PAIA Manual

1. Introduction

PAIA gives effect to the constitutional right of access to information held by public and private bodies, subject to conditions and limitations. This PAIA Manual is compiled for Bwiser as a private body and describes:

• Contact details for the Information Officer and how to submit requests.
• The categories of records held by Bwiser and how they may be accessed.
• The request procedure, fees, and grounds for refusal under PAIA.
• How PAIA requests interact with POPIA where personal information is involved.

This Manual is intended to support operational readiness and transparency. It should be reviewed and finalised with legal counsel to ensure the Manual reflects the organisation’s structure and record categories in production.

2. Company Details

Legal name: Bwiser (private body).
Principal place of business: Johannesburg, South Africa (update with the registered address for production).
General contact: [email protected].

3. Information Officer

In terms of PAIA (and POPIA), the head of a private body is deemed the Information Officer. Bwiser designates an Information Officer and may designate Deputy Information Officers. For operational purposes, requests should be directed to the contact details below. If these details change, Bwiser will update this Manual.

4. Guide on How to Use PAIA

A guide on PAIA is available from the Information Regulator (South Africa). The guide explains how to submit requests and the remedies available. If you need assistance, you may also contact Bwiser’s Information Officer using the details above.

5. Records Automatically Available

Certain records may be available without a formal PAIA request (for example, information on our website). Examples may include:

• Public-facing policy pages (Privacy Policy, Cookie Policy, POPIA Notice, AML/KYC Policy, Security/Compliance pages).
• General product information and help content.
• Marketing and informational material intended for public use.

6. Categories of Records Held by Bwiser

Bwiser holds records in various categories. Access is subject to PAIA, POPIA, confidentiality obligations, and grounds for refusal. Categories may include:

• Corporate and governance records: incorporation records, board resolutions, policies, and governance documents.
• Financial and accounting records: financial statements, reconciliations, invoices, payment records, and audit reports.
• Operational records: voucher issuance logs, redemption audit trails, settlement records, operational reporting, and support tickets.
• Customer records: onboarding information, contracts (where applicable), account profiles, and communications.
• Compliance records: AML/KYC decisions, verification logs, risk assessments, and incident records.
• Human resources records: employee and contractor records, where applicable.
• IT and security records: access logs, security monitoring logs, change management, and incident response documentation.
• Legal records: agreements, legal correspondence, and dispute records.

Some records may be stored electronically and may be maintained by third-party Operators (for example, hosting providers) under contractual controls. Where records are held by Operators, requests will be processed through Bwiser’s Information Officer.

7. Records That May Be Requested

Subject to PAIA, a requester may request access to records held by Bwiser. Examples may include copies of contracts (where applicable), account-specific operational records, or correspondence, subject to identity verification and lawful grounds. Requests must be specific enough for Bwiser to identify the record.

8. Request Procedure

Requests must be made in the prescribed form and submitted to the Information Officer. Where a request is made on behalf of another person, proof of authority must be provided. A request should include:

• The requester’s full names and contact details.
• Details of the record requested (sufficient for identification).
• The preferred format of access (inspection, electronic copy, printed copy).
• The reason the record is required (where required by PAIA for private body requests).
• Proof of identity and, where relevant, proof of authority to act.

Bwiser may request additional information to process the request, confirm identity, or locate the record. If the request is unclear, Bwiser may assist the requester to clarify it.

9. Timeframes

Requests are processed in accordance with PAIA timelines. Timeframes may be extended in circumstances permitted by PAIA, such as where the request is complex, involves a large number of records, or requires consultation with third parties.

If a request is time-sensitive (for example, for an urgent legal matter), you should indicate this in the request and provide supporting context. While PAIA sets statutory processes, additional clarity can help us prioritise triage and reduce delays caused by incomplete information.

10. Fees

PAIA provides for request fees and access fees for private body requests in certain circumstances. Fees may include costs for searching, preparing, and reproducing records. The Information Officer will advise the requester of any applicable fees and payment requirements before processing where required.

11. Grounds for Refusal

PAIA sets out grounds on which a private body may refuse access. Grounds may include, for example:

• Protection of personal information of a third party (subject to POPIA and PAIA).
• Protection of confidential commercial information and trade secrets.
• Protection of privileged legal documents and legal professional privilege.
• Protection of safety and security of individuals or property.
• Protection of records that, if disclosed, would prejudice investigations or security controls.

Where access is refused, Bwiser will provide reasons as required and outline available remedies or further steps under PAIA.

12. POPIA Alignment and Access to Personal Information

Where a request relates to personal information, Bwiser will handle it in a manner aligned with both PAIA and POPIA. This includes verifying the requester’s identity, confirming authority (where acting on behalf of another person), and applying lawful exemptions and protections.

Data subjects may also request correction or deletion of personal information under POPIA where applicable. Such requests may be processed through the same contact channel and may require additional verification.

13. Remedies

If you are not satisfied with the outcome of a PAIA request, you may have remedies available under PAIA, including lodging a complaint with the Information Regulator and/or taking other steps as permitted by law. Bwiser encourages requesters to contact us first to attempt to resolve disputes or misunderstandings.

14. Availability of This Manual

This Manual is available on our website at the PAIA Manual page. A copy may be provided upon request in a reasonable format where practicable.

15. Forms and Submission Requirements (Practical Guidance)

PAIA requests should be submitted using the prescribed request form. The form generally requires the requester to identify themselves, describe the record requested, and explain the right being exercised and why the record is required to exercise or protect that right (for private body requests). Where a request is made on behalf of another person, proof of authority must be provided.

To help us process requests efficiently, include as much detail as possible, for example:

• Account identifiers (registered email/phone) where the request relates to a Platform account.
• Transaction references, voucher IDs, repayment references, or dates for operational records.
• The format you prefer (PDF, printed copy, inspection at premises), where feasible.

16. Fee Principles (High-Level)

Fees under PAIA are determined by regulations and may change from time to time. Where fees are applicable, we may require a deposit prior to processing. Fees may include costs for:

• Searching for and preparing the record.
• Reproducing the record (printing, copying, converting to digital format).
• Postage or courier where physical delivery is requested.

If you want an estimate, include an indication of the scope (date ranges, specific transactions) so we can assess likely effort.

17. Third-Party Consultation

Some records may contain information about third parties (for example, a station’s operational data linked to a redemption). PAIA may require consultation with relevant third parties before disclosure. This can extend processing timelines. Bwiser will apply the relevant legal process and protect personal information and confidential commercial information where applicable.

18. Common Grounds for Refusal (Expanded)

In addition to the broad grounds described above, requests may be refused or partially granted where:

• Disclosure would reveal confidential commercial information (trade secrets, pricing, proprietary scoring methods).
• Disclosure would prejudice the security of the Platform, including fraud detection measures and internal controls.
• Disclosure would unreasonably disclose personal information of other data subjects, unless consent or a lawful basis exists.
• Records are legally privileged or prepared for litigation.
• The request does not meet statutory requirements (for example, the right and necessity requirement for private body records).

Where partial access is possible, we may redact portions of records to protect protected information while providing access to the remainder, in line with PAIA.

19. How We Provide Access (Formats and Redaction)

Where access is granted, Bwiser will provide the record in a format that is reasonably practicable, taking into account the nature of the record, security considerations, and the requester’s preference. Typical formats may include:

• Electronic copies (for example, PDF exports of account and transaction history).
• Printed copies, where electronic delivery is not suitable.
• Inspection of records at an agreed location (where appropriate and lawful).

To protect confidentiality and personal information of other data subjects, we may redact records. Redaction means removing or obscuring protected parts of a record (for example, another person’s personal information, confidential commercial terms, or security-sensitive internal controls) while still providing access to the remainder where possible.

For Platform records, a large portion of information is stored as structured audit events (voucher application, approval, redemption, repayment events). Where access is granted, we may extract relevant events for the requester’s account and provide them in a readable format.

If a record cannot be provided in the requested format, we will explain why and offer an alternative format where possible. We may also apply additional verification steps before releasing records that could expose account security (for example, detailed login or device metadata). Where a request is overly broad, we may ask you to narrow the scope to specific date ranges, transaction references, or record types to reduce delays and costs.

Bwiser’s goal is to provide access where lawful and practical. However, we must balance access with privacy, confidentiality, and security. In some cases, the most appropriate outcome is to provide a summary record rather than raw internal logs, or to provide partial records with redactions. If you believe a refusal or redaction is incorrect, you may follow the remedies described above.

20. Contact

Submit PAIA requests to: [email protected] (subject: PAIA Request).

If you do not receive an acknowledgement within a reasonable time, you may resend the request and include any reference number previously issued. Please avoid including passwords or highly sensitive credentials in email. Where additional verification is needed, we will request it through a secure and appropriate channel.

Note: This PAIA Manual is provided for transparency and operational readiness and does not constitute legal advice.