PAIA Manual

1. Purpose and availability

This manual is prepared under section 51 of the Promotion of Access to Information Act 2 of 2000, as amended, and addresses related requirements under the Protection of Personal Information Act 4 of 2013. It explains the records held by Bibeno and the procedure for requesting access where a record is required for the exercise or protection of a right.

The current effective manual is made available on Bibeno's website and at the verified principal place of business during reasonable business hours. A copy is provided to the Information Regulator on request and to another person in the manner required by law. The status, effective date, version, and content hash displayed with this manual identify whether it is the current published section 51 manual.

2. Private body and Information Officer

The following verified details identify the private body, head or Information Officer, registered office, service address, and public contact routes for PAIA and POPIA requests.

BIBENO (PTY) LTD

2026/355321/07

Bibeno

Plot 17 Second Street, Mooilande AH, Meyerton, Gauteng, 1963, South Africa

Plot 17 Second Street, Mooilande AH, Meyerton, Gauteng, 1963, South Africa

Jean Posthumus

support@bibeno.co.za

+27 60 659 1848

support@bibeno.co.za

3. Information Regulator guide

The Information Regulator publishes a guide explaining how to use PAIA, the rights and procedures available, assistance for requesters, applicable fees, remedies, and contact details for public and private bodies. The current guide and prescribed forms are available from the Information Regulator's official website and offices.

A requester should use the current official guide and forms published at https://inforegulator.org.za/paia/ rather than relying on an outdated copy. Bibeno will provide reasonable assistance to identify the correct process without giving legal advice or requiring a requester to describe their claim more broadly than PAIA requires.

4. Records voluntarily or automatically available

The following records may be available without a formal PAIA request, subject to authentication, customer confidentiality, intellectual property, security, legal holds, and the rights of other people.

• Published Terms, Privacy Notice, Refund, Cancellation, and Billing Policy, Data Processing Agreement, Security Measures Schedule, Subprocessor List, Acceptable Use Policy, Support Policy, and legal version history.
• The approved PAIA Manual, prescribed request forms, Information Officer contact details, and public complaint routes.
• Public product descriptions, plan information, support guidance, status or incident communications approved for publication, and corporate disclosures required by law.
• An authenticated customer's own invoices, acceptance records, account settings, supported exports, support requests, and other self-service records available through the product.
• A data subject's own personal information where the POPIA or authenticated self-service route applies and disclosure does not prejudice another person.

5. Legislation and recordkeeping

Bibeno may hold records under legislation applicable to its verified entity, activities, employees, tax status, electronic services, contracts, consumer dealings, privacy, access to information, intellectual property, security, and disputes. Bibeno maintains its controlled legal register for its actual corporate form, staff, turnover, providers, products, territories, and enabled regulated features, and updates that register when those facts change.

• Companies Act, Income Tax Act, Tax Administration Act, Value-Added Tax Act where registered, and related corporate and accounting requirements.
• Basic Conditions of Employment Act, Labour Relations Act, Employment Equity Act where applicable, Unemployment Insurance legislation, Compensation for Occupational Injuries and Diseases Act, and related employee records.
• Consumer Protection Act and Regulations, Electronic Communications and Transactions Act, and applicable complaint or industry-code requirements.
• POPIA, PAIA and their regulations, guidance, prescribed forms, Information Officer, security-compromise, and prior-authorisation requirements.
• Copyright, trade mark, cybercrime, evidence, prescription, court, regulator, and contractual recordkeeping requirements.
• National Credit Act, payment, stored-value, marketing, sector, health and safety, food, or other specialist rules only to the extent Bibeno or a customer feature is actually within their scope.

6. Categories of records held

• Corporate, ownership, governance, registrations, approvals, policies, insurance, professional-adviser, and compliance records.
• Financial, banking, pricing, quotation, contract, subscription, invoice, payment, refund, credit note, tax, expense, procurement, and accounting records.
• Customer, user, administrator, invitation, employee, contractor, role, permission, authentication, device, session, security, and training records.
• Product, inventory, supplier, purchase, consignment, manufacturing, merchant-storefront, catalogue-publication, online-order, acceptance, collection, delivery, kitchen, sale, payment reference, refund, receipt, cash, tip, service-charge, report, gift-card, loyalty, and marketing records processed for customers.
• Customer agreements, legal versions and hashes, notices, acceptance evidence, checkout evidence, cancellation and renewal choices, complaints, disputes, and litigation records.
• Privacy requests, PAIA requests, consents, objections, suppression, unsubscribe, NCC cleansing, Information Officer, impact-assessment, processing, retention, legal-hold, and deletion records.
• Security incidents and compromises, access and audit events, vulnerabilities, provider reviews, logs, monitoring, backups, restores, business continuity, release, deployment, and remediation records.
• Support tickets, correspondence, call or message metadata, attachments, malware-scan outcomes, exports, customer instructions, resolution, and service-performance records.
• Intellectual property, source code, designs, specifications, tests, documentation, trade marks, licences, open-source notices, commercial secrets, and research records.

7. Who may request and what must be shown

A person may request a record of a private body where it is required for the exercise or protection of a right and the procedural requirements of PAIA are met. A personal requester seeks records containing their own personal information; another requester must identify the right, why the record is required, and how it will assist.

A person acting for another must provide authority. Bibeno may reasonably verify identity, authority, contact details, preferred access form, the record or category sought, and enough context to locate it, but will assist a requester who cannot complete the form without unfairly obstructing the request.

8. Request procedure

• Use the current prescribed Form 2 for a request to a private body and submit it to the verified Information Officer contact.
• Describe the record or category, relevant dates and people, the right to be exercised or protected where required, why the record is necessary, preferred form and language of access, and how notice should be sent.
• Provide proof of identity or representative authority through the secure route requested by the Information Officer; do not email unnecessary identity documents.
• Pay only a prescribed request or access fee lawfully due after receiving the required notice. A personal requester is not charged a request fee.
• Keep the acknowledgement and reference. Notify the Information Officer if contact details, urgency, scope, or authority changes.

Bibeno records receipt, identity and authority checks, scope clarification, searches, third-party consultation, fees, decisions, notices, access delivery, refusal grounds, legal holds, complaints, and final closure in its durable privacy and PAIA workflow.

9. Fees and form of access

The request and access fees are those prescribed under PAIA at the time of the request. Bibeno gives the required written fee notice and, where permitted, may require a deposit for a request requiring more than the prescribed preparation time. Fees are not invented, inflated, or used to discourage a valid request.

Access may be provided by inspection, copy, transcript, electronic file, listening, viewing, or another prescribed form. Bibeno provides the requested form where reasonably possible, subject to accessibility, security, third-party rights, technical feasibility, and the permitted fee.

10. Decision, extension, and record preservation

The Information Officer decides a compliant request within the period prescribed by PAIA, currently ordinarily 30 days from receipt, and gives the required written notice. A permitted extension is used only for a statutory reason, is recorded, and is communicated with its length, reason, and remedy.

Bibeno preserves a requested record and relevant search evidence while the request, complaint, review, or court process is pending. If a record cannot be found or does not exist after reasonable steps, the Information Officer supplies the required affidavit or affirmation describing the searches and what is known about the record.

11. Grounds for refusal and severance

Access may be refused only on a ground permitted by PAIA, including protected personal information of another person, commercial or confidential information, safety, legal privilege, research, or specified law-enforcement and security interests. A discretionary ground is considered fairly and the public-interest override is applied where required.

Bibeno considers notice and representations from an affected third party where PAIA requires it. If a protected part can reasonably be severed, Bibeno provides the remainder rather than refusing the entire record. A refusal notice identifies the adequate reasons and available complaint or court route without exposing the protected content.

12. Remedies and complaints

A private body has no internal PAIA appeal. A requester or affected third party may lodge a complaint with the Information Regulator or approach a court within the periods and procedure prescribed by PAIA. Bibeno's decision notice gives the current route and contact details.

A person may first ask the Information Officer to correct a clear administrative error, clarify the search, explain a fee, or narrow a request, but doing so does not suspend or remove a statutory complaint or court right unless law provides otherwise.

13. POPIA processing disclosures

Bibeno processes the personal-information categories, people, purposes, sources, recipients, operator relationships, international transfers, retention, safeguards, rights, security-compromise, marketing, and contact details described in the Privacy Notice, Data Processing Agreement, Security Measures Schedule, Subprocessor List, and applicable feature schedule.

• Data subjects include owners, administrators, users, employees, applicants, consumers, online-order customers and recipients, delivery recipients, loyalty members, suppliers, contacts, support requesters, and people named in customer-controlled records.
• Recipients include authorised customer users, approved Bibeno personnel and sub-operators, customer-selected providers, professional advisers, payment parties, regulators, courts, and other lawful recipients.
• Cross-border processing is blocked until the recipient, locations, purpose, onward transfers, security, retention, and a POPIA section 72 safeguard are approved.
• Appropriate safeguards include access control, tenant isolation, encryption and secret handling, secure development, logging, malware controls, provider assurance, backup, incident response, retention, deletion, and legal holds.
• Data subjects may use the POPIA objection, correction or deletion, complaint, privacy-request, and PAIA routes described in the Privacy Notice.

14. Updating the manual

Bibeno reviews this manual after a material change to the legal entity, Information Officer, locations, records, law, processing, providers, territories, products, or request procedure and at the approved periodic cadence. Each published version remains immutable and its effective date and content hash are recorded.

Questions or requests for the current manual and forms may be sent to the verified Information Officer contact. A version may be marked effective only after the Information Officer registration, corporate details, principal place of business, prescribed forms and fee sources, record categories, processing disclosures, and owner publication approval have been verified for that exact version.