PAIA Manual

DRAFT — FOR PROFESSIONAL LEGAL REVIEW

Prepared for ORION269 (PTY) LTD / WhatsMyBiz.App

This document is a draft for review only. Subject to professional legal review and approval.

PAIA Manual

ORION269 (PTY) LTD

Prepared in terms of section 51 of the Promotion of Access to Information Act 2 of 2000 (as amended)

Draft v2.0 for review — not published. Draft prepared for ORION269 (PTY) LTD. Subject to professional legal review and approval.

Registration Number: 2026/535275/07 Date of Compilation: 08/07/2026 Last reviewed: 10/08/2026 (draft revision pending review)

1. LIST OF ACRONYMS AND ABBREVIATIONS

2. PURPOSE OF PAIA MANUAL

This PAIA Manual is useful for the public to:

2.1 Check the categories of records held by ORION269 which are available without a person having to submit a formal PAIA request.

2.2 Have a sufficient understanding of how to make a request for access to a record of the body, by providing a description of the subjects on which the body holds records and the categories of records held on each subject.

2.3 Access all the relevant contact details of the Information Officer who will assist the public with the records they intend to access.

2.4 Know the description of the guide on how to use PAIA, as updated by the Regulator, and how to obtain access to it.

2.5 Know the purpose of processing of personal information and the description of the categories of data subjects and of the information or categories of information relating thereto.

2.6 Know the recipients or categories of recipients to whom the personal information may be supplied.

2.7 Know whether the body has planned to transfer or process personal information outside the Republic of South Africa.

2.8 Know whether the body has appropriate security measures to ensure the confidentiality, integrity and availability of the personal information which is to be processed.

3. KEY CONTACT DETAILS FOR ACCESS TO INFORMATION

3.1 Information Officer

3.2 Access to Information General Contacts

(Note: address to be confirmed against the CIPC registered address before publication.)

4. GUIDE ON HOW TO USE PAIA AND HOW TO OBTAIN ACCESS TO THE GUIDE

4.1 The Regulator has, in terms of section 10(1) of PAIA, as amended, updated and made available the revised Guide on how to use PAIA ("Guide"), in an easily comprehensible form and manner, as may reasonably be required by a person who wishes to exercise any right contemplated in PAIA and POPIA.

4.2 The Guide is available in each of the official languages and in braille.

4.3 The Guide contains the description of:

• 4.3.1 The objects of PAIA and POPIA;
• 4.3.2 The postal and street address, phone and fax number and electronic mail address of the Information Officer;
• 4.3.3 The manner and form of a request for access to a record;
• 4.3.4 The assistance available from the IO in terms of PAIA and POPIA;
• 4.3.5 The assistance available from the Regulator in terms of PAIA and POPIA;
• 4.3.6 The remedies available regarding a decision by the head of a private body;
• 4.3.7 The provisions of sections 51 and 52 requiring a private body to compile a manual;
• 4.3.8 The notices regarding fees to be paid in relation to requests for access;
• 4.3.9 The regulations made in terms of section 92.

4.4 Members of the public can inspect or make copies of the Guide from the offices of public and private bodies, including the office of the Regulator, during normal working hours.

4.5 The Guide can also be obtained:

• 4.5.1 Upon request to the Information Officer;
• 4.5.2 From the website of the Regulator (https://www.justice.gov.za/inforeg/).

5. CATEGORIES OF RECORDS AVAILABLE WITHOUT A PERSON HAVING TO REQUEST ACCESS

The following records are available without a formal PAIA request:

6. RECORDS AVAILABLE IN ACCORDANCE WITH OTHER LEGISLATION

7. DESCRIPTION OF SUBJECTS ON WHICH THE BODY HOLDS RECORDS AND CATEGORIES OF RECORDS HELD

8. PROCESSING OF PERSONAL INFORMATION

8.1 Purpose of Processing Personal Information

ORION269 processes personal information for the following purposes:

• Providing Intelligent Agent–based business communication, WhatsApp automation and related services to clients;
• Managing client accounts, billing, and support;
• Lead generation and customer relationship management;
• Software development, testing, and deployment;
• Recruitment and human resource management;
• Compliance with legal and regulatory obligations;
• Business improvement and analytics (anonymised/aggregated data only).

8.2 Description of Categories of Data Subjects and Personal Information

(Note: where special personal information (e.g. identity number, race, health or biometric data) is processed, ORION269 will do so only where a lawful basis exists under POPIA and appropriate safeguards are applied.)

8.3 Recipients or Categories of Recipients to Whom Personal Information May Be Supplied

(Note: the provider list may change; the role of each recipient depends on what it actually does with the information.)

8.4 Planned Transborder Flows of Personal Information

ORION269 uses Cloudflare for cloud infrastructure and hosting. Some personal information may be processed on servers located outside the Republic of South Africa, including in the United States and Europe. ORION269 will consider and apply the safeguards required by POPIA for the relevant transfers, including appropriate contractual, technical or other lawful safeguards where required. Specific agreements with providers (such as standard contractual clauses and provider data-processing addenda) will be confirmed before any specific claim is published.

8.5 Information Security Measures

ORION269 implements the following security measures to ensure the confidentiality, integrity and availability of personal information:

• HTTPS/TLS encryption for data in transit;
• Cloudflare Web Application Firewall (WAF);
• Multi-factor authentication (2FA) on critical accounts (coverage to be confirmed before publication);
• Secrets isolation (credentials not stored in code — platform secrets);
• Database encryption at rest (managed by the Cloudflare platform);
• API token scoping (least privilege principle);
• Regular security reviews and updates;
• Access control — role-based access for employees/contractors;
• Automated retention purge of expired records where implemented;
• Breach response plan in place (detection, containment, notification).

9. AVAILABILITY OF THE MANUAL

9.1 A copy of this Manual is available:

• 9.1.1 On the ORION269 website at https://docs.oriondevcore.com/paia;
• 9.1.2 At the registered office for public inspection during normal business hours;
• 9.1.3 To any person upon request and upon payment of a reasonable prescribed fee;
• 9.1.4 To the Information Regulator upon request.

9.2 A fee for a copy of the Manual is payable in accordance with the PAIA Regulations as published by the Information Regulator from time to time (currently R140.00 request fee and R2.00 per A4 page for a copy).

10. REQUESTS FOR ACCESS TO RECORDS

(New section — drafted on the official PAIA framework; flagged for attorney confirmation.)

10.1 A request for access to a record must be made on the prescribed form (Form 2 under the PAIA Regulations), addressed to the Information Officer at the contact details in section 3.

10.2 The requester must provide sufficient particulars to enable the Information Officer to identify the record requested, must indicate the form of access required, and — as required for a request to a private body — must specify the right the requester seeks to exercise or protect and why the record is necessary for the exercise or protection of that right.

10.3 A request fee is payable in accordance with the PAIA Regulations (currently R140.00 per request, as published by the Information Regulator from time to time). A requester may be required to pay the prescribed request fee before processing continues.

10.4 ORION269 will take a decision on a request within 30 calendar days of receipt, subject to any extension permitted under PAIA. Where access is granted, a further access fee may be payable in accordance with the Regulations.

10.5 Access to a record may be refused only on grounds recognised by PAIA, including where the record falls within a listed exemption (for example, protection of third-party personal information, privileged information, or records the disclosure of which would be unreasonable or unlawful). Where a request is refused, the requester will be informed of the reasons and of the available remedies.

10.6 Remedies: a requester who is dissatisfied with a decision may lodge a complaint with the Information Regulator on the prescribed form (Form 5 under the PAIA Regulations) within 180 days of the refusal or failure to respond (or after 30 days from the request where no decision was given), and/or apply to a court for appropriate relief, as provided in PAIA.

11. UPDATING OF THE MANUAL

The Information Officer will on a regular basis update this manual as required by changes in legislation or business operations.

12. INFORMATION REGULATOR CONTACT DETAILS

Issued by: Graham Schubach, Information Officer, ORION269 (PTY) LTD Date: 08 July 2026 (reviewed 10 August 2026; draft revision pending)

ORION269 (PTY) LTD · CIPC 2026/535275/07 · Information Officer: Graham Schubach (Reg. 2026-061428) Draft prepared for ORION269 (PTY) LTD. Subject to professional legal review and approval.