PAIA manual

• “JollyBee”, “we”, “us”: Buzz Holdings (Pty) Ltd
• “PAIA”: the Promotion of Access to Information Act 2 of 2000
• “POPIA”: the Protection of Personal Information Act 4 of 2013
• “Regulator”: the Information Regulator (South Africa)
• “IO”: Information Officer; “DIO”: Deputy Information Officer

PAIA gives everyone a right of access to records held by a private body when the record is needed to exercise or protect a right. This manual tells you what records we hold and how to request them, as section 51 requires. It also describes how we process personal information, as section 51(1)(c) requires.

• Information Officer, designated by the head of Buzz Holdings (Pty) Ltd: Reinier Matthee
• Deputy Information Officer: none appointed yet
• Email: reinier@jollybee.buzz
• Postal and street address: 3 Timberon Street, Buitenverwagting, Paarl, South Africa
• Website: jollybee.buzz

The Regulator publishes a guide under section 10 of PAIA. It explains how to use PAIA and POPIA to request access to records, the help available from information officers, the remedies available and the fees. It is available in English and ten other official languages on the Regulator’s website (the English version), or from the Regulator at Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191, phone 010 023 5200, email enquiries@inforegulator.org.za.

A copy of the guide in English and Afrikaans is available for inspection at our address above during normal office hours, as regulation 3 of the PAIA Regulations, 2021 requires. You can ask our Information Officer for a copy. There is no charge for inspecting or receiving a copy of the guide.

These records are published on our website and you do not need to request them:

• Privacy Policy, including our list of service providers
• Terms of Service and Merchant terms
• This PAIA manual
• How to request account deletion
• Help articles at jollybee.buzz/help
• Public community, event and offering pages that communities publish on JollyBee

We keep records as the following laws require, where they apply to us. Some of these records are available to the people the law names, for example shareholders under the Companies Act.

• Companies Act 71 of 2008
• Income Tax Act 58 of 1962
• Tax Administration Act 28 of 2011
• Value-Added Tax Act 89 of 1991
• Basic Conditions of Employment Act 75 of 1997
• Labour Relations Act 66 of 1995
• Employment Equity Act 55 of 1998
• Unemployment Insurance Act 63 of 2001 and Unemployment Insurance Contributions Act 4 of 2002
• Compensation for Occupational Injuries and Diseases Act 130 of 1993
• Skills Development Levies Act 9 of 1999
• Occupational Health and Safety Act 85 of 1993
• Consumer Protection Act 68 of 2008
• Electronic Communications and Transactions Act 25 of 2002
• Protection of Personal Information Act 4 of 2013
• Promotion of Access to Information Act 2 of 2000

• Company records: incorporation documents, memorandum of incorporation, share register, directors’ records, resolutions and minutes.
• Financial and tax records: financial statements, accounting records, invoices, bank records, and tax and VAT returns.
• People who work for us: employment and contractor agreements, payroll, leave and statutory records.
• Customers (communities and businesses): agreements, account and billing records, invoices, payout details, team members and their permissions, business verification documents and correspondence.
• JollyBee account holders: sign-in accounts, profiles, app devices, marketing choices and correspondence.
• Records we hold for communities: members’ and contacts’ records, memberships, bookings, tickets, event registrations and answers, attendance, payments, shop orders, documents, signed agreements and messages. A community is the responsible party for these records; we may consult it, or refer a request to it, before deciding on access.
• Payments: transaction records and payment notices from our payment providers.
• Suppliers and service providers: agreements, data processing terms, invoices and correspondence.
• Technology and security: source code, system documentation, security and access logs, and incident records.
• Marketing and public content: website content, help articles, published materials and marketing consent records.
• Legal: contracts, legal opinions, disputes and regulatory correspondence.

1. Complete Form 2, “Request for access to record” (regulation 7 of the PAIA Regulations, 2021). All PAIA forms are on the Regulator’s forms page.
2. Describe the record clearly enough for us to find it, say which form of access you want (for example a copy by email), and say which right you want to exercise or protect and why you need the record for it (section 53(2)).
3. Send the form to our Information Officer by email to reinier@jollybee.buzz or by post or hand to 3 Timberon Street, Buitenverwagting, Paarl, South Africa, with a copy of your identity document. If you request on behalf of someone else, include proof of your authority.
4. Pay the request fee (below). We will not process the request until it is paid.
5. We decide within 30 days of receiving the request (section 56). We may extend this once by up to 30 days, and tell you why (section 57). We tell you the outcome and any access fee on Form 3, “Outcome of request and of fees payable”.
6. We may refuse access only on the grounds in Chapter 4 of Part 3 of PAIA (sections 62 to 70), for example to protect another person’s privacy, a third party’s commercial information, or confidential or privileged information. If a record concerns a third party, we notify them and consider their response first (section 71).

To find out what personal information we hold about you, you can also use your rights under POPIA section 23, described in our Privacy Policy.

If you disagree with our decision, you may complain to the Regulator within 180 days on PAIA Form 5 (section 77A), by email to PAIAComplaints@inforegulator.org.za, or apply to court (section 78). There is no internal appeal against a private body’s decision.

The fees are prescribed in Annexure B of the PAIA Regulations, 2021 (Government Notice R.757, Government Gazette 45057, 27 August 2021). Since POPIA amended section 54 of PAIA, the request fee is payable by every requester, including a person asking for their own personal information.

• Request fee: R140.00
• Photocopy or printed copy, per A4 page: R2.00
• Copy on a flash drive or CD provided by you: R40.00; on a CD we provide: R60.00
• Transcription of an audio record, per A4 page: R24.00
• Copy of an audio record on a flash drive or CD provided by you: R40.00; on a CD we provide: R60.00
• Transcription or copy of visual images: the quoted cost of an outside service provider
• Search and preparation, for each hour or part of an hour after the first: R145.00, up to a total of R435.00
• Postage, email or other electronic transfer: the actual cost, if any

If the search and preparation will take more than six hours, we may ask for a deposit of up to one third of the access fee before we start (regulation 8). If access is refused, the deposit is repaid.

Our Privacy Policy gives the full detail. In summary, as section 51(1)(c) requires:

10.1 Purpose of processing

• to provide the JollyBee platform to communities and businesses, and to act as their operator for their members’ and contacts’ records;
• to create and secure JollyBee accounts and sign people in;
• to take payments and keep financial records;
• to send messages that communities and people ask for, and marketing only with consent;
• to provide the AI features a community switches on;
• to keep the platform secure, prevent abuse and fix faults;
• to meet our legal and tax obligations.

10.2 Categories of data subjects and their information

• JollyBee account holders: name, email, mobile number, password hash, profile details (which can include date of birth, gender, addresses, identity number, emergency contacts and health details), devices, location data they permit, and marketing choices.
• Members and contacts of communities: contact details, memberships, bookings, tickets, registrations and answers (which can include health information and children’s details), attendance, payments and card details from payment notices (card type, first six and last four digits, expiry and a reusable token), documents, signed agreements, messages and marketing choices.
• Community owners, team members and businesses: contact details, permissions, billing and payout details, and business verification documents.
• Website and app visitors: IP address, browser or device details and request logs.
• People who work for us and our suppliers: contact, employment, payment and tax details.

10.3 Recipients

• the communities people join, and their authorised team members;
• our service providers: hosting (Vercel), database and storage (Supabase), payments (Paystack; Glimmer and Paycorp for card terminals; SnapScan), email (SendPulse), SMS (BulkSMS), WhatsApp (Meta), push notifications (Expo), maps (Mapbox), AI (Anthropic; OpenAI where a community chooses it), DNS and bot checks (Cloudflare) and app bug reports (n8n);
• services a community or person connects: Xero, Lightspeed, Cin7, Mailchimp, SendPulse and Strava;
• regulators, courts, law enforcement and the South African Revenue Service, where the law requires it; and our professional advisers.

10.4 Planned transborder flows

Our database and file storage are in Ireland (Amazon Web Services, through Supabase). Our website’s server code runs in Vercel’s Cape Town region, with fallback regions in the European Union and the United Kingdom. Email, push notifications, maps, AI and several integrations are processed in the United States or the European Union. We rely on section 72(1) of POPIA for these transfers, mainly on our providers’ binding data processing terms (section 72(1)(a)).

10.5 Security measures

• encrypted HTTPS connections for the website, app and terminals, with browsers told to use HTTPS only;
• browser security headers that restrict framing and where scripts may load from;
• sign-in sessions in HttpOnly, Secure cookies that expire after 30 days without use;
• database access rules that limit each person and each community’s team to their own records, by permission;
• card numbers entered only on our payment providers’ pages; saved card tokens for members’ payments readable only by our server;
• encryption of stored payment provider keys and of identity numbers on account profiles;
• rate limits on sign-up and sign-in, and review of suspicious new accounts;
• automatic deletion of event answers and other records after set periods, as described in our Privacy Policy.

This manual is available:

• on our website at jollybee.buzz/paia;
• for inspection at our address above during normal office hours;
• by email from our Information Officer, at no charge;
• to the Information Regulator on request.

We update this manual when our details, records or processing change, and change the date at the top.