PAIA Manual

Manual in terms of section 51 of the Promotion of Access to Information Act 2 of 2000 ("PAIA") · Last updated: 31 August 2026

1. About this manual

PAIA gives people a right of access to records held by private bodies where the record is required for the exercise or protection of a right, and — read with the Protection of Personal Information Act 4 of 2013 ("POPIA") — a right of access to their own personal information. This manual explains what records IndunAI (by In-House IT) holds and how to request access to them.

2. Contact details (section 51(1)(a))

Private body: In House It (Pty) Ltd (registration number 2024/456850/07), trading as IndunAI.
Head of the private body / Information Officer: Angus Baumgardt.
Physical and postal address: 47 Moss Road, Ocean View, Durban, KwaZulu-Natal, 4052.
Telephone: +27 76 786 4417.
Email: angus@indunai.co.za.
Website: indunai.co.za.

3. The Regulator's Guide (section 51(1)(b))

The Information Regulator publishes a Guide (section 10 of PAIA) on how to use the Act, in all official languages. It is available from the Information Regulator (South Africa): inforegulator.org.za · Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191.

4. Categories of records we hold (section 51(1)(b)(iv))

5. Records available without a PAIA request (section 51(1)(b)(ii) read with section 52)

Our privacy policy, the platform's client terms, this manual, and anything we've published (website content, social media posts) can simply be read — no request needed. Your own upcoming booking details can be confirmed by asking the assistant in the same conversation channel you booked on.

6. Records available under other legislation

Some records are available to the persons or bodies entitled to them under other laws (for example tax records to SARS under the Tax Administration Act, company records under the Companies Act). Certain records may also be accessible under other legislation. Where applicable, access may be provided in accordance with that legislation as contemplated by PAIA.

7. How to request a record (sections 53 and 56)

1. Use Form 02 (Annexure A to the PAIA Regulations, 2021), available from inforegulator.org.za.
2. Send it to angus@indunai.co.za, identifying the record, the right you seek to exercise or protect (not needed when requesting your own personal information), and how you'd like access (copy, inspection, electronic).
3. Fees: the fees prescribed in Annexure B to the PAIA Regulations, 2021 (as amended from time to time) apply. The request fee (currently R140) is payable by every requester of a private body's record, plus reproduction fees. If you are asking for your own personal information, you can instead use your separate right of access under section 23 of POPIA: confirmation that we hold information about you is free of charge, and we charge no fee for access to your own information (no fee is prescribed).
4. We must respond within 30 days. That period can be extended once, by not more than 30 further days, where the request is for a large number of records, the records are held at another office, consultation is necessary before we can decide, a combination of those applies, or you consent in writing (with notice to you, section 57 read with section 56).

8. Grounds on which access may be refused

PAIA (Chapter 4 of Part 3) requires or permits refusal in defined cases — chiefly to protect another person's privacy, confidential or commercially sensitive information of a third party, records privileged in legal proceedings, and our own commercial information where disclosure would cause harm. Where only part of a record is protected, any part of it that can reasonably be severed from the protected part, and is not itself protected, must be disclosed (section 59).

9. How we process personal information (section 51(1)(c))

Purposes: answering enquiries, making and managing appointments, reminders and review requests, direct marketing with consent or to existing customers, and ordinary business administration.
Categories of data subjects and information: customers and prospective customers — names, contact details, conversation content, appointment details; mailing-list subscribers — contact details and consent records.
Recipients: our team; In House IT (Pty) Ltd as our POPIA operator (hosting, in Johannesburg); the AI provider that generates the assistant's replies, our own account with OpenAI (message content and voice notes, to generate replies and transcribe); Meta Platforms in the United States and Ireland where WhatsApp is used (WhatsApp also carries the alerts our own team receives about enquiries and bookings, whichever channel the customer used); Google, where bookings are placed in our calendar; ipwho.is (a web-chat visitor's network address alone); OpenStreetMap's Nominatim service in Germany (street addresses only, for call-out dispatch); and PayFast (Pty) Ltd where a customer pays an invoice online. Transfers outside South Africa are made under section 72 of POPIA on the basis of each provider's data-processing terms read with the necessity of the transfer to perform what the data subject asked for — our privacy policy sets this out in full.
Security: isolated hosted environment with its own database in Johannesburg, encrypted transport, restricted access, nightly backups encrypted before they leave the server, with an encrypted copy held off-site (Microsoft OneDrive) that cannot be read without our key.
Full detail is in our privacy policy.

10. Remedies

If a request is refused or we fail to respond, you may lodge a complaint with the Information Regulator on Form 05 of the PAIA Regulations, 2021, generally within 180 days (section 77A), via inforegulator.org.za. Once that complaints procedure has been exhausted, section 78 allows you to apply to a court with jurisdiction.

11. Availability of this manual (section 51(3))

This manual is published at this address, is available for inspection at our principal place of business during business hours, and copies can be requested from angus@indunai.co.za. A copy will also be provided to the Information Regulator on request. It is updated whenever the underlying facts change.