contact details, CV content, messages, interview times and documents, as described in our operator agreement |
| Suppliers and their contact people | Names, contact details, contracts, invoices |
| Staff (if any) | Employment, payroll and tax details |
Who receives it: our hosting provider (xneelo, South Africa), Amazon Web Services (Cape Town), Anthropic (AI processing of text with identifying details removed), Paystack (payments), Meta (WhatsApp messages, only with the add-on), our professional advisers, and authorities when the law requires.
Information sent outside South Africa: text with identifying details removed is sent to Anthropic in the United States; WhatsApp messages go through Meta; payment details go through Paystack. Each is bound by an agreement giving protection substantially similar to POPIA.
Security: information is stored in South Africa, each agency has its own database and encryption key, sensitive data is encrypted, access is limited and logged, backups are encrypted and tested, and we have a written incident plan. Our operator agreement describes these measures in more detail.
8. How to request a record
- Fill in Form 2 (Request for access to a record) from the PAIA Regulations, available from the Information Regulator's website or from us.
- Send it to our Information Officer by email, post or hand delivery, using the details in section 2.
- Give enough detail for us to find the record, say how you'd like access (a copy, by email or to inspect it), and explain which right you need the record to exercise or protect.
- Include proof of identity. If you ask on behalf of someone else, include proof that you may act for them.
- Pay the request fee if it applies (see section 9). We will tell you if a deposit or access fee is needed before we search.
We will decide within 30 days. We may extend this once, by up to 30 days, if the request is large or needs a long search, and we will tell you why. If we don't answer in time, the request is treated as refused.
We may refuse access only on the grounds in Chapter 4 of Part 3 of PAIA, for example to protect another person's privacy, a third party's commercial or confidential information, someone's safety, legally privileged records, or our own commercial information. If a record is about a third party, we will tell them and give them a chance to respond before we decide. If we refuse, we will give you our reasons.
9. Fees
These are the fees prescribed for private bodies. People asking for their own personal information don't pay the request fee.
| Item | Fee |
|---|---|
| Request fee | R140.00 |
| Photocopy or printed copy, per A4 page | R2.00 |
| Copy on a flash drive you supply | R40.00 |
| Copy on a CD you supply / we supply | R40.00 / R60.00 |
| Transcription of an audio record, per A4 page | R24.00 |
| Search and preparation, per hour after the first hour | R145.00, up to R435.00 in total |
| Deposit, if the search takes more than 6 hours | One third of the access fee |
| Postage or courier | Actual cost |
Fees are set by the PAIA Regulations and may change. We will always tell you the fee before you pay.
10. If you're not happy with our decision
You may complain to the Information Regulator within 180 days of our decision, or apply to court within 180 days. The Regulator's details are in section 3.