PAIA Manual

1. Purpose and responsible contact

This manual describes FlexiMetaDoc (Pty) Ltd's records-access process under the Promotion of Access to Information Act 2 of 2000 and relevant processing under the Protection of Personal Information Act 4 of 2013. Hardus Van Dyk is the owner-designated Information Officer and responsible contact. Requests, assistance and inspection arrangements use the business contact details above. Any deputy acting on a request must identify their authority and scope. A contact designation does not by itself represent a regulator-registration certificate.

Public website notices and product information are available without a formal request. A list of records below does not make every record public or remove third-party privacy, confidentiality or other statutory safeguards.

2. Regulator guide and prescribed forms

The Information Regulator's PAIA guide, private-body guidance and prescribed forms explain access, assistance and remedies. Ask the Information Officer for help identifying the process or an accessible copy. Form 2 requests access; Form 3 records the outcome and fees; Form 5 is used for complaints. Use the current forms and tariffs rather than an unverified historic fee.

3. Records and relevant legislation

Relevant duties may arise under the Companies Act 71 of 2008, PAIA, POPIA, ECTA 25 of 2002, the Consumer Protection Act 68 of 2008, applicable income-tax and tax-administration legislation, copyright law and, where the activity applies, VAT and employment/payroll legislation. Access and retention are separate questions: statutory record-keeping does not make every record automatically public. The Information Officer identifies the applicable record and legal basis when assessing a request.

4. Request, identity checks and fees

Send Form 2 to Hardus Van Dyk using the email or business telephone above. Identify the record, your contact details and preferred access format, and any authority to act for another person. For a private-body PAIA request, identify the right you wish to exercise or protect and why the record is needed for it. An account or paid subscription is not required.

Reasonable clarification and proportionate identity/authority checks may be necessary. Arrange a secure channel before sending identity documents or sensitive records. We explain prescribed fees, exemptions, deposits and access arrangements before charging. Confirmation of whether we hold your personal information under POPIA is free. Assistance is available for people who cannot complete the form or need an accessible alternative.

5. Decision, refusal and remedies

PAIA decisions are ordinarily due within 30 calendar days. A permitted extension of up to a further 30 days requires notice with reasons and review rights. Refusals require a statutory ground, reasons and applicable remedies; confidentiality alone does not justify refusing every business record. Where appropriate, lawful severance permits access to the remainder of a record.

A private body does not have the statutory internal appeal applicable to certain public bodies. You may use the Information Regulator's complaint procedure, generally within 180 days of the relevant refusal or failure to respond, subject to applicable rules and condonation, and may seek competent court relief. Internal correspondence does not suspend a statutory deadline. See current Regulator forms and guidance.

6. Personal-information processing

Purposes include account administration, the agreed document/form/workflow service, billing, access control and security, support, legal compliance and authorised communications. Data subjects include customer users and contacts, respondents and people whose records the customer submits, suppliers and personnel where relevant. Categories include identity/contact and account details, customer-submitted documents/responses and extracted data, workflow and audit events, payment references and rights/support correspondence. Special or children's information requires the applicable legal authorisation and service safeguards.

Recipients may include authorised customer users, infrastructure/storage, AI, email, payment and selected integration providers, advisers and authorities where lawful. The Processing and Retention Schedule identifies supported routes, planned cross-border processing and retention controls. The actual service-specific providers, countries, onward recipients and section 72 safeguards must be identified for the relevant deployment.

Reasonable technical and organisational safeguards must address access and tenant isolation, authorised roles, secure transmission, system protection, audit and incident records, recovery, disposal and risk review. Scope depends on the deployment. This manual does not claim independent certification, universal encryption at rest or verified effectiveness of every control. Operator processing for customers follows the written Data Processing Agreement and documented instructions.

For correction, deletion, restriction, objection and automated-decision review, see the Privacy Policy. POPIA rights may follow a different process from a PAIA records request. A request receipt is not a completed outcome.

7. Availability and updates

This edition is freely available on this page and can be saved or printed from your browser. Contact Hardus Van Dyk for an accessible copy, principal-business-place inspection arrangements during normal business hours, or legally required copies. Only lawful reproduction charges may apply to physical copies. The Information Officer reviews this manual when contact facts, processing or legal requirements change. Edition: 2026-11-02, prepared on the owner's instructions of 2 November 2026.