PAIA manual

1. Purpose of this manual

PAIA gives effect to the constitutional right of access to information held by private bodies where that information is needed to exercise or protect a right. This manual explains:

• what records we hold;
• how to ask for access to them, and what it costs;
• how and why we process personal information, as POPIA requires.

It applies to Pursuit IT Solutions CC, a private body as defined in PAIA.

2. Contact details

3. The Information Regulator's PAIA guide

The Information Regulator has published a guide on how to use PAIA and POPIA, as required by section 10 of PAIA. The guide is available in all official languages, and you can get it from the Regulator's website or offices:

You can also ask us for a copy of the guide. It is available for inspection at our office during office hours.

4. Records available without a formal request

We haven't published a formal notice under section 52 of PAIA. The following are freely available without a PAIA request:

• information published on our website, including product and service information, our privacy policy and our refund and returns policy;
• marketing material and brochures;
• this manual.

5. Records held in terms of other legislation

We keep records as required by the following laws, as they apply to us. Records held under these laws may be requested under this manual, subject to PAIA:

• Basic Conditions of Employment Act 75 of 1997
• Broad-Based Black Economic Empowerment Act 53 of 2003
• Close Corporations Act 69 of 1984
• Compensation for Occupational Injuries and Diseases Act 130 of 1993
• Consumer Protection Act 68 of 2008
• Electronic Communications and Transactions Act 25 of 2002
• Employment Equity Act 55 of 1998
• Income Tax Act 58 of 1962
• Labour Relations Act 66 of 1995
• Occupational Health and Safety Act 85 of 1993
• Protection of Personal Information Act 4 of 2013
• Skills Development Act 97 of 1998 and Skills Development Levies Act 9 of 1999
• Tax Administration Act 28 of 2011
• Unemployment Insurance Act 63 of 2001 and Unemployment Insurance Contributions Act 4 of 2002
• Value-Added Tax Act 89 of 1991

6. Subjects and categories of records held

Listing a category doesn't mean every record in it will be made available. Access is subject to the grounds for refusal in section 10.

7. Processing of personal information (POPIA)

7.1 Purpose of processing

We process personal information to:

• provide managed IT, cybersecurity, cloud and backup services, and sell products;
• respond to enquiries and prepare quotes;
• manage client, supplier and employee relationships;
• register licenses and warranties with vendors;
• market our services, with consent where required;
• keep our systems secure;
• meet our legal, tax and regulatory obligations.

7.2 Categories of data subjects and information

7.3 Recipients of personal information

• service providers acting as operators, such as hosting, email and Microsoft 365, backup, accounting, payroll, payment processing and courier providers;
• vendors and distributors, for license and warranty registration;
• SARS and other authorities, where the law requires it;
• professional advisers, such as auditors and attorneys.

7.4 Planned transborder flows

Some service providers, such as cloud, email, analytics and vendor licensing platforms, may store or process personal information outside South Africa. We only transfer information where section 72 of POPIA allows it, for example where the recipient is bound by laws, binding corporate rules or an agreement that gives adequate protection. Backups we manage through our BackIT service are stored in South Africa.

7.5 Security measures

We use appropriate, reasonable technical and organisational measures to protect personal information, including:

• next-generation firewalls and endpoint protection;
• encryption;
• multi-factor authentication and role-based access control;
• 24/7 monitoring;
• patch management;
• encrypted backups;
• staff confidentiality obligations and awareness training.

7.6 Objections and corrections

Data subjects may object to processing using POPIA Form 1, or request correction or deletion using POPIA Form 2. Both forms are available on the Information Regulator's website or from us. See our privacy policy for more.

8. How to request access to a record

1. Complete PAIA Form 2 (Request for Access to Record), available on the Information Regulator's website or from us.
2. Give enough detail for us to identify the record and you, and state the form of access you want.
3. State which right you want to exercise or protect, and explain why the record is needed for that.
4. If you're asking on behalf of someone else, provide proof of your authority.
5. Send the form to the Information Officer by email, post or hand delivery (see section 2), and pay the request fee.

If you can't read or write, or you have a disability, you may make the request orally, and the Information Officer will help you complete the form.

We'll notify you of our decision within 30 days. We may extend this once, by up to 30 days, where section 57 of PAIA allows it, and we'll tell you why. If the request affects a third party, we'll follow the notification process in section 71 of PAIA.

9. Fees

These fees are prescribed in Annexure B of the PAIA Regulations, 2021. VAT may be added because we are a VAT vendor.

Access fees are payable before we release the record. If your request is refused, any deposit is refunded.

10. Grounds for refusal

We may, and in some cases must, refuse access to protect:

• the privacy of a third party who is a natural person (section 63);
• commercial information of a third party (section 64);
• confidential information of a third party (section 65);
• the safety of individuals and the protection of property (section 66);
• records that are privileged from production in legal proceedings (section 67);
• our own commercial information, such as trade secrets, financial information, or information that could harm our competitive position (section 68);
• research information (section 69).

We must still grant access where the public interest override in section 70 applies. A request may also be refused if the record doesn't exist or can't be found after a reasonable search. In that case we'll tell you by affidavit or affirmation.

11. Remedies

We don't have an internal appeal procedure, so our Information Officer's decision is final within PursuIT Solutions. If you're not satisfied with a decision, you may:

• lodge a complaint with the Information Regulator within 180 days of the decision (section 77A), or
• apply to court for appropriate relief (section 78).

12. Availability and updates

This manual is available on our website and at our office. You can inspect it free of charge, and we'll provide a copy to the Information Regulator on request. We review this manual regularly and update it when our details or practices change.

Compiled by Thomas Saether, Information Officer, Pursuit IT Solutions CC. Date of compilation: 28 September 2026.