PAIA manual

This manual is published in terms of section 51 of the Promotion of Access to Information Act 2 of 2000 (“PAIA”), which gives effect to the constitutional right of access to information and is read with the Protection of Personal Information Act 4 of 2013 (“POPIA”). The exemption that previously relieved small private bodies of the duty to keep a manual lapsed on 31 December 2021, so Warwick Brown, as a small private body, is obliged to maintain and publish this manual. It is available free of charge on this website and on request.

As set out in the privacy notice, Warwick Brown holds records in two capacities. It is the responsible party for account, sign-in, security and support information. It is an operator only in respect of each school's claim and payroll records, namely the submitted timesheets and the audit trail behind them, which it processes on that school's instruction. A request for a record that belongs to a school will be referred to that school.

Private body: Warwick Brown, trading as Timeslip. The full identifying details, including legal status, are in the panel at the foot of this page.

Head of the private body and Information Officer: Warwick Brown, the person to whom PAIA requests are directed.

Requests may be emailed to support@timeslip.co.za or posted to 18 Murray Avenue, Morningside Manor, Sandton, Gauteng, South Africa.

The Information Regulator (South Africa) oversees PAIA and POPIA. The Regulator has, under section 10, compiled a Guide on how to use PAIA, available in all official languages from the Regulator's office and website. A requester who is uncertain how to proceed should consult the Guide.

• Email (PAIA complaints): PAIAComplaints@inforegulator.org.za
• Email (general enquiries): enquiries@inforegulator.org.za
• Website: inforegulator.org.za · Telephone: 010 023 5200 / 0800 017 160 (toll-free)
• Address: Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191 (postal: P.O. Box 31533, Braamfontein, Johannesburg, 2017)

(A) Records available without a PAIA request, free of charge

• This manual, the privacy notice and the terms of use;
• the public pages of the website;
• your own timesheets and hours, which may be viewed and downloaded at any time from your account, and all information held under your email address, which is available from Your data.

(B) Records available on request under PAIA, by category

• agreements with the schools that use Timeslip, and operator arrangements under them;
• financial and tax records;
• systems, deployment and processing records, including backups and the mail outbox;
• the timesheet records of a school, subject to that school's instruction;
• correspondence about support requests and incidents.

Records are also held under other legislation, including POPIA, the Consumer Protection Act 68 of 2008, the Electronic Communications and Transactions Act 25 of 2002 and the Income Tax Act 58 of 1962. The inclusion of a category of record in this section does not mean that access will be granted. Every request is assessed against the grounds for refusal in section 7.

The private body is a sole proprietorship with no employees, and accordingly holds no personnel or employment records. It is not registered for value-added tax, and no VAT is added to the prescribed fees in section 6.

• Purpose: recording hours worked, building the school's timesheet, obtaining a lecturer's signature or approval, delivering the finished sheet to the school office, and operating and securing accounts.
• Data subjects and information: students (name, university address, student number, hours, signature); lecturers and school staff (name, address, signature, and the time, internet address and browser recorded at signing); account holders (address, hashed password, session and message records, push subscriptions, school and role).
• Recipients: the hosting provider (Microsoft Azure, South Africa North region); the South African mail host; a fallback mail service where no mail host is configured; the browser push services of Apple, Google or Mozilla where a person has enabled notifications; and the machine to which an offsite backup copy is sent.
• Planned trans-border flows: as described in the privacy notice, section 9: the mail fallback, push services, and an offsite backup where its destination is outside the Republic (POPIA section 72).
• Security: HTTPS in transit, hashed passwords and tokens, per-school isolation, single-use expiring signing links, sealed timesheets, encrypted backups where a key is configured, and the retention horizons in the privacy notice, section 10.

A request for access to a record must be made on the prescribed Form 2 (Request for Access to Record) under the 2021 PAIA Regulations and sent to the Information Officer at the address in section 2. The former Form C has been repealed and must not be used. The form must identify the record sufficiently for it to be located, state your contact details and the form of access required and, where you act on behalf of another person, include proof of your authority.

The prescribed fees are:

• a non-refundable request fee of R140.00, payable before the request is processed;
• an access fee for search, preparation and reproduction once a request is granted: R2.00 per A4 photocopy or printed page, and search-and-preparation at R145.00 per hour (excluding the first hour), notified to you on the prescribed Form 3 (Outcome);
• a deposit of one third of the access fee may be required where search and preparation is estimated to take more than six hours.

These are the prescribed fees in force at the date of this manual. We charge no more than the prescribed fees and add no VAT.

As a private body, we may, or in certain cases must, refuse access on the following grounds:

• protection of the privacy of a third party who is a natural person (s63);
• protection of the commercial information of a third party (s64);
• protection of information held in confidence (s65);
• protection of the safety of individuals and of property (s66);
• records privileged from production in legal proceedings (s67);
• protection of our own commercial information and trade secrets (s68);
• protection of research information of a third party or of ours (s69).

Access may nonetheless be required where the public-interest override in section 70 applies, for example where the record would reveal evidence of a substantial contravention of the law, or of an imminent and serious risk to public safety or the environment.

PAIA provides no internal appeal against the decision of a private body. The internal-appeal procedure in section 74 applies to public bodies only. If you are dissatisfied with a decision, you may lodge a complaint with the Information Regulator under section 77A within 180 days of the decision, and may thereafter apply to a competent court under sections 78 and 82. The Regulator's PAIA-complaints contact is in section 3.

A request under PAIA for access to a record is distinct from a request under POPIA to access, correct or delete your own personal information. Your rights under POPIA may be exercised free of charge, without a prescribed form and without payment of any PAIA fee: see the privacy notice, section 12, and Your data. A request concerning a timesheet that has been delivered to a school is referred to that school, as the privacy notice explains.

This manual is available free of charge on this website and on request, and on request from the Information Regulator. It is reviewed and updated as required, and the version shown at the head of this page is the version in force. We have had regard to the Information Regulator's "PAIA Manual Template: Private Body".