PAIA manual

PAIA gives people a right of access to records held by private bodies where the record is required to exercise or protect a right. Section 51 requires a private body to publish a manual explaining who it is, what records it holds, and how to ask for them. This is that manual for WebOn Digital Solutions, a small private body: one founder, two consultation contacts, and no separate departments — the manual is short because the business is.

WebOn Digital Solutions (“WebOn”), Johannesburg, South Africa — webon.africa. The head of the private body, who is also the Information Officer for the purposes of PAIA and POPIA, is:

• Ethan Olivier, Founder
• Email: ethan.olivier@webon.africa
• Phone: 072 769 7117
• Physical address, and address for service of legal documents: 81 Mackay Avenue, Blairgowrie, Randburg, 2194. Requests by email are preferred and answered fastest.

The Information Regulator publishes a guide, in every official language, on how to use PAIA — how requests work, what they cost, and what to do if refused. It is available from the Information Regulator (South Africa) at inforegulator.org.za (opens in a new tab), and from the Regulator’s offices.

Everything published on webon.africa — including the sample builds, the approach and packages pages, the privacy notice, the terms, and this manual — is available without a PAIA request, free of charge, by visiting the site.

Section 51(1)(d) of PAIA asks a private body to list records that are accessible in terms of other legislation. Beyond the right POPIA itself gives you to your own personal information — see section 9 of this manual and the privacy notice — no records held by this business have been identified as separately accessible under other legislation. If that changes, this section will list them.

Subject to the grounds of refusal in PAIA, the following categories of records exist or may exist as the business operates:

• Company and financial records — accounting records, tax records, banking records, and statutory business records.
• Enquiry and client records — correspondence with people who contact us, quotes, project agreements, project files and deliverables, and handover documentation.
• Supplier and operational records — records relating to hosting, domain, and service providers used to run the business and client projects.
• Website records — the published content of webon.africa itself. The website holds no visitor records: it sets no cookies and stores no form submissions, as described in the privacy notice.
• Personnel records — where applicable, records relating to the people who work on builds.

Use the prescribed request form (Form 2 in the 2021 PAIA Regulations), available from the Information Regulator at inforegulator.org.za (opens in a new tab), and send it to the Information Officer at ethan.olivier@webon.africa. To process a request we need:

• enough detail to identify the record you want;
• which right you are exercising or protecting, and why the record is required for it;
• proof of identity, and of authority if you request on someone else’s behalf; and
• how you would like to receive the record.

The fees a private body may charge — a request fee, and reproduction and search fees — are prescribed in the Regulations’ fee schedule; we charge no more than the prescribed amounts, and where a record is quick to produce we will simply waive what the law lets us waive. Requests for your own personal information are handled free of charge, as promised in the privacy notice. A decision is made within 30 days of receiving the request, extendable once by up to 30 days where PAIA allows, and you are informed of the outcome in writing either way.

PAIA obliges or permits refusal in defined cases — chiefly to protect someone else’s privacy, confidential commercial information of a third party, records protected by legal privilege, and safety. If a request is refused, the refusal will say which PAIA ground applies and why, not just “no”.

If you disagree with a refusal, you may complain to the Information Regulator or apply to court. The Regulator’s complaint procedure is at inforegulator.org.za (opens in a new tab).

The 2021 Regulations ask a manual to summarise how the body processes personal information. Directly, then:

• Purposes: responding to enquiries, preparing quotes, building previews, running client projects, and keeping legally required business records.
• Data subjects and categories: people who enquire, clients, and suppliers — names, contact details, and the business information they send us. The website itself collects nothing about visitors.
• Recipients: no personal information is sold or shared for marketing. Hosting and network providers (Vercel, Cloudflare) process routine connection data to serve the site.
• Transborder flows: those infrastructure providers operate globally, under contractual terms binding them to protection comparable to POPIA’s conditions.
• Security: access-protected business accounts and devices, access limited to the people named on the About page, and no central visitor database to breach.

The privacy notice is the full statement of these matters and of data subject rights, and forms part of this manual by reference.

This manual is published at webon.africa/paia, is available free of charge from the Information Officer on request, and can be inspected at our principal place of business during business hours — write first, so someone is there to receive you. It is updated when the business or the law changes; the date at the top is the version.