PAIA Manual

1. What is this manual for?

This manual is published under section 51 of the Promotion of Access to Information Act 2 of 2000 (PAIA), as amended by the Protection of Personal Information Act 4 of 2013 (POPIA). It explains which records we hold, how to request access to them, the fees that apply, and how we process personal information.

2. Who are we and how do you contact us?

• Private body: EM Mgiba Investments (Pty) Ltd, trading as Three One Solutions
• Registration number: 2015/256789/07
• Head of the private body and Information Officer: Elleck Madubula Mgiba, Director
• Physical address: 1st Floor, 292 Surrey Avenue, Ferndale, Randburg, 2194
• Postal address: as above
• Telephone: 010 017 4571
• Email: support@threeonesolutions.com
• Website: threeonesolutions.com

3. Where can you find the Information Regulator’s PAIA Guide?

The Information Regulator publishes a Guide on how to use PAIA and POPIA (section 10 of PAIA), in every official language. Download it at inforegulator.org.za, request it from the Regulator on Form 1, or ask our Information Officer for a copy. Information Regulator: Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191. Email enquiries@inforegulator.org.za, phone 010 023 5200, toll-free 0800 017 160.

4. Which records are available without a request?

Everything published on threeonesolutions.com, including our service descriptions, articles, wage schedules, terms and conditions, and privacy policy, is available without a PAIA request. We have not published a notice under section 52 of PAIA.

5. Which records do we keep under other laws?

We keep records as required by, among others:

• Companies Act 71 of 2008
• Tax Administration Act 28 of 2011, Income Tax Act 58 of 1962 and Value-Added Tax Act 89 of 1991
• Broad-Based Black Economic Empowerment Act 53 of 2003
• Electronic Communications and Transactions Act 25 of 2002
• Consumer Protection Act 68 of 2008
• Protection of Personal Information Act 4 of 2013

6. Which categories of records do we hold?

• Company records: incorporation documents, share register, director records, minutes and resolutions, B-BBEE certificates.
• Financial and tax records: annual financial statements, accounting records, invoices, quotes, bank statements, tax and VAT returns.
• Client records: engagement letters, audit and assessment reports, workshop and masterclass registrations, correspondence and compliance working papers.
• Marketing records: enquiry and lead records, newsletter subscriptions, consent and opt-out records, email delivery logs.
• Supplier and operator records: contracts and service agreements with service providers.
• Website records: website content, analytics data and security logs.
• Contractor records: contractor agreements, invoices and payment records. We currently have no employees.

7. How do you request access to a record?

1. Complete Form 2: Request for Access to Record (Regulation 7). Describe the record clearly, state the form of access you want, and explain which right you want to exercise or protect.
2. Email the form to the Information Officer at support@threeonesolutions.com, or deliver it to our physical address.
3. Pay the request fee (see section 8). If you ask for your own personal information, no request fee applies.
4. We will tell you our decision on Form 3 within 30 days. We may extend this once by up to 30 days, and we will tell you why.

We may refuse access only on the grounds in Chapter 4 of Part 3 of PAIA, for example to protect another person's privacy, commercial information of a third party, confidential information, or legally privileged records. If we refuse, we will give reasons. PAIA has no internal appeal for private bodies. You may lodge a complaint with the Information Regulator on Form 5 within 180 days, or apply to court.

8. What fees apply?

Fees follow the Information Regulator's schedule for private bodies (PAIA Regulations, 2021):

• Request fee: R140.00 (not payable for a request for your own personal information).
• Photocopy or printed A4 page: R2.00 per page.
• Copy on a flash drive or CD you provide: R40.00. On a CD we provide: R60.00.
• Transcription of an audio record: R24.00 per A4 page.
• Search and preparation: R145.00 per hour after the first hour, capped at R435.00.
• Deposit: one third of the access fee if the search will take more than 6 hours.

The current schedule is at inforegulator.org.za. If it changes, the Regulator's schedule applies.

9. How do we process personal information?

As section 51(1)(c) of PAIA requires, this section summarises our processing. Our Privacy Policy has the full detail.

• Purposes: answering enquiries, running compliance assessments, delivering audits, workshops, masterclasses and compliance packages, invoicing, direct marketing with consent, website security and analytics, and meeting legal duties.
• Data subjects and information: prospective and existing clients and their staff (names, contact details, business details, assessment answers, transaction records); motor industry employees who use our employee assessment (contact details and answers); subscribers (contact details and consent records); website visitors (usage data); suppliers and contractors (business and banking details); motor industry businesses whose contact details are published in online directories and search results (business name, contact person and business contact details).
• Recipients: our service providers (operators): Supabase, Vercel, Amazon Web Services, Resend, PayFast, Cal.com, Google, Meta (WhatsApp) and Skool. We also disclose information to regulators, SARS and courts when the law requires it.
• Cross-border transfers: several operators process data outside South Africa, mainly in the United States and the European Union. We rely on contract terms or laws that give protection substantially similar to POPIA (section 72).
• Security: encrypted connections, database access controls, a password-protected owner dashboard, authenticated email domains, bot protection on forms, and breach notification under section 22 of POPIA.

10. How do you object to processing or ask for a correction?

To object to processing, including direct marketing, use Form 1 of the POPIA Regulations. To ask us to correct or delete your information, use Form 2 of the POPIA Regulations. Both are available at inforegulator.org.za. Email them to support@threeonesolutions.com. You can also unsubscribe from marketing email with the link in any email.

11. Where is this manual available?

This manual is published at threeonesolutions.com/paia-manual and is available free of charge at our physical address during business hours. We review it at least once a year.