PAIA manual

1. Acronyms used in this manual

2. What this manual is for

PAIA gives you a right of access to records. This manual is the document the Act requires us to publish so that you can use that right without having to guess. It tells you which of our records you can simply have, which you must request, what we hold and on what subjects, who to ask, how to ask, and what to do if we say no.

It also sets out what personal information we process and who we give it to, which POPIA requires a manual to cover. The privacy notice says the same things in more detail and in plainer language; this manual is the version structured the way the Regulator asks for it. Where the two differ in wording they are meant to agree in substance — if they ever do not, tell us and we will fix it.

3. Who to contact

Private body: MTBRZ GROUP, registration number 2026/523775/07, trading as Kwalifi.

Information Officer: Wesley Sing, who is the head of the private body. Email admin@kwalifi.co.za.

Deputy Information Officer: none has been designated. Section 56 of POPIA requires a body to provide for the designation of such number of deputies as is necessary; at our present size that number is none, and a request sent to the Information Officer above reaches the person who will decide it rather than a stand-in. We will designate and publish a deputy here when the volume of requests makes one necessary.

Address for requests: 123 Acutt Avenue, Durban North, Durban, KwaZulu-Natal, 4051. Post may be addressed there; we have no separate postal address. Telephone +27 31 012 5414. Website kwalifi.co.za. We hold no fax line.

Our office hours are Monday to Friday, 08:00–17:00 (SAST), and we answer correspondence within two business days. That reply time is our service undertaking and does not shorten or extend the statutory periods in section 8 below.

4. The Guide on how to use PAIA

The Regulator has, under section 10(1) of PAIA, published a Guide on how to use the Act. It describes the objects of PAIA and POPIA, the form a request must take, the assistance available from an Information Officer and from the Regulator, every remedy in law available to you, the obligation on bodies to compile a manual, and the gazetted fees. It is published in each official language and in braille.

You can obtain the Guide from the Regulator at inforegulator.org.za, or by asking us. On request we will provide a copy in English or isiZulu, being the two official languages most used where we trade, during office hours and at no charge.

5. Records you can have without making a request

Section 52 of PAIA lets a private body publish categories of records that are available without a formal request. These are ours. Everything in this table is on this website already, free, with no request and no fee.

Certificate verification deserves one note. A certificate is worthless if nobody can check it, so the verification page answers anyone holding the certificate number, without an account and without a request. It discloses the holder's name, the course and the issue date, and nothing else. Certificate numbers cannot be guessed or listed, so this is not a register of learners.

6. Records held under other legislation

These are records we keep because another Act requires it. Listing them here does not make them available on request — most are subject to the grounds of refusal in section 8 — but you are entitled to know they exist.

7. Subjects on which we hold records

Section 51(1)(e) asks for enough detail that you can frame a request without knowing how we file things. These are the subjects and the categories of record held on each.

8. How to request a record

What you have to show. Section 50 of PAIA gives you access to a record of a private body where the record is required for the exercise or protection of a right, you follow the procedure below, and no ground of refusal applies. Unlike a request to a government department, a request to a private body has to say which right is at stake and why this record is needed for it. If you are asking for your own personal information rather than exercising a right, POPIA is usually the easier route — see the privacy notice, and just email us.

How to make it. Use the prescribed form — Form 2 of the PAIA Regulations, available from the Regulator's website — and send it to the Information Officer at the email address in section 3. Tell us enough to find the record, which right you are exercising or protecting, how the record is required for it, and how you want to receive the record. If a disability makes the prescribed form impractical, tell us and we will take the request in a form that works for you, and record it ourselves.

Fees. Section 54 allows a private body to require a request fee before it processes a request, and an access fee for search, reproduction and postage. The amounts are gazetted and change, so we do not reprint them here; we will quote you the current gazetted amount in writing before doing any chargeable work, and you can withdraw the request rather than pay it. We do not charge for anything in section 5, and we do not charge for a copy of your own personal information under POPIA where the Act does not permit it.

How long we take. We must decide within 30 days of receiving a compliant request and tell you the outcome in writing. That period can be extended once, by up to a further 30 days, where the Act allows it — for instance where the request covers a large number of records or requires a search through records held elsewhere. If we extend, we will tell you why and tell you that you may complain about the extension.

When we may refuse. Chapter 4 of PAIA requires or permits refusal in defined cases, and several apply squarely to what we hold: the mandatory protection of another person's privacy, commercial information of a third party, information held in confidence, legally privileged records, and records whose disclosure would prejudice a person's safety. Two of ours are worth naming. Assessment answer keys and marking criteria are withheld, because releasing them destroys the assessment for every learner who has not yet sat it. Another learner's records are withheld, because they are not yours. If we refuse, we will tell you which provision we relied on and what you can do about it.

If you are unhappy with our decision. There is no internal appeal against a private body — that route exists only for public bodies. You may lodge a complaint with the Regulator, or apply to a court. The Guide in section 4 sets out how to do both.

9. Personal information we process

9.1 Why we process it. To give a learner access to a course they have enrolled on, to mark assessments, to issue a certificate and keep it verifiable, to take payment, to support people when something goes wrong, and to keep the records a training business and its accredited clients are required to keep. We collect the minimum needed for those purposes. We do not sell personal information and we do not use it for advertising.

9.2 Whose information, and what.

9.3 Who it may be supplied to.

9.4 Transfers outside the Republic. Our database and the files uploaded to it are hosted in Frankfurt, Germany, so personal information is transferred out of the Republic. Section 72 of POPIA permits this where the recipient is subject to a law providing an adequate level of protection: Germany is in the European Union and subject to the General Data Protection Regulation, and our operators are bound by data processing agreements that impose the same protections and restrict onward transfer. Email is dispatched by Supabase on our behalf and may be delivered through servers outside the Republic. Card details are processed by our payment provider on its own systems and never reach ours.

9.5 How it is secured. Access is enforced at the database itself rather than in the application, so one organisation's learners cannot be read by another and answer keys are not readable by learners. Evidence files are held in private storage and served only through short-lived links. Traffic is encrypted in transit. Staff access is by role and limited to what the role needs. We hold no card data.

10. Where to get this manual

This page is the manual, published at kwalifi.co.za/legal/paia, free to read and free to print. A copy is available for inspection at the address in section 3 during office hours, to any person on request, and to the Regulator on request. A reasonable fee per A4 photocopy, as contemplated in the Regulations, is payable only where you ask us to make physical copies.

11. Keeping it current

The Information Officer reviews this manual when what we hold or how we process it changes, and at least once a year. The compilation and revision dates at the top are maintained by hand, so they state when the manual actually changed.

Issued by Wesley Sing, Information Officer and head of the private body.