PAIA Manual

1. List of acronyms and abbreviations

2. Purpose of this manual

Sportivo SA (Pty) Ltd is a private body as defined in PAIA. This manual is published in terms of section 51 of PAIA and is intended to assist any person who wishes to request access to a record held by the Company.

This manual sets out:

• the records the Company holds that are available without a formal PAIA request;
• the records the Company holds that are accessible in terms of other legislation;
• the subjects on which the Company holds records, and the categories of records held under each subject;
• the procedure to be followed in submitting a request for access, and the fees payable;
• the contact details of the Information Officer;
• how to obtain the Regulator’s guide on how to use PAIA;
• the purpose for which the Company processes personal information, the categories of data subjects and of personal information processed, the recipients to whom personal information may be supplied, whether personal information is transferred outside the Republic, and a general description of the Company’s information security measures.

The last two items are required by PAIA as amended by POPIA, and this manual accordingly serves both as the Company’s PAIA manual and as its published description of its processing of personal information.

3. Contact details

3.1 Information Officer

3.2 Deputy Information Officer

The Company has not designated a Deputy Information Officer. All requests must be directed to the Information Officer.

3.3 Registered office and postal address

4. The Regulator’s guide on how to use PAIA

The Regulator has published a guide, in terms of section 10 of PAIA, containing the information a person requires in order to exercise a right under PAIA. The guide is available in each of the official languages and in braille.

The guide may be obtained from the Regulator at:

5. Records available without a request

The Company has not published a notice in terms of section 52(2) of PAIA.

The following records are nevertheless made available without the need for a formal PAIA request, on the basis set out below:

6. Records available in terms of other legislation

Certain records held by the Company are accessible in terms of legislation other than PAIA. Access in those cases is governed by the relevant statute and not by this manual.

7. Subjects and categories of records held

The Company holds records on the following subjects. The listing of a record in this manual does not mean that access to it will be granted; every request is considered on its merits against the grounds of refusal in PAIA.

8. Processing of personal information

8.1 Purpose of processing

The Company processes personal information in order to provide its sports performance analytics, tournament management and scheduling services to its clients; to administer client accounts, licences, orders and billing; to provide support and training; to employ and administer its personnel; to manage its supplier relationships; to market its services; to secure and maintain its systems; and to comply with its legal obligations.

Responsible party and operator. In respect of its own client, employee and supplier records, the Company acts as a responsible party. In respect of team, player and participant data captured on the platform by or for a client school, club, union or tournament organiser, the Company acts as an operator on behalf of that client. The client remains the responsible party for that data and is responsible for the lawful basis on which it is collected, including any consent required in respect of a child under section 35 of POPIA. The Company processes such data only on the client’s documented instruction and in terms of a written operator agreement as required by section 21 of POPIA.

8.2 Categories of data subjects and personal information processed

8.3 Recipients of personal information

8.4 Transborder flows of personal information

The Company uses cloud hosting, communications and business software providers whose infrastructure may be located outside the Republic of South Africa. Where personal information is transferred to a recipient in a foreign country, the Company transfers it only in accordance with section 72 of POPIA, and on the basis of a written agreement that imposes obligations on the recipient that are substantially similar to the conditions for lawful processing under POPIA.

Current providers and hosting regions: Microsoft Azure (platform hosting, West Europe region, the Netherlands), Google Firebase (authentication, European Union, Germany) and Vimeo (video storage for match footage and website videos, United States; certified under the EU-U.S. Data Privacy Framework). The Company’s other service providers — Freshsales, Zoho, Twilio SendGrid, Google Analytics, Peach Payments, Stripe, Wise and PayPal — are listed in section 9 of the Privacy Policy.

8.5 Information security measures

The Company has put in place appropriate, reasonable technical and organisational measures to secure the integrity and confidentiality of personal information in its possession or under its control, including:

• role-based access control, so that users and staff can reach only the data their role requires;
• individual user accounts and password controls, with multi-factor authentication on administrative accounts;
• encryption of data in transit;
• regular backups and tested restoration procedures;
• written operator agreements with all third parties that process personal information on the Company’s behalf;
• logging of system and administrative access;
• an internal procedure for identifying, containing and reporting security compromises, including notification to the Regulator and to affected data subjects where section 22 of POPIA requires it.

9. How to request access to a record

9.1 The request

9.1.1 A request for access to a record held by the Company must be made on Form 2 (Request for Access to Record of Private Body), prescribed by regulation 7 of the PAIA Regulations, 2021. Form 2 is attached as Annexure A and is available on the Company’s website.

9.1.2 The completed form must be delivered to the Information Officer at the address, or sent to the email address, in paragraph 3 of this manual.

9.1.3 The requester must provide sufficient particulars to enable the Information Officer to identify the record and the requester, and must indicate the form of access required and the manner in which the requester wishes to be informed of the decision.

9.1.4 A requester must state the right that is sought to be exercised or protected and explain why the record requested is required for the exercise or protection of that right, as required by section 50(1)(a) of PAIA.

9.1.5 If the request is made on behalf of another person, proof of the capacity in which the requester is acting must be attached.

9.1.6 A requester who is unable to read or write, or who has a disability, may make the request orally to the Information Officer, who will complete Form 2 on that person’s behalf and provide a copy.

9.2 Fees

Two fees may be payable. A request fee is payable by every requester on submission of the request. An access fee is payable, where access is granted, for the reproduction, search and preparation of the record, and for postage or electronic transfer. The fees are those prescribed in Annexure B to the PAIA Regulations, 2021, and are set out in Annexure B to this manual.

The Information Officer will notify the requester of the access fee payable before granting access, and may require a deposit where the search is likely to exceed six hours. Access will be granted once the applicable fees have been paid.

9.3 Decision and timelines

9.3.1 The Information Officer will decide the request and notify the requester in writing within 30 days of receipt of the request.

9.3.2 That period may be extended once, by a further period of not more than 30 days, where the request is for a large number of records, or requires a search through records held at premises other than the Company’s office, or where consultation is necessary and cannot reasonably be completed within the original period. The requester will be notified in writing of any extension and the reasons for it.

9.3.3 Where a request is refused, the notice will state adequate reasons for the refusal, the provisions of PAIA relied on, and that the requester may lodge a complaint with the Regulator or apply to a court.

9.4 Grounds for refusal

The Company may, and in some cases must, refuse a request on the grounds set out in Chapter 4 of Part 3 of PAIA, which include:

• the mandatory protection of the privacy of a third party who is a natural person (section 63);
• the mandatory protection of the commercial information of a third party (section 64);
• the mandatory protection of information supplied in confidence, where disclosure would constitute a breach of a duty of confidence (section 65);
• the mandatory protection of the safety of individuals and the protection of property (section 66);
• the mandatory protection of records privileged from production in legal proceedings (section 67);
• the protection of the Company’s own commercial information, including trade secrets, and information the disclosure of which would harm its commercial or financial interests (section 68);
• the protection of research information of the Company or a third party (section 69).

A record must nevertheless be disclosed where section 70 of PAIA applies, being where the public interest in disclosure clearly outweighs the harm contemplated by the ground of refusal.

9.5 Remedies

There is no internal appeal against a decision of the Information Officer of a private body. A requester who is dissatisfied with a decision may lodge a complaint with the Regulator in terms of section 77A of PAIA within 180 days of the decision, or may apply to a court for appropriate relief in terms of section 78 of PAIA.

10. Availability of this manual

This manual is available:

• on the Company’s website at https://sportivo.app;
• for inspection at the Company’s principal place of business during normal business hours, free of charge;
• to any person on request, against payment of the prescribed fee of R2.00 per A4 page or part of a page;
• to the Information Regulator on request, free of charge.

11. Updating of this manual

The Information Officer will review this manual at least once a year, and will update it whenever there is a material change to the Company’s structure, contact details, the records it holds or the manner in which it processes personal information. The version number and review date on the cover page will be updated on each revision.

Annexure A — Form 2: Request for access to record of private body

Regulation 7 of the Regulations relating to the Promotion of Access to Information, 2021. Form A and Form C, prescribed under the repealed 2002 Regulations, are no longer valid and must not be used.

A. Particulars of private body

B. Particulars of requester

C. Particulars of person on whose behalf the request is made

Complete only if the request is made on behalf of another person.

D. Particulars of record requested

E. Form of access and manner of notification

F. Right to be exercised or protected

G. Fees

A request fee of R140.00 is payable on submission of this form. An access fee may be payable before access is granted, calculated in accordance with Annexure B to this manual.

Annexure B — Fees payable

As prescribed in Annexure B to the Regulations relating to the Promotion of Access to Information, 2021, for a private body. Amounts include VAT where applicable.