1Purpose of this Manual
This Manual is intended to help members of the public understand what information Smartz holds and how to exercise rights of access to records in accordance with PAIA. It also contains the disclosures regarding personal-information processing that section 51 of PAIA requires from a private body.
- Identify records that are publicly available without a formal PAIA request.
- Explain the subjects on which Smartz holds records and the categories of records held.
- Provide the contact details needed to submit a request for access.
- Explain the Information Regulator’s PAIA Guide and the formal request process.
- Describe Smartz’s purposes for processing personal information, categories of data subjects and information, recipients, transborder flows and security measures.
- Explain the main procedural steps, possible refusal grounds and remedies available to a requester.
Important. A PAIA request to a private body must relate to a record that is required for the exercise or protection of a right. The requester must identify that right and explain why access to the record is required for that purpose.
2Company and Information Officer details
| Item | Details |
|---|---|
| Legal entity | Smartz Solutions RSA (Pty) Ltd |
| Trading name | Smartz Solutions |
| Registration number | 2006/003794/07 |
| Information Officer | Cindy van Wyk (Head of Private Body) |
| PAIA / privacy email | info@smartz-solutions.com |
| Telephone | +27 87 740 1191 / +27 10 065 0060 |
| Physical address | 70 Gordon Road, Cnr Cloetenberg Road, Somerset West, 7130 |
| Postal address | Postnet Suite #419, Private Bag X15, Somerset West, 7129 |
| Website | www.smartz-solutions.com |
Any Deputy Information Officer formally designated and registered from time to time may also assist the Information Officer with requests and POPIA-related duties. Requests may in all cases be sent to the general PAIA / privacy email address above for routing.
3Information Regulator PAIA Guide
The Information Regulator has published and updates a Guide on how to use PAIA. The Guide explains the objects of PAIA and POPIA, how to make a request, available assistance, applicable fees, complaint processes and other remedies. The Guide and prescribed PAIA forms are available from the Information Regulator’s website and eServices portal.
| Regulator contact | Details |
|---|---|
| Address | Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191 |
| Postal address | P.O. Box 31533, Braamfontein, Johannesburg, 2017 |
| Telephone | 010 023 5200 |
| Toll free | 0800 017 160 |
| enquiries@inforegulator.org.za | |
| Website | www.inforegulator.org.za |
4Records available without a formal request
| Category | Examples | How to access |
|---|---|---|
| Corporate and contact information | Company contact details and other information intentionally published on the Smartz website. | Website |
| PAIA and privacy documents | Current PAIA Manual, Website Privacy Policy, Website Access & Disclaimer and related public notices. | Website / on request |
| Product and service information | Public brochures, product descriptions, feature overviews, public release communications and marketing material. | Website / on request |
| Thought leadership and public content | Public articles, guides, research, announcements and social-media content issued by Smartz. | Website / public channels |
| Recruitment information | Publicly advertised vacancies and recruitment notices, when applicable. | Website / recruitment channels |
| Public training information | Public course descriptions, Academy information and published learning-content descriptions. | Website / learning portal |
The fact that a record is described as publicly available does not require Smartz to disclose confidential, privileged, security-sensitive or third-party information embedded in or associated with that record.
5Records available under other legislation
| Category of records | Applicable legislation |
|---|---|
| Corporate and statutory records | Companies Act 71 of 2008; Companies Regulations. |
| Employment and payroll records | Basic Conditions of Employment Act 75 of 1997; Labour Relations Act 66 of 1995; Employment Equity Act 55 of 1998; Unemployment Insurance Act 63 of 2001; UI Contributions Act 4 of 2002; Skills Development Act 97 of 1998; Skills Development Levies Act 9 of 1999; COIDA 130 of 1993; Occupational Health and Safety Act 85 of 1993. |
| Tax and accounting records | Income Tax Act 58 of 1962; Value-Added Tax Act 89 of 1991; Tax Administration Act 28 of 2011. |
| Access and privacy records | Promotion of Access to Information Act 2 of 2000; Protection of Personal Information Act 4 of 2013 and applicable regulations. |
| Electronic and website records | Electronic Communications and Transactions Act 25 of 2002; Consumer Protection Act 68 of 2008, to the extent applicable. |
| Cybersecurity and electronic-evidence records | Cybercrimes Act 19 of 2020 and other applicable law. |
| Intellectual property records | Copyright Act 98 of 1978; Trade Marks Act 194 of 1993 and related legislation, where applicable. |
This list is not exhaustive. Records may also be created or retained under any other law applicable to Smartz, its employees, services, contracts or business operations.
6Subjects and categories of records held
| Subject | Categories of records |
|---|---|
| Corporate governance | Incorporation and CIPC records; governance records; resolutions; shareholder and group-company records; delegated authorities; statutory registers. |
| Finance and tax | Accounting records; invoices; purchase orders; bank and payment records; budgets; management accounts; tax records; audit records. |
| Human resources | Employment contracts; payroll records; leave and attendance; policies; performance records; recruitment records; training and development records; disciplinary and grievance records; occupational health and safety records. |
| Customers, partners and resellers | Contracts; order forms; statements of work; proposals; pricing; service correspondence; account records; implementation and onboarding records; relationship-management records. |
| Suppliers and contractors | Supplier agreements; due diligence; quotations; invoices; security and compliance records; vendor-management correspondence. |
| Products and technology | Product documentation; release notes; source-code and development records; architecture and design documentation; configuration records; testing records; licences; intellectual-property records. |
| Service delivery and support | Service-desk tickets; incident and problem records; change records; service reports; support correspondence; monitoring and operational records. |
| Information security and privacy | Security policies; risk assessments; access-control records; audit logs; data-processing agreements; privacy notices; operator/subprocessor records; breach and incident records; PAIA and POPIA records. |
| Sales and marketing | Campaign records; website enquiries; CRM records; event and webinar records; consent and communication-preference records; brochures and marketing materials. |
| Smartz Academy and training | Learner registration and enrolment records; course progress; assessments; certifications; attendance; course content; support records. |
| Legal, compliance and insurance | Contracts; legal correspondence; claims; regulatory filings; compliance assessments; insurance policies; dispute records; privileged material. |
| Website and digital properties | Web logs; analytics; cookie and preference records; web-form submissions; content-management records; security logs. |
7Processing of personal information
7.1 Purposes of processing
- Provide, operate, secure, support and improve Smartz products, services, websites and learning services.
- Engage with prospective customers, customers, resellers, partners and suppliers; prepare proposals; contract; bill; collect payment; and administer relationships.
- Provide implementation, support, incident management, service management and customer communications.
- Manage employees, applicants, contractors and related HR, payroll, performance, safety and training processes.
- Run Smartz Academy, provision learners, track learning progress, administer assessments and issue training records or certificates where applicable.
- Conduct lawful marketing, events, research and business-development activities and manage communication preferences.
- Comply with legal, regulatory, tax, accounting, audit, security and governance obligations; establish, exercise or defend legal rights.
- Protect systems, users, confidential information and business operations, including through access controls, logging, monitoring, fraud prevention and security incident response.
7.2 Categories of data subjects and personal information
| Data subject category | Personal information that may be processed |
|---|---|
| Website visitors and prospects | Names; business contact details; company and job information; enquiry content; marketing preferences; IP address; browser/device and usage data; cookie or similar identifiers. |
| Customers, resellers and partners | Business contact details; account and contract details; communications; billing and payment-related information; support and project records; authentication and access information. |
| Customer end users and interaction participants | Where processed through Smartz services: identifiers, contact information, voice recordings, chat or message content, screen recordings, interaction metadata and other data submitted to or generated through the relevant service. Smartz may act as an operator for this information under the customer’s instructions. |
| Employees, applicants and contractors | Identification and contact details; employment and payroll information; qualifications; work history; performance; leave; benefits; emergency contacts; access and security records; legally required demographic or employment-equity information. |
| Learners and Academy users | Name and contact details; employer/customer affiliation; account identifiers; enrolment; course progress; assessment and certification records; support communications. |
| Suppliers and service providers | Names and business contact details; registration and tax details; bank/payment information; due-diligence and contract information; security and access details. |
| Directors, shareholders and professional advisers | Identity and contact details; governance records; statutory information; professional and engagement records. |
| Regulators, complainants and requesters | Identity and contact details; request or complaint details; correspondence; supporting records and outcome information. |
7.3 Recipients or categories of recipients
- Smartz employees and authorised personnel who require access for legitimate business purposes.
- Cloud, hosting, communications, learning-platform, CRM, analytics, cybersecurity, support and other technology service providers acting as operators or service providers.
- Banks, payment providers, auditors, insurers, professional advisers and debt-collection or legal service providers where applicable.
- Customers, resellers, partners or group companies where disclosure is necessary for the relevant relationship or service and is lawful.
- Regulators, courts, law-enforcement agencies, tax authorities and other public bodies where disclosure is required or permitted by law.
- Other recipients authorised by the data subject or permitted under POPIA or other applicable law.
7.4 Planned transborder flows
Smartz uses cloud and software-as-a-service infrastructure and may engage group companies or service providers outside South Africa. Personal information may therefore be stored, accessed or otherwise processed in other countries where this is necessary for service delivery, support, security, administration or business operations. Any cross-border processing is subject to the safeguards required by section 72 of POPIA and applicable contractual, organisational and technical controls.
7.5 General security measures
- Encryption in transit and at rest where appropriate.
- Role-based access controls, least-privilege access and multi-factor authentication for privileged access where reasonably available.
- Logging, monitoring, vulnerability management and security-event response.
- Secure development, change-management and backup/recovery controls.
- Contractual security and confidentiality requirements for relevant operators and service providers.
- Security awareness and confidentiality obligations for personnel with access to personal information.
- Periodic risk assessment and continual improvement of privacy and security controls.
8How to request access to a record
- Complete the prescribed PAIA Form 2 (Request for Access to Record). The current form is available from the Information Regulator.
- Identify the record with enough detail for Smartz to locate it.
- Identify the right that you seek to exercise or protect and explain why the requested record is required for that purpose.
- Provide sufficient proof of identity. If you act for another person, provide proof of authority or capacity.
- Specify the preferred form of access and contact method, subject to what is reasonably available and lawful.
- Send the completed request and supporting documents to info@smartz-solutions.com for the attention of the Information Officer, or deliver them to the physical address in section 2.
- Pay any prescribed request fee, access fee or deposit when Smartz issues the required notice.
Security note. Do not send passwords, card numbers, special personal information or unrelated confidential information unless Smartz specifically asks for it as necessary to verify or process the request.
9Fees, timeframes and decisions
- Fees are governed by PAIA and the applicable regulations. Where a fee is payable, Smartz may require payment of the prescribed request fee before further processing and may require an access fee and, where permitted, a deposit for extensive search or preparation work.
- Smartz will generally decide a properly submitted request within 30 days, subject to any extension permitted by PAIA.
- The requester will be informed of the outcome and of any fees payable using the prescribed notice or an equivalent lawful communication.
- Where access is granted, Smartz will provide access in the form requested where reasonably practicable and lawful, subject to payment of applicable fees.
- Where access is refused, Smartz will provide the requester with the basis for refusal and information about available remedies, subject to PAIA.
10Grounds on which access may be refused
PAIA contains mandatory and discretionary grounds on which a private body must or may refuse access. Depending on the record, these can include:
- Protection of the privacy of third parties.
- Protection of confidential commercial information or trade secrets of Smartz or third parties.
- Protection of confidential information supplied by a third party under circumstances creating a duty of confidence.
- Protection of the safety of individuals and the security of property or systems.
- Protection of legally privileged records.
- Protection of research information in circumstances recognised by PAIA.
- Records whose disclosure would be prohibited by other law or where another PAIA refusal ground applies.
Where only part of a record is protected, Smartz will consider whether reasonably severable information can be disclosed in accordance with PAIA.
11Remedies and complaints
Private bodies do not generally have a mandatory internal PAIA appeal process. A requester who is dissatisfied with a refusal, a deemed refusal, a fee decision, an extension or another decision may use the remedies provided by PAIA, including lodging a complaint with the Information Regulator and/or seeking appropriate court relief.
The Information Regulator states that a complaint should generally be lodged within 180 days of the relevant refusal or decision, or after the statutory response period has elapsed in a deemed-refusal situation. The current prescribed complaint form is Form 5.
12Availability and updating of this Manual
- On the Smartz website at www.smartz-solutions.com.
- For inspection at Smartz’s physical address during normal business hours, subject to reasonable access arrangements.
- From Smartz upon request, subject to any lawful copying or delivery fee.
- To the Information Regulator upon request.
The Information Officer will review and update this Manual on a regular basis and when material changes in law, company information, record categories or processing activities make an update necessary.
Prepared in terms of section 51 of PAIA, with reference to PAIA (Act 2 of 2000, particularly ss 50, 51, 54 and 56–73) and its Regulations, 2021; POPIA (Act 4 of 2013, incl. ss 21, 22, 23–25, 55, 69 and 72); and the Information Regulator PAIA Manual Template and current Guide. See also the Privacy Policy and Access & Disclaimer.