PAIA Manual

Last updated 21 September 2026

This is the manual of Xinnace (Pty) Ltd (“we”, “us”) in terms of section 51 of the Promotion of Access to Information Act, 2000 (PAIA), read with the Protection of Personal Information Act, 2013 (POPIA). It explains what records we hold and how to request access to them.

1. Who we are

• Private body: Xinnace (Pty) Ltd  (registration number 2025/316516/07)
• Head of the private body and Information Officer: Poobalan Soobramoney, Chief Executive Officer — registered with the Information Regulator
• Email: accounts@xinnace.co.za
• Website: reports.xinnace.co.za
• Physical and postal address: 22 Umhlanga Boulevard, Umhlanga, KwaZulu-Natal, 4321
• Telephone: +27 60 997 4764

2. The Regulator’s guide

The Information Regulator has published a guide, in terms of section 10 of PAIA, on how to use the Act. It is available from the Information Regulator (South Africa): inforegulator.org.za, or enquiries@inforegulator.org.za.

3. Records available without a PAIA request

These are published on our website and need no formal request:

• the description of the service on our public pages
• the Privacy Policy, Terms of Service and Operator Policy
• this manual

In addition, a client’s own records on the platform — its reports and the figures behind every earlier version, its most recent uploaded files, its invoices, and its audit trail — are available to that client’s authorised users directly through the platform, at any time, without a PAIA request.

4. Records held in terms of other legislation

• Company records, in terms of the Companies Act, 2008
• Financial and tax records, in terms of the Income Tax Act and related tax legislation
• Personal information records, in terms of POPIA

5. Categories of records we hold

• Corporate: company and statutory records
• Financial: invoices issued, payment records, accounting records
• Client: client agreements and contact details; each client’s uploaded data, reports and report versions, held in that client’s own database
• Enquiries: records of conversations with organisations asking about the service — who we spoke to, what was asked for, and what was established
• Operational: user accounts, audit trails, report view logs, and backups
• Legal and policy: the published policies listed above

6. Personal information we process (POPIA)

The full description is in the Privacy Policy and, for information inside client uploads, the Operator Policy. In summary:

• Data subjects: users of the platform; client billing contacts; people at organisations who enquire about the service; the client’s own staff whose details appear in the data the client uploads; and anyone else whose details a client includes in a file it uploads
• Purpose: delivering, securing and invoicing the reporting service — nothing else; no marketing, no analytics, no sale of information
• Recipients: the client’s own named users; our hosting in South Africa; Google Workspace for email delivery
• Cross-border: email sent through Google Workspace may be processed outside South Africa; platform data itself is hosted in South Africa
• Security: a database per client, encrypted transport, hashed credentials, audit trails, and the further measures listed in the policies above
• Retention: activity records 24 months; enquiry records 24 months without contact; uploaded files, the ten most recent per report; backups 14 days, with off-site copies destroyed within a further 60 days; a client’s own data for 90 days after their account closes, then destroyed

7. How to request a record

• Use the prescribed request form (Form 2 in the PAIA Regulations), available from the Information Regulator.
• Send it to the Information Officer at accounts@xinnace.co.za.
• Identify the record you want, the right you seek to exercise or protect, and why the record is required for it — PAIA grants third parties access to a private body’s records only on that basis.
• The fees are those prescribed in the PAIA Regulations. We will tell you the applicable fee before processing the request.
• We respond within 30 days, as the Act requires, either giving access or stating the grounds for refusal.

8. Grounds on which a request may be refused

PAIA itself sets these out, and they include: the mandatory protection of the privacy of a third party (including the personal information of a client’s staff inside that client’s data), the mandatory protection of a third party’s confidential information, and records privileged from production in legal proceedings. Where a record contains a client’s information, the client will be notified and heard before any decision, as the Act provides.

9. Remedies

If a request is refused, the requester may lodge a complaint with the Information Regulator (South Africa) or apply to a court, as provided for in the Act.

10. Availability of this manual

This manual is available on this website, and on request from the Information Officer at accounts@xinnace.co.za.