1code X (Pty) Ltd PAIA and POPIA Manual

This manual is published under section 51 of the Promotion of Access to Information Act 2 of 2000 (PAIA), as amended by the Protection of Personal Information Act 4 of 2013 (POPIA), and regulation 4(1)(c) of the POPIA Regulations, 2018. It follows the Information Regulator's template manual for private bodies.

It tells you what records 1code X (Pty) Ltd holds, which of them you can get without asking, how to ask for the others, what it costs, when we may refuse, and what you can do if you disagree. Its last part explains how we handle personal information, as POPIA requires.

If you want your own personal information, you do not need this procedure to start. Write to privacy@1code.email. It is free (see section 9).

1. Words used in this manual

2. About 1code SA

1code X (Pty) Ltd is a private company registered in South Africa, registration number 2025/981275/07.

People who live in South Africa, or whose business is established there, contract with 1code SA for everything they use and buy on 1code, and 1code SA bills them in rand through Paystack. 1code SA uses 1code UK to run 1code for them, including 1code ID and 1code Mail. 1code UK publishes the 1code phone app on Google Play. Our team works from South Africa.

1code UK is the responsible party (the controller) for the personal information in the 1code service, for everyone. 1code SA handles that information for 1code UK, as its operator. 1code SA is the responsible party for its own company, tax, accounting, staff and supplier records. Section 12 explains this in more detail.

3. Contact details

Head of the private body and Information Officer

Deputy Information Officer: none appointed. The Information Officer deals with every request.

Registration with the Regulator: to be confirmed — register the Information Officer on the Regulator's eServices portal under section 55(2) of POPIA, and add the registration number here — owner

The Information Officer also handles the same requests for 1code UK (see section 8.8).

4. The Regulator's Guide on how to use PAIA

The Regulator has updated and published the Guide under section 10 of PAIA. It explains, in plain language, how to use PAIA and POPIA to get access to records. It covers:

• the purpose of PAIA and POPIA;
• the postal and street address, phone number and email of the Information Officer of every public body, and of every Deputy Information Officer of every public and private body;
• how and in what form to ask a public or private body for a record, and how to ask a responsible party for your own personal information under section 23 of POPIA;
• the help that Information Officers and the Regulator must give you;
• every remedy you have, including internal appeals against public bodies, complaints to the Regulator and applications to court;
• the duty of public and private bodies to publish a manual, and how to get one;
• the fees; and
• the regulations made under PAIA.

How to get the Guide

• Download it from the Regulator's website, inforegulator.org.za. It is available in every official language and in braille.
• Inspect it at the Regulator's office: Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg 2191.
• Ask the Regulator for a copy: P.O. Box 31533, Braamfontein, Johannesburg 2017, enquiries@inforegulator.org.za, 010 023 5200 or toll-free 0800 017 160. The Regulator uses Form 01 (Request for a Guide from the Regulator, regulation 2).
• Ask us for a copy, or to inspect it at our office during normal business hours, using Form 01 (Request for a copy of the Guide from an Information Officer, regulation 3) or any written request to privacy@1code.email. We do not charge for a copy of the Guide or for inspecting it.

5. Records you can get without a request

You do not need to make a request for these. They are freely available:

1code.co.za, the South African door to the same website, shows the same pages. We have not published a notice under section 52 of PAIA. If you cannot find one of these records, write to privacy@1code.email and we will send it to you free of charge.

6. Records available under other laws

The laws below require us to keep certain records. Some of these laws also give certain people (such as shareholders, employees or officials) a right to see particular records. Those people can use the procedure in that law. Everyone else can use the procedure in this manual. The list is not complete. If a law not listed here gives you a right to a record, we will honour it.

to be confirmed — whether 1code SA has employees, or only contractors. If it has no employees, the employment laws above can be removed — owner

7. Subjects on which we hold records

These are the subjects on which we hold records, and the kinds of record we hold on each. Listing a record here does not mean you can have it. Each request is decided under PAIA, including the grounds for refusal in section 10.

8. How to ask for a record

8.1 What you must show

You must show that you need the record to use or protect a right (section 50 of PAIA). This is not required when you ask for your own personal information.

8.2 Use Form 02

Use Form 02, "Request for access to record", prescribed by regulation 7 of the PAIA Regulations. You can download it from the Regulator's website, inforegulator.org.za, or ask us for a copy.

In the form, give:

• enough detail for us to find the record;
• the form of access you want, for example an electronic copy by email;
• your postal address, email address or other way for us to reach you;
• the right you want to use or protect, and why you need the record for it;
• if you want to be told our decision in another way as well, which way; and
• if you ask for someone else, proof that you may act for them.

Include proof of your identity. If you need help to complete the form, for example because of a disability, tell us and we will help you.

8.3 Where to send it

• Email: privacy@1code.email, with "PAIA request" in the subject line
• Post or hand delivery: The Information Officer, 1code X (Pty) Ltd, 2 The Circus St, Three Rivers, Vereeniging 1935

Hand delivery is by appointment only. Write to privacy@1code.email first and we will arrange a time.

8.4 Fees before we start

If you are not a personal requester, we will ask you to pay the request fee before we deal with your request (section 54 of PAIA). Section 9 sets out the fees.

8.5 How long it takes

• We decide within 30 days after we receive a complete request and any request fee that is due.
• We may extend this once, by up to 30 more days, if the request is for a large number of records, if we must search records held somewhere else, if we must consult others first, or if you agree. We tell you in writing before the first 30 days end, with our reasons. You can complain to the Regulator or apply to a court about an extension.
• If we do not decide within the time allowed, the law treats your request as refused (section 58 of PAIA).

8.6 Records about other people or businesses

If the record contains information about a third party, we take reasonable steps to tell them within 21 days of receiving your request. They then have 21 days to agree to its release or to tell us why it should not be released. We decide within 30 days after telling them, and tell you both. If we decide to release the record, we wait 30 days before releasing it, so that the third party can complain to the Regulator or go to court.

8.7 Our answer

We tell you our decision on Form 03, "Outcome of request and of fees payable" (regulation 8).

• If we grant the request, we tell you the access fee (if any), the form in which you will get the record and your right to complain if you disagree with the fee or the form. We give access once you have paid.
• If we refuse, we give you our reasons, the provision of PAIA we rely on, and your right to complain to the Regulator or apply to a court.
• If we grant part of it, we give you the parts that can be released and blank out the rest (section 59 of PAIA).
• If we cannot find the record or it does not exist, we tell you in an affidavit or affirmation, with the steps we took to find it (section 55 of PAIA).

We give access in the form you ask for, unless that would interfere unreasonably with how we run our business, damage the record, or infringe someone else's copyright. Then we offer another form.

8.8 Records held by 1code UK

Most information about the 1code service, such as accounts, content, mail and security records, is held by 1code UK in the United Kingdom and stored in Western Europe. Our team in South Africa has access to it only to work for 1code UK.

You can send a request about any 1code record to the same Information Officer. If the record is held by 1code UK, we deal with your request together with 1code UK under this manual. 1code UK has agreed in writing to help. If your request is about your own personal information, 1code UK's Privacy Policy also gives you the right to a copy, free of charge, under the UK GDPR as well as POPIA.

8.9 PAIA does not apply in some cases

PAIA does not apply to a record requested for criminal or civil proceedings after those proceedings have started, if another law provides for access to it (section 7 of PAIA). You must then use the court procedure.

9. Fees

Your own personal information is free. We do not charge personal requesters any fee: no request fee and no access fee. This matches our Privacy Policy.

Copies of this manual and of the Guide are free.

Other requests. For every other request, the fees are those prescribed for private bodies in Annexure B to the PAIA Regulations, 2021 (Government Notice R. 757 of 27 August 2021). On the date of this manual, they are:

Deposit. If searching for and preparing the record will take more than six hours, we may ask for a deposit of one third of the access fee (items 2 to 8) before we search (section 54 of PAIA).

If the request is refused, we refund any deposit.

Where you can challenge a fee. You can complain to the Regulator or apply to a court about a request fee, a deposit or an access fee.

Fees we choose not to charge. We send electronic copies by email where possible. We do not charge for the first hour of searching, as the regulations provide, and we may waive other fees.

The fees change only when the PAIA Regulations change. The current schedule is on the Regulator's website.

10. When we may refuse

PAIA allows, and sometimes requires, a private body to refuse access. The grounds are in Chapter 4 of Part 3 of PAIA (sections 62 to 70). In plain terms, we may or must refuse access where the record:

• contains personal information about another person and releasing it would be an unreasonable disclosure (section 63). This protects our customers, users, staff and others, including people who have died;
• contains a third party's commercial information: trade secrets, or financial, commercial, scientific or technical information whose release would be likely to harm them, or information given to us in confidence whose release would put them at a disadvantage in negotiations or competition (section 64);
• would breach a duty of confidence we owe to a third party under an agreement (section 65);
• could endanger someone's life or physical safety, or would be likely to harm the security of a building, a system (including a computer or communication system), or the ways in which people or property are protected (section 66). This covers, for example, details of our security measures and sign-in systems;
• is privileged from production in legal proceedings, unless the privilege has been waived (section 67);
• contains our own commercial information: trade secrets; financial, commercial, scientific or technical information whose release would be likely to harm us; information whose release would put us at a disadvantage in negotiations or competition; or a computer program we own (section 68);
• contains research information of a third party or of us, whose release would be likely to expose the third party, the researcher or the subject of the research to serious disadvantage (section 69).

When we must release it anyway. Even where one of these grounds applies, we must release a record if it would reveal evidence of a substantial breach of the law, or an imminent and serious risk to public safety or the environment, and the public interest in releasing it clearly outweighs the harm the ground protects against (section 70).

If only part of a record is protected, we release the rest.

11. If you disagree with our decision

There is no internal appeal against a decision of a private body. You may:

• Complain to the Regulator within 180 days of our decision (sections 77A and 77B of PAIA). Use Form 05, "Complaint form" (regulation 10), from the Regulator's website. You can complain about a refusal, a fee, an extension of time or the form of access. The Regulator may investigate, try to settle the matter, and issue an enforcement notice.
• Apply to a court within 180 days for appropriate relief (sections 78 and 82 of PAIA). The Act may require you to use the Regulator's complaint procedure first. The Guide explains this.

A third party may do the same if we decide to release a record about them.

The Information Regulator (South Africa)

• Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg 2191
• P.O. Box 31533, Braamfontein, Johannesburg 2017
• 010 023 5200 or toll-free 0800 017 160
• General enquiries: enquiries@inforegulator.org.za
• Complaints: use the address on Form 05 (at the date of this manual, PAIAComplaints@inforegulator.org.za)
• inforegulator.org.za

12. How we handle personal information (POPIA)

Section 51(1) of PAIA, as amended by POPIA, requires this part. Our Privacy Policy, at 1code.studio/privacy, has the full detail.

12.1 Who is responsible

• For the 1code service (accounts, content, mail, rooms, stores, invoices in Books, sign-in and security records), 1code UK is the responsible party for everyone, including people in South Africa. 1code SA handles this information only for 1code UK, as its operator, under a written agreement that meets sections 19 to 21 and 72 of POPIA.
• For 1code SA's own records (company, tax and accounting records, records of our contracts with South African customers, staff and supplier records), 1code SA is the responsible party.
• For information our customers put in 1code about other people (company mailboxes, audiences in Rooms, shoppers in Store, clients in Books), the customer is the responsible party, and 1code acts as its operator.

12.2 Why we process personal information

We do not sell personal information, show advertising, send marketing email or use anyone's content to train AI.

12.3 People we hold information about, and what we hold

We do not intend to process special personal information (such as health, religion or biometric information) or children's information, apart from staff health information that labour law requires. 1code is for people aged 18 or over. Users may choose to put such information in their own content, which we look at only when our work for 1code UK requires it, as the Privacy Policy describes.

12.4 Who receives it

• 1code UK, which runs 1code and is the responsible party for the service.
• Our operators and theirs: Paystack (payments, South Africa); Cloudflare (hosting, storage and email); Resend (sending email); Google (Firebase notifications, Cloud Key Management and Google Play); domains.co.za and Name.com (domains customers buy through us). The Privacy Policy lists them all.
• Our accountants and auditors. to be confirmed — name of the accountant or auditor of 1code SA — owner
• Banks, for payments and payouts.
• Authorities, only where the law requires: SARS, CIPC, the South African Police Service, the Regulator, the Film and Publication Board, courts and other bodies with lawful power to require it.
• The people you share content with, and the services and AI agents you connect, as you choose.

12.5 Personal information that leaves South Africa

1code is run from the United Kingdom, its data is stored in Western Europe, and some of its operators are in the United States. So personal information leaves South Africa:

Each transfer is also needed to carry out the contract between the customer and us. We do not send special personal information or children's information to a country without adequate protection, so the Regulator's prior authorisation under section 57 of POPIA is not needed.

12.6 How we keep it secure

This is a general description, as section 51(1) of PAIA requires. We do not publish details that would help someone attack us.

• Encryption. Information is encrypted on its way to and from 1code, and our storage provider encrypts it at rest.
• No passwords. Our staff sign in with 1code ID: a private key on their phone, behind fingerprint or face, that never leaves the phone.
• Least access. Staff reach only the systems and information their work needs. Access is granted by role, reviewed, and removed when it is no longer needed.
• Records of access. Sign-ins and important actions are logged, and the logs are kept for 12 months.
• Keys. Keys from other services are kept encrypted. Keys we issue to apps and AI agents are kept only as one-way fingerprints.
• Private storage. Identity documents are kept in private storage that is never public.
• Staff. Everyone who works with personal information is bound to confidentiality and trained on these rules. People at 1code do not read users' content unless the user asks, we must look into abuse or a security problem, or the law requires it.
• Devices. Staff computers and phones use full-disk encryption, a screen lock and current software updates.
• Operators. Everyone who handles personal information for us does so under a written agreement that requires security measures, as section 21 of POPIA requires.
• Deletion. We delete information on fixed schedules, set out in the Privacy Policy. Backups are kept for up to 30 days.
• Security compromises. If personal information is accessed or acquired by someone not allowed to, we tell the Regulator through its eServices portal and tell the people affected, as soon as reasonably possible, as section 22 of POPIA requires.

12.7 Your rights under POPIA

You have the right to:

• find out whether we hold personal information about you, for free, and ask for a copy of it or a description of it (section 23 of POPIA). Use the procedure in section 8 of this manual, or simply write to privacy@1code.email. It is free;
• ask us to correct or delete it, or to destroy a record we are no longer allowed to keep (section 24). Use Form 2 of the POPIA Regulations, 2018, or any written request;
• object to our processing it, on reasonable grounds about your own situation, where we rely on legitimate interests (section 11(3)). Use Form 1 of the POPIA Regulations, 2018, or any written request. Objecting is free;
• not be subject to a decision made by computer alone that has legal or similarly serious effects (section 71). We do not make such decisions;
• complain to the Regulator (section 74) at POPIAComplaints@inforegulator.org.za or using the details in section 11.

We may ask you to confirm it is you by approving on your phone with 1code ID before we act. We answer within one month.

13. Where to find this manual

This manual is available:

• on our website, at 1code.co.za/paia (also at 1code.studio/paia);
• for inspection at 2 The Circus St, Three Rivers, Vereeniging 1935, by appointment, during normal business hours;
• free of charge by email from privacy@1code.email; and
• to the Regulator on request.

14. Updates

We review this manual at least once a year, and whenever our business, our records or the law changes in a way that affects it. Each version shows its date and number.

Approval

Approved by the head of 1code X (Pty) Ltd.

Name: Thebe Phele Position: Director and Information Officer Signature: ______________________ Date: ______________________

to be confirmed — sign and date, publish on the website, and keep a printed copy at the business address — owner