PAIA manual

01 · Introduction

Introduction

Section 51 of the Promotion of Access to Information Act 2 of 2000 PAIA requires every private body to compile a manual containing the information prescribed in that section. This manual has been compiled in accordance with those requirements.

Pleks (Pty) Ltd is a private body as defined in PAIA. This manual describes the categories of records held by Pleks, explains the procedure for requesting access to those records, and provides the contact details of our Information Officer.

This manual is made available in accordance with section 51 of PAIA and the applicable PAIA Regulations. The current version is always available at pleks.co.za/paia-manual.

02 · Contact details

Contact details

2.1 Information Officer

Every private body is required by POPIA · S55 to designate an Information Officer. Pleks has registered its Information Officer with the Information Regulator of South Africa. For the purposes of PAIA s51(1)(a), the head of Pleks (Pty) Ltd is Stéan Bouwer, who also serves as Information Officer.

2.2 Information Regulator

Any person whose request for access to records has been refused, or who wishes to lodge a complaint regarding Pleks’s processing of personal information, may approach the Information Regulator:

03 · SAHRC guide

Guide on how to use PAIA

The South African Human Rights Commission (SAHRC) has compiled a guide explaining how to use PAIA. This guide is available in all official languages and can be obtained from:

• The SAHRC website at sahrc.org.za
• Telephonically from the SAHRC
• The SAHRC office: 29 Princess of Wales Terrace, Parktown, Johannesburg

Pleks will also assist any requester who contacts our Information Officer with guidance on how to submit a PAIA request.

04 · Records available without a request

Available without a request

The following categories of records are automatically available to any person without the need to submit a formal PAIA request. These are publicly accessible via pleks.co.za.

4.1 Public legal documents

• Privacy Policy
• Terms of Service
• POPIA Processing Register
• Credit Check Policy
• Cookie Policy
• This PAIA Manual

4.2 General product information

• Product feature descriptions and pricing (pleks.co.za/#pricing)
• Sub-processor list (published within the Privacy Policy and section 08 of this manual)

No request or fee is required to access any of the documents listed above.

05 · Records held by Pleks

Records held

Pleks holds records in the following categories. The categories reflect the nature of Pleks as a property management software platform serving estate agents, property managers, landlords, tenants, and rental applicants.

06 · Records that may be refused

Grounds for refusal

Pleks may refuse access to records in the following circumstances, as provided for in PAIA:

• Third-party personal information. Records containing personal information about a third party will not be disclosed without the consent of that third party, unless disclosure is required by law or is in the public interest. For example, a tenant may not access another tenant’s personal information.
• Commercially sensitive information. Records containing confidential commercial information, trade secrets, or proprietary business information — including the Pleks platform source code, internal pricing models, and client-specific configurations — may be refused on the grounds of commercial confidentiality.
• Legal professional privilege. Communications between Pleks and its legal advisors that attract legal professional privilege will not be disclosed.
• Internal deliberative records. Internal records relating to deliberative processes, including draft documents, internal strategic discussions, and product development records not yet published, may be refused.
• Records harmful to law enforcement. Records whose disclosure would prejudice a pending investigation, legal proceeding, or law enforcement operation may be refused.

Even where grounds for refusal exist, Pleks will consider whether the public interest in disclosure outweighs the grounds for refusal, as provided by PAIA · S70 (the public-interest override for private bodies). Note: PAIA s46 applies to public bodies only; for private bodies the equivalent provision is s70.

07 · How to request access

How to request access

7.1 Who may request

Any person — including a juristic person — may request access to records held by Pleks. Data subjects (individuals whose personal information is processed by Pleks) have specific rights under POPIA in addition to their PAIA rights.

7.2 How to submit a request

PAIA requests must be submitted using Form 2, prescribed under the 2021 PAIA Regulations. This form is available from:

• The Information Regulator website at inforegulator.org.za
• Our Information Officer at legal@pleks.co.za — who will provide the form on request
• The Data & Privacy section within the Pleks platform (for registered users)

Informal email requests that do not use Form 2 will be acknowledged but cannot be processed as formal PAIA requests. Our Information Officer will assist any requester in completing the correct form.

The request must include:

• The requester’s full name and contact details
• A description of the records being requested, with sufficient detail to identify them
• The form in which the records are requested (electronic or paper)
• If the request is made on behalf of another person, proof of authority to do so

7.3 Request fees

PAIA provides for a request fee and an access fee. The current prescribed fees are set by regulation and are subject to change. As at the date of this manual:

• Request fee: R140.00 (the regulated maximum under the 2021 PAIA Regulations for private bodies; payable before the request is processed, unless waived)
• Access fee: Calculated based on the form and volume of records, per the PAIA regulations

No request fee is charged where a data subject requests access to their own personal information, in accordance with regulation 7 of the 2021 PAIA Regulations. Self-service data access via Settings → Data & Privacy within the platform is always free.

7.4 Response timeframe

Pleks will respond to a PAIA request within 30 days of receipt of the request, as required by PAIA · S56. If the request is for a large volume of records or is otherwise complex, Pleks may extend this period by a further 30 days with written notice to the requester.

7.5 If a request is refused

If Pleks refuses a request, the Information Officer will provide written reasons for the refusal. The requester may then:

• Apply to the Information Regulator for a review of the decision
• Apply to a court for relief

7.6 Data subject rights under POPIA

Data subjects have the following rights under POPIA which may be exercised directly, without a formal PAIA request:

• Access (s23) — request a copy of personal information held, including the right to receive it in a usable form. The platform’s bulk-export feature provides a structured archive as a voluntary product commitment.
• Correction (s24) — request correction or deletion of inaccurate, misleading, outdated, incomplete, or unlawfully obtained personal information
• Deletion / restriction (s25) — request destruction or deletion of personal information no longer authorised to be retained, subject to statutory retention obligations
• Objection (s11(3)) — object to processing based on legitimate interests on grounds relating to your particular situation
• Automated-decision reconsideration (s71) — Pleks does not make automated decisions about applicants; if you believe an automated decision was nonetheless made, you may request reconsideration and the underlying logic of the decision
• Withdraw consent — withdraw consent where it is the lawful basis; withdrawal does not affect lawfulness of prior processing

Registered Pleks users may exercise most of these rights directly in Settings → Data & Privacy within the platform. All other requests must be submitted to our Information Officer. We will respond within 30 days.

08 · Sub-processors & cross-border transfers

Sub-processors & transfers

Pleks processes personal information using the following third-party sub-processors. All cross-border transfers are governed by Standard Contractual Clauses or equivalent mechanisms as required by POPIA · S72.

The sub-processor list above is reviewed at least annually. The current list is also published within our Privacy Policy.

09 · Security & data protection

Security & data protection

Pleks implements technical and organisational measures appropriate to the risks of the personal information we process, as required by POPIA · S19. Key measures include:

• Passkey-native authentication for all agency staff, with step-up verification required for trust account actions
• Row-level security enforcing strict organisational data isolation — no cross-organisation data leakage is possible at the database level
• AES-256 encryption at rest for all stored personal information; application-level encryption before INSERT for sensitive fields (ID numbers, banking details, credit reports), so raw values are never visible in database dumps or to infrastructure operators
• TLS 1.3 encryption in transit for all communications
• Immutable audit log of all state changes, retained for 7 years
• Client-side compression of inspection photographs, with GPS coordinates and timestamps extracted and stored separately as tamper-evident metadata
• Two-tier automatic purge of rejected-applicant data: raw screening data destroyed 90 days after a declined or withdrawn application; a limited decision-accountability record retained up to 5 years; active legal holds suspend purge
• Consent log recording timestamp, IP address, consent version, and purpose for every POPIA consent event

9.1 Data breach notification

In the event of a data breach, Pleks will:

• Notify the Information Regulator as soon as reasonably possible, as POPIA · S22 requires, for Pleks’s Part A processing. This obligation applies to Pleks as Responsible Party for Part A data. For Part B (agency-managed) data, Pleks notifies the agency immediately once it has reasonable grounds to believe that personal information has been accessed or acquired by an unauthorised person (ToS §09.4) — an Operator-to-RP obligation under POPIA s21(2); the agency then independently assesses its s22 obligation to notify the Regulator and affected data subjects.
• Notify affected data subjects of Part A breaches as soon as reasonably practicable
• Maintain a written record of the breach and the steps taken in response

9.2 Retention schedule

10 · Amendments

Amendments

Pleks will review this manual at least once every two years, or whenever there is a material change in our records, processing activities, or the applicable law. The current version of this manual is always available at pleks.co.za/paia-manual.

If an inconsistency exists between this PAIA Manual and the Pleks Terms of Service, the Terms of Service prevail unless mandatory law requires otherwise.

The version number and effective date on the cover of this document indicate when it was last updated. Requesters are encouraged to check the website for the most current version before submitting a request.

11 · Certification

Certification

This PAIA manual has been compiled in accordance with the requirements of section 51 of the Promotion of Access to Information Act 2 of 2000 and approved this 5th day of May 2026 by the Information Officer of Pleks (Pty) Ltd.