PAIA Manual
Manual compiled in terms of section 51 of the Promotion of Access to Information Act, 2 of 2000 ("PAIA"), read together with the Protection of Personal Information Act, 4 of 2013 ("POPIA").
Last Updated: 12 June 2026 · Approved by: Head of the Body, IT Ex Gratia (Pty) Ltd
1. Introduction
This Manual is published by IT Ex Gratia (Pty) Ltd ("ITEX", "the Company", "we") in compliance with section 51 of PAIA. PAIA gives effect to the constitutional right of access to information held by another person where that information is required for the exercise or protection of any right. POPIA regulates how responsible parties process personal information and gives effect to the right to privacy.
Following the 2021 amendments to the PAIA Regulations, this Manual also serves as a transparency document describing how ITEX processes personal information. It explains the records ITEX holds, how to request access to those records, and the remedies available to a requester or data subject.
2. Particulars of the Company
3. Information Officer
In terms of PAIA and POPIA, the Head of the Body is the Information Officer of ITEX. The Information Officer is responsible for dealing with requests made under PAIA and for the Company's compliance with POPIA, and is registered with the Information Regulator as required by POPIA.
4. The Information Regulator's Guide on PAIA
In terms of section 10 of PAIA, the Information Regulator has compiled a Guide containing information reasonably required by a person who wishes to exercise any right under PAIA and POPIA. The Guide explains how to use the Acts and is available in each of the official languages.
The Guide may be obtained from the Information Regulator at the contact details set out below, or downloaded from https://inforegulator.org.za/paia/.
5. The Information Regulator (South Africa)
A requester or data subject may lodge a complaint with the Information Regulator. The Regulator's contact details are:
6. Records Available Without a Formal Request
The following categories of records are automatically available to the public without the need to submit a formal PAIA request:
- Information published on the ITEX website (www.itex.co.za)
- Marketing, brochure and service information made publicly available
- This PAIA Manual
- Public notices and press releases issued by ITEX
7. Records Available in Terms of Other Legislation
ITEX keeps records in accordance with, among others, the following legislation. Access to these records is governed by the relevant Act:
8. Subjects and Categories of Records Held
ITEX holds records in the following subject categories, subject to PAIA, POPIA, confidentiality obligations, and security controls:
Corporate & Governance
- Company incorporation and registration documents
- Governance and policy documentation
- Management and operational records
Client Records
- Client agreements and contracts
- Service level agreements
- Technical service records
- Support tickets and service logs
- Billing and invoicing records
Human Resources
- Employment contracts
- Personnel files
- Payroll and benefits records
- Leave and disciplinary records
- Training records
Financial Records
- Accounting records
- Financial statements
- Tax records
Supplier & Third-Party
- Supplier agreements
- Due diligence documentation
- Invoices and payment records
Information Technology
- System and access logs
- Security and monitoring records
- Backup and recovery documentation
9. Processing of Personal Information (POPIA)
In terms of the 2021 PAIA Regulations and POPIA, ITEX discloses the following about its processing of personal information. ITEX processes personal information lawfully, reasonably, and in a manner that does not infringe the privacy of data subjects.
Purpose of Processing
- Providing managed IT services, support, and related solutions to clients
- Managing client relationships, contracts, service delivery, and billing
- Recruitment, employment, payroll, and human-resource administration
- Supplier, contractor, and third-party management
- Complying with legal, regulatory, and contractual obligations
- Security monitoring, incident response, and protection of systems
- Marketing, communications, and website analytics
Categories of Data Subjects and Personal Information
- Employees and job applicants — identity, contact, qualifications, payroll, banking, and employment records
- Clients and their representatives — contact, account, and billing information
- Personal information processed on behalf of clients — as governed by the relevant service agreement
- Suppliers and service providers — contact and payment details
- Website visitors — technical data, cookies, and analytics information
Recipients of Personal Information
- Authorised ITEX employees and personnel
- Operators and sub-processors, including cloud and hosting service providers, engaged under written agreement
- Professional advisors such as auditors, accountants, and legal advisors
- Regulatory authorities, law-enforcement, and courts where required by law
- Banking and payment institutions for processing payments
Transborder Flows of Personal Information
Where personal information is hosted or processed outside the Republic of South Africa (for example, through cloud-based infrastructure), ITEX ensures, in accordance with section 72 of POPIA, that the recipient is subject to laws, binding corporate rules, or agreements that provide an adequate level of protection substantially similar to POPIA.
Security Safeguards
ITEX maintains an Information Security Management System certified to ISO/IEC 27001:2022. Appropriate, reasonable technical and organisational measures are implemented to secure the integrity and confidentiality of personal information, including access controls, encryption, network and endpoint security, monitoring, staff confidentiality and training, incident response, and backup and recovery. Operators are bound by written contracts to maintain equivalent safeguards.
10. Procedure to Request Access to a Record
How to Submit a Request
A requester must complete the prescribed Form 2 (Request for Access to Record of a Private Body) in terms of the PAIA Regulations and submit it to the Information Officer. Form 2 can be downloaded here, is available from the Information Officer on request, and from the Information Regulator's website at https://inforegulator.org.za/paia/.
Completed forms may be submitted by email to: paia@itex.co.za
Information to Be Provided
- Sufficient particulars to enable the Information Officer to identify the record requested and the requester
- The form of access required
- The postal address, email address, fax, or telephone number of the requester in the Republic
- Identification of the right the requester is seeking to exercise or protect, with an explanation of why the record is required
- If the request is made on behalf of another person, proof of the capacity in which the requester is making the request
Fees
A request fee of R140.00 (the amount currently prescribed by the PAIA Regulations and subject to amendment by the Minister) is payable by a requester (other than a personal requester seeking their own personal information) before the request is processed. An access fee for reproduction, search, and preparation may also be charged in accordance with the current prescribed tariff. Where preparation is estimated to exceed six hours, a deposit may be required. You will be notified in writing of any fees before they are incurred.
Timeframes
The Information Officer will decide on a request within 30 days of receipt and notify the requester of the decision. This period may be extended by a further 30 days in the circumstances permitted by PAIA, and the requester will be notified of any such extension.
11. Grounds for Refusal of Access
ITEX may refuse a request for access to a record on the grounds of refusal set out in Chapter 4 of Part 3 of PAIA, including:
- Mandatory protection of the privacy of a third party who is a natural person
- Mandatory protection of the commercial information of a third party
- Mandatory protection of certain confidential information of a third party
- Mandatory protection of the safety of individuals and the protection of property
- Protection of records privileged from production in legal proceedings
- Commercial information of the private body
- Requests that are manifestly frivolous or vexatious, or that involve an unreasonable diversion of resources
12. Remedies Available
If a request is refused, or a requester or data subject is dissatisfied with how a request was handled, the following remedies are available:
- Internal: contact the Information Officer at paia@itex.co.za to resolve the matter directly.
- Complaint to the Regulator: lodge a complaint with the Information Regulator in the prescribed manner, using the contact details set out in section 5 of this Manual.
- Court: apply to a court with jurisdiction for appropriate relief as provided in PAIA.
13. Availability of the Manual
This Manual is available, free of charge, on the ITEX website at www.itex.co.za, at the principal place of business of ITEX during office hours, and from the Information Officer on request. Copies are available in the official languages on request, and on request to the Information Regulator.
14. Updates to This Manual
This Manual will be reviewed and updated as required by changes in law or in ITEX's operations. The current version is published on the ITEX website and is available on request from the Information Officer.