PAIA Manual

This is the manual of Cardtly (Pty) Ltd under section 51 of the Promotion of Access to Information Act 2 of 2000 (PAIA). PAIA gives everyone the right to request a record held by a private body where the record is needed to exercise or protect a right, subject to the grounds for refusal in the Act.

It sets out the records we hold, how to ask for one, what it can cost, how long a decision takes, and when we may refuse. As the Protection of Personal Information Act 4 of 2013 (POPIA) requires, it also describes how we process personal information.

Only want your own information? You do not need this procedure. Signed-in users can download everything we hold about their account in Dashboard, Settings, under Account. Otherwise email our Information Officer at andre@cardtly.com. That is a request under POPIA section 23, and no PAIA request fee applies to it.

In this manual:

• PAIA is the Promotion of Access to Information Act 2 of 2000, and the PAIA Regulations are the regulations made under it in 2021.
• POPIA is the Protection of Personal Information Act 4 of 2013.
• The Regulator is the Information Regulator (South Africa).
• Cardtly, we and us mean Cardtly (Pty) Ltd.

Send requests and questions about this manual to the Information Officer.

As section 10 of PAIA requires, the Regulator publishes a guide explaining how to use the Act: what rights it gives, how to make a request, and what to do if a request is refused. It is available from the Regulator's website. We will email you a copy on request, and a copy can be inspected at our office by arrangement.

The Information Regulator (South Africa)

• Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191
• Telephone 010 023 5200, toll free 0800 017 160
• Email enquiries@inforegulator.org.za
• Website inforegulator.org.za

These are published on our website, and anyone may read them without making a request under PAIA:

• our Privacy Policy;
• our Terms of Service, including the POPIA operator agreement;
• this manual, and our Trust Centre;
• the instructions for deleting an account;
• product information and articles on cardtly.com; and
• digital business cards, which their owners publish and which anyone with a card's link can see.

We keep records that the following laws require, where they apply to us. Records held under them are available as those laws, and PAIA, allow. The list is not complete.

• Basic Conditions of Employment Act 75 of 1997
• Companies Act 71 of 2008
• Compensation for Occupational Injuries and Diseases Act 130 of 1993
• Consumer Protection Act 68 of 2008
• Electronic Communications and Transactions Act 25 of 2002
• Income Tax Act 58 of 1962
• Labour Relations Act 66 of 1995
• Promotion of Access to Information Act 2 of 2000
• Protection of Personal Information Act 4 of 2013
• Tax Administration Act 28 of 2011
• Unemployment Insurance Act 63 of 2001

Listing a category here does not mean every record in it will be released. Each request is decided under sections 7 and 8 of this manual.

1. Complete Form 2, Request for Access to Record, prescribed under regulation 7 of the PAIA Regulations. It is available from the Regulator's website, and we will email you a copy on request.
2. Send it to our Information Officer at andre@cardtly.com.
3. Include enough detail for us to identify the record, the form of access you want (for example a copy, or inspecting it), and the right you want to exercise or protect, with why the record is needed for it, as section 53 of PAIA requires. Attach proof of your identity and, if you are asking for someone else, proof that you may act for them.

Fees. If you are asking for your own personal information, no request fee is payable. Anyone else pays the request fee prescribed in Annexure B of the PAIA Regulations before we process the request. Access fees for reproducing a record, and for the time it takes to search for and prepare it, may then apply to any requester, and a deposit may be asked for where the work will take longer than the Regulations allow without one. We tell you in writing what is payable, and why, before you pay anything.

How long it takes. We decide within 30 days of receiving a complete request, as section 56 requires, and tell you the decision. We may extend that once, by up to 30 more days, where section 57 allows, for example when the request covers many records, and we tell you why. If we do not decide in time, PAIA treats the request as refused, and you may use the remedies in section 9.

Records about someone else. If a record contains a third party's personal or commercial information, sections 71 to 73 require us to tell them, give them the chance to respond, and consider what they say before deciding. This can add time.

Information captured through a customer's card. For contacts and leads captured through a card, the customer who owns the card is the responsible party and Cardtly is its operator. We will usually refer a request for that information to the customer and help them respond, as our Privacy Policy describes.

Chapter 4 of Part 3 of PAIA sets out the grounds on which a private body must or may refuse access. In summary, we may refuse a record, or part of one, where releasing it would:

• unreasonably disclose personal information about another person (section 63);
• disclose a third party's trade secrets, or financial, commercial, scientific or technical information likely to harm their commercial or financial interests (section 64);
• breach a duty of confidence owed to a third party (section 65);
• endanger someone's life or physical safety, or the security of a building, system or property (section 66);
• disclose a record privileged from production in legal proceedings (section 67);
• disclose our own trade secrets, or financial, commercial, scientific or technical information likely to harm our commercial or financial interests, or information whose release would put us at a disadvantage in negotiations or competition (section 68); or
• disclose research by us or a third party where that would seriously disadvantage the researcher or the subject (section 69).

Even then, section 70 requires us to release the record where it would reveal evidence of a substantial breach of the law, or an imminent and serious risk to public safety or the environment, and the public interest in releasing it clearly outweighs the harm. Where only part of a record may be refused, we release the rest (section 59). A refusal is given in writing, with our reasons.

A private body has no internal appeal under PAIA. If we refuse your request, do not decide in time, or you disagree with a fee or an extension, you may, within 180 days of our decision:

• complain to the Regulator, on its Form 5, through its website or at the contact details in section 3; or
• apply to a court for relief, as section 78 of PAIA allows.

A third party who disagrees with our decision to release a record about them has the same options.

This section gives what PAIA section 51 asks of a manual. Our Privacy Policy sets out in full how we handle information about the people who use Cardtly and the people their cards reach.

Why we process it.

• to create accounts and publish the digital cards our customers make;
• to store, as our customers' operator, the contacts and requests their cards capture, and run their team accounts;
• to take payment, invoice organisations and manage subscriptions;
• to make, and deliver, physical NFC cards that customers order;
• to review reseller applications and run reseller accounts;
• to send service emails, and provide support;
• to keep the service secure and prevent fraud and abuse;
• to improve the product from patterns across many accounts;
• to run the AI bio writer and paper card scanning, each time someone chooses to use them; and
• to keep the records the law requires.

Whose information, and what.

Who receives it. The service providers named in section 7 of our Privacy Policy, each receiving only what it needs: Supabase, Vercel, Paystack, Resend, OpenAI, ipapi.co, Google, Apple and Microsoft. On a team account, the organisation's own administrators. A reseller sees the names, seats and admin email address of the client teams it creates. Authorities, where the law requires it.

Transfers outside South Africa. Our database and uploaded files are hosted by Supabase in its West Europe region, in the European Union, and our other providers may process what they receive in other countries, including the United States. We rely on POPIA section 72: the recipients are bound by laws giving protection substantially similar to POPIA's, and the transfers are needed to provide the service.

How it is protected.

• Row-level security in the database refuses one customer's records to anyone else, whatever the website asks for.
• HTTPS only in transit, enforced so browsers will not try an insecure connection. Our database, files and backups are encrypted at rest by our hosting provider.
• Passwords are stored only as one-way hashes, and sign-in attempts are rate limited.
• Administrative actions by Cardtly staff, and every change to a subscription, are logged with who made them and when.
• Payment card details are handled only by Paystack. We never see or store a card number.
• If a breach affects personal information, we notify the Regulator and the people affected as soon as reasonably possible, as POPIA section 22 requires.

This manual is published at cardtly.com/paia. We will email a copy free of charge on request, and a copy can be inspected at our office during business hours by arrangement.

We update this manual when the records we hold, or the way we process personal information, change. The date at the top shows the last update.

Issued by Andre Nel, Information Officer, for Cardtly (Pty) Ltd.