PAIA manual
Published in terms of section 51 of the Promotion of Access to Information Act 2 of 2000, and including the information required by section 51(1)(c) as amended by POPIA.
1. Purpose of this manual
The Promotion of Access to Information Act gives effect to the constitutional right of access to information held by another person where that information is required for the exercise or protection of any right. This manual tells you what records I-Sixty Group holds, and how to ask for one.
It is a real document rather than a formality: if you need something we hold in order to protect a right of yours, this is the route, and we would rather give it to you than be asked for it twice.
2. Contact details
- Private body
- I-Sixty Group, trading as Tenvar
- Registration number
- 2005/033769/07
- Head of the body / Information Officer
- Available on request
- Physical address
- 26 Pretorius Avenue, Lyttelton Manor, Centurion, 0157
- Postal address
- Available on request
- Telephone
- Available on request
- support@tenvar.co.za
- Website
- https://tenvar.co.za
3. The Information Regulator's guide
The Regulator has published a guide, in terms of section 10 of PAIA, on how to use the Act. It is available from the Information Regulator (South Africa) at https://inforegulator.org.za, or by contacting them at PAIAComplaints@inforegulator.org.za.
JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001.
4. Records available without a formal request
These are published and need no request at all:
- Our company and contact details — contact page
- What the product does and what it costs — home page
- The terms on which it is supplied — terms of service
- What personal information we process — privacy policy
- Cookies and tracking — cookies page
- Our security posture — security page
- This manual
No notice has been published under section 52(2) of PAIA making other categories of record automatically available.
5. Records available under other legislation
Records may also be accessible in terms of, among others, the Companies Act 71 of 2008, the Income Tax Act 58 of 1962, the Value-Added Tax Act 89 of 1991, the Basic Conditions of Employment Act 75 of 1997, the Labour Relations Act 66 of 1995 and POPIA. Access under those Acts follows their own procedures rather than this manual.
6. Records we hold
| Subject | Categories of record |
|---|---|
| Company | Founding documents, statutory registers, minutes, insurance, licences. |
| Financial | Annual financial statements, ledgers, invoices, bank records, tax and VAT returns. |
| Customers | Subscription agreements, correspondence, support records, billing, and the customer data held in the application on their behalf. |
| Employees | Contracts of employment, payroll and leave records, disciplinary records, POPIA and health-and-safety records. |
| Suppliers | Agreements, invoices and correspondence with our own service providers. |
| Information technology | System documentation, access logs, backup records, and records relating to security incidents. |
Customer data held in the application is not ours to give away. Where a record belongs to a customer — his sites, his costs, his employees' details — we hold it as an operator on his instruction. A request for it will normally be referred to that customer as the responsible party, and we will tell you that we have done so.
7. How to request a record
- Complete Form 2 of the PAIA Regulations (the prescribed request form for a private body), available from https://inforegulator.org.za.
- Send it to the Information Officer at the address or email in section 2, with enough detail to identify the record and to identify you.
- State the right you are seeking to exercise or protect, and why the record is required for it. This is a requirement of the Act, and a request that omits it will be refused.
- Say how you would like the record, and in what language.
- Pay the request fee if one applies (see below).
We will decide within 30 days and tell you in writing. That period may be extended by a further 30 days where the Act allows, and we will tell you if it is.
Access may be refused on the grounds set out in Chapter 4 of PAIA — among them another person's privacy, someone's commercial information, information given in confidence, and records prepared for litigation. If we refuse, we will give the reason and the section relied on.
If you are unhappy with the outcome you may lodge a complaint with the Information Regulator, or apply to a court. There is no internal appeal against the decision of a private body.
8. Fees
The request fee, access fee, and the fees for reproduction, search and preparation are those prescribed in the PAIA Regulations. We charge no more than the prescribed amounts, and because those amounts are set by regulation and change from time to time, they are not reproduced here — we will quote you the exact fee in writing before doing any work, and you may withdraw the request rather than pay it.
A requester asking for a record about themselves pays no request fee.
9. Processing of personal information
Required by section 51(1)(c) of PAIA as amended. The full account is in the privacy policy; the summary the Act asks for is:
Purposes of processing
To provide and support the Tenvar service, to bill for it, to employ our own staff, and to meet our legal, accounting and tax obligations.
Categories of data subjects, and the information relating to them
- Our customers' employees — name, username, role, hourly rate, employment start date, hours worked, leave, cash advances, and photographs of documents they capture.
- Our customers' contacts — name, business email, telephone number.
- Suppliers of our customers — business name, contact name, email, telephone.
- Our own employees and suppliers — ordinary employment and account records.
- Enquirers — whatever you put in an email to us.
Recipients
- Railway — Application hosting and the PostgreSQL database that holds all of your data.
- Railway object storage (Tigris Data) — Stores the photographs of delivery notes and fuel slips captured on site.
- Anthropic — Reads a photographed delivery note or fuel slip and proposes the figures on it, so the person on site does not have to type them. Optional — it can be switched off, and the app works without it.
- IntelliDesk — The support widget on the office screens. It renders a "Help" button and a ticket form; a ticket only reaches IntelliDesk when somebody fills it in and submits it. The widget does ask IntelliDesk for its own configuration when an office page loads, so they see the request even when no ticket is raised.
- Twilio SendGrid — Sends purchase orders to your suppliers and the weekly digest to you.
- Our professional advisors, and any authority to which disclosure is required by law.
Cross-border transfers
Personal information is transferred outside the Republic to the recipients listed above, in terms of section 72 of POPIA, on the basis that each is bound by terms requiring a level of protection substantially similar to POPIA's conditions for lawful processing. The transfers, and what is in them, are described in the privacy policy.
Security safeguards
Described in full on the security page: transport encryption, Argon2 password hashing, encryption of sensitive fields at rest, role-separated access, schema validation of all input, rate-limited authentication, an append-only financial ledger, and platform-managed backups.
10. Availability of this manual
This manual is available on this website, at our physical address on request during business hours, and by email from the Information Officer. It will be updated whenever it is materially out of date; the date at the top of this page shows when it last changed.