PAIA Manual

1. Purpose of this manual

This manual is published to help you:

• see which categories of records we hold and which are available without a formal request;
• understand how to make a request for access to a record, and what it will cost;
• know the grounds on which a request may be refused and the remedies available to you; and
• understand how we process personal information, as required by section 51(1)(c) of PAIA read with POPIA.

2. Contact details

Address requests to the Information Officer and mark them "PAIA request".

3. The Information Regulator's guide to PAIA

Section 10 of PAIA requires the Information Regulator to publish a guide on how to use PAIA and POPIA. The guide is available in every official language and in braille. It explains, among other things, the objects of PAIA and POPIA, how to make a request to a public or private body, the help available from Information Officers and the Regulator, the remedies available, and the fees that apply.

You can get the guide from the Information Regulator's website at https://inforegulator.org.za/paia-guidelines/, by contacting the Regulator, or by asking our Information Officer for a copy. We will email it to you free of charge or make a copy available for inspection at our office during business hours.

• The Information Regulator (South Africa)
• Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191
• enquiries@inforegulator.org.za · 010 023 5200
• https://inforegulator.org.za

4. Records available without a request

We have not published a notice under section 52(2) of PAIA. The following records are, however, freely available without a formal request:

• Everything published on https://www.departmentsix.co, including our Terms and Conditions, Privacy Policy, this manual, service descriptions, case studies and published articles.
• Our public company records held by the Companies and Intellectual Property Commission (CIPC), which anyone may obtain from the CIPC.
• Marketing and credentials material we publish or send out.

5. Records kept under other legislation

We keep records as required by the following legislation, to the extent it applies to us. Where a statute gives you a right of access to a record, you may use that route instead of PAIA.

• Basic Conditions of Employment Act 75 of 1997
• Broad-Based Black Economic Empowerment Act 53 of 2003
• Companies Act 71 of 2008
• Compensation for Occupational Injuries and Diseases Act 130 of 1993
• Consumer Protection Act 68 of 2008
• Copyright Act 98 of 1978
• Electronic Communications and Transactions Act 25 of 2002
• Employment Equity Act 55 of 1998
• Income Tax Act 58 of 1962
• Labour Relations Act 66 of 1995
• Occupational Health and Safety Act 85 of 1993
• Promotion of Access to Information Act 2 of 2000
• Protection of Personal Information Act 4 of 2013
• Skills Development Act 97 of 1998 and Skills Development Levies Act 9 of 1999
• Tax Administration Act 28 of 2011
• Trade Marks Act 194 of 1993
• Unemployment Insurance Act 63 of 2001 and Unemployment Insurance Contributions Act 4 of 2002
• Value-Added Tax Act 89 of 1991

6. Subjects and categories of records we hold

Listing a category here does not mean that every record in it will be released. Each request is decided on its merits under PAIA, including the grounds for refusal in section 9.

7. How to make a request

1. Use Form 2 (Request for Access to Record) prescribed by the PAIA Regulations, 2021. It is available on the Information Regulator's website and from our Information Officer on request.
2. Send the completed form to the Information Officer by email to hello@departmentsix.co or by hand or post to 4th Floor, The Harrington, 50 Harrington Street, Zonnebloem, Cape Town, 8001, South Africa.
3. Give enough detail for us to identify the record and you; say which form of access you want (for example, an electronic copy or an inspection); give an email or postal address for our reply; and, if you would like to be told of our decision in another way, say how.
4. Identify the right you want to exercise or protect, and explain why the record is required for that purpose (section 53(2)(d) of PAIA). Access to a private body's records is only available where the record is required to exercise or protect a right (section 50).
5. If you are requesting on behalf of someone else, provide proof of the capacity in which you are making the request.
6. Pay the request fee (section 8) unless you are requesting your own personal information.
7. If you have a disability or cannot read or write, you may make the request orally. The Information Officer will help you complete the form.

PAIA does not apply to a record requested for the purpose of criminal or civil proceedings that have already started, where access is otherwise provided for by law (section 7).

If you are asking for your own personal information, you may also use your rights under section 23 of POPIA, described in our Privacy Policy.

8. Fees

Fees follow the Information Regulator's schedule for private bodies under the PAIA Regulations, 2021. If the fee schedule changes, the prescribed amounts in force on the date of your request apply.

If the search and preparation will take more than six hours, we will ask for a deposit of one third of the access fee before we start. If access is refused, the deposit is refunded. We will not release the record until the access fee has been paid. An electronic copy of this manual is free.

9. Timelines, decisions and grounds for refusal

We will decide your request and tell you the outcome within 30 days of receiving it (section 56). We may extend this once, by up to 30 days, in the circumstances section 57 allows, and we will tell you why. If we do not respond in time, the request is regarded as refused (section 58).

Where a record concerns a third party, we will take reasonable steps to tell them within 21 days of receiving your request, and they have 21 days to make representations before we decide (sections 71 and 72).

We must or may refuse access on the grounds in Chapter 4 of Part 3 of PAIA, which include:

• unreasonable disclosure of personal information about a third party who is a natural person (section 63);
• third-party trade secrets, or financial, commercial, scientific or technical information whose disclosure would likely cause harm (section 64);
• information supplied in confidence by a third party, where disclosure would breach a duty of confidence (section 65);
• safety of individuals and protection of property (section 66);
• records privileged from production in legal proceedings (section 67);
• our own trade secrets and commercial information, including information about client engagements, pricing and computer programs we own (section 68); and
• research information of a third party or of Department Six (section 69).

Despite these grounds, we must grant access where disclosure would reveal evidence of a substantial contravention of the law or an imminent and serious public safety or environmental risk, and the public interest clearly outweighs the harm (section 70).

10. Remedies

We do not have an internal appeal procedure; a decision of the Information Officer is final within Department Six. If you are unhappy with a decision, including a refusal, a fee, an extension or the form of access, you may within 180 days:

• lodge a complaint with the Information Regulator (section 77A); or
• apply to a court with jurisdiction for appropriate relief (sections 78 and 82).

A third party affected by a decision to grant access has 30 days to lodge a complaint or apply to court.

1. Purposes of processing

• Responding to enquiries and scoping work.
• Contracting for and delivering services across D6 Ventures, D6 Creative Studio, D6 Product, D6 Engineering, D6 Harness and D6 Signal.
• Processing personal information on clients' instructions as their operator.
• Invoicing, payment, accounting, tax and statutory reporting.
• Recruitment and the employment and engagement of our people.
• Venture investment, due diligence and portfolio governance.
• Running, securing and improving our business and systems.
• Direct marketing, with consent or to existing clients with an opt-out.
• Complying with the law and establishing, exercising or defending legal claims.

2. Categories of data subjects and personal information

3. Recipients

We may share personal information with: our employees and contractors who need it; operators that provide our hosting, database, email, messaging, analytics, accounting, productivity, design, code and AI services; clients, where the engagement requires it; professional advisers, auditors and insurers; co-investors and portfolio companies in D6 Ventures work; banks; the South African Revenue Service, the CIPC and other regulators and authorities where the law requires; and a successor business if we sell, merge or restructure.

4. Planned transborder flows

Many of our operators store data in the United States and the European Union, and we serve clients in Africa, Europe, the United Arab Emirates, Japan and Australia. Personal information is therefore transferred outside South Africa. We do so only as section 72 of POPIA allows, chiefly under written agreements binding the recipient to protection substantially similar to POPIA.

5. Security measures

We protect personal information with measures that include: encryption in transit and at rest on core systems; single sign-on and multi-factor authentication; least-privilege access, revoked when an engagement ends; managed secrets storage; code review and dependency monitoring; vetted operators under written agreements; and an incident response procedure, including notification of security compromises to the Information Regulator and affected data subjects under section 22 of POPIA.

6. Objection, correction and deletion

Data subjects may object to processing, or ask us to correct or delete personal information, free of charge, by email to hello@departmentsix.co or in any other reasonable way. We respond within 30 days. Our Privacy Policy explains these rights in full.

1. Availability

This manual is published at https://www.departmentsix.co/paia. It is also available for inspection at our office during business hours, free by email on request, and to the Information Regulator on request. A printed copy costs the prescribed fee per A4 page in section 8 of Part A.

2. Updates

We review this manual at least once a year and whenever our records, processing or contact details change. The version and effective date at the top show which version applies.