PAIA Manual

This is the manual of VERIFYMZANSI (PTY) LTD, a private body, under section 51 of the Promotion of Access to Information Act 2 of 2000 (PAIA), as amended by the Protection of Personal Information Act 4 of 2013 (POPIA).

It explains what records we hold, which records are available without a request, how we process personal information, and how to ask for access to a record.

The manual is published on this page and is available for inspection at our registered address, free of charge. You may print it or save it as a PDF from your browser.

The Information Regulator publishes a guide, in each official language, on how to use PAIA and POPIA (section 10 of PAIA). You can get it from the Information Regulator's website, inforegulator.org.za, or by email to enquiries@inforegulator.org.za. A copy is also available from our Information Officer on request.

The following are freely available on verifymzansi.com, without a PAIA request:

• Terms of Service, Privacy Policy and this manual
• Trust & Safety, Safety Centre and help pages, including what our verification checks mean
• Plan prices and billing rules on the pricing page
• Public posts, business profiles and the stickers they hold

No notice has been published under section 52 of PAIA.

Where they apply to us, we keep records under these laws, among others:

• Companies Act 71 of 2008
• Income Tax Act 58 of 1962, Value-Added Tax Act 89 of 1991 and Tax Administration Act 28 of 2011
• Basic Conditions of Employment Act 75 of 1997, Labour Relations Act 66 of 1995, Unemployment Insurance Act 63 of 2001 and Compensation for Occupational Injuries and Diseases Act 130 of 1993
• Consumer Protection Act 68 of 2008
• Electronic Communications and Transactions Act 25 of 2002
• Protection of Personal Information Act 4 of 2013 and Promotion of Access to Information Act 2 of 2000

• Company: incorporation documents, CIPC records, share register, minutes and resolutions
• Finance and tax: accounting records, invoices, payment records from Ozow, tax returns and correspondence with SARS
• People who work with us: contracts, payroll and statutory records, where applicable
• Members: account details, verification records (phone confirmation, ID and selfie review decisions), posts, media, enquiries, plans bought, reports, moderation and appeal records
• Businesses: business profiles, CIPC registered and Seen by VerifyMzansi verification cases, decisions and correspondence
• Suppliers and partners: contracts, Business Sponsor agreements and correspondence
• Technology and security: system, audit and access logs, and incident records

Purposes: to run accounts and verification, publish posts and pass on enquiries, take payment for plans, prevent fraud and abuse, provide support, keep legal, tax and accounting records, and keep the platform secure.

Categories of data subjects and their information:

• Members: name, email, phone, SA ID or passport number and images, selfie, province and city, posts, media, enquiries, payment references and device data
• Business owners and representatives: the above, plus company details, director or representative status and verification notes or visit photos
• Visitors: device and browser data, a random browser identifier and a hashed network address used for view counting
• People who send enquiries: name, contact details and message
• Employees, contractors, suppliers and partners: contact, contract and payment details

Recipients: our own staff on a need-to-know basis, and operators who process information for us: Supabase (database, sign-in and file storage), Cloudflare (hosting, security and bot protection), Resend (email), Africa's Talking (SMS codes), Sentry (error monitoring) and Ozow (payments). We also disclose information where the law requires it.

Cross-border transfers: some of these operators store or process information outside South Africa. We only use operators bound by agreements that give a level of protection substantially similar to POPIA, as section 72 of POPIA requires.

Security: encryption in transit, encryption of ID numbers at rest, restricted and logged access to verification files, private storage that is never public, deletion schedules for ID, selfie and business verification files, and audit logs.

Retention periods are set out in our Privacy Policy.

Use Form 2 (Request for Access to Record), which you can download from the Information Regulator's website, and send it to privacy@verifymzansi.com. Give enough detail for us to identify the record, say how you want access (copy, inspection or electronic), and, if you ask on behalf of someone else, include proof of your authority. To exercise a PAIA right that protects you, explain which right and why the record is needed.

For your own personal information, signed-in members can also use the data-subject request form for access, correction, deletion, objection, export and recipient-information requests.

Fees: requests for your own personal information are free. For other records, the request and access fees prescribed in the PAIA Regulations apply. We will tell you the amount in writing before any work starts, and you may ask the Information Regulator to review a fee.

1. 1

   Send your request

   By email, or the signed-in form.

2. 2

   We confirm who you are

   We may ask for proof of identity.

3. 3

   We decide within 30 days

   We may extend once by up to 30 days, in writing.

We acknowledge requests within 2 business days where possible, and decide within 30 days (section 56 of PAIA). We may extend this once by up to 30 days, and will tell you why in writing (section 57). If we do not decide in time, the request is treated as refused (section 58).

We may refuse access only on the grounds in Chapter 4 of Part 3 of PAIA, for example to protect another person's privacy, commercial information, confidential information, safety or legally privileged records. If we refuse, we give reasons.

If you are unhappy with our decision, you may complain to the Information Regulator South Africa within 180 days (section 77A), or apply to court (section 78).

Our Information Officer is registered with the Information Regulator.