PAIA Manual

This manual is prepared in terms of section 51 of the Promotion of Access to Information Act 2 of 2000, as amended, and follows the template published by the Information Regulator for private bodies.

1. List of acronyms and abbreviations

2. Purpose of this PAIA manual

This manual allows any member of the public to:

• see which categories of records the BnB makes available without a formal request;
• understand how to make a request for access to a record, by describing the subjects on which the BnB holds records and the categories of records held on each subject;
• see which records are available in terms of other legislation;
• find the contact details of the Information Officer;
• learn about the Guide published by the Regulator and how to obtain it;
• understand whether and why the BnB processes personal information, and the categories of data subjects and information concerned;
• see to whom personal information may be supplied;
• see whether personal information is transferred outside the Republic; and
• see whether appropriate security measures protect that personal information.

3. Key contact details

Information Officer

Under section 56 of POPIA the Information Officer of a private body is the head of that body.

Deputy Information Officer

No Deputy Information Officer has been designated. Section 17(1) of PAIA, read with section 56 of POPIA, requires such number of deputies "if any" as is necessary; given the size of the BnB the Information Officer performs these duties personally. This manual will be updated if a deputy is appointed.

General contact for access to information

4. The Guide on how to use PAIA, and how to obtain it

The Regulator has, in terms of section 10(1) of PAIA, compiled and made available a Guide to assist any person who wishes to exercise a right under PAIA or POPIA. The Guide is available in each of the official languages and in braille.

The Guide describes, among other things, the objects of PAIA and POPIA, the contact details of information officers, the manner and form of a request for access to a record of a public body under section 11 and of a private body under section 50, the assistance available from the Regulator, the remedies available in law including internal appeals, complaints to the Regulator and applications to court, the obligation on private bodies under section 51 to compile this manual, the voluntary disclosure of records under section 52, the fees payable under section 54, and the regulations made under section 92.

The Guide may be obtained:

• from the Regulator's website at inforegulator.org.za;
• by request to the Information Officer of the BnB at ladyndish@gmail.com; and
• by inspection at the BnB's premises at 234A Steve Biko Street, Gugulethu, Cape Town, 7750, South Africa during normal business hours.

Making a request for access to a record

• A request must be made on the form prescribed by the regulations made under PAIA, and sent to the Information Officer at ladyndish@gmail.com or delivered to 234A Steve Biko Street, Gugulethu, Cape Town, 7750, South Africa.
• Under section 50(1) of PAIA a requester must be given access to a record of a private body if the record is required for the exercise or protection of any right, the procedural requirements have been met, and no ground of refusal in Chapter 4 applies. Please state clearly which right you are exercising or protecting.
• A request fee and an access fee may be payable, as prescribed in Annexure B of the regulations. The Information Officer will notify you of any fee before the request is processed further.
• The Information Officer will respond within 30 days, which may be extended in the circumstances PAIA allows.
• If a request is refused, reasons will be given, together with the remedies available to you, including a complaint to the Regulator or an application to court.

5. Records available without a request

The following are published on the BnB's website and may be read, printed or requested at no charge.

6. Records available in terms of other legislation

7. Subjects on which records are held, and the categories of records

8. Processing of personal information

8.1 Purpose of processing

The BnB processes personal information in order to:

• receive, confirm and manage accommodation bookings;
• communicate with guests about their stay, including confirmations and directions;
• receive payment, issue receipts and process refunds;
• arrange metered taxi transport when a guest asks for it;
• answer enquiries;
• publish guest reviews with the reviewer's agreement;
• keep the accounting and tax records required by law; and
• keep guests, staff and the property safe.

The BnB does not process personal information for advertising, profiling or automated decision-making.

8.2 Categories of data subjects and the information processed

8.3 Recipients of personal information

The BnB does not sell personal information and does not supply it to any third party for that party's own marketing.

8.4 Planned transborder flows of personal information

Guest records are stored on systems located in the Republic. The BnB has no planned bulk transfer of guest records outside the Republic. Certain supporting services do, however, process limited personal information outside it:

Where information does leave the Republic, the BnB relies on recipients subject to laws or binding agreements affording protection substantially similar to POPIA, and limits what is sent to the minimum required. A guest who objects to their details passing through the WhatsApp relay may ask for the booking to be taken by telephone instead.

8.5 Information security measures

The BnB has implemented, and continues to maintain, the following safeguards to protect the confidentiality, integrity and availability of personal information:

• administrator passwords are stored only as one-way cryptographic hashes and never in a readable form;
• repeated failed login attempts temporarily lock the administrator login;
• all database access uses parameterised queries, protecting against injection attacks;
• every form carries a token that prevents forged cross-site submissions;
• uploaded files are validated by their actual content rather than their file name, and the folder they are stored in cannot execute programs;
• configuration files, logs and guest documents are not reachable from the public internet;
• card details are never received or stored by the BnB; card payments are processed entirely by PayFast, which is PCI-DSS compliant;
• access to guest records is limited to the Information Officer and authorised staff; and
• records are retained only for as long as they are needed or as the law requires, and are then deleted.

9. Availability of this manual

A copy of this manual is available:

• on the BnB's website at https://nxubaguesthouse.co.za/paia-manual.php;
• at 234A Steve Biko Street, Gugulethu, Cape Town, 7750, South Africa, for public inspection during normal business hours;
• to any person on request, on payment of the reasonable fee prescribed in Annexure B of the regulations for each A4 photocopy; and
• to the Information Regulator on request.

10. Updating of this manual

The head of the BnB will update this manual on a regular basis, and whenever the information in it changes materially. The date of the most recent revision appears at the top of this page.

Issued by

Prof AB Stuurman Ka Nxuba Guest House
Head of Professor AB Stuurman Ka Nxuba Guest House and Information Officer
234A Steve Biko Street, Gugulethu, Cape Town, 7750, South Africa