PAIA Manual

1. Introduction

This manual explains how to request access to records held by Draftly and describes the personal information Draftly processes under the Protection of Personal Information Act, 2013 (POPIA). It is compiled in terms of section 51 of PAIA.

2. About Draftly and our Information Officer

Draftly (draftly.co.za) is a South African service that generates workplace disciplinary and HR documents for employers and employees. Our Information Officer is the head of the business. The registered legal-entity name, registration number and registered address are being finalised and are available on request.

Contact for access requests and privacy matters: info@draftly.co.za.

3. The Regulator’s PAIA Guide

The Information Regulator has published a Guide on how to use PAIA, available in each official language from the Regulator (inforeg@inforegulator.org.za · inforegulator.org.za · 010 023 5200).

4. Records held by Draftly

Draftly holds, by category: account and user records (login, contact and usage details); documents generated by users and their inputs; for employer clients, employee data uploaded to generate documents (processed by Draftly as an operator on the employer’s behalf); subscription and billing records (via our payment provider); marketing and consent records; and operational, security and audit logs. We deliberately do not collect or store South African ID numbers.

5. Records held under other legislation

Draftly also keeps records required under, among others, the Companies Act, the Tax Administration Act and the Value-Added Tax Act (where applicable), and POPIA. Employment-law records are kept where and to the extent Draftly employs staff.

6. How to request access to a record

Complete the prescribed Form 02 (Regulation 7), “Request for Access to Record of Private Body”, and submit it to the Information Officer at info@draftly.co.za with proof of identity, the record sought and the form of access required. The prescribed request and access fees (per the current PAIA Regulations) apply. We respond within the timelines set by PAIA.

7. Grounds on which a request may be refused

Access may be refused on the grounds set out in Chapter 4 of PAIA, including the mandatory protection of a third party’s personal information (s63), commercial information (s64/s68) and legal privilege (s67).

8. Remedies

A requester may lodge a complaint with the Information Regulator (Form 05, Regulation 10) and/or apply to court.

9. How Draftly processes personal information (POPIA)

We process personal information to provide the document service, administer accounts and billing, and meet legal obligations. Recipients are the service providers needed to run Draftly (hosting in the EU, our AI provider, our payment and email providers). Personal information is hosted in the European Union (Frankfurt), a cross-border arrangement papered under POPIA. Our security measures include row-level tenant isolation, access control, encryption in transit and at rest, and audit logging. Our full Privacy Policy has the detail.

10. Your POPIA rights and how to exercise them

You may request access to the personal information we hold about you, ask us to correct or delete it, object to certain processing, and withdraw consent (for example, to marketing). To make any such request, email info@draftly.co.za. We log every request and respond as soon as reasonably possible, and within 30 days where the Regulations require.

11. Availability of this manual

This manual is available on draftly.co.za, on request, and to the Information Regulator on request. It is reviewed regularly and updated whenever Draftly’s records, processing or contact details materially change.