Introduction
This manual is published in terms of section 51 of the Promotion of Access to Information Act 2 of 2000 (PAIA). It explains what records Escience Associates (Pty) Ltd holds, how to request access to them, and what it does with personal information as required by the Protection of Personal Information Act 4 of 2013 (POPIA).
The exemption that previously relieved certain private bodies from the obligation to compile a manual lapsed on 31 December 2021. Every private body must now have a manual, and it must be available free of charge.
Particulars of the private body (section 51(1)(a))
| Name of the private body | Escience Associates (Pty) Ltd |
| Trading name | — |
| Registration number | 2009/014472/07 |
| Physical address | Oaklands, Johannesburg |
| Telephone | 011 718 6380 |
| info@escience.co.za | |
| Website | https://www.escience.co.za/ |
| Information Officer | Theo Ernst Fischer |
| Information Officer email | theo@escience.co.za |
| Deputy Information Officer | Lize Nortje |
The Information Regulator
PAIA and POPIA are regulated by the Information Regulator (South Africa). A requester who is dissatisfied may lodge a complaint with the Regulator.
Information Regulator (South Africa), JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001; PO Box 31533, Braamfontein, Johannesburg, 2017. Telephone 010 023 5200. General enquiries: enquiries.IR@inforegulator.org.za. PAIA complaints: PAIAComplaints.IR@inforegulator.org.za. POPIA complaints: POPIAComplaints.IR@inforegulator.org.za. Website: https://inforegulator.org.za
The section 10 guide
The Information Regulator has compiled a guide, in terms of section 10 of PAIA, containing information reasonably required by a person who wishes to exercise a right under the Act. The guide is available in each official language on the Regulator's website at https://inforegulator.org.za, or on request from the Regulator at the details above.
Categories of records held (sections 51(1)(d) and (e))
The following categories of record are held. Listing a record here does not mean that access will automatically be granted; a request is considered against the grounds of refusal in Chapter 4 of Part 3 of PAIA.
| Category | Records included | Legislation under which they are held |
|---|---|---|
| Company and statutory records | Founding documents, registration certificates, share and member registers, minutes and resolutions | Companies Act 71 of 2008 |
| Financial records | Annual financial statements, accounting records, invoices, statements, banking records, tax returns and assessments | Companies Act; Tax Administration Act 28 of 2011; Value-Added Tax Act 89 of 1991 |
| Client and customer records | Engagement letters, contracts, correspondence, service records, client files and billing records | Held in the ordinary course of business |
| Supplier and contractor records | Contracts, purchase orders, invoices, banking details and correspondence | Held in the ordinary course of business |
| Employee records | Employment contracts, personnel files, payroll and remuneration records, leave and attendance records, disciplinary records, training records, and health-related records held separately | Basic Conditions of Employment Act 75 of 1997; Labour Relations Act 66 of 1995; Employment Equity Act 55 of 1998; Compensation for Occupational Injuries and Diseases Act 130 of 1993; Income Tax Act 58 of 1962 |
| Website and marketing records | Website content, enquiry and sign-up records, marketing lists, consent and objection records | Held in the ordinary course of business |
| Security records | CCTV footage, access control and visitor registers | Held in the ordinary course of business |
| Compliance records | This manual, the privacy notice, the data protection policy, the retention schedule, the registers required under POPIA, records of data subject requests and of security compromises | Protection of Personal Information Act 4 of 2013 |
Records available without a formal request
The following are available on the website or on request at no charge, and do not require a PAIA request:
- This PAIA manual
- The privacy notice
- Standard terms of business and published service information
- Marketing and promotional material
Processing of personal information (POPIA)
The following is included in this manual as required in respect of the processing of personal information.
Purpose of processing
- To deliver its products and services
- To prepare quotations and respond to enquiries
- To invoice, collect payment and maintain accounting records
- To employ, pay and manage staff
- To meet legal and regulatory obligations
- To market its services to existing and prospective clients
- To secure its premises and systems
- To verify identity and carry out required checks
- To recruit
Categories of data subjects and the information relating to them
| Category of data subject | Information held |
|---|---|
| Customers and clients | Name, contact details, address, identity number, banking details, service and billing records, and correspondence |
| Prospective customers and enquirers | Name, contact details and the content of the enquiry |
| Employees | Name, contact details, identity number, banking details, tax number, payroll and leave records, contract, performance and disciplinary records, and health records held separately |
| Job applicants | CV, contact details, qualifications, references and interview notes |
| Suppliers and service providers | Contact person, contact details, banking details, registration and tax documents, and correspondence |
| Independent contractors | Name, contact details, identity number, banking details, tax details and contract records |
| Persons recorded on CCTV | Video footage recorded at the premises |
| Shareholders, members, trustees and directors | Name, identity number, address, shareholding and statutory records |
Recipients to whom the information may be supplied
- Professional advisers, including accountants, auditors and attorneys
- Banks and payment providers
- Government bodies where required by law, including the South African Revenue Service
- The UIF, the Compensation Fund and the payroll provider
- Microsoft 365 (email, files, Teams)
- Cloud file storage (Dropbox / OneDrive / iCloud)
- Accounting software
- Payroll / HR software
- Website host / developer
- Outsourced IT support
- WhatsApp (business communication)
- Remote access provider
- Managed backup provider
- AI tools (ChatGPT, Copilot, transcription)
- Outside bookkeeper / accountant / payroll bureau
Planned transborder flows of personal information
Personal information is stored or processed outside South Africa through the cloud services used for email, file storage and business software. Such transfers are made in reliance on section 72 of POPIA, on the basis that the recipient is subject to binding rules or a binding agreement providing a level of protection substantially similar to POPIA and that the transfer is necessary for the performance of a contract with the data subject.
General description of information security measures
Individual named user accounts; multi-factor authentication on email and cloud systems; encryption of portable devices; access to sensitive records restricted on a need-to-know basis and reviewed periodically; endpoint protection and patching; regular backups that are tested; prompt removal of access when a person leaves; secure storage and destruction of paper records; and written operator agreements with every service provider that processes personal information.
How to request access to a record
- Complete Form 2 (Request for Access to Record of Private Body), prescribed under regulation 7 of the PAIA Regulations. The form is available from the Information Officer and on the Regulator's website.
- Provide sufficient particulars to enable the record to be identified, and to identify the requester.
- State the right you are seeking to exercise or protect, and explain why the record is required to exercise or protect that right. A request that does not do this must be refused.
- State the form of access required and how you wish to be informed of the decision.
- Where the request is made on behalf of another person, attach proof of authority.
- Pay the prescribed request fee. Submit the form to the Information Officer at theo@escience.co.za.
The Information Officer must decide within 30 days of receipt and notify the requester in writing. The period may be extended by a further 30 days where the request is for a large number of records or requires a search of records held elsewhere; the requester will be notified in writing of any extension and the reasons for it. If no decision is given within the period, the request is regarded as having been refused.
Fees
The fees below are those prescribed under PAIA. No fee is payable for a request for your own personal information, and no fee is payable for a correction, a deletion or an objection under POPIA.
| Item | Fee |
|---|---|
| Request fee (payable on submission of Form 2) | R140.00 |
| Photocopy or printed copy of an A4 page | R2.00 per page |
| Copy in computer-readable form on flash drive | R40.00 |
| Copy on compact disc (requester provides the disc) | R40.00 |
| Copy on compact disc (provided by the private body) | R60.00 |
| Transcription of an audio record, per A4 page | R24.00 |
| Copy of an audio record on flash drive | R40.00 |
| Transcription of visual images | Outsourced — actual cost on quotation |
| Search and preparation, per hour or part of an hour, excluding the first hour | R145.00 (maximum R435.00) |
| Deposit, where the search is estimated to exceed six hours | One third of the access fee |
| Postage, email or other electronic transfer | Actual cost |
Grounds on which a request may be refused
Access may be refused on the grounds set out in Chapter 4 of Part 3 of PAIA, which include:
- The mandatory protection of the privacy of a third party who is a natural person (section 63).
- The mandatory protection of the commercial information of a third party (section 64).
- The mandatory protection of information supplied in confidence, where disclosure would breach a duty of confidence (section 65).
- The mandatory protection of the safety of individuals and of property (section 66).
- The protection of records privileged from production in legal proceedings (section 67).
- The protection of the commercial information of the private body itself, including trade secrets and information whose disclosure would harm its commercial or financial interests (section 68).
- The protection of research information (section 69).
- Where the request is manifestly frivolous or vexatious, or would involve a substantial and unreasonable diversion of resources (section 45).
Where a request is refused, the requester is told in writing of the decision, the grounds for it, and the remedies available.
Remedies available to a requester
There is no internal appeal against a decision of the Information Officer of a private body. A requester who is dissatisfied may:
- Lodge a complaint with the Information Regulator in terms of section 77A of PAIA, within 180 days of the decision; or
- Apply to a court with jurisdiction for appropriate relief in terms of section 78 of PAIA, within 180 days of the decision.
Availability and updating of this manual
This manual is available free of charge:
- On the website at https://www.escience.co.za/
- At the offices of the business, on request
- By email from the Information Officer at theo@escience.co.za
- On request from the Information Regulator
It is reviewed at least annually and whenever there is a material change to the records held or to the particulars of the business.