Access to information manual

This is the manual of Amiti Connect (Pty) Ltd, a private body, under section 51 of the Promotion of Access to Information Act 2 of 2000 (PAIA). It explains what records we hold and how you can ask for them. It also describes how we process personal information, as the Protection of Personal Information Act 4 of 2013 (POPIA) requires.

In this manual "Amiti", "we" and "us" mean Amiti Connect (Pty) Ltd.

Where to get this manual

• On our website, at amiti.co.za/paia, where you can also download it as a PDF.
• At our office, by appointment, for you to read free of charge.
• By email or post from our Information Officer (section 3). A printed copy costs the prescribed copying fee in section 6.

We also give a copy to the Information Regulator if it asks.

The Information Regulator's guide

The Information Regulator publishes a guide on how to use PAIA and POPIA. It explains your rights, how to make a request to any public or private body, and what help is available. It is free, in every official language, at inforegulator.org.za and at the Regulator's offices:

• Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191
• Email: enquiries@inforegulator.org.za
• Phone: 010 023 5200

• Name: Amiti Connect (Pty) Ltd
• Registration number: 2019/387758/07
• Head of the private body: Theunis de Klerk, director
• Street address: Crossfire Place, 15 Gardener Williams Avenue, Paardevlei, Somerset West, 7130
• Postal address: Crossfire Place, 15 Gardener Williams Avenue, Paardevlei, Somerset West, 7130
• Phone: +27 83 244 5540
• Fax: none
• Email: hello@amiti.co.za
• Website: amiti.co.za

Amiti Connect provides Amiti, an assistant that helps estates, schools and clubs run their WhatsApp groups.

Our director, as head of the company, is our Information Officer. Send every request under this manual to:

• Information Officer: Theunis de Klerk
• Email: hello@amiti.co.za
• Phone: +27 83 244 5540
• Post or by hand: Crossfire Place, 15 Gardener Williams Avenue, Paardevlei, Somerset West, 7130

We have not designated a deputy Information Officer.

Records available without a request

We have not published a notice under section 52(2) of PAIA. The following are available to anyone, without a request and without a fee:

• everything on our website, including our prices, our privacy notice, our terms and this manual;
• our company details on the CIPC register.

Records we keep because the law requires it

We keep records under these laws, as far as they apply to us:

• Basic Conditions of Employment Act 75 of 1997
• Companies Act 71 of 2008
• Compensation for Occupational Injuries and Diseases Act 130 of 1993
• Consumer Protection Act 68 of 2008
• Electronic Communications and Transactions Act 25 of 2002
• Employment Equity Act 55 of 1998
• Income Tax Act 58 of 1962
• Labour Relations Act 66 of 1995
• Promotion of Access to Information Act 2 of 2000
• Protection of Personal Information Act 4 of 2013
• Tax Administration Act 28 of 2011
• Unemployment Insurance Act 63 of 2001 and Unemployment Insurance Contributions Act 4 of 2002
• Value-Added Tax Act 89 of 1991

A record kept under one of these laws is available under that law where it allows access. Otherwise you can ask for it under this manual.

Subjects and categories of records

You can ask for any of these records. Some will be refused for the reasons in section 7.

Subject	Categories of records
Company	Memorandum of incorporation, CIPC registration documents and annual returns, director and shareholder records, resolutions and minutes
Finance and tax	Annual financial statements, accounting records, invoices, bank statements, tax returns and assessments, VAT records
Customers	Agreements and plan confirmations, contact details of the people who act for each customer, set-up notes, support conversations, invoices and payment records
Communities using Amiti (held for our customers)	Records of each customer's WhatsApp groups, member lists, conversations with the assistant, the customer's rules and documents, notifications and reports
Suppliers and operators	Agreements, operator agreements, invoices and correspondence
Staff and contractors	Contracts, payroll and tax records, leave records, and other records employment law requires
Information technology	System and security logs, access records, backups, and records of security incidents
Website	Website content, and the technical logs the website host keeps
Legal	Correspondence with authorities, legal opinions, disputes and claims
Marketing	Brochures, presentations, price lists and correspondence with people who asked about Amiti

We hold records of a community's groups for the customer that runs that community. If you ask for them, we decide the request ourselves. Because they hold other people's personal information, we tell the customer and the people concerned as section 71 of PAIA requires, and we may refuse under section 63.

How we process personal information

Why we process it. To provide Amiti to our customers, including welcome messages and broadcasts they choose to send. To set up, support and invoice customers. To answer enquiries. To keep the service and website working and secure. To keep the records the law requires. Our privacy notice sets out each purpose and our reason in law for it.

Whose information, and what information.

Data subjects	Personal information
Website visitors	IP address, browser and device type, pages visited and times, in the website host's technical logs
People who contact us	Name, phone number or email address, organisation, and what they tell us
Customers and the people who act for them	Names, phone numbers, email addresses, roles, dashboard log-in details and use, agreements, support records, invoices and payments. For customers that are companies or other organisations: registered name, registration and VAT numbers, address
Members of groups that use Amiti (we act as operator for the customer)	Phone number, WhatsApp profile name, messages with replies, reactions, edits and deletions, photos, voice notes, documents and the text read from them, joining and leaving, admin status, member-list details such as a unit or house number
People who message the assistant (we act as operator for the customer)	Phone number, WhatsApp profile name, messages and the assistant's replies
People mentioned in groups, such as service providers members recommend	Name, contact details and what members say about them
Suppliers and operators	Company name, contact people, agreements, invoices and bank details for payment
Staff and contractors	Names, contact details, identity numbers, contracts, tax and payroll details, bank details for payment

Who may receive it. The customer's authorised admins, and systems the customer connects through its API access, for that customer's community records. Our operators: cloud hosting and storage, the WhatsApp messaging provider, AI language services, transcription and document-reading services, and services for sign-in, tracing of AI requests, logging and error monitoring, product analytics and email delivery, and a technology company in the European Union that develops and runs the Amiti platform for us. WhatsApp, which carries every message. Our accountant, auditor and lawyers. Authorities such as the South African Revenue Service when the law requires it. A buyer of our business, if we sell it.

Information sent outside South Africa. Our main servers, database and backups are in South Africa. Operators in the European Union, the United States and India process parts of the information, and some services run on global networks in other countries. We send personal information outside South Africa only as section 72 of POPIA allows, usually where the recipient is bound by law or a written agreement that protects it in ways substantially similar to POPIA.

How we protect it. We encrypt information in transit between devices, our servers and our operators. People get access only to what their role needs, with extra sign-in checks for accounts that can see everything. Every operator is bound by a written agreement to keep information secure. We keep regular backups in South Africa. If personal information is accessed or obtained without permission, we notify the Information Regulator and the people affected for our own records (POPIA section 22), and for a community's records we tell the community straight away (section 21(2)).

Making a request

1. Fill in Form 2 of the PAIA Regulations, "Request for access to record". You can get it from our Information Officer or from inforegulator.org.za.
2. Send it to our Information Officer by email, by post or by hand (section 3).
3. Pay the request fee, if one applies (section 6).

On the form, describe the record clearly enough for us to find it. Say how you want access, for example a copy by email or a chance to look at the record. Say which right you want to exercise or protect, and why you need the record to do so, as section 53 of PAIA requires.

If you ask on behalf of someone else, include proof that you may act for them. If you need help with the form, contact our Information Officer, who will help you.

Asking for your own personal information

You can ask whether we hold personal information about you, free of charge, under section 23 of POPIA. To ask for a copy, use Form 2 of the PAIA Regulations, as above. We waive the request fee when you ask for your own personal information.

To ask us to correct or delete personal information, use Form 2 of the POPIA Regulations. To object to how we use it, use Form 1 of the POPIA Regulations. A clear email to our Information Officer is also enough. For a community's records, we pass correction, deletion and objection requests to that community, which is the responsible party for them, and help it respond.

What happens next

• We may ask you to prove who you are.
• We decide within 30 days of receiving your request, and tell you on Form 3 of the PAIA Regulations. We may extend that once, by up to 30 days, if the request is for a large number of records or needs a long search or consultation. If we do, we tell you why.
• If the record contains information about someone else, or is a community's record that we hold, we may first have to tell that person or community and give them 21 days to respond (sections 71 and 72 of PAIA). We then decide within 30 days after every one of them has been told, instead of within 30 days of receiving your request (section 73). We let you know when this applies. If we cannot tell someone after taking all reasonable steps, we decide without their response, and we tell you the date by which we will decide.
• If we do not decide within the time allowed, the law treats your request as refused (section 58 of PAIA), and you can use the remedies in section 8.
• If we grant your request, you get access once you have paid any access fee. Where we had to tell someone else about your request, we give access only once 30 days have passed after we tell them of our decision. If they complain to the Information Regulator or apply to court within those 30 days (see section 8), we wait for the outcome (section 73).

These are the fees the PAIA Regulations, 2021 prescribe for private bodies. We will tell you in writing what you owe before you pay anything.

What	Fee
Request fee, payable by every requester (we waive it for a request for your own personal information, see section 5)	R140.00
Photocopy of an A4 page, black and white	R2.00 per page or part of a page
Printed copy of an A4 page	R2.00 per page or part of a page
Copy in electronic form on a flash drive you provide	R40.00
Copy on a compact disc you provide	R40.00
Copy on a compact disc we provide	R60.00
Transcription of visual images, per A4 page	Quoted by the service provider
Copy of visual images	Quoted by the service provider
Transcription of an audio record, per A4 page	R24.00
Copy of an audio record on a flash drive you provide	R40.00
Copy of an audio record on a compact disc you provide	R40.00
Copy of an audio record on a compact disc we provide	R60.00
Search and preparation, for each hour or part of an hour after the first hour	R145.00, up to a total of R435.00

• Deposit. If the search and preparation will take more than six hours, we may ask for a deposit of one third of the fees for the copies and transcriptions in the table, not counting the search and preparation fee, before we start. If we then refuse your request, we refund the deposit.
• Sending copies. We do not charge for sending records by email or by post.
• Paying. We tell you how to pay when we tell you the fee.

We may refuse access to a record, or part of it, only on the grounds PAIA sets out. We must refuse where a record would:

• unreasonably disclose personal information about another person, including someone who has died (section 63);
• disclose another company's trade secrets, or financial, commercial, scientific or technical information that would likely harm it, or information it gave us in confidence that would put it at a disadvantage in negotiations or competition (section 64);
• breach a duty of confidence we owe someone else under an agreement (section 65);
• endanger someone's life or physical safety (section 66(a));
• be privileged from production in legal proceedings, unless the privilege has been waived (section 67);
• disclose research being carried out by or for someone else, where that would seriously disadvantage them, the researcher or the subject of the research (section 69(1)).

We may refuse where a record would:

• prejudice the security of a building, structure, system, means of transport or other property, or of methods used to protect people or property (section 66(b));
• disclose our own trade secrets, or financial, commercial, scientific or technical information that would likely harm us, or put us at a disadvantage in negotiations or competition, or a computer program we own (section 68);
• disclose our own research, where that would seriously disadvantage us, the researcher or the subject of the research (section 69(2)).

Even then, we must give access if disclosing the record would reveal evidence of a serious breach of the law or an imminent and serious risk to public safety or the environment, and the public interest in disclosure clearly outweighs the harm (section 70).

If only part of a record may be refused, we give you the rest (section 59). If we refuse, we tell you why and what you can do next.

We are a private body, so there is no internal appeal. If you are unhappy with our decision about your request, including a refusal, a fee, an extension of time or the form of access, you can take these steps, in this order:

1. Complain to the Information Regulator within 180 days of our decision, on Form 5 of the PAIA Regulations, to PAIAComplaints@inforegulator.org.za (sections 77A to 77E of PAIA).
2. Apply to a court (section 78 of PAIA), within 180 days, if you are still unhappy after the Regulator's complaint process. The law requires you to use that process first.

Complaints about how we process personal information go to the Information Regulator under POPIA, to POPIAComplaints@inforegulator.org.za.

Information Regulator: Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191. Phone 010 023 5200. Website inforegulator.org.za.