PAIA and POPIA Manual

1Introduction and Purpose

1.1
This Manual is published by Kwico Digital Labs (Pty) Ltd (“Kwico”) in compliance with section 51 of the Promotion of Access to Information Act 2 of 2000 (“PAIA”) and in support of Kwico’s obligations under the Protection of Personal Information Act 4 of 2013 (“POPIA”).
1.2
The purpose of this Manual is to: describe the categories of records held by Kwico; explain the procedure for requesting access to those records; and set out the rights of data subjects in relation to their Personal Information.
1.3
This Manual is a passive compliance document. It does not form part of the User acceptance journey and does not require User acknowledgement.
1.4
This Manual is published on the Kwico website at https://www.heykwico.com and is linked in the website footer. It is available for download by any person.
1.5
Kwico’s registration number is 2026/497744/07. Kwico’s registered address is 148 Acacia Road, Northcliff, Gauteng, 2195.
1.6
Kwico is affiliated with Pronto Digital Labs, Inc., a corporation incorporated in the State of Delaware in the United States of America, which provides certain technical, hosting, domain and payment-processing functions in support of Kwico’s services. Pronto Digital Labs, Inc. acts as an Operator processing Personal Information on Kwico’s behalf and on Kwico’s instruction. Kwico is the Responsible Party in respect of all Personal Information processed in connection with its services and remains responsible to Data Subjects in respect of that processing.
1.7
This Manual will be reviewed and updated annually or as required by changes in applicable law or Kwico’s operations.
1.8
Kwico’s user-facing legal framework operates on a two-layer architecture: (a) the Kwico Terms and Conditions of Use, which are accepted electronically by the User upon initiating a WhatsApp conversation with Kwico or upon subscribing; and (b) the Kwico Privacy Policy, which sets out the manner in which Personal Information is processed. This Manual supports that framework by setting out the categories of records held by Kwico, the access request procedure, and the rights of Data Subjects. It does not form part of the User acceptance journey and does not require User acknowledgement.

2Description of Kwico’s Business

2.1
Kwico is a technology business that designs, generates, publishes, hosts and maintains websites for small and medium-sized businesses. Kwico’s service is delivered through an automated conversational agent operating on the WhatsApp Business Platform, by means of which a User describes their business and Kwico generates a website reflecting that description, presents it to the User for preview, and publishes it.
2.2
The nature and scope of Kwico’s services include, without limitation:
1. 2.2.1
  intake and processing of User enquiries and business information submitted through the WhatsApp Business Platform;
2. 2.2.2
  automated generation of website content, structure, layout and design based on the information supplied by the User;
3. 2.2.3
  delivery of preview links enabling the User to review and revise the generated website before publication;
4. 2.2.4
  publication and hosting of the website, either on a domain owned by Kwico or on a custom domain registered by or for the User;
5. 2.2.5
  registration, renewal and administration of custom domain names on behalf of Users;
6. 2.2.6
  ongoing maintenance, revision and updating of published websites during the currency of a subscription;
7. 2.2.7
  provision of a dashboard reflecting traffic and usage statistics in respect of a User’s website;
8. 2.2.8
  administration of subscription billing and the collection of subscription fees through third-party payment processors;
9. 2.2.9
  administration of Kwico’s referral programme, including the calculation and payment of referral discounts and referral rewards; and
10. 2.2.10
  user support delivered through the WhatsApp channel.
2.3
Kwico offers a free tier, in terms of which a website is published on a domain owned by Kwico at no charge to the User, and a paid tier, in terms of which a website is published on the User’s own custom domain against payment of a monthly subscription fee.
2.4
The information which Kwico collects from a User is information which the User provides for the express purpose of having it published on the User’s website and displayed to the public at large. The publication of that information is the whole object of Kwico’s service. Kwico does not solicit, and has no use for, Personal Information which is not intended for publication on a User’s website, and does not use or retain information of that nature beyond what is operationally necessary to conduct the conversation and deliver the service.
2.5
Kwico is not a general-purpose artificial intelligence assistant, a distributor of large language models, or an open-ended conversational artificial intelligence provider. Any automated or AI-assisted processing occurring in the course of a WhatsApp conversation is incidental and ancillary to Kwico’s core business of website creation, hosting and maintenance.
2.6
Kwico does not provide legal advice, tax advice, accounting advice, financial advice, insurance advice, investment advice, or any regulated advisory service.
2.7
In the course of rendering its services, Kwico makes use of technology and AI-assisted systems, including large language model providers, cloud hosting and database platforms, messaging platforms, payment platforms and automated communication tools, subject at all times to human oversight and validation.
2.8
The registered address of Kwico is 148 Acacia Road, Northcliff, Gauteng, 2195. Kwico’s principal place of business is 24 Sultan Street, Die Boord, Stellenbosch, 7600.

3Legislative Framework

Promotion of Access to Information Act 2 of 2000 (“PAIA”)

3.1
PAIA was assented to on 2 February 2000 and commenced on 9 March 2001. The fundamental purpose of PAIA is to give effect to section 32 of the Constitution, which entrenches the right of access to information held by the State or any other person, where that information is required for the exercise or protection of a right.
3.2
Where a Request for Access is made in terms of section 50 of PAIA, a private body such as Kwico is obliged to release records or information except where PAIA expressly provides that records or information may or must be withheld.
3.3
PAIA sets out the procedural requirements to be followed by a Requester when requesting access to records held by a private body.

Protection of Personal Information Act 4 of 2013 (“POPIA”)

3.4
POPIA was assented to on 26 November 2013 and fully commenced on 1 July 2021. The purpose of POPIA is to give effect to the constitutional right to privacy by protecting Personal Information and regulating the free flow and processing of Personal Information.
3.5
POPIA sets out minimum Conditions for Lawful Processing that all Responsible Parties, including Kwico, must comply with in order to ensure that Personal Information is protected. These conditions are more fully described in section 8 of this Manual.
3.6
POPIA recognises that the right to privacy is not absolute and may be limited only to the extent that such limitation is reasonable and justifiable in an open and democratic society, as contemplated in section 36 of the Constitution.

4Information Officer

Kwico has designated an Information Officer in terms of section 55 of POPIA, who has been registered with the Information Regulator. The Information Officer is responsible for encouraging and ensuring compliance with POPIA within Kwico and for handling all PAIA access requests and POPIA data subject rights requests.

Information Officer: Adriaan Reinier van Coller
Email: adriaanvc@heykwico.com
Telephone: 083 795 2177
Postal address: 148 Acacia Road, Northcliff, Gauteng, 2195

5South African Information Regulator

5.1
The Information Regulator is the regulatory authority established in terms of section 39 of POPIA and is responsible for monitoring and enforcing compliance with POPIA and PAIA in South Africa. The functions previously exercised by the South African Human Rights Commission in relation to PAIA now vest in the Information Regulator.
5.2
A Guide on how to use PAIA has been compiled by the Information Regulator in terms of section 10 of PAIA. That Guide is available in each of the official languages, free of charge, from the Information Regulator at the contact details set out below and on the Information Regulator’s website.
5.3
The contact details of the Information Regulator are as follows:
1. 5.3.1
  Address: Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191
2. 5.3.2
  Postal address: P.O. Box 31533, Braamfontein, Johannesburg, 2017
3. 5.3.3
  Email address (general enquiries): enquiries@inforegulator.org.za
4. 5.3.4
  Email address (POPIA complaints): POPIAComplaints@inforegulator.org.za
5. 5.3.5
  Email address (PAIA complaints): PAIAComplaints@inforegulator.org.za
6. 5.3.6
  Website: www.inforegulator.org.za
7. 5.3.7
  Phone number: 010 023 5200 / Toll Free: 0800 017 160

6Categories of Records Held by Kwico and Purposes of Processing

6.1
In the course of conducting its business as a website creation, publication, hosting and maintenance service provider, Kwico holds and processes various categories of records. These records are held for lawful and specific purposes relating to the conduct of Kwico’s business, the rendering of its services, compliance with applicable law, and the protection of Kwico’s legitimate interests.

User Records

6.2
Kwico holds the following categories of records in relation to its Users:
1. 6.2.1
  WhatsApp mobile telephone numbers and WhatsApp profile names;
2. 6.2.2
  full names and contact details of Users and their representatives (telephone numbers, email addresses, and physical or business addresses, for example);
3. 6.2.3
  business information supplied by the User for publication (business name, trading name, description of goods or services offered, trading hours, areas served, physical location, and public contact details, for example);
4. 6.2.4
  images, photographs, logos and other media uploaded by the User for inclusion on the website;
5. 6.2.5
  the content, structure, design and successive versions of each website generated for the User;
6. 6.2.6
  conversation records exchanged between the User and Kwico’s automated agent through the WhatsApp Business Platform, including message content, timestamps and conversation state;
7. 6.2.7
  preview records, User feedback and revision instructions;
8. 6.2.8
  domain registration records, including registrant details and domain administration correspondence;
9. 6.2.9
  subscription records, billing records, payment authorisations, invoices and payment status records;
10. 6.2.10
  website traffic and usage statistics generated for the User’s dashboard;
11. 6.2.11
  referral programme records, including referral codes, referral relationships, discounts applied and rewards paid; and
12. 6.2.12
  correspondence and support records exchanged between Kwico and the User.
6.3
The purposes for which Kwico processes User records include:
1. 6.3.1
  generating, refining, publishing, hosting and maintaining the User’s website;
2. 6.3.2
  publishing the business information supplied by the User on the User’s website for access by the public, that being the purpose for which the information was supplied;
3. 6.3.3
  communicating with the User through the WhatsApp Business Platform in the ordinary course of the service;
4. 6.3.4
  registering, renewing and administering custom domain names on the User’s behalf;
5. 6.3.5
  processing subscription payments and administering billing and collections;
6. 6.3.6
  administering Kwico’s referral programme, including the calculation and payment of discounts and rewards;
7. 6.3.7
  generating traffic and usage statistics for the User’s dashboard;
8. 6.3.8
  providing user support and resolving technical issues;
9. 6.3.9
  internal analysis, debugging, security monitoring and improvement of Kwico’s service;
10. 6.3.10
  fraud prevention and the protection of Kwico’s systems and infrastructure;
11. 6.3.11
  complying with applicable legal and regulatory obligations;
12. 6.3.12
  protecting Kwico’s rights and interests in the event of a dispute or legal proceedings; and
13. 6.3.13
  record-keeping obligations imposed by law.

Records Relating to Third Parties Named on User Websites

6.4
A User may supply Kwico with Personal Information relating to third parties for publication on the User’s website (the names, photographs, job titles, qualifications and contact details of the User’s personnel, for example). Kwico holds such information solely for the purpose of publishing it on the User’s website as instructed by the User, and for no other purpose. In terms of the Kwico Terms and Conditions of Use, the User warrants that it is entitled to supply that information and to have it published, and that its publication will not infringe the rights of any person.

Third-Party Provider Records

6.5
Kwico holds records relating to third-party providers (cloud hosting and infrastructure providers, database and storage providers, messaging platform providers, payment processors, domain registrars, artificial intelligence service providers, cybersecurity providers, and other service providers, for example) with whom it interacts in the course of its operations. These records include contact details and correspondence; service agreements, terms of service and commercial arrangements; and data processing agreements and related compliance records.

Employee and Personnel Records

6.6
Kwico holds employment-related records in relation to its employees, directors, contractors, and service providers. These records include employment agreements and service contracts; personal details (names, identity numbers, addresses, and contact details, for example); payroll, remuneration, and tax records; performance records; leave records; and records required by law (tax registration, UIF, and similar records, for example).

Financial and Accounting Records

6.7
Kwico holds financial and accounting records including annual financial statements and management accounts; tax returns and tax records; banking records and bank account details; merchant and payment-processor settlement records; invoices, creditor and debtor records; fixed asset registers; and audit or independent review reports, where applicable.

Company Secretarial Records

6.8
Kwico holds company secretarial records including the Memorandum of Incorporation and any amendments thereto; share registers and records of directors and officers; minutes of meetings and resolutions; and CIPC registration and filing records.

Information Technology and Systems Records

6.9
Kwico holds records relating to its information technology infrastructure and systems, including software licence agreements and platform terms; source code, configuration and deployment records; records relating to hosting, database, storage and messaging platforms used in the course of the business; domain registration information; cybersecurity, access control and credential management records; and system, usage and activity logs.

Marketing and Communications Records

6.10
Kwico does not conduct direct marketing. It holds communications records, being records of WhatsApp conversations and service messages exchanged with Users, records of opt-out requests received, and media communications and publications. Should Kwico in future conduct direct marketing in compliance with section 69 of POPIA, it will also hold records of the consents obtained and the objections received.

Records Held in Terms of Other Legislation

6.11
Kwico holds records in terms of, or in order to comply with, the following legislation, among others. These records are not automatically available and access thereto remains subject to the provisions of PAIA:
1. 6.11.1
  Companies Act 71 of 2008;
2. 6.11.2
  Consumer Protection Act 68 of 2008;
3. 6.11.3
  Electronic Communications and Transactions Act 25 of 2002;
4. 6.11.4
  Protection of Personal Information Act 4 of 2013;
5. 6.11.5
  Promotion of Access to Information Act 2 of 2000;
6. 6.11.6
  Income Tax Act 58 of 1962;
7. 6.11.7
  Tax Administration Act 28 of 2011;
8. 6.11.8
  Value-Added Tax Act 89 of 1991, where applicable;
9. 6.11.9
  Basic Conditions of Employment Act 75 of 1997;
10. 6.11.10
  Labour Relations Act 66 of 1995;
11. 6.11.11
  Employment Equity Act 55 of 1998, where applicable;
12. 6.11.12
  Unemployment Insurance Act 63 of 2001 and Unemployment Insurance Contributions Act 4 of 2002;
13. 6.11.13
  Compensation for Occupational Injuries and Diseases Act 130 of 1993;
14. 6.11.14
  Skills Development Act 97 of 1998 and Skills Development Levies Act 9 of 1999, where applicable; and
15. 6.11.15
  Occupational Health and Safety Act 85 of 1993.

Records Automatically Available

6.12
In terms of section 52 of PAIA, Kwico makes the following records available to any person without the need for a Request for Access: this Manual; the Kwico Terms and Conditions of Use; the Kwico Privacy Policy; and any other information published by Kwico on its website from time to time. No other category of record is automatically available.

7Categories of Data Subjects

7.1
In terms of section 1 of POPIA, a Data Subject may be either a natural or a juristic person. The categories of Data Subjects in respect of whom Kwico processes Personal Information include:
1. 7.1.1
  Users, being natural or juristic persons who have engaged Kwico’s services through the WhatsApp Business Platform, whether on the free tier or the paid tier;
2. 7.1.2
  prospective Users who have initiated a conversation with Kwico’s automated agent but have not proceeded to publication or subscription;
3. 7.1.3
  the owners, directors, members, representatives and personnel of Users;
4. 7.1.4
  third parties whose Personal Information is supplied by a User for publication on the User’s website;
5. 7.1.5
  participants in Kwico’s referral programme, both as referrers and as referred persons;
6. 7.1.6
  visitors to websites hosted by Kwico, to the limited extent that usage and traffic data is generated;
7. 7.1.7
  employees, directors, contractors, and service providers of Kwico;
8. 7.1.8
  job applicants and prospective employees;
9. 7.1.9
  representatives and personnel of third-party providers with whom Kwico interacts in the ordinary course of business (hosting provider representatives, payment processor representatives, and domain registrar representatives, for example); and
10. 7.1.10
  any other natural or juristic persons whose Personal Information Kwico processes in compliance with applicable law.

8Processing of Personal Information

Conditions for Lawful Processing

8.1
Chapter 3 of POPIA provides for the minimum Conditions for Lawful Processing of Personal Information by a Responsible Party. These conditions may not be derogated from unless specific exclusions apply as set out in POPIA. Kwico, as a Responsible Party, ensures compliance with all eight Conditions for Lawful Processing, which are described as follows:
1. 8.1.1
  Accountability: Kwico, as the Responsible Party, ensures compliance with POPIA in respect of all processing of Personal Information that it undertakes or that is undertaken on its behalf, including processing undertaken by Pronto Digital Labs, Inc. and other Operators.
2. 8.1.2
  Processing Limitation: Kwico collects Personal Information directly from Data Subjects to the extent applicable. Personal Information is only processed with the consent of the Data Subject or on another legitimate basis provided for in terms of POPIA, and only for the purposes for which it was obtained.
3. 8.1.3
  Purpose Specification: Kwico only processes Personal Information for the specific, explicitly defined, and lawful purpose for which it was obtained, being the creation, publication, hosting and maintenance of the User’s website and the administration of the User’s subscription, and does not retain Personal Information for any longer than is necessary to achieve that purpose.
4. 8.1.4
  Further Processing Limitation: Further processing of Personal Information by Kwico is only undertaken where such further processing is compatible with the original purpose for which the Personal Information was collected.
5. 8.1.5
  Information Quality: Kwico takes reasonable steps to ensure that the Personal Information it holds is accurate, complete, and updated on a regular basis, and that the integrity of that information is maintained through appropriate security measures.
6. 8.1.6
  Openness: Kwico maintains transparency with Data Subjects regarding the processing of their Personal Information. Appropriate privacy notices or data collection notices are provided to Data Subjects when their Personal Information is collected, and this Manual and the Kwico Privacy Policy are published on Kwico’s website.
7. 8.1.7
  Security Safeguards: Kwico implements reasonable and appropriate technical and organisational security measures to ensure that Personal Information is processed responsibly and is not unlawfully accessed, lost, damaged, or destroyed.
8. 8.1.8
  Data Subject Participation: Kwico ensures that Data Subjects are made aware that their Personal Information is being processed and respects the rights of Data Subjects to access and correct their Personal Information.

Purposes of Processing

8.2
Kwico processes Personal Information for the following purposes:
1. 8.2.1
  to generate, refine, publish, host and maintain websites for Users;
2. 8.2.2
  to publish, on the User’s website and for access by the public at large, the business information supplied by the User for that purpose;
3. 8.2.3
  to enter into and perform obligations under the Kwico Terms and Conditions of Use;
4. 8.2.4
  to communicate with Users and their representatives through the WhatsApp Business Platform in the ordinary course of the service;
5. 8.2.5
  to register, renew and administer custom domain names on behalf of Users;
6. 8.2.6
  to process subscription payments, administer billing, and manage collections and failed payments;
7. 8.2.7
  to administer the referral programme, including the calculation of discounts and the payment of rewards;
8. 8.2.8
  to generate website traffic and usage statistics for the User’s dashboard;
9. 8.2.9
  to provide user support and to detect, investigate and resolve technical faults;
10. 8.2.10
  to manage and administer Kwico’s business operations;
11. 8.2.11
  to prevent fraud and to secure Kwico’s systems, infrastructure and Users’ websites;
12. 8.2.12
  to fulfil applicable legal and regulatory obligations;
13. 8.2.13
  to manage employment relationships and comply with employment law obligations;
14. 8.2.14
  to maintain and improve the quality of Kwico’s services;
15. 8.2.15
  to protect Kwico’s rights and interests in the event of a dispute or legal proceedings; and
16. 8.2.16
  to send Users service communications relating to their website and subscription and, only where the requirements of section 69 of POPIA are met, marketing communications.
8.3
Kwico does not use Personal Information processed in the course of rendering its services to create, develop, train, or improve any general-purpose machine learning or artificial intelligence model, and does not permit any third party to do so. Any fine-tuning is undertaken exclusively for Kwico’s internal and private use in delivering its own service.

Sharing of Personal Information

8.4
We may engage carefully selected third-party service providers to assist us in providing, operating, maintaining and improving our services. These service providers may include providers of cloud hosting and infrastructure, database and storage services, communications and messaging services, payment processing, website and domain services, cybersecurity, analytics, and artificial intelligence services. Such service providers may process personal information on our behalf where reasonably necessary to provide the relevant services. We require service providers that process personal information on our behalf to implement appropriate technical and organisational safeguards and, where applicable, to be bound by appropriate contractual data-processing and confidentiality obligations. We may also disclose personal information to professional advisers, regulatory authorities, law-enforcement agencies, courts, or other third parties where required or permitted by law, or where reasonably necessary to protect our rights, property, users or services. We do not disclose personal information to third parties for their own independent marketing purposes without an appropriate lawful basis or, where required, your consent. The categories of service providers used by us may change from time to time as our services and technology develop; however, any such providers will be engaged only for purposes consistent with this Manual and the Kwico Privacy Policy, and subject to applicable data-protection requirements.
8.5
Pronto Digital Labs, Inc. is one such service provider and processes Personal Information on Kwico’s behalf as an Operator, subject to the same obligations.
8.6
For the avoidance of doubt, the publication of a User’s business information on the User’s own website is not a sharing of Personal Information with a third party. It is the outcome which the User has instructed Kwico to achieve and the purpose for which the information was supplied.
8.7
Kwico does not sell, rent, or otherwise trade in the Personal Information of any Data Subject.

9Cross-Border Processing

9.1
In the course of delivering its services, Kwico makes use of third-party technology platforms, cloud infrastructure, database and storage services, communication tools, payment platforms, workflow automation systems, and AI-assisted tools. Cross-border processing of Personal Information occurs in the ordinary course of Kwico’s operations, with processing occurring in jurisdictions including the United States of America and the European Union.
9.2
Personal Information is transferred to Pronto Digital Labs, Inc. in the United States of America, being Kwico’s affiliate and an Operator processing Personal Information on Kwico’s behalf, and to the hosting, database, payment and artificial intelligence service providers engaged by Kwico or by Pronto Digital Labs, Inc.
9.3
Kwico ensures that appropriate safeguards are in place for all cross-border transfers in accordance with section 72 of POPIA, including data processing agreements imposing data protection obligations substantially equivalent to those required under POPIA. Where no such agreement is in place, transfers are effected on another lawful basis contemplated in section 72, including that the transfer is necessary for the performance of the contract between the Data Subject and Kwico, or with the consent of the Data Subject.
9.4
Kwico maintains an internal vendor register of all material Operators and their data processing arrangements. Data Subjects may request further information regarding cross-border processing arrangements from the Information Officer.

10Data Subject Rights Under POPIA

10.1
In terms of POPIA, Data Subjects have a number of rights in relation to the processing of their Personal Information by Kwico. These rights are set out below.

Right to be Notified

10.2
A Data Subject has the right to be notified that their Personal Information is being collected and processed by Kwico. A Data Subject also has the right to be notified in the event of a security compromise affecting their Personal Information.

Right of Access

10.3
A Data Subject has the right to request access to, or copies of, their Personal Information held by Kwico, together with information regarding the nature of the processing and any disclosure of that Personal Information. Any request for access must be made in accordance with the procedure set out in section 12 of this Manual.

Right to Correction or Deletion

10.4
A Data Subject has the right to request the correction or deletion of Personal Information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading, or unlawfully obtained. Kwico may however retain certain information for record-keeping purposes or where required by law, notwithstanding a request for deletion.
10.5
A Data Subject whose Personal Information appears on a website published by Kwico on the instruction of a User may direct a request for correction or deletion to the Information Officer, who will action the request or refer it to the relevant User as the circumstances require.

Right to Object

10.6
A Data Subject has the right to object to the processing of their Personal Information where Kwico is processing the Personal Information for the purposes of direct marketing by means of unsolicited electronic communications, or where there are grounds relating to the particular situation of the Data Subject which justify an objection to the processing.

Right Not to be Subject to Automated Decision-Making

10.7
A Data Subject has the right not to be subject to a decision which results in legal consequences for that Data Subject, or which affects the Data Subject to a substantial degree, and which is based solely on the automated processing of Personal Information intended to provide a profile of that Data Subject. Kwico does not take decisions of that nature.

Right to Lodge a Complaint

10.8
A Data Subject has the right to lodge a complaint with the Information Regulator regarding an alleged infringement of any right protected under POPIA, and to institute civil proceedings regarding alleged non-compliance.

Exercising Data Subject Rights

10.9
Data Subjects may exercise any of the rights described in this section by contacting the Information Officer in writing using the contact details set out in section 4 of this Manual. Kwico will respond to such requests within a reasonable time and in accordance with the requirements of POPIA.

11Security Measures

11.1
Kwico implements reasonable technical and organisational measures to protect Personal Information against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access, as required by section 19 of POPIA.
11.2
Kwico does not own or operate its own physical infrastructure. Its services are delivered on the platforms of third-party providers of cloud hosting, database and storage, messaging and communication, payment processing, domain and artificial intelligence services. Kwico relies on the technical and organisational security measures implemented by those providers in respect of the infrastructure, systems and data under their control, and selects its providers on the basis that they maintain security measures appropriate to the nature of the services rendered and the risks associated with the processing.
11.3
Payment card data is processed directly by Kwico’s third-party payment processor and is not stored on Kwico’s systems.
11.4
Access to Personal Information held by Kwico is restricted to those persons who require access for the performance of their functions.
11.5
Kwico does not hold an independent security certification in respect of its own application layer.
11.6
No method of transmission or storage over the internet is completely secure, and Kwico cannot guarantee absolute security.
11.7
Where there are reasonable grounds to believe that Personal Information has been accessed or acquired by an unauthorised person, Kwico will notify the Information Regulator and the affected Data Subjects as required by section 22 of POPIA.

12Access Request Procedure

12.1
Any person who wishes to request access to records held by Kwico must comply with the procedural requirements set out in section 53 of PAIA.

Prescribed Form 2

12.2
A Requester must submit a request for access on the prescribed form known as Form 2 (“Request for Access to a Record of a Private Body”), which is prescribed in terms of the PAIA Regulations. Form 2 is attached to this Manual as Annexure A and is also available from the Information Officer on request.

Content of the Request

12.3
The completed Form 2 must be submitted with sufficient particularity to enable the Information Officer to identify at least the following:
1. 12.3.1
  the record or records requested;
2. 12.3.2
  the identity of the Requester;
3. 12.3.3
  the form of access required, if the request is granted;
4. 12.3.4
  the postal address, fax number, or email address of the Requester in the Republic;
5. 12.3.5
  the right that the Requester seeks to exercise or protect and an explanation of why the record requested is necessary for the exercise or protection of that right; and
6. 12.3.6
  proof of the capacity in which the Requester is making the request, if the request is made on behalf of another person.

Submission of Request

12.4
The completed Form 2 and all supporting documentation must be submitted to the Information Officer at the postal, physical, or email address set out in section 4 of this Manual.

Fees

12.5
A Requester, other than a Personal Requester, is required to pay the prescribed request fee before the request is processed. Where the search, preparation and reproduction of a record is required, an access fee is payable in accordance with the PAIA Regulations, and a deposit may be required where the preparation of the record is likely to exceed the prescribed number of hours.
12.6
The fees payable are those prescribed in the PAIA Regulations as amended from time to time, and include a request fee, a fee per A4 page reproduced, an hourly search and preparation fee, the cost of any electronic storage medium used, and the actual cost of postage or electronic transmission. The Information Officer will notify the Requester in writing of the fees payable before the request is processed, and no record will be released until all applicable fees have been paid.

Time Period for Response

12.7
Kwico will process a Request for Access within 30 (thirty) days of receipt of the request, unless an extension of time is required in terms of PAIA. An extension of up to 30 (thirty) additional days may be granted in the following circumstances:
1. 12.7.1
  the request is for a large number of records;
2. 12.7.2
  a search for the requested records is required at premises not located in the same town or city as Kwico’s principal place of business;
3. 12.7.3
  consultation among different divisions or departments of Kwico is required; or
4. 12.7.4
  the Requester consents to an extension in writing.
12.8
Where an extension is required, the Requester will be informed in writing of the extension and the reasons therefor.
12.9
Where Kwico fails to respond to a Request for Access within the prescribed period, the request will be deemed to have been refused, in accordance with section 58 read with section 56(1) of PAIA.

Notification of Decision

12.10
The Information Officer will notify the Requester in writing of the decision on the Request for Access. Where the request is granted, the Requester will be notified of:
1. 12.10.1
  the access fee payable in respect of the record;
2. 12.10.2
  the format in which access will be given; and
3. 12.10.3
  the right to appeal the access fee charged or the format of access to a court of competent jurisdiction.
12.11
Where the request is refused, the Information Officer will provide the Requester with adequate reasons for the refusal and inform the Requester of the right to appeal the decision to a court of competent jurisdiction.

Right to Complain to the Information Regulator

12.12
If a Requester is aggrieved by a decision of the Information Officer to refuse access to a record, or if the Information Officer fails to respond to a request within the prescribed period (in which case the request is deemed refused in terms of section 58 read with section 56(1) of PAIA), the Requester may lodge a complaint with the Information Regulator using the prescribed Form 5 (Complaint Form). Form 5 is available from the Information Regulator at www.inforegulator.org.za.
12.13
A complaint to the Information Regulator must generally be lodged within 180 (one hundred and eighty) days of the decision or deemed refusal, or such other period as may apply in the circumstances.
12.14
The contact details of the Information Regulator for this purpose are: Address: Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191; Email: PAIAComplaints@inforegulator.org.za.

13Records Not Found

13.1
If a record cannot be found or does not exist, the Information Officer will notify the Requester in writing of this fact, providing full details of all steps taken to search for the record or to determine its existence.
13.2
If a record that could not be found is subsequently located, the Requester will be given access to that record unless access is refused on one of the grounds set out in section 14 of this Manual.

14Grounds for Refusal of Access

14.1
Kwico may refuse a Request for Access on any of the grounds set out in Part 3, Chapter 4 of PAIA. These grounds include, without limitation, the following:
1. 14.1.1
  the record constitutes privileged information for the purposes of legal proceedings or is subject to professional privilege (legal professional privilege or attorney-client privilege, for example);
2. 14.1.2
  the disclosure of the record would reveal confidential commercial information of a third party or of Kwico, including trade secrets, source code, system architecture, financial information or commercial information the disclosure of which would cause harm;
3. 14.1.3
  the disclosure of the record would reveal information that was supplied in confidence by a third party and which, if disclosed, would place Kwico in breach of its duty of confidence towards that third party;
4. 14.1.4
  it is necessary to protect the safety of individuals or property, or the security of Kwico’s systems, buildings, computer systems or communication systems;
5. 14.1.5
  the disclosure of the record would unreasonably disclose the Personal Information of a third party;
6. 14.1.6
  the record contains research information of a third party or of Kwico, the disclosure of which would expose Kwico or that third party to serious disadvantage; or
7. 14.1.7
  the record is otherwise exempt from disclosure in terms of PAIA or any other applicable law.
14.2
Where a Request for Access is refused, the Information Officer will notify the Requester in writing of:
1. 14.2.1
  the refusal;
2. 14.2.2
  adequate reasons for the refusal;
3. 14.2.3
  the Requester’s right to appeal the decision to a court of competent jurisdiction; and
4. 14.2.4
  the fact that any deposit paid will be refunded.

15Defined Terms

15.1
In this Manual, unless the context requires otherwise:
1. 15.1.1
  “Acts” means PAIA and POPIA, as more fully described in section 3 of this Manual;
2. 15.1.2
  “Conditions for Lawful Processing” means the eight conditions set out in Chapter 3 of POPIA, as more fully described in section 8 of this Manual;
3. 15.1.3
  “Data Subject” means the person to whom Personal Information relates;
4. 15.1.4
  “Information Officer” means the Information Officer appointed by Kwico in terms of POPIA and PAIA, as described in section 4 of this Manual;
5. 15.1.5
  “Manual” means this PAIA and POPIA Manual compiled in terms of section 51 of PAIA;
6. 15.1.6
  “Operator” has the meaning assigned to it in section 1 of POPIA, and means a person who processes Personal Information for a Responsible Party in terms of a contract or mandate, without coming under the direct authority of that party;
7. 15.1.7
  “PAIA” means the Promotion of Access to Information Act 2 of 2000, as amended from time to time;
8. 15.1.8
  “Personal Information” has the meaning assigned to it in section 1 of POPIA, and includes information relating to an identifiable, living, natural person or an identifiable, existing juristic person, including (without limitation): information relating to the race, gender, sex, pregnancy, marital status, national, ethnic or social origin, colour, sexual orientation, age, physical or mental health, well-being, disability, religion, conscience, belief, culture, language, and birth of the person; information relating to the education, medical, financial, criminal, or employment history of the person; identifying numbers, symbols, email addresses, physical addresses, telephone numbers, location information, and online identifiers; biometric information; personal opinions, views, or preferences; and correspondence of a private or confidential nature;
9. 15.1.9
  “Personal Requester” means a Requester seeking access to a record containing Personal Information about that Requester;
10. 15.1.10
  “POPIA” means the Protection of Personal Information Act 4 of 2013, as amended from time to time;
11. 15.1.11
  “Privacy Policy” means the Kwico Privacy Policy published on the Kwico website, as amended from time to time;
12. 15.1.12
  “Processing” has the meaning assigned to it in section 1 of POPIA, and means any operation or activity or set of operations concerning Personal Information, including the collection, receipt, recording, organisation, collation, storage, updating, modification, retrieval, alteration, consultation, use, dissemination, transmission, distribution, merging, linking, restriction, degradation, erasure, or destruction of information;
13. 15.1.13
  “Kwico” means Kwico Digital Labs (Pty) Ltd, registration number 2026/497744/07, a private company incorporated in terms of the laws of the Republic of South Africa;
14. 15.1.14
  “Request for Access” or “Request” means a request made in terms of section 50 of PAIA for access to records held by Kwico;
15. 15.1.15
  “Requester” means any person making a Request for Access in terms of PAIA;
16. 15.1.16
  “Responsible Party” has the meaning assigned to it in section 1 of POPIA, and in the context of this Manual refers to Kwico;
17. 15.1.17
  “Terms and Conditions of Use” means the Kwico Terms and Conditions of Use published on the Kwico website and accepted electronically by Users, as amended from time to time; and
18. 15.1.18
  “User” means any natural or juristic person who engages Kwico’s services through the WhatsApp Business Platform, whether on the free tier or the paid tier.

16Availability

16.1
This Manual is available free of charge in electronic form from the Information Officer on request, and is published on the Kwico website at https://www.heykwico.com.
16.2
A copy of this Manual may be obtained in printed form from the Information Officer upon payment of the fee prescribed in the PAIA Regulations per A4-size page or part thereof.
16.3
Kwico will update this Manual from time to time to reflect changes in its information-handling practices or changes in applicable legislation. The most current version of this Manual will be made available through the Information Officer and on the Kwico website.

Annexures

Download the prescribed forms referred to in section 12 of this Manual.