PAIA Manual

1. Introduction

This manual is published in terms of section 51 of the Promotion of Access to Information Act, 2000 (PAIA), read with the Protection of Personal Information Act, 2013 (POPIA), for Innovative Vending Solutions (Pty) Ltd, trading as VendBot (“the Company”). It explains what records the Company holds and how to request access to them.

2. Company and Information Officer details

3. The Information Regulator’s Guide (section 10)

The Information Regulator has published a Guide on how to use PAIA, in all official languages, available from the Information Regulator (South Africa): inforegulator.org.za. The Guide explains the request procedure, fees, and remedies in detail.

4. Categories of records held

The Company holds records ordinarily required to operate and administer a South African technology and vending-services business. These include corporate and statutory records, financial, tax, banking and accounting records, client and merchant records, agreements, onboarding and FICA documentation collected for payment-partner submission, correspondence and support records, operational records relating to machines, telemetry, transaction reporting, suppliers and partners, marketing and website records, personnel records relating to directors, employees and contractors, and information-technology records such as system documentation, security policies and access logs.

Records available without a PAIA request include this PAIA Manual, our Privacy Policy, POPIA Notice, Cookie Policy, Terms of Use, published website content, product and service information made public on vendbot.co.za, and company records publicly available from CIPC or other public registries. Records may also be available under other legislation, including the Companies Act 71 of 2008, the Tax Administration Act 28 of 2011, and the Financial Intelligence Centre Act 38 of 2001.

5. How to request access

1. Complete Form 2 (Request for Access to Record) prescribed under the PAIA Regulations, 2021 (available from inforegulator.org.za).
2. Submit it to the Information Officer at support@vendbot.co.za or the business address above.
3. Identify the record clearly, state the right you seek to exercise or protect and why the record is required for that purpose, and provide proof of identity (and authority, if acting for someone else).
4. Pay the prescribed request and access fees where applicable: personal requesters pay no request fee; other requesters must pay the prescribed request fee before the request is processed; access, reproduction, search/preparation, deposit and postage fees are charged only as permitted by the PAIA Regulations, 2021, as amended.

We will decide on a request within 30 days as required by PAIA, subject to any lawful extension, and will give written reasons if access is refused (grounds of refusal appear in Chapter 4 of Part 3 of PAIA — e.g. privacy of a third party, commercial confidentiality, legal privilege).

6. Remedies

The Company is a private body and has no internal appeal procedure. If a request is refused, the requester may lodge a complaint with the Information Regulator or apply to a court with jurisdiction.

7. Processing of personal information (POPIA)

We process personal information about website enquirers, prospective and current clients, authorised representatives, portal users, suppliers, employees/contractors and business contacts. The categories include contact details, identity/FICA documents, company and banking-support documents, account credentials, portal activity, machine telemetry, transaction records with masked card details only, support correspondence and statutory/accounting records. We process this information for enquiries, contracting, merchant onboarding through AddPay, service delivery, support, security, accounting, tax and legal compliance. Recipients include AddPay and categories of operators — hosting and infrastructure providers (including an EU-hosted cloud database, authentication and storage provider), a contact-form relay provider, a business email and productivity provider, and a lead-management tool provider — as described further in our POPIA Notice and Privacy Policy. Information may be transferred outside South Africa under section 72 of POPIA where adequate protections, binding agreements or another lawful basis applies. We use role-based access, confidentiality duties, TLS encryption, row-level security, restricted document storage, credential controls and incident-response procedures.

8. Availability of this manual

This manual is available free of charge on this website and on request from the Information Officer. It will be updated when the Company’s details or record categories change.