PAIA manual.

01 · Introduction

Purpose of this manual

The Promotion of Access to Information Act 2 of 2000 (PAIA) gives effect to the constitutional right of access to any information held by the State, and to information held by another person that is required for the exercise or protection of any right. Section 51 of PAIA requires every private body to compile a manual explaining how a person may request access to the records it holds.

This manual is published by TheUmbrella (Pty) Ltd (registration number 2026/771931/07), a private company incorporated in the Republic of South Africa ("theUmbrella", "the company", "we"). It covers the company and the products it operates directly, including SBS, its security review service for software businesses.

Wilderpass, the online booking platform for outdoor experiences within the theUmbrella group, processes a distinct set of records (guests, operators, bookings and held funds) and publishes its own PAIA manual. Where a request concerns Wilderpass records, the Wilderpass manual applies and the request is handled under it. Where it is unclear which manual applies, send the request to the Information Officer named below, who will direct it.

This manual also contains the information that section 51 of PAIA, as amended by POPIA, requires about the processing of personal information by the company.

02 · Section 51(1)(a)

Contact details

The head of a private body is its Information Officer under PAIA and POPIA. The company's Information Officer and the details for lodging a request are:

Requests under PAIA, and questions about personal information under POPIA, must be sent to the Information Officer at the email or postal address above. Please mark the subject line "PAIA request" or "POPIA request" so that it is routed to the Information Officer without delay.

03 · Section 51(1)(b)

The Information Regulator's guide on how to use PAIA

The Information Regulator has compiled a Guide, in terms of section 10 of PAIA, in each official language, to help any person who wishes to exercise a right under PAIA or POPIA. The Guide explains the objects of both Acts, the contact details of information officers, how to lodge a request and the fees, the remedies available if a request is refused, and how to lodge a complaint with the Regulator.

The Guide is available free of charge from the Regulator:

The Guide can also be inspected at the company's office during business hours on request to the Information Officer.

04 · Section 51(1)(c) and 52(2)

Records that are automatically available

The following records are available without a person having to request access under PAIA. No fee is charged for records accessed on the website.

• All content published on www.theumbrella.co.za, including the description of the company's services and its founders.
• The company's Terms & Policies (terms and conditions of sale, payment, refund, cancellation, delivery and privacy policies).
• This PAIA manual, on the website and in PDF.
• Public product information, brochures and marketing material for SBS and the company's consulting services, as published from time to time.
• Information that the company is required to make public under the Companies Act 71 of 2008, obtainable from the Companies and Intellectual Property Commission (CIPC).

The company has not, at the date of this manual, published a notice under section 52(2) of PAIA. If it does, the notice will be referenced here.

05 · Section 51(1)(d)

Records available in terms of other legislation

Where a person is entitled to a record under another law, access is given under that law and this manual does not apply to it. Records held by the company under the following legislation (where applicable to the company) may be requested by persons entitled to them under that legislation:

• Companies Act 71 of 2008
• Income Tax Act 58 of 1962, Value-Added Tax Act 89 of 1991 and Tax Administration Act 28 of 2011
• Basic Conditions of Employment Act 75 of 1997, Labour Relations Act 66 of 1995, Employment Equity Act 55 of 1998, Unemployment Insurance Act 63 of 2001, Compensation for Occupational Injuries and Diseases Act 130 of 1993 and Skills Development Levies Act 9 of 1999
• Consumer Protection Act 68 of 2008
• Electronic Communications and Transactions Act 25 of 2002
• Protection of Personal Information Act 4 of 2013
• Financial Intelligence Centre Act 38 of 2001 (to the extent applicable)
• Promotion of Access to Information Act 2 of 2000

The list is not exhaustive and is read as including the regulations under each Act.

06 · Section 51(1)(e)

Subjects and categories of records held by the company

The company holds records on the following subjects. Listing a category here does not mean that a record in it will be disclosed; every request is assessed against the grounds for refusal in Chapter 4 of Part 3 of PAIA (see section 10 of this manual).

6.1 Company and statutory records

• Incorporation documents, memorandum of incorporation, share register and securities records
• Minutes and resolutions of directors and shareholders
• Statutory returns and correspondence with CIPC, SARS and other regulators
• Registration and correspondence with the Information Regulator

6.2 Financial records

• Annual financial statements, management accounts, budgets and bank records
• Invoices, receipts, tax invoices and payment records, including settlement records from payment service providers (Payfast for SBS)
• Tax records, VAT returns and payroll records

6.3 Client, customer and engagement records

• Proposals, quotations, statements of work, contracts and non-disclosure agreements
• Client contact details and correspondence
• SBS review records: order and payment records; scope and access authorisations; source code, configuration, infrastructure and documentation supplied by the client for review; working notes and findings; delivered security reports. These records contain clients' confidential and security-sensitive information and are held under strict confidentiality undertakings.
• Consulting engagement deliverables, architecture documents and project records

6.4 Human resources records

• Employment contracts, personnel files, remuneration and leave records
• Contractor and consultant agreements
• Disciplinary, grievance, performance and training records

6.5 Supplier and operational records

• Supplier contracts, service-level agreements and invoices, including those with hosting, cloud, payment and software providers
• Policies, procedures and standards, including the company's Secure Build Standard
• Information-security records: access logs, audit logs, incident reports and vulnerability records
• Insurance records

6.6 Intellectual property and legal records

• Source code, designs, documentation and other intellectual property of the company and its products
• Trade marks, domain names and licences
• Legal opinions, litigation and dispute records

6.7 Marketing and website records

• Website content, analytics and contact-form enquiries
• Marketing materials, mailing lists and consents

6.8 Wilderpass

Records of the Wilderpass platform (guest, operator and booking records, held-funds and payout records processed through Turnstay, and platform operational records) are described in the Wilderpass PAIA manual and are not listed here.

07 · Section 51(1)(c) read with POPIA

Processing of personal information

The company is a responsible party under POPIA. This section sets out the information that a PAIA manual must contain about the company's processing of personal information. The company's privacy policy, in the Terms & Policies, gives a fuller description.

7.1 Purposes of processing

• Providing the company's services and products, including performing SBS security reviews and consulting engagements
• Managing client relationships, orders, payments, invoicing and support
• Complying with legal obligations, including tax, company law, consumer protection and anti-fraud requirements
• Recruiting, employing and managing staff and contractors
• Managing suppliers and service providers
• Securing the company's systems, detecting and investigating security incidents, and meeting its own security standards
• Marketing the company's services, with consent where required

7.2 Categories of data subjects and of personal information

7.3 Recipients of personal information

• Operators (service providers processing on the company's behalf): hosting and content-delivery providers, email and productivity providers, payment service providers (Payfast), accounting, payroll and professional advisers
• Regulators and public bodies where the law requires, including SARS, CIPC and the Information Regulator
• Courts, tribunals and legal representatives in the course of disputes
• Within the theUmbrella group, including Wilderpass, only where necessary for a shared function and subject to the same safeguards

7.4 Transborder flows of personal information

Some of the company's service providers host data outside South Africa, including cloud hosting, content delivery, email and AI-assisted tooling used in service delivery. Personal information is transferred only to providers that are bound by contract to a level of protection substantially similar to POPIA, or where another ground in section 72 of POPIA applies. Card payment data is processed by the payment service provider and never held by the company.

7.5 Security measures

The company applies its own Secure Build Standard to its systems and takes appropriate, reasonable technical and organisational measures to protect personal information, including: encryption in transit and at rest; multi-factor authentication and least-privilege access control; centralised logging and alerting; separation of production and non-production environments; secure development and review practices; contractual security obligations on operators; staff confidentiality undertakings; and an incident-response procedure that includes notification to the Regulator and affected data subjects where section 22 of POPIA requires it.

7.6 Objection, access and correction

A data subject may request access to, or correction or deletion of, their personal information, or object to its processing, by writing to the Information Officer using the Regulator's prescribed forms (Form 1 for an objection and Form 2 for a correction or deletion request under the POPIA Regulations). A request for access to personal information is handled as a PAIA request under section 8 of this manual, except that no request fee is payable for a data subject's own personal information.

08 · Section 51(1)(f) and 53

How to request access to a record

8.1 Who may request

Any person may request access to a record of the company if the record is required for the exercise or protection of a right. A requester must identify the right and explain why the record is required to exercise or protect it. A request may also be made on behalf of another person, in which case proof of the capacity in which the request is made must be provided.

8.2 The form

A request must be made on the Regulator's prescribed Form 2 (Request for access to record of private body), available from inforegulator.org.za under PAIA forms, or from the Information Officer on request. The form must:

• give enough particulars to enable the company to identify the record and the requester;
• state the form of access required (inspection, copy, electronic copy, transcript);
• give the requester's postal address, email address or fax number in South Africa;
• identify the right to be exercised or protected and explain why the record is required for it;
• state whether the requester wants to be informed of the decision in a particular way; and
• if made on behalf of someone else, include proof of that capacity to the reasonable satisfaction of the Information Officer.

Send the completed form to the Information Officer by email to hello@theumbrella.co.za or by post to the address in section 2. The Information Officer will assist a requester who cannot complete the form because of illiteracy or disability.

8.3 Fees payable with the request

A request fee of R140 is payable before the request is processed, unless the requester is asking for their own personal information. Where the request requires more than six hours to search for and prepare the record, the Information Officer may require a deposit of one third of the estimated access fee. See section 9.

8.4 Time to respond

The Information Officer will decide on a request as soon as reasonably possible and in any event within 30 days of receiving it, and will notify the requester of the decision in writing. The period may be extended once by up to a further 30 days where the request is for a large number of records, requires a search through many records, or requires consultation with a third party, in which case the requester is notified of the extension and the reasons for it. If no decision is communicated within the period, the request is deemed refused.

8.5 Third-party records

Where a request concerns a record containing information about a third party (including a client's confidential information or another person's personal information), the company must notify that third party and allow them to make representations before deciding on the request, as required by Chapter 5 of Part 3 of PAIA.

8.6 Access

If access is granted, the record is made available in the form requested where reasonably possible, on payment of the applicable access fee and, where relevant, postage. Access is given electronically wherever practicable.

09 · Section 54 and the PAIA Regulations

Fees

Fees are prescribed in the Regulations published under PAIA (Annexure B, as amended from time to time) and published by the Information Regulator in its PAIA fee structure. The amounts below reflect the fee structure in force at the date of this manual; where the regulations change, the regulated amounts apply. All amounts are inclusive of VAT.

No request fee is payable for a data subject's own personal information. A record provided by email carries no reproduction fee. The company may waive a fee where the cost of collecting it would exceed the amount.

10 · Section 51(1)(f) and Chapter 4 of Part 3

Grounds for refusal and remedies

10.1 Grounds for refusal

The company must refuse access to a record, or may refuse it, on the grounds set out in sections 62 to 70 of PAIA, including where disclosure would:

• involve the unreasonable disclosure of personal information about a third party (section 63);
• reveal trade secrets, financial, commercial, scientific or technical information of a third party, or information supplied in confidence whose disclosure could prejudice that third party (section 64) — this ground is likely to apply to SBS review records, which contain clients' security-sensitive information;
• breach a duty of confidence owed to a third party under an agreement (section 65);
• endanger the life or physical safety of an individual, or prejudice the security of property or a system (section 66);
• be privileged from production in legal proceedings (section 67);
• reveal the company's own trade secrets, commercial or technical information, or research (sections 68 and 69); or
• be frivolous, vexatious or involve an unreasonable diversion of the company's resources (section 45, as applied to private bodies).

Access must nevertheless be granted where disclosure would reveal evidence of a substantial contravention of the law or an imminent and serious public-safety or environmental risk, and the public interest in disclosure clearly outweighs the harm (section 70). Where a record contains some information that may be refused, the remainder is severed and disclosed where reasonably possible (section 59).

10.2 Remedies if a request is refused

PAIA does not provide for an internal appeal against a decision of a private body. A requester, or a third party, who is dissatisfied with a decision of the Information Officer (including a refusal, a fee, an extension or the form of access) may:

• lodge a complaint with the Information Regulator on the prescribed Form 5, within 180 days of the decision, at PAIAComplaints@inforegulator.org.za or the address in section 3; or
• apply to a court with jurisdiction for appropriate relief in terms of section 78 of PAIA, within 180 days of the decision or of the Regulator's finding.

11 · Section 51(3) and Regulation 7

Availability and updating of this manual

This manual is available:

• on the company's website at www.theumbrella.co.za/PAIA.html, and as a PDF;
• at the company's principal place of business, for inspection during normal business hours, on request to the Information Officer; and
• from the Information Regulator, to which a copy is provided on request.

Copies may be requested from the Information Officer, who may charge the prescribed reproduction fee for printed copies. This manual is available in English; a translation into another official language will be considered on request.

The manual is reviewed at least once a year and whenever the company's contact details, products, categories of records or processing of personal information change materially. The effective date and version appear at the top of the manual.