PAIA Manual

1. Acronyms and abbreviations

2. Purpose of this manual

This manual is here so that any member of the public can-

• see which of our records are available without having to make a formal PAIA request;
• understand well enough how to request access to a record, by knowing the subjects on which we hold records and the categories of records held on each subject;
• see which of our records are available under other legislation;
• find the contact details of the person who will deal with a request;
• find the Regulator's Guide on how to use PAIA, and how to obtain it; and
• understand what personal information we process, why, who it may be given to, whether it leaves the Republic, and how it is protected.

3. Contact details

3.1 Head of the private body and Information Officer

No deputy information officer has been designated. WageDesk is a small business and the Information Officer deals with every request personally.

3.2 Head office

We have no fax number.

4. The Regulator's Guide on how to use PAIA

The Regulator has, under section 10(1) of PAIA, compiled a Guide on how to use PAIA. It explains the objects of PAIA and POPIA, how to make a request to a public or a private body, the assistance available from an Information Officer and from the Regulator, and every remedy available if a request is refused.

The Guide is available in each official language and in braille. It can be obtained-

• from the Regulator's website at https://inforegulator.org.za, and directly at the English edition;
• from the Regulator, at the contact details in section 11.5; and
• on request from our Information Officer, at the contact details in section 3.1.

5. Records available without making a request

These records are published and may be read, downloaded or printed at any time. No form, no fee and no request is needed.

We have not issued a notice under section 52(2) of PAIA.

6. Records available in accordance with other legislation

Being listed here does not mean the record is open to the public. It means the record exists because another Act requires it, and that Act governs who may see it.

7. Subjects on which we hold records

8. Processing of personal information

8.1 The purpose of the processing

WageDesk is a staff management service delivered over WhatsApp and a web dashboard. Employers use it to record and manage leave, overtime, salary advances, days and hours worked, absences and conduct records for their staff, and to produce payslips and the UIF and PAYE figures and returns that go with them.

The personal information of an employee is processed so that their employer can meet obligations that the law places on the employer - principally the duty to issue a payslip, to keep employment records, and to calculate and declare UIF and PAYE. In relation to that information the employer is the responsible party and WageDesk is the operator, processing it on the employer's instruction and for no other purpose. We do not sell personal information, and we do not use it to market to anyone.

The personal information of an employer is processed to create and run their account, to bill them, to support them, and to send them notices about their own account.

8.2 Categories of data subject, and the information held about each

8.3 Recipients to whom personal information may be supplied

WageDesk does not submit anything to SARS or to the Unemployment Insurance Fund on an employer's behalf. It produces the files and returns; the employer submits them.

8.4 Planned transborder flows of personal information

Personal information is processed outside the Republic by the following service providers. A provider marked as planned is named here because section 51(1)(c)(iv) of PAIA asks for planned flows as well as current ones; nothing is sent to it today.

8.5 Information security measures

A general description, sufficient for a preliminary assessment of their suitability, as required by section 51(1)(c)(v) of PAIA.

• The database is encrypted at rest, on an encrypted volume, and the hourly local backups are held inside the same encrypted volume.
• Off-site backups are encrypted with AES-256-GCM before they leave the server, under a passphrase held separately from the data. An unencrypted backup is refused rather than sent.
• All traffic to and from the service is encrypted in transit over HTTPS.
• Passwords are stored only as a one-way hash. Card numbers are never held on our servers.
• Two-factor authentication is available on the administrator sign-in and on the customer sign-in.
• Every account is scoped to its own records, and a manager can be limited further to their own team.
• Payslips and other generated documents are reachable only through individually signed links, which cannot be found by guessing a filename.
• Sign-in attempts are rate limited, and inbound messages from the messaging provider are signature-checked.
• Every material action is written to an audit trail, which is retained for five years and is also the record of any erasure.
• Personal information past its retention period is deleted by an automated daily sweep.
• Changes to the service are gated by an automated check suite before they can be released.

9. Availability of this manual

A copy of this manual is available-

• on our website at wagedesk.co.za/paia;
• at our head office for public inspection during normal business hours;
• to any person on request, against payment of the prescribed fee of R2.00 for each A4 page copied; and
• to the Information Regulator on request.

It is published in English.

10. Updating this manual

The Information Officer reviews and updates this manual on a regular basis, and whenever the Company's contact details, the records it holds, the service providers it uses or the way it processes personal information change. The dates of compilation and of the last revision appear at the top of this manual.

11. How to request a record

11.1 When you have a right to a record

Under section 50(1) of PAIA, a requester must be given access to a record of a private body if the record is required for the exercise or protection of any right, the requester follows the procedure below, and no ground of refusal in Chapter 4 of PAIA applies.

Because most of what we hold belongs to an employer and concerns their employees, a request will often be quicker and free if it is made to the employer instead. See the note at the top of this manual.

11.2 How to make the request

1. Complete the prescribed request form, Form 2, available from the Regulator at this link or from our Information Officer on request.
2. The form must give enough detail to identify the record and to identify you, say in what form you want access, give a postal address or fax number in the Republic, and identify the right you are seeking to exercise or protect together with an explanation of why the record is required for it. If you are asking on someone else's behalf, attach proof of your authority to do so.
3. Send it to the Information Officer at the email address in section 3.1, or deliver it to the head office address in section 3.2.
4. Pay the request fee when we ask you for it. We are required by section 54(1) of PAIA to require the request fee before we process the request any further.

11.3 Fees

The fees below are those prescribed for a private body. They are set by regulation and published by the Regulator, not by us.

Where a search is expected to take more than the prescribed number of hours, we may require a deposit of up to one third of the access fee before we start. If access is later refused, the deposit is refunded.

11.4 Our decision, and how long it takes

Under section 56(1) of PAIA we must decide as soon as reasonably possible, and in any event within 30 days of receiving the request or the further particulars we asked for, and tell you the decision. That period may be extended once, by up to a further 30 days, in the circumstances set out in section 57. If a third party's information is involved we must notify them first and give them a chance to make representations, and the period runs from then.

If we grant the request, the notice will state the access fee to be paid and the form in which access will be given. If we refuse it, the notice will state which provision of PAIA we relied on, give adequate reasons, and set out your right to complain to the Regulator or to apply to a court. If we do not answer you in time, the request is regarded as refused.

11.5 Grounds on which we may have to refuse

PAIA obliges a private body to refuse access on certain grounds, mainly to protect other people. The grounds that can apply to us are-

Where only part of a record must be withheld, section 59 obliges us to give you the rest of it.

11.6 If you are not satisfied

There is no internal appeal against a decision of a private body. If you are unhappy with our decision, with the fee, or with the form of access, you may-

• lodge a complaint with the Information Regulator under section 77A of PAIA, using Form 5; or
• apply to a court under section 78 of PAIA.

The Regulator's details are:

11.7 Asking about your own personal information

If what you want is your own personal information rather than a record in the PAIA sense, POPIA gives you a separate and simpler right to ask what we hold, to have it corrected, and to have it deleted. Write to the Information Officer at info@wagedesk.co.za, or read our privacy policy, which sets out those rights and how we answer them.