PAIA manual of 365 Solutions (Pty) Ltd

AI draft for legal review. This is a first draft prepared with AI assistance for 365solutions. It is not legal advice. It must not be published until a qualified South African attorney has reviewed it, the placeholders are filled in, and the prescribed forms and fees have been checked against the current PAIA Regulations. Points to confirm are listed in section 13.

Prepared under section 51 of the Promotion of Access to Information Act 2 of 2000 ("PAIA"), as amended by the Protection of Personal Information Act 4 of 2013 ("POPIA").

Version 0.1 (draft) · 9 November 2026 · Website footer: PAIA manual · also available at our offices

1. Purpose of this manual

1.1 PAIA gives everyone the right to request access to records held by a private body where the record is needed to exercise or protect a right. This manual tells you what records 365 Solutions (Pty) Ltd ("365solutions") holds and how to ask for them. It also gives the information about our processing of personal information that section 51(1)(c) of PAIA requires.

1.2 365solutions provides Vigia, a software platform for private security companies.

2. Contact details (section 51(1)(a))

3. Guide on how to use PAIA (section 51(1)(b)(i))

3.1 The Information Regulator has published a guide on how to use PAIA and POPIA. It is available in the official languages on the Regulator's website, inforegulator.org.za, and from the Regulator:

3.2 A copy of the guide is also available for inspection at our offices during business hours.

4. Records available without a request (section 51(1)(b)(ii) and section 52)

[Lawyer: confirm whether a section 52 notice has been or should be submitted.]

5. Records kept under other laws (section 51(1)(b)(iii))

Records are kept as required by, among others [Lawyer: confirm and complete the list]:

• Companies Act 71 of 2008
• Income Tax Act 58 of 1962, Value-Added Tax Act 89 of 1991 and Tax Administration Act 28 of 2011
• Basic Conditions of Employment Act 75 of 1997, Labour Relations Act 66 of 1995, Employment Equity Act 55 of 1998, Unemployment Insurance Act 63 of 2001, Skills Development Levies Act 9 of 1999, Compensation for Occupational Injuries and Diseases Act 130 of 1993
• Electronic Communications and Transactions Act 25 of 2002
• Protection of Personal Information Act 4 of 2013
• Promotion of Access to Information Act 2 of 2000
• Consumer Protection Act 68 of 2008
• Cybercrimes Act 19 of 2020
• Broad-Based Black Economic Empowerment Act 53 of 2003

6. Subjects and categories of records held (section 51(1)(b)(iv))

Customer data held as operator. 365solutions also hosts data that security companies (our customers) put into Vigia — for example their staff's shift and location records and incident reports. We hold that data as an operator on behalf of the security company, which is the responsible party. A request for such a record should be made to the security company concerned. If we receive it, we will refer it to that company. [Lawyer: confirm the correct PAIA treatment of records held by an operator — whether 365solutions "holds" them for PAIA purposes, and whether section 21 transfer-type handling applies to private bodies.]

7. Processing of personal information (section 51(1)(c))

7.1 Purposes

• To provide, support, secure and bill the Vigia service.
• To answer enquiries and trial requests and to check that prospective customers are registered security companies.
• To market Vigia, with consent or to existing customers with an opt-out.
• To employ and manage our staff.
• To manage suppliers and partners.
• To comply with the law and protect our legal rights.
• As an operator, to process personal information on the instructions of our customers under our data processing agreement.

7.2 Categories of data subjects and their personal information

7.3 Recipients

Our service providers (hosting, email, SMS, push, maps, accounting, customer-relationship and support tools), resellers and distributors, professional advisers, banks and payment providers, and authorities where the law requires. The current sub-processors for the Vigia service are listed in Annex 3 of the data processing agreement.

7.4 Planned transborder flows

Vigia is hosted on Microsoft Azure in South Africa [confirm: planned]. Some service providers (for example email delivery, push notifications and maps) process limited personal information outside South Africa, under POPIA section 72. Customer data from security companies outside South Africa is transferred into South Africa for hosting.

7.5 Security measures

A general description: encryption in transit and at rest; separate encryption of sensitive fields under managed keys; isolation of each customer's data; multi-factor authentication; least-privilege access with approved, logged support sessions; tamper-evident audit trail; malware scanning of uploads; backups with tested restores; independent security testing. See our security statement.

8. How to request access

8.1 Complete the prescribed request form (Form 2 of the PAIA Regulations, 2021 [confirm]), available from the Information Regulator's website or from our Information Officer.

8.2 Send it to the Information Officer by email, post or hand delivery at the addresses in section 2. Give enough detail to identify the record, say which form of access you want, and state the right you are exercising or protecting and why the record is needed for it.

8.3 If you request on behalf of someone else, include proof of your authority.

8.4 You may need help completing the form if you have a disability or cannot read or write; the Information Officer will help you.

9. Fees

9.1 A request fee and, if access is granted, an access fee (for search, preparation and reproduction) may be payable, as prescribed in the PAIA Regulations. [Insert the current prescribed amounts — confirm from the Regulations.]

9.2 No request fee is payable when you ask for your own personal information. [Confirm.]

9.3 If the search and preparation will take longer than the prescribed hours, we may ask for a deposit before processing.

10. Time to decide

10.1 We will decide within 30 days of receiving a complete request, and may extend this once by up to 30 days in the circumstances PAIA allows, with notice and reasons.

11. Grounds for refusal

11.1 We may or must refuse access on the grounds in Chapter 4 of Part 3 of PAIA, including to protect:

• the privacy of a third party who is a natural person (section 63);
• the commercial information of a third party (section 64) or of 365solutions (section 68), including trade secrets and information whose disclosure could harm commercial or financial interests;
• confidential information of a third party (section 65);
• the safety of individuals and the protection of property (section 66) — relevant to security information about our customers' sites, systems and staff;
• records privileged from production in legal proceedings (section 67);
• research information (section 69).

11.2 We will grant a request despite a ground for refusal where the public interest override in section 70 applies.

12. Remedies

12.1 We have no internal appeal procedure. If you are not satisfied with our decision, you may, within 180 days, lodge a complaint with the Information Regulator (section 77A) or apply to court (section 78).

13. Points for legal review

1. Whether 365solutions is exempt from compiling a manual as a small private body under any current exemption notice, and whether to publish one anyway (recommended).
2. PAIA treatment of customer records held by 365solutions as operator (section 6).
3. Prescribed form numbers and current fees (sections 8–9).
4. List of laws under which records are kept (section 5), and whether a section 52 notice applies (section 4).
5. Head of the private body, Information Officer and deputy — names, registration with the Information Regulator.
6. Information Regulator's current contact details.