PAIA manual of Numbaas (Pty) Ltd
Draft, under legal review. Highlighted items are still to be confirmed. This document takes effect once it is final and dated.
Prepared under section 51 of the Promotion of Access to Information Act 2 of 2000 (PAIA), as amended, and the Protection of Personal Information Act 4 of 2013 (POPIA).
1. Purpose of this manual
This manual explains what records Numbaas (Pty) Ltd holds and how to ask for access to them under PAIA. It also sets out how we process personal information, as POPIA requires.
Numbaas (Pty) Ltd (registration number 2026/777218/07) is a private company that provides NUMBAAS, an online accounting, payroll and business-management service, to businesses in South Africa. Every private body must have a PAIA manual, and the exemption that small companies once had lapsed on 31 December 2021.
2. Contact details
| Item | Item |
|---|---|
| Head of the private body and Information Officer | William Tembo, Director |
| Deputy Information Officer | [None appointed / to confirm] |
| Street and postal address | 5 Plange Avenue, Malanshof, Randburg, 2194 |
| Telephone | [to confirm] |
| Email for PAIA and privacy requests | privacy@numbaas.co.za |
| Website | numbaas.co.za |
The Information Officer is registered with the Information Regulator [to confirm: registration date and certificate].
3. The guide to PAIA
The Information Regulator has published a guide on how to use PAIA and POPIA (section 10 of PAIA). It explains, among other things, the purpose of PAIA, how to request a record from a public or private body, the assistance available from Information Officers and the Regulator, the fees, and the remedies if a request is refused.
The guide is available on the Regulator's website, inforegulator.org.za, and from us on request (section 2), in English [to confirm: other official languages offered]. The Information Regulator took over responsibility for PAIA from the South African Human Rights Commission on 1 July 2021.
4. Records available without a request, and under other laws
Available without a formal request (on numbaas.co.za, or by email): this manual, our Privacy Policy and Terms of Service, our price list and product information. We have not published a notice under section 52(2).
Records we keep because other laws require them, where applicable:
| Law | Records |
|---|---|
| Companies Act 71 of 2008 | Memorandum of incorporation, register of directors, securities register, minutes, annual financial statements |
| Income Tax Act 58 of 1962, Value-Added Tax Act 89 of 1991, Tax Administration Act 28 of 2011 | Tax returns, invoices, VAT records, supporting documents |
| Basic Conditions of Employment Act 75 of 1997; Labour Relations Act 66 of 1995; Employment Equity Act 55 of 1998 | Employment contracts, time and pay records, leave, disciplinary records, employment-equity records |
| Unemployment Insurance Act 63 of 2001; Skills Development Levies Act 9 of 1999; Compensation for Occupational Injuries and Diseases Act 130 of 1993 | UIF, SDL and COID records |
| Protection of Personal Information Act 4 of 2013 | Records of processing, Information Officer registration, breach records |
| Electronic Communications and Transactions Act 25 of 2002 | Records of electronic transactions with customers |
5. Subjects and categories of records we hold
| Subject | Categories of records |
|---|---|
| Company and statutory | Incorporation documents, directors and shareholders, minutes, resolutions, CIPC filings, Information Regulator registration |
| Finance and tax | Accounting records, bank statements, invoices, management accounts, budgets, tax and VAT records |
| People | Employment contracts, payroll records, leave, performance and disciplinary records, policies |
| Customers (as responsible party) | Accounts and users, subscriptions and billing, support communications, consents and opt-outs |
| Suppliers and service providers | Contracts, data-processing agreements, invoices |
| Information technology and security | Audit trails, security and access logs, integrity seals and their Bitcoin proofs, backups and restore tests, security reviews |
| Legal | Agreements, intellectual property (including trademarks), correspondence |
Records our customers keep in NUMBAAS. We hold these as an operator for the business concerned (see our Privacy Policy, section 2), which is the responsible party for them. A request for such records should be made to that business. If one is made to us, we will tell the requester, and the business concerned, and consider it under PAIA. Requests for another business's records are normally refused to protect third parties' personal, confidential and commercial information (sections 63 to 65).
6. Processing of personal information
Our Privacy Policy describes this in full. In summary:
| Item | Item |
|---|---|
| Purposes | Providing and securing NUMBAAS, billing, support, complying with the law, employing our staff, managing suppliers, and marketing with consent |
| Data subjects and their information | Customers' users (name, email, role, security and usage records); billing contacts (billing details); our employees (identity, contact, tax, banking, employment records); suppliers (contact and payment details); website visitors and enquirers (contact details, messages) |
| Recipients | Our hosting, payment, email and AI providers, each bound in writing; SARS and other authorities where the law requires; our professional advisers |
| Transfers outside South Africa | To our AI and email providers, and possibly our payment provider, only under agreements giving protection substantially similar to POPIA (section 72). The NUMBAAS database and its backups stay in South Africa |
| Security | Separation between businesses enforced by the database (row-level security), encryption in transit, two-factor sign-in, role-based access with segregation of duties, a full audit trail, tamper-evident books, daily backups with tested restores, and independent security reviews |
7. How to request a record
- Complete the prescribed request form (Form 2 of the PAIA Regulations, available on the Information Regulator's website and from us), identifying the record and the right you want to exercise or protect, and send it to the Information Officer (section 2).
- Fees: the request and access fees are those prescribed in Annexure B of the PAIA Regulations. Someone asking for their own personal information pays no request fee. We will tell you of any fee before we proceed.
- Decision: within 30 days of receiving a complete request. We may extend this once, by up to 30 days, and will tell you why.
- Third parties: if the record concerns another person or business, we will notify them and consider their views before deciding.
- Refusal: we may refuse only on the grounds PAIA sets out (sections 62 to 70), such as protecting another person's privacy, commercial information or confidential information. We will give reasons.
- If you disagree: you may complain to the Information Regulator within 180 days of our decision, or apply to court.
8. Availability and updates
This manual is available on numbaas.co.za, at our principal place of business (section 2) during normal business hours, and to the Information Regulator on request, as section 51(3) of PAIA requires. We review it at least once a year and whenever our records or processing change.
Signed: ____________________ William Tembo, Director and Information Officer. Date: ____________
Also see: Terms · Privacy Policy