Legal
PAIA Manual
The section 51 manual: what records we hold, and how to request access to them.
Musket Goose (Pty) Ltd · Effective
1. Purpose of this manual
The Promotion of Access to Information Act 2 of 2000 (PAIA) gives effect to the constitutional right of access to information. Section 51 requires every private body in South Africa to compile a manual describing the records it holds and how to ask for them. This is that manual.
It is published by Musket Goose (Pty) Ltd, a private company incorporated in the Republic of South Africa and registered with the Companies and Intellectual Property Commission (CIPC), Republic of South Africa.
It also serves as the documentation of our processing operations required by section 17 of the Protection of Personal Information Act 4 of 2013 (POPIA). There is no separate register: for a private body, PAIA section 51 and POPIA section 17 describe the same document.
2. Contact details of the head of the body
PAIA makes the chief executive officer of a company the head of the private body, and POPIA makes the head of a private body its Information Officer automatically. Both roles are held by Jack Spence.
We have not designated a Deputy Information Officer. POPIA section 56 requires a private body to designate deputies only where the size and structure of the business make it necessary, and it does not yet. This section will name them when we do.
| Detail | Value |
|---|---|
| Head of the body and Information Officer | Jack Spence |
| jack.spence@musketgoose.com | |
| Registered name | Musket Goose (Pty) Ltd |
| Registration number | 2026/433866/07 |
| Physical and registered address | 14 Parkes Lane Knysna Western Cape 6570 South Africa |
| Postal address | 14 Parkes Lane Knysna Western Cape 6570 South Africa |
| Telephone | +27 60 927 0891 |
| Website | https://musketgoose.com |
3. The Information Regulator's guide on how to use PAIA
The Information Regulator has published a guide, under section 10 of PAIA, explaining how to use the Act. It is written for the public rather than for lawyers, and it is free.
It is available in all eleven official languages and in braille, from the Information Regulator's website at https://inforegulator.org.za, or from the Regulator on request at the address in the remedies section below.
If you are unsure whether PAIA is the right route for what you need, read that guide first. You are also welcome to write to us and ask.
4. Records available without a request
Section 52 of PAIA lets a private body voluntarily publish categories of records that anyone may have without making a formal request. It is optional, and we have not published such a notice, so there is currently no category of record available on that basis.
That is a narrower statement than it sounds. A good deal of what we hold about a client is already theirs and reaches them through the ordinary course of the work rather than through PAIA. Ask us directly before filing a request: it is faster for both of us, and it costs you nothing.
5. Records held under other legislation
We keep records because other statutes require us to. Listing them here does not make them automatically available, and access to them is still decided under PAIA.
- Companies Act 71 of 2008: memorandum of incorporation, share register, records of directors, minutes and resolutions, annual financial statements.
- Income Tax Act 58 of 1962 and the Tax Administration Act 28 of 2011: tax returns, assessments, PAYE, UIF and SDL records, and supporting documents.
- Basic Conditions of Employment Act 75 of 1997 and the Labour Relations Act 66 of 1995: employment contracts, hours and leave records, remuneration records.
- Unemployment Insurance Act 63 of 2001 and the Unemployment Insurance Contributions Act 4 of 2002: employee and contribution records.
- Compensation for Occupational Injuries and Diseases Act 130 of 1993: employee earnings returns.
- Skills Development Levies Act 9 of 1999: levy records.
- Protection of Personal Information Act 4 of 2013: this manual, records of processing, and records of any security compromise.
6. Subjects on which we hold records, and the categories of record held
These are the actual record classes held on our systems, grouped by subject. Some are held on our own behalf, and some are held on behalf of a client whose software we operate. Where a record belongs to a client, they are its owner and we will refer a request to them rather than deciding it ourselves.
| Subject | Categories of record |
|---|---|
| Company and governance | Memorandum of incorporation, share and shareholder register, director records, board and operational decisions, resolutions, insurance and statutory filings. |
| Finance | Invoices and line items, ledger transactions, bank statements imported for reconciliation, spend requests and approvals, recurring commitments, supplier and vendor records, tax records. |
| Employees and contractors | Employment contracts, personal and contact details, role and reporting lines, leave applications and balances, onboarding checklists, payroll runs, PAYE, UIF and SDL records, and payment details. |
| Clients and prospective clients | Contact details of individuals at client and prospect companies, sales pipeline records, proposals, agreements, project and milestone records, time entries, and correspondence. |
| Support and correspondence | Support conversations and replies, internal notes, and messages exchanged between our operators on our internal platform. |
| Documents | Contracts, signed documents and signature records, and files stored in the internal vault. |
| Operations and security | Operator accounts and roles, session records, audit logs of actions taken on the platform, incident records, runbooks, monitoring and uptime data, and website analytics. |
| Records held for clients | Data inside software we build and operate for a client. We process these on that client's instruction, and the client is the responsible party for them. |
7. Processing of personal information under POPIA
Required by section 51(1)(c) of PAIA, as amended by POPIA. Our full privacy notice is at /privacy and carries more detail on rights and legal bases.
7.1 Purpose of the processing
- Running the company: accounting, tax, statutory records, and governance.
- Employing people: payroll, leave, benefits and the obligations that come with being an employer.
- Winning and delivering client work: quoting, contracting, building, invoicing and supporting.
- Operating software on behalf of clients, on their instruction.
- Securing our systems, and keeping an audit trail of what was done on them.
7.2 Categories of data subjects and of the information held about them
- Employees, directors and contractors: identity and contact details, employment terms, remuneration, leave, tax and payment details.
- Shareholders: identity and shareholding.
- Individuals at client and prospective client companies: name, role, contact details, and correspondence.
- Suppliers and their staff: contact and payment details.
- Visitors to this website: technical and usage data as described in the cookie policy.
- Individuals whose data sits inside software we operate for a client: as defined by that client, who decides what is collected.
7.3 Recipients or categories of recipient
- Our service providers, listed individually with their purpose and location at /subprocessors.
- Our accountants, auditors and professional advisers.
- SARS, the Companies and Intellectual Property Commission, the Department of Employment and Labour, and other regulators where the law requires it.
- Banks and payment providers, to make and receive payment.
- A client, where the records are held on their behalf.
- A court, or a party with a lawful order requiring disclosure.
7.4 Planned transborder flows of personal information
Personal information is processed outside South Africa by the service providers listed at /subprocessors, in United States and the European Union. Section 72 of POPIA permits this where the recipient is bound by an agreement providing an adequate level of protection with onward-transfer restrictions substantially similar to POPIA's, or where the transfer is necessary to perform a contract. We rely on the data processing agreements each provider offers, and on the necessity of the transfer to deliver the service.
We do not sell personal information, and we do not transfer it to anyone for their own marketing.
7.5 General description of information security measures
- Access to the internal platform requires an account, and every account carries a role that limits what it can reach. Permission is checked again on the server for each request, not only in the interface.
- Passwords are stored hashed, never in a form we can read. Sessions are held in a signed, HttpOnly cookie and can be revoked centrally.
- Repeated failed sign-in attempts are rate limited and locked out.
- Traffic is encrypted in transit with HTTPS, and data at rest is encrypted by our hosting and database providers.
- Actions taken inside the platform are written to an audit log, with sensitive values redacted.
- Credentials for third-party services are held in the environment and never written to the database.
- Access is granted on a least-privilege basis and reviewed when a person's role changes or they leave.
8. How to request access to a record
Requests are made on Form 2, "Request for Access to Record", prescribed by regulation 7 of the Regulations Relating to the Promotion of Access to Information, 2021 (GN R.757 in Government Gazette 45057 of 27 August 2021). The form is on the Information Regulator's website at https://inforegulator.org.za. Send the completed form to jack.spence@musketgoose.com.
Section 50(1) of PAIA sets the test for a private body: you must show that the record is required for the exercise or protection of a right. That is why Form 2 asks you to describe the right concerned. This is narrower than the position for a government department, and a request that does not identify a right will be refused.
- Complete Form 2 in enough detail that we can identify the record without guessing.
- State which right you are exercising or protecting, and how the record is required for it.
- Attach proof of identity, and proof of your authority if you are requesting on someone else's behalf.
- Pay the request fee of R140.00. It is payable on every request and is separate from any access fee for the copies themselves.
- Tell us the form you want the record in, and the language you prefer. We will give effect to your choice where we reasonably can.
8.1 How long it takes
Section 56(1) requires us to decide as soon as reasonably possible, and in any event within 30 days of receiving the request or the further particulars we asked for, and to tell you the outcome.
Section 57 allows one extension of up to a further 30 days, and only on the grounds the section lists: a large volume of records, records held at another office, or a necessary consultation that cannot be finished in time. If we extend, we will write to you and say which ground applies.
If we do not respond within the period, the request is regarded as refused and you may take it further as described below.
8.2 When we may refuse
Chapter 4 of PAIA sets out the grounds, and some of them oblige us to refuse rather than permit us to. In outline they cover another person's privacy, a third party's commercial information, information given to us in confidence, records privileged in legal proceedings, our own research and commercially sensitive information, and records whose disclosure would endanger a person or property.
Section 46 sets against those a public interest override: we must grant access despite a refusal ground where the record would reveal a substantial contravention of the law or an imminent and serious public safety or environmental risk, and the public interest in disclosure clearly outweighs the harm.
A refusal will be in writing, will give reasons, and will tell you what you can do next.
9. Fees
Prescribed by Annexure B to the 2021 Regulations. These are the private body amounts, which are higher than the amounts a government department may charge, and we may not charge more.
The request fee is payable before we deal with the request. Access fees for the copies themselves are payable once we have granted access and told you the amount. Where a search is likely to take more than six hours we may ask for a deposit of one third of the access fee first.
The exemption from fees for requesters below an income threshold applies to public bodies only, and we are not obliged to apply it.
This manual itself is free on this website. We may charge the per-page copying fee below only for a printed copy.
| Item | Fee |
|---|---|
| Request fee, payable on every request | R140.00 |
| Photocopy or printed copy, per A4 page or part of a page | R2.00 |
| Copy on a flash drive or CD supplied by you | R40.00 |
| Copy on a CD supplied by us | R60.00 |
| Transcription of an audio record, per A4 page | R24.00 |
| Copy of an audio record, on a flash drive or CD you supply | R40.00 |
| Copy of an audio record, on a CD we supply | R60.00 |
| Transcription and copies of visual images | Actual cost, on the service provider's quotation |
| Search and preparation, per hour or part of an hour, excluding the first hour | R145.00, capped at R435.00 |
| Postage, email or other electronic transfer | Actual cost |
10. If you are unhappy with our decision
There is no internal appeal against a decision of a private body. PAIA gives that right against government departments only, and we will not pretend to offer a procedure that does not exist.
Your routes are a complaint to the Information Regulator, or an application to court under section 78 of PAIA. A complaint is made on Form 5, prescribed by regulation 10, and costs nothing.
| Detail | Value |
|---|---|
| Physical address | Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191 |
| Telephone | 010 023 5200 |
| Toll free | 0800 017 160 |
| General enquiries | enquiries@inforegulator.org.za |
| PAIA complaints | PAIAComplaints@inforegulator.org.za |
| POPIA complaints | POPIAComplaints@inforegulator.org.za |
| Website | https://inforegulator.org.za |
11. Availability of this manual
Section 51(3) requires the manual to be available in four ways, and all four apply at once.
- On our website, free, at https://musketgoose.com/paia.
- At our principal place of business, 14 Parkes Lane, Knysna, Western Cape, 6570, for inspection during normal business hours. Please write first so that somebody is there to meet you.
- To any person on request, against payment of the per-page copying fee above.
- To the Information Regulator on request.
12. Updating this manual
Section 51(2) requires the manual to be updated regularly. We review it once a year, and immediately whenever the purposes of our processing change, a recipient or sub-processor changes, a cross-border flow changes, or the details of the head of the body change.
The compilation and revision dates are shown at the top of this page.
Questions about this document? Email jack.spence@musketgoose.com