PAIA & POPIA Manual

Prepared in terms of Section 51 of the Promotion of Access to Information Act, 2000 (Act No. 2 of 2000) ("PAIA") and the Protection of Personal Information Act, 2013 (Act No. 4 of 2013) ("POPIA").

1. Particulars of the organisation

Both officers are registered with the Information Regulator in terms of POPIA section 55 (Registration Certificate 2026-062042).

2. Guide on how to use PAIA

The Information Regulator has, in terms of section 10 of PAIA, compiled a guide on how to use the Act, available from the Information Regulator: inforegulator.org.za · [email protected] · Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg.

3. Records held in terms of other legislation

Records are kept in accordance with, among others, the Companies Act 71 of 2008, the Income Tax Act 58 of 1962, the VAT Act 89 of 1991, the Labour Relations Act 66 of 1995, the Basic Conditions of Employment Act 75 of 1997, and POPIA.

4. Categories of records held

• Company records — registration, financial and tax records, contracts, insurance.
• Employee / contractor records — employment, payroll and statutory records.
• Client records — business contact details, account and billing information, correspondence.
• Personal information processed on behalf of clients via the OmniDesk platform — end-customer names, phone numbers, email addresses, message and conversation content, and usage history. This information is processed by EdgeproCX as an Operator on behalf of each client, who remains the Responsible Party for that data.
• Marketing and website records — enquiries, subscriptions and website analytics.

5. How to request access to a record

1. Complete the prescribed PAIA Request Form (Form 2), available from the Information Regulator or on request.
2. Submit it to the Information Officer at [email protected] or the address above.
3. Provide enough detail to identify the record and the right you seek to exercise, with proof of identity.
4. Prescribed request and access fees may apply; you will be notified before processing.
5. The Company will respond within 30 days (extendable by a further 30 days as permitted by PAIA).
6. Access may be refused only on the grounds set out in PAIA (e.g. third-party privacy, commercial confidentiality, legal privilege).

6. Processing of personal information (POPIA)

• Purpose: to provide and support the OmniDesk communication, CRM and VoIP platform; administer accounts and billing; provide customer support; comply with legal obligations; and, with consent, send marketing communications.
• Data subjects: clients, clients' end-customers, employees and contractors, suppliers, and website visitors.
• Personal information: names, contact details, phone numbers, email addresses, message/conversation content, usage and device data, and payment/billing details.
• Recipients / Operators: DigitalOcean, LLC (hosting — EU); Anthropic, PBC (AI processing — US); payment processors; and messaging/voice carriers (WhatsApp/Meta, SMS and voice providers) as required to deliver the service.
• Cross-border transfers: to the EU (DigitalOcean) and US (Anthropic) under Data Processing Agreements providing adequate protection per POPIA section 72.
• Security (s19): access controls, encryption in transit, routine off-site backups, monitoring, and other reasonable technical and organisational measures.
• Retention: personal information is retained only as long as necessary or as required by law, then deleted or de-identified.
• Your rights: to access, correct, delete or object — contact the Information Officer at [email protected].
• Direct marketing: marketing is sent only with consent, and every marketing message includes a simple opt-out that is honoured promptly.

7. Availability of this manual

This manual is available on this website, at the Company's registered office, and from the Information Regulator on request.

8. Approval

Approved by Mpho Malatjie, Information Officer, EdgeproCX (Pty) Ltd.