PAIA manual

This PAIA manual is published under section 51 of the Promotion of Access to Information Act 2 of 2000 (PAIA), as amended by the Protection of Personal Information Act 4 of 2013 (POPIA). It sets out the records we hold, how a request for access to a record may be made, and how we process personal information.

• Private body: Kamb Trading (Pty) Ltd, trading as Assay House
• Registration number: 2022/846711/07
• Postal and street address: 3 Varing Avenue, Windsor Park, George, 6529, Western Cape
• Business: brand strategy, marketing and website development services
• Head of the private body and Information Officer: the director
• Email: hello@assayhouse.co.za
• Telephone: 063 848 5962
• Fax: none
• Website: assayhouse.co.za

No deputy Information Officer is appointed.

The Information Regulator has compiled a guide under section 10 of PAIA on how to exercise the rights in PAIA and POPIA. It is available from the Regulator at inforegulator.org.za, and a copy may be inspected at our address during normal business hours.

Information Regulator of South Africa. Complaints: complaints.IR@inforegulator.org.za.

Everything published on this website is available without a request, including our privacy policy, terms and data deletion procedure. We have not published a notice under section 52 of PAIA.

We keep records in terms of the following laws, where they apply to us:

• Companies Act 71 of 2008;
• Income Tax Act 58 of 1962;
• Tax Administration Act 28 of 2011;
• Basic Conditions of Employment Act 75 of 1997;
• Consumer Protection Act 68 of 2008;
• Electronic Communications and Transactions Act 25 of 2002;
• Protection of Personal Information Act 4 of 2013; and
• Copyright Act 98 of 1978.

Company and accounting records are kept for seven years, as section 24 of the Companies Act requires, or longer where another law requires it.

• Company and statutory records: incorporation documents, Memorandum of Incorporation, registers, resolutions and filings.
• Financial and tax records: invoices, accounting records, bank records and tax returns.
• Client records: proposals, contracts, briefs, deliverables, approvals, client portal activity and correspondence.
• Research records: interview notes, recordings, consent records and signed releases.
• Supplier records: agreements, invoices and correspondence.
• Website and marketing records: enquiries, applications, playbook sign-ups and website usage statistics.
• Connected Facebook and Instagram accounts: authorisations and page and account statistics.
• Personnel records, where people are engaged to work for us.
• Systems access and security logs.

Our privacy policy sets out this processing in detail, including the lawful basis for each purpose and how long each kind of information is kept.

Purposes. We process personal information to:

• respond to enquiries and scope the work asked about;
• assess and arrange applications for the Commercial Foundation or a teardown;
• write and send a one-page read requested after the Brand Stage Map;
• send a playbook or other publication to people who sign up for it;
• deliver contracted services and operate the client portal;
• conduct research interviews and record calls, with consent;
• publish content in which a person appears, under a signed release;
• publish to and report on a client's connected Facebook and Instagram accounts;
• send electronic marketing as section 69 of POPIA allows;
• invoice, keep accounts and meet our legal obligations;
• engage suppliers and contractors; and
• operate, secure and improve this website.

Data subjects and their information.

• Prospective clients and enquirers: name, email address, telephone number, business name, website, area of interest, budget range, message, and Choice Check answers sent to us.
• Applicants: name, email address, telephone number, business name, website and application answers.
• Clients and their staff: names, contact details, business details, portal logins, comments and approvals, files supplied, and billing records.
• Research participants, including clients' customers: what they say in interviews, our notes of it, recordings where they agree, and consent records.
• Subscribers: name and email address.
• People appearing in content: image, voice, name, job title and words, and the signed release.
• Suppliers: business and contact details, agreements and payment details.
• Contractors: name, contact details, agreements and payment details.
• Website visitors: pages visited, referring site, campaign parameters, browser user agent, an analytics cookie identifier, and a one-way hash of the IP address.

Recipients. The operators named in clause 5 of our privacy policy, who process personal information on our instructions; the client who commissioned research, for findings in which participants are not named; our professional advisers; and authorities, where the law requires it. We do not sell personal information.

Transfers outside South Africa. Some of those operators hold information in the United Kingdom, Germany, the United States and other countries, as listed in clause 5 of the privacy policy. Transfers are made under section 72 of POPIA, as set out in clause 6 of the privacy policy.

Security measures.

• This website is served over HTTPS and information is encrypted in transit.
• Personal information is held in an access-controlled database with row-level security, which is not publicly readable.
• Every person with access uses a named login. Accounts are not shared.
• Credentials are held outside working documents.
• Information is deleted at the end of the retention periods in the privacy policy. In the database this runs automatically every day.
• A security compromise affecting personal information is notified to the Information Regulator and the people affected, as section 22 of POPIA requires.

A request is made on Form 2 of the PAIA Regulations, available from the Information Regulator at inforegulator.org.za/paia, and emailed to hello@assayhouse.co.za. The request must:

• describe the record requested in enough detail to identify it;
• identify the requester, with a postal address, fax number or email address;
• state the form of access required;
• identify the right the requester seeks to exercise or protect, and explain why the record is required for it; and
• state any other way in which the requester wishes to be told of the decision.

A request made on behalf of another person must include proof of the authority to make it. We verify the identity of the requester before giving access.

Fees prescribed by the PAIA Regulations may apply. We state the amount before any charge is made.

A request for your own personal information under section 23 of POPIA is made in the same way and is dealt with free of charge, as our privacy policy states.

We decide a request within 30 days of receiving it. That period may be extended once, by up to 30 days, with written reasons. A request may be refused only on the grounds in Chapter 4 of Part 3 of PAIA, and reasons for any refusal are given in writing.

A requester who is not satisfied with our decision may lodge a complaint with the Information Regulator, at complaints.IR@inforegulator.org.za, or apply to a court, within 180 days of the decision, as PAIA provides.

This PAIA manual is published at assayhouse.co.za/paia-manual/. A copy is emailed free of charge on request to hello@assayhouse.co.za, is available for inspection at the address above during normal business hours, and is given to the Information Regulator on request. It is updated when our details or practices change.