PAIA and POPIA manual: outline
DRAFT OUTLINE 0.4 for attorney review, 22 October 2026. Not published.
Manual of Ledgeforge Software (Pty) Ltd under section 51 of the Promotion of Access to Information Act 2 of 2000 ("PAIA"), including the information POPIA s51 adds.
[ATTORNEY: (1) Confirm whether Ledgeforge must compile a manual now or falls within an exemption for small private bodies, and if exempt whether to publish one anyway (recommended: yes, it is short and shows good faith). (2) Confirm the current prescribed form (Regulator's template) and fees under the PAIA Regulations, 2021. (3) Information Officer registration on the Regulator's eServices portal.]
1. Introduction
Purpose of the manual; date of compilation [DATE]; date of last update [DATE]; where it can be found (our website at [ledgeforge.co.za/legal/paia] and at our office, free of charge; a printed copy on request for the prescribed fee).
2. Contact details (PAIA s51(1)(a))
| Item | Detail |
|---|---|
| Name | Ledgeforge Software (Pty) Ltd |
| Registration number | 2026/774859/07 |
| Head of the private body | Jeffrey Nash, sole director |
| Information Officer | Jeffrey Nash |
| Deputy Information Officer | [NONE / NAME] |
| Physical address | 10 Cloyne Kenmare, Kenmare, Mogale City, Gauteng, 1739 |
| Postal address | [SAME / PO BOX] |
| Telephone | 083 550 0535 |
| [privacy@ledgeforge.co.za or jeffrey@nashass.co.za] | |
| Website | [ledgeforge.co.za] |
3. The Regulator's guide (s10)
The Information Regulator's guide on how to use PAIA and POPIA is available from the Regulator (https://inforegulator.org.za; JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001). [ATTORNEY: confirm details.]
4. Records available without a request (s52)
- Privacy Notice, Terms of Service and annexes, Cookie Notice, Security Statement, this manual (website).
- Product descriptions and the Price List (website and Services).
5. Records kept under other laws (s51(1)(b)(iii))
Companies Act 71 of 2008; Tax Administration Act 28 of 2011; Income Tax Act 58 of 1962; Value-Added Tax Act 89 of 1991 (registration records when applicable); Basic Conditions of Employment Act 75 of 1997 and Labour Relations Act 66 of 1995 (if staff are employed); Electronic Communications and Transactions Act 25 of 2002; Consumer Protection Act 68 of 2008; POPIA. [ATTORNEY: complete.]
6. Subjects and categories of records held (s51(1)(b)(iv))
| Subject | Categories |
|---|---|
| Company | incorporation documents, share register, directors' records, minutes and resolutions |
| Finance and tax | annual financial statements, accounting records, tax returns, bank statements |
| Customers | subscription records, invoices, payment records, correspondence, support records, audit logs |
| Users | sign-in, membership and consent records (see Privacy Notice) |
| Suppliers | contracts and invoices from AWS, PayFast, Cloudflare and others |
| Products | software source code and designs, security documentation (confidential: see section 8) |
| Personnel | [if any] employment contracts, payroll |
| Customer Data | held as operator for Customers, only while subscribed and for 90 days after a product's last day of access, then deleted automatically, including accounting records (see 6A); requests are referred to the Customer, who is the responsible party |
6A. Records we do not hold after deletion
Ledgeforge deletes all Customer Data automatically 90 days after a product's subscription ends, as the Customer instructs in our terms. After that date Ledgeforge holds no copy of a former Customer's accounting records or other data, apart from copies in backups that expire within 35 days and are not used to answer requests. A request for such records must be made to the former Customer, which is responsible for keeping them. Ledgeforge keeps only its own invoices to the Customer, payments received and the audit log, for the period the law requires. [ATTORNEY: confirm that backup copies awaiting expiry need not be searched for a PAIA request.]
7. How to make a request (s53)
- Use the prescribed form (Form 2 of the PAIA Regulations, 2021) and send it to the Information Officer.
- Give enough detail to identify the record and the requester, the form of access wanted, and the right the record is needed to exercise or protect.
- Prescribed fees: request fee [R], access fees per page or per hour of search and preparation as prescribed. [ATTORNEY: confirm current amounts.]
- Time to decide: 30 days, extendable once by up to 30 days with notice.
- Grounds for refusal: as in PAIA Part 3 Chapter 4, including protection of third parties' personal information (s63), commercial information of third parties (s64), confidential information (s65), safety and security of systems (s66 and s68 for our own commercial and security information).
- Remedies: complaint to the Information Regulator, or an application to court, within 180 days.
8. Processing of personal information (POPIA s51 additions)
8.1 Purposes of processing. As in Privacy Notice section 4.
8.2 Categories of data subjects and their information. Users; customer contacts; website visitors and prospects; suppliers' contacts; pilot participants; and, as operator, Customers' clients, suppliers and staff.
8.3 Recipients. The sub-processors in the Operator Terms, Schedule 1; SARS and other authorities when the law requires.
8.4 Planned cross-border transfers. As in Privacy Notice section 5.
8.5 Security measures. General description, as in the Security Statement.
9. Objections, correction and deletion (POPIA)
Forms 1 (objection) and 2 (correction or deletion) of the POPIA Regulations, 2018, sent to the Information Officer. [ATTORNEY: confirm forms.]
10. Availability and updates
This manual is reviewed at least once a year and whenever the business or the products change materially.