PAIA manual

This manual is published under section 51 of the Promotion of Access to Information Act 2 of 2000 (PAIA), as amended by the Protection of Personal Information Act 4 of 2013 (POPIA). It covers Xee Holdings (Pty) Ltd, which makes Indably.

1. The company

2. Information Officer

Xien Singh, Director. privacy@indably.com, at the address above.

3. The Information Regulator's guide

The Information Regulator publishes a guide on how to use PAIA, in each official language. It's available from the Regulator at inforegulator.org.za, or by email from enquiries@inforegulator.org.za.

4. Records available without a request

The content of indably.com, including our privacy notice, terms, refunds and cancellation, sub-processors and this manual.

5. Records we keep, available on request

• Company: incorporation documents, the share register, directors' resolutions and minutes (Companies Act 71 of 2008).
• Financial and tax: annual financial statements, accounting records, invoices, VAT and income tax records (Income Tax Act 58 of 1962, Value-Added Tax Act 89 of 1991, Tax Administration Act 28 of 2011).
• Customers: account and billing records, invoices, the settings and content of each account, its activity log, and correspondence.
• Suppliers: agreements and correspondence.
• Product and security: system logs, security records and policies.
• Personnel: contracts and records required by the Basic Conditions of Employment Act 75 of 1997 and related laws.

Being listed here doesn't mean a record will be given: PAIA's grounds for refusal (for example, another person's privacy, or commercial confidentiality) still apply.

6. Personal information we process (POPIA)

• Purpose: to provide Indably (publishing, approvals, reports and ads for our customers' own accounts), to bill for it, to support customers and keep the service secure, and to meet legal duties.
• People and information: customers' users (names, email addresses, sign-in details, and for those who choose it, a WhatsApp number); billing contacts (company name, VAT number, address); the accounts customers connect (names, handles, encrypted sign-in tokens, and aggregate post numbers); website visitors (counted without cookies, as described in the privacy notice).
• Who receives it: the organisations on our sub-processors page, the networks customers publish to, and authorities where the law requires.
• Across borders: some sub-processors and networks are outside South Africa (see the sub-processors page). We send them only what's needed, under terms that protect it as POPIA requires.
• Security: network sign-ins encrypted at rest, passkeys or authenticator apps for every user, roles per brand, an activity log, hosting in South Africa, and security testing by Xee Security.

7. How to ask for a record

1. Use Form 2 (Request for Access to a Record of a Private Body) from the PAIA regulations, available from the Information Regulator.
2. Send it to the Information Officer at privacy@indably.com or by post to the address above, with proof of identity, enough detail to find the record, the right you want to protect or exercise, and how you'd like to be answered.
3. A request fee and access fees may apply, as set in the PAIA regulations. We'll tell you what they are before any work starts. People asking for their own personal information don't pay a request fee.
4. We decide within 30 days, which PAIA allows us to extend by up to 30 more days, and we'll tell you if we need to.

If we refuse, we'll give you the reasons. You can complain to the Information Regulator, or apply to court.

8. Availability

This manual is on indably.com/paia and available at our address during office hours.