This manual is published in terms of section 51 of PAIA, as amended by POPIA. It explains what records Bitlogiq holds, how to request access to them, and how personal information is processed. Our Privacy Policy gives more detail on how we handle personal information. Complete the bracketed company and contact fields before publishing.
1. Purpose of this manual
This manual helps you to:
- understand what categories of records we hold;
- request access to a record we hold, in terms of PAIA;
- understand how and why we process personal information, as required by POPIA; and
- exercise your rights to access, correct, delete or object to the processing of your personal information.
2. Company details
| Detail | Information |
|---|---|
| Name | [Company Name] (Pty) Ltd, trading as Bitlogiq |
| Registration number | [Registration Number] |
| Head of the private body | [Director Names] |
| Physical address | [Physical Address] |
| Postal address | [Postal Address] |
| Telephone | +27 66 366 8490 |
| info@bitlogiq.co.za | |
| Website | https://www.bitlogiq.co.za |
3. Information Officer
All requests in terms of PAIA and POPIA must be sent to our Information Officer.
| Detail | Information |
|---|---|
| Information Officer | [Information Officer] |
| Deputy Information Officer | [Deputy Information Officer, if any] |
| info@bitlogiq.co.za (subject line: “PAIA request” or “POPIA request”) | |
| Telephone | +27 66 366 8490 |
| Physical address | [Physical Address] |
4. The Information Regulator’s guide
The Information Regulator has published a guide on how to use PAIA and POPIA, as required by section 10 of PAIA. It is available in all official languages on the Regulator’s website and from our Information Officer on request.
| Information Regulator (South Africa) | Details |
|---|---|
| Website | inforegulator.org.za ↗ |
| General enquiries | enquiries@inforegulator.org.za |
| POPIA complaints | POPIAComplaints@inforegulator.org.za |
| Telephone | 0800 017 160 (toll-free) or 010 023 5200 |
5. Records available without a request
The following records are available without a formal PAIA request (section 52 of PAIA):
- Our Terms and Conditions, Privacy Policy, and Refund and Cancellation Policy, on our website.
- Information about our products, services and pricing, on our website.
- This manual, on our website and at our office.
6. Records kept in terms of legislation
We keep records as required by the following laws, among others. Access to them is subject to the conditions in those laws and in PAIA.
| Legislation | Examples of records |
|---|---|
| Companies Act 71 of 2008 | Memorandum of Incorporation, share register, director and shareholder records, minutes |
| Income Tax Act 58 of 1962 | Tax returns and supporting records |
| Value-Added Tax Act 89 of 1991 | VAT invoices and returns |
| Tax Administration Act 28 of 2011 | Accounting and tax records |
| Basic Conditions of Employment Act 75 of 1997 | Employee records, time and remuneration records |
| Labour Relations Act 66 of 1995 | Disciplinary and dispute records |
| Employment Equity Act 55 of 1998 | Employment equity records, where applicable |
| Unemployment Insurance Act 63 of 2001 | UIF records |
| Compensation for Occupational Injuries and Diseases Act 130 of 1993 | Injury and incident records |
| Skills Development Levies Act 9 of 1999 | Skills levy records |
| Consumer Protection Act 68 of 2008 | Customer agreements and complaint records |
| Electronic Communications and Transactions Act 25 of 2002 | Records of electronic transactions |
| Protection of Personal Information Act 4 of 2013 | Records of processing, consents and data subject requests |
7. Categories of records we hold
| Subject | Categories of records |
|---|---|
| Company and governance | Incorporation documents, statutory registers, resolutions, minutes, shareholder records |
| Finance and tax | Financial statements, ledgers, invoices, bank statements, tax and VAT records, budgets |
| Customers | Customer accounts, agreements, orders, invoices, support tickets, correspondence, domain registration records |
| Suppliers and partners | Supplier agreements, invoices, operator agreements, correspondence |
| Staff and contractors | Employment and contractor agreements, payroll, leave, performance and disciplinary records |
| Information technology | System and security logs, backups, infrastructure records, software licences, incident records |
| Sales and marketing | Prospect enquiries, marketing consents and opt-outs, website analytics, campaign records |
| Legal and compliance | Contracts, legal opinions, litigation records, POPIA and PAIA records, insurance policies |
| Intellectual property | Source code, software documentation, trademarks, designs |
Listing a category does not mean a record will be released. Each request is decided in terms of PAIA.
8. Processing of personal information (POPIA)
8.1 Purposes of processing
We process personal information to:
- provide our SaaS, hosting, domain, digital product and professional services;
- set up and manage customer accounts, and bill and collect payments;
- provide support and communicate with customers and prospects;
- keep our systems and data secure, and prevent fraud and abuse;
- recruit, employ and manage staff and contractors;
- manage suppliers and operators;
- send marketing, where permitted by section 69 of POPIA; and
- comply with legal, tax and regulatory obligations.
8.2 Categories of data subjects and their information
| Data subject | Personal information processed |
|---|---|
| Customers and their authorised users | Name, contact details, company details, account and login details, billing and payment records, communications, usage and technical data, domain registrant details |
| Prospective customers and website visitors | Name, contact details, enquiry content, IP address, cookie and analytics data, marketing preferences |
| Staff and job applicants | Name, ID number, contact details, qualifications, employment history, banking details, tax number, remuneration, leave and performance records, and special personal information only where required by law |
| Contractors, suppliers and operators | Name, contact details, company details, banking details, VAT number, agreements and correspondence |
8.3 Recipients of personal information
We may share personal information with:
- operators who provide cloud hosting, payment processing ([Payment Provider]), email, accounting, customer support and analytics services;
- domain registries and registrars, such as the ZA Central Registry and ICANN-accredited registrars;
- professional advisers, such as auditors, accountants and attorneys;
- SARS, the Information Regulator, courts and law enforcement, where the law requires it; and
- a buyer or successor of our business, under confidentiality.
8.4 Cross-border transfers
Some of our operators and infrastructure in [Hosting Locations] may be outside South Africa. We transfer personal information outside South Africa only as permitted by section 72 of POPIA, for example where the recipient is bound by a law, binding corporate rules or a written agreement giving protection substantially similar to POPIA.
8.5 Security measures
We protect personal information with appropriate, reasonable technical and organisational measures, as required by section 19 of POPIA. These include:
- encryption of data in transit, and at rest where appropriate;
- access controls based on job need, and multi-factor authentication for staff;
- firewalls, malware protection, and regular updates and patching;
- monitoring and logging of access to systems;
- regular backups;
- written confidentiality and data protection terms with staff and operators; and
- an incident response process, including notifying the Information Regulator and affected data subjects of security compromises under section 22 of POPIA.
9. How to request access to a record (PAIA)
- Complete the prescribed request form (Form 2 of the PAIA Regulations, available from the Information Regulator’s website or our Information Officer).
- Send it to our Information Officer by email or by hand at our physical address.
- Provide proof of identity and, if you act for someone else, proof of your authority.
- Describe the record in enough detail for us to find it, and state the form of access you want.
- If you need the record to exercise or protect a right, say which right and why the record is needed (section 53 of PAIA).
- Pay the request fee and any access fee, as prescribed in the PAIA Regulations. We will tell you if a deposit or access fee applies before we process the record.
We will decide on your request within 30 days of receiving it. This may be extended once by up to 30 days in the circumstances allowed by section 57 of PAIA, in which case we will notify you.
10. Grounds for refusing access
We may or must refuse access to a record on the grounds set out in Chapter 4 of Part 3 of PAIA (sections 62 to 70). These include protecting:
- the privacy of a third party who is a natural person;
- commercial information of a third party or of Bitlogiq, such as trade secrets, source code and financial information;
- confidential information of a third party;
- the safety of individuals and the protection of property;
- records privileged from production in legal proceedings; and
- research information of a third party or of Bitlogiq.
If we refuse access, we will give reasons and tell you about your remedies.
11. Remedies
Bitlogiq is a private body and has no internal appeal procedure. If you are not satisfied with our decision, you may, within 180 days of being notified of it:
- lodge a complaint with the Information Regulator (section 77A of PAIA); or
- apply to a court for appropriate relief (section 78 of PAIA).
12. Your POPIA rights
You may ask our Information Officer to:
- confirm whether we hold your personal information and give you a copy of it (section 23 of POPIA);
- correct or delete personal information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or unlawfully obtained, using Form 2 of the POPIA Regulations (section 24); and
- stop processing your personal information where you object to it, using Form 1 of the POPIA Regulations (section 11(3)).
You may also withdraw consent at any time, opt out of direct marketing, and lodge a complaint with the Information Regulator. We will verify your identity before acting and respond within 30 days.
13. Availability and updates
This manual is available on our website and at our office during business hours, free of charge. We review it at least once a year and whenever our processing changes materially.