PAIA Manual

This manual is published by Lenucs Pty Ltd, a private body, under section 51 of the Promotion of Access to Information Act, 2000 (PAIA). It explains what records we hold and how to ask for access to them. It also covers access to personal information under section 23 of the Protection of Personal Information Act, 2013 (POPIA).

Information Officer: To be published. Deputy Information Officer: To be published. Requests can be sent to the Information Officer through our contact form (choose “Privacy”).

The Information Regulator publishes a guide on how to use PAIA and POPIA, in all official languages. It is available from the Regulator at inforegulator.org.za, and a copy can be requested from our Information Officer.

Lenucs holds the following categories of records:

• Company records: incorporation documents, registers, resolutions and shareholder records.
• Financial and tax records: accounting records, invoices, payment records and tax returns.
• Personnel records: employment contracts, payroll records and staff policies.
• Customer and account records: accounts, workspaces, plans, support enquiries, privacy requests, Terms and Privacy acceptance records and marketing preferences.
• Customer Data processed for customers: CRM records, form responses, product links, orders and bookings. Requests for these are usually best directed to the business concerned, which controls them.
• Operational and security records: staff audit logs, security incident records, service configuration and source code.
• Supplier records: agreements with service providers.

These are available on our website without a PAIA request: the Legal Center documents (Terms, Privacy Policy and the other policies), our Subprocessors list, our pricing and our company information. No notice under section 52 of PAIA has been published yet.

We keep records as required by laws including the Companies Act, 2008; the Tax Administration Act, 2011; the Income Tax Act, 1962; the Value-Added Tax Act, 1991 (if registered); the Basic Conditions of Employment Act, 1997; the Labour Relations Act, 1995; the Electronic Communications and Transactions Act, 2002; the Consumer Protection Act, 2008; and POPIA.

• Purposes: as set out in our Privacy Policy, including providing Lenucs Console, security, support, billing and legal compliance.
• Categories of data subjects and information: users (identity and contact details, account data), customers’ contacts, leads, respondents and buyers (the information customers choose to collect), staff (employment information), and suppliers (contact and contract details).
• Recipients: our service providers listed on the Subprocessors page, the customers who own the data, and authorities where the law requires.
• Cross-border transfers: some providers process information outside South Africa, as described in the Privacy Policy.
• Security measures: described on our Security page.

1. Complete the prescribed request form, Form 2 under the PAIA Regulations, available from the Information Regulator. Give enough detail for us to identify the records, the form of access you want, and how you want to be contacted. If you request on behalf of someone else, include proof of your authority.
2. Send it to the Information Officer through our contact form (choose “Privacy”), or by hand or post to our physical address: York Road, Hill Crest, Mthatha, Eastern Cape, 5099.
3. Pay any prescribed request fee and, if access is granted, any prescribed access fee. Fees are set by the PAIA Regulations. People asking for their own personal information don’t pay the request fee.
4. We will decide within 30 days, which can be extended once by up to 30 days with notice. If access is refused, we will give reasons and tell you about your right to complain to the Information Regulator or apply to court.

Your own personal information: for access, correction or deletion of your own information you can also use the simpler privacy request form, or Profile → Privacy and data in Console. Requests to correct or delete information under POPIA use Form 2 of the POPIA Regulations if you prefer the formal route.

We may refuse access only on the grounds in Chapter 4 of Part 3 of PAIA, including to protect the privacy of third parties, commercial information of third parties or of Lenucs, confidential information, the safety of people and property, records privileged in legal proceedings, and research information. Where only part of a record is protected, we provide the rest.

We have no internal appeal procedure. If you are unhappy with our decision you can complain to the Information Regulator within 180 days, or apply to court.

This manual is available on our website and, on request, from the Information Officer. We review it at least once a year and update the version and dates at the top when it changes.