PAIA manual

About this manual

This manual is published under section 51 of the Promotion of Access to Information Act 2 of 2000 (PAIA) and the Protection of Personal Information Act 4 of 2013 (POPIA). It explains what records The Write Source (Pty) Ltd keeps, how you can ask for access to them, and how we handle personal information.

Our contact details

• Business: The Write Source (Pty) Ltd, registration number 2025/867861/07.
• Head of the business and Information Officer: Vineshree Govender (Director).
• Deputy Information Officer: none appointed. The Information Officer handles all requests.
• Physical and postal address: 55 San Jerez, Seaward Estate, Ballito, 4420.
• Email: orders@thewritesource.co.za · Phone: 083 289 5124
• Website: www.thewritesource.co.za

The Information Regulator's guide to PAIA

The Information Regulator publishes a guide on how to use PAIA and POPIA to get access to records, in every official language. You can get it from the Regulator's website or its office:

• Website: inforegulator.org.za
• Email: enquiries@inforegulator.org.za · Phone: 010 023 5200
• Physical address: JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001
• Postal address: PO Box 31533, Braamfontein, Johannesburg, 2017

Records anyone can see without a request

These are on our website, free of charge:

• our terms of sale, privacy policy and this manual;
• the school stationery lists we supply, with their item prices;
• our key dates, delivery information and frequently asked questions.

Records we keep because the law requires them

We keep records under these laws, among others:

• Companies Act 71 of 2008;
• Consumer Protection Act 68 of 2008;
• Electronic Communications and Transactions Act 25 of 2002;
• Income Tax Act 58 of 1962 and Tax Administration Act 28 of 2011;
• Protection of Personal Information Act 4 of 2013 and Promotion of Access to Information Act 2 of 2000;
• when we employ staff: the Basic Conditions of Employment Act 75 of 1997, Unemployment Insurance Act 63 of 2001 and Compensation for Occupational Injuries and Diseases Act 130 of 1993.

Subjects on which we keep records

• Company records: registration documents, memorandum of incorporation, director and shareholder records, resolutions.
• Finance and tax: accounting records, bank statements, invoices, financial statements and tax records.
• Orders: order emails with the parent's and learners' details, uploaded lists, proofs of payment, payment records and messages with customers.
• Suppliers and service providers: agreements, orders, invoices and contact details.
• Website and IT: service agreements, security settings, and our order-number counter (numbers and times only, with no personal details).
• Staff, when we employ any: employment contracts, pay, tax and leave records.

How we process personal information

Why we process it: to take, pack, label and deliver orders; to check payments; to answer questions and complaints; to keep the records the law requires; and to keep our website secure. We don't use it for marketing and we never sell it. Our privacy policy has the details.

Whose information, and what:

• Parents and guardians: name, cell number, email address, delivery choice, proofs of payment and messages.
• Learners (children): name, class, school and grade, processed with their parent's or guardian's consent.
• Teachers who ask for a quote: name, school, cell number, email address, the stationery list they upload and messages.
• Suppliers and service providers: business contact details, banking details and agreements.
• Staff, when we employ any: identity, contact, banking, tax and employment details.
• Website visitors: technical information, such as IP address and browser type, used for security and the spam check.

Who receives it: our team; the learner's school, which receives the labelled pack; the service providers that run our website and email, acting on our instructions (Cloudflare, Resend and HostAfrica); our bank, for payments; WhatsApp, if you message us there; and authorities such as SARS when the law requires it.

Information sent outside South Africa: Cloudflare and Resend process information outside South Africa, including in Europe and the United States, under data processing agreements that protect it to a standard similar to POPIA (POPIA s72).

How we protect it: an encrypted connection (HTTPS) on our website, and encrypted email delivery whenever the receiving service supports it; no orders or personal details stored on the website (orders go straight to our mailbox, which only our team can open, and the website's only database holds order numbers and times); strong, unique passwords with two-step login wherever offered; checked uploads (PDF, JPG or PNG, up to 5 MB); deleting order emails, messages and children's details after the school year; and telling you and the Information Regulator if a breach happens.

How to ask for a record

1. Complete Form 2 (Request for access to a record) from the PAIA Regulations, 2021. It's on the Information Regulator's website, or ask us for a copy.
2. Send it to our Information Officer at orders@thewritesource.co.za or to our address above. Describe the record well enough for us to find it, say how you'd like to receive it, and, if you're asking for someone else, include proof that you may act for them.
3. We reply within 30 days. If the request needs a long search, we may extend this once by up to 30 days and tell you why.

Your own information: to see, correct or delete information about you or your children, you can simply email or WhatsApp us, free of charge, as our privacy policy explains.

Fees

These are the fees the PAIA Regulations, 2021 set for private bodies:

• Request fee: R140.00. You don't pay it when you ask for your own personal information.
• Searching for and preparing the record: R145.00 per hour or part of an hour after the first hour, up to R435.00.
• Copies: R2.00 per A4 page. Postage, if any, at cost.
• If the search will take more than six hours, we may ask for a deposit of up to one third of the fee.

If the Regulator changes these fees, the Regulator's current table applies.

When we may refuse

PAIA lets us refuse access only on the grounds it sets out, for example to protect another person's privacy, someone's commercial or confidential information, a person's safety, or records privileged in legal proceedings. If we refuse, we'll tell you why and how to challenge it.

If you're unhappy with our decision

You may complain to the Information Regulator within 180 days of our decision, or apply to court. The Regulator's contact details are above.

Where to find this manual

This manual is on our website and available at our address on request. We review it at least once a year and whenever our details change.