PAIA Manual

1. Introduction

This manual is prepared for the GeoLayers operator as a private body under section 51 of the Promotion of Access to Information Act 2 of 2000, as amended (PAIA). It should be read together with PAIA, POPIA and the Information Regulator's current PAIA Guide and prescribed forms.

2. Guide on how to use PAIA

The Information Regulator publishes a guide explaining how to exercise rights under PAIA, including request forms, fees, grounds for refusal and remedies. The guide and forms are available from the Information Regulator PAIA resources.

Information Regulator contact information currently published includes:

• Website: https://inforegulator.org.za/
• Email: enquiries@inforegulator.org.za
• Telephone: 010 023 5200
• Address: Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg

3. Records available without a formal PAIA request

Subject to website availability and applicable licences, the following categories are generally available without a formal PAIA request:

• public website pages and product descriptions;
• published legal policies and this PAIA Manual;
• public documentation and developer documentation;
• public blog posts, tutorials, case studies and release notes;
• public pricing information;
• public marketplace listings and licence information displayed on a product page; and
• public datasets or external data links expressly identified as publicly accessible.

Access to a public resource does not remove copyright, licence, confidentiality or acceptable-use restrictions.

4. Categories of records that may be held

Subject to the actual records in existence, GeoLayers may hold records in the following categories:

Corporate and legal

Formation or operator records, contracts, policies, legal correspondence, regulatory records, insurance information, intellectual-property records and agreements with suppliers or customers.

Financial and commercial

Invoices, quotations, transaction references, subscription records, accounting records, tax records, procurement documents, supplier records and organization agreements.

Customer and account

Account records, support requests, organization/workspace records, subscription records, service communications and relationship-management records.

Project and technical

Project metadata, user-uploaded project data, layer metadata, workflow definitions, system logs, audit records, snapshots, backups, API configuration, application documentation, source-code records, security documentation and infrastructure records.

Personnel and contractors

Where applicable: employment, contractor, payroll, performance, training, leave, disciplinary, recruitment and related records. Access may be restricted to protect personal information and confidential interests.

Intellectual property and product development

Software designs, source code, product roadmaps, specifications, algorithms, test records, brand assets, proprietary datasets, methods and internal documentation.

5. Records held in terms of other legislation

Where applicable, GeoLayers may hold records required by legislation relating to company or business administration, tax, employment, occupational health and safety, electronic transactions, consumer protection, intellectual property, cybercrime, POPIA and other laws relevant to the operator's actual legal form and activities.

This paragraph does not imply that every listed law applies to every GeoLayers activity.

6. Personal-information processing

Purposes

GeoLayers processes personal information to manage accounts, authentication, projects, collaboration, subscriptions, support, security, developer services, marketplace functions, analytics, legal compliance and communications as described in the Privacy Policy.

Categories of data subjects

Data subjects may include website visitors, registered users, prospective customers, customers, organization administrators, collaborators, suppliers, contractors, support contacts, developers, marketplace users and people whose information is lawfully included in customer-controlled project datasets.

Categories of personal information

These may include contact and identity information, account identifiers, organization roles, billing metadata, project/collaboration metadata, support communications, IP/device information, logs, analytics information and personal information contained in project data.

Recipients

Information may be disclosed to authorized GeoLayers personnel, the relevant customer or organization, contracted service providers/operators, professional advisers, regulators, courts or authorities where legally required, and third parties specifically authorized by the data subject or customer.

Cross-border flows

Cloud and technology providers may process information outside South Africa. GeoLayers seeks to handle cross-border transfers consistently with section 72 of POPIA as explained in the Privacy Policy.

Security measures

Safeguards may include encrypted transport, authentication, access controls, project permissions, restricted secret handling, logging, security monitoring, backups and recovery controls. Detailed security architecture may be withheld where disclosure would create a security risk.

7. How to request access to a record

A requester should use the current prescribed Form 02: Request for Access to Record available from the Information Regulator and submit it to the Information Officer using the contact details in this manual.

The request should identify:

• the requester and, where applicable, the person on whose behalf the request is made;
• the record or category of records requested with enough detail to locate it;
• the preferred form of access;
• a contact address or email;
• the right the requester seeks to exercise or protect, where PAIA requires this; and
• why access to the record is necessary for exercising or protecting that right.

GeoLayers may request proof of identity or authority to act for another person.

8. Fees

Prescribed request and access fees may be payable where PAIA permits them. If a fee applies, the requester will be informed in accordance with the Act and regulations. Any fee exemption or reduction provided by law remains applicable.

9. Decision and grounds for refusal

A request will be considered under PAIA. Access may be refused or limited where a mandatory or discretionary ground of refusal applies, including protection of third-party privacy, commercial confidentiality, safety or security, privileged material, research information, or other protected interests.

Where only part of a record is protected and the remainder can reasonably be severed, access may be provided to the non-protected part where required by PAIA.

10. Remedies

If a request is refused or not properly dealt with, the requester may have remedies under PAIA, including a complaint to the Information Regulator or an application to court, depending on the circumstances and applicable procedure.

11. Availability of this manual

This manual is available electronically at https://geolayers.co.za/paia.html. A copy can also be requested from info@geolayers.co.za. Where PAIA requires physical availability, the operator will make the manual available at the physical business address identified above.

12. Updates

This manual may be updated when the operator's legal details, records, processing activities, Information Officer, regulations or PAIA requirements change. The effective date identifies the current version.