Legal · PAIA
PAIA manual
Protoworks Group (Pty) Ltd
Registration number 2026/556877/07
Prepared under section 51 of the Promotion of Access to Information Act 2 of 2000 (PAIA), following the Information Regulator's template for private bodies.
Version 1.0, 25 September 2026.
1. Abbreviations
| Company, we | Protoworks Group (Pty) Ltd |
| IO | Information Officer |
| DIO | Deputy Information Officer |
| PAIA | Promotion of Access to Information Act 2 of 2000 |
| POPIA | Protection of Personal Information Act 4 of 2013 |
| Regulator | Information Regulator (South Africa) |
2. Purpose of this manual
This manual tells you:
- what categories of records the Company holds;
- which records you can have without making a request;
- how to ask for any other record, and what it costs;
- how the Company processes personal information; and
- who to contact.
The Company is the holding company of the Protoworks group. It does not trade. It holds the shares in the operating companies, owns the Protoworks word mark and group identity, and provides shared services to the group companies. Each group company has its own PAIA manual.
3. Contact details
| Company | Protoworks Group (Pty) Ltd |
| Registration number | 2026/556877/07 |
| Head of the Company | Richard Peters, Director |
| Information Officer | Richard Peters |
| Deputy Information Officer | None designated yet |
| Email for requests | privacy@protoworks.dev |
| Physical and postal address | From the Information Officer, on request |
| Website | https://protoworks.dev |
4. The Regulator's guide to PAIA
The Regulator publishes a guide on how to use PAIA (section 10). It explains your rights, how to make a request, the fees, and how to complain. It is available in all eleven official languages:
- on the Regulator's website, https://inforegulator.org.za; and
- by email on request to privacy@protoworks.dev.
5. Records available without a request
You do not need to make a PAIA request for these. They are published on protoworks.dev:
- this manual;
- the Protoworks privacy notice;
- our vulnerability disclosure policy and security.txt contact file; and
- information about the group.
The Company has not published a notice under section 52(2) listing other categories of automatically available records.
6. Records kept under other legislation
The Company keeps records required by the following laws, where they apply to it. Some of these records are available to specific people under those laws.
- Companies Act 71 of 2008
- Income Tax Act 58 of 1962
- Value-Added Tax Act 89 of 1991
- Tax Administration Act 28 of 2011
- Basic Conditions of Employment Act 75 of 1997
- Labour Relations Act 66 of 1995
- Trade Marks Act 194 of 1993
- Electronic Communications and Transactions Act 25 of 2002
- Protection of Personal Information Act 4 of 2013
- Promotion of Access to Information Act 2 of 2000
7. Subjects and categories of records
| Subject | Categories of records |
|---|---|
| Company administration | Memorandum of Incorporation, registration certificate, securities register, register of directors, beneficial ownership register, minutes and resolutions |
| Group companies | Share certificates and registers for the subsidiaries, shareholder resolutions, intercompany agreements |
| Finance | Annual financial statements, accounting records, bank records, invoices, budgets |
| Tax | Income tax and VAT records and correspondence with SARS |
| Shared services | Accounting, payroll, company secretarial, HR administration and IT records kept for the group companies |
| Brand | Trade mark applications and registrations, the Protoworks group identity |
| Premises | Leases, subleases and landlord correspondence |
| Suppliers and operators | Contracts, data processing terms, invoices, correspondence |
| Information security | Access records, request and audit logs, incident register, vulnerability reports |
Listing a category here does not mean every record in it will be released. PAIA sets out when we must or may refuse (sections 62 to 70), for example to protect another person's privacy, another company's commercial information, the safety of people or property, or legally privileged material.
8. Processing of personal information
8.1 Why we process personal information
- To run the protoworks.dev website and keep it secure.
- To answer people who contact us, and to send the updates people ask for.
- To provide shared services, including payroll and HR administration, to the group companies.
- To enter into and carry out contracts with suppliers and landlords.
- To meet our legal, tax and regulatory duties.
8.2 Whose information and what information
| Category of person | Information |
|---|---|
| Website visitors | IP address, browser type, pages requested, times |
| People who contact us or use the notify form | Name, email address, message content |
| Staff of the group companies, where we provide shared services | Identity and contact details, tax and bank details, employment records |
| Directors and shareholders | Identity and contact details, shareholding |
| Supplier and landlord representatives | Name, role, work contact details, correspondence |
8.3 Who receives it
- Operators that process information for us under written terms: Google Cloud (hosting in Johannesburg) and Google Workspace (email).
- The group company that employs a staff member, for that staff member's shared-services records.
- SARS, the CIPC and other public bodies, where a law requires it.
- Our auditors and professional advisers.
8.4 Information sent outside South Africa
Email may be stored in Google data centres outside South Africa, under Google's data processing terms (POPIA section 72(1)(b)). Website hosting and request records are held in Johannesburg.
8.5 How we protect it
- Encryption in transit on every connection.
- Access limited to named people, through groups, with two-step verification.
- A web application firewall in front of the website.
- Audit logs of access to our cloud systems.
- A published vulnerability disclosure policy and a security contact.
- Notification of security compromises to the Regulator and to affected people, as POPIA section 22 requires.
9. How to request a record
- Complete PAIA Form 2 (Request for access to record), which is in the PAIA Regulations, 2021 and on the Regulator's website. Give enough detail for us to identify the record, say how you want access (a copy, inspection, or electronically), and say how you want to be told our decision.
- If you are asking on behalf of someone else, include proof of your authority.
- Send it to the Information Officer at privacy@protoworks.dev. If you would rather deliver or post it, ask the Information Officer for the address.
- Pay the request fee if one applies (section 10). A personal requester asking for their own personal information pays no request fee.
- We decide within 30 days and tell you in writing. We may extend this once, by up to 30 more days, and will tell you why (sections 56 and 57).
If we refuse, we give reasons. You may then complain to the Regulator within 180 days (section 77A) or apply to court (section 78).
10. Fees
The fees are the ones prescribed in Annexure B of the PAIA Regulations, 2021:
- a request fee, payable when you submit the request, unless you are a personal requester asking for your own information;
- an access fee for reproducing records, and for the time spent searching for and preparing them.
If the search and preparation will take more than six hours, we will ask for a deposit of up to one third of the access fee before we start (section 54(2)). If the request is refused, the deposit is refunded.
11. Availability of this manual
This manual is available:
- on protoworks.dev;
- for inspection, by arrangement with the Information Officer; and
- to the Regulator on request.
A printed copy is available on request, at the prescribed reproduction fee.
12. Updates
We review this manual at least once a year and whenever our contact details or processing change. Each update carries a new version number and date.
Issued by Richard Peters, Director and Head of Protoworks Group (Pty) Ltd, on 25 September 2026.