About this manual
PAIA gives everyone a right of access to records held by a private body where the record is needed to exercise or protect a right. This manual tells you what records JOV holds, which of them you can have without asking, and how to ask for the rest. It also describes the personal information we process, as section 51 requires since the Protection of Personal Information Act 4 of 2013 (POPIA) took effect.
To see or correct your own personal information, you do not need this process: email hello@jov.co.za as our privacy notice describes.
Contact details
| Trading as | JOV |
|---|---|
| Information Officer | Ryan Sayer (head of the business) |
| hello@jov.co.za | |
| Website | jov.co.za |
We have not appointed a deputy information officer.
The Information Regulator's guide
The Information Regulator has published a guide on how to use PAIA, as section 10 requires. It explains the rights PAIA gives you and how to use them, and is available in each official language from the Regulator:
| Regulator | Information Regulator (South Africa) |
|---|---|
| Address | Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191 |
| Enquiries | enquiries@inforegulator.org.za |
| Website | https://inforegulator.org.za |
Records available without a request
These are public on jov.co.za and you do not need to make a PAIA request for them:
- this manual;
- our privacy notice, cookies page and terms;
- information about our services, pricing and work published on this website.
Records kept under other laws
We keep records as these laws require, where they apply to us:
| Law | Records |
|---|---|
| Companies Act 71 of 2008 | Company and director records |
| Tax Administration Act 28 of 2011 | Tax records and supporting documents |
| Income Tax Act 58 of 1962 | Income tax and employees’ tax records |
| Value-Added Tax Act 89 of 1991 | VAT records, where we are registered |
| Basic Conditions of Employment Act 75 of 1997 | Employment records, where we employ staff |
| Unemployment Insurance Act 63 of 2001 | UIF records, where we employ staff |
| Electronic Communications and Transactions Act 25 of 2002 | Electronic transaction records |
| Consumer Protection Act 68 of 2008 | Agreements and records of goods and services supplied |
| Protection of Personal Information Act 4 of 2013 | Records of personal information processed |
| Promotion of Access to Information Act 2 of 2000 | This manual, and requests made under it |
This list is not exhaustive. A record not listed here may still be requested.
Records we hold
| Subject | Categories of record |
|---|---|
| Company | Registration documents, director and shareholder records, minutes and resolutions |
| Financial | Accounting records, invoices, bank statements, tax returns and supporting documents |
| Clients | Proposals, agreements, operator agreements, project records, correspondence and invoices |
| Suppliers | Agreements, invoices and correspondence with service providers |
| Staff and contractors | Agreements, payroll and tax records, where we engage people |
| Platform and website | Enquiries, dashboard accounts, website analytics and the records described in our privacy notice |
| Security | Access records, security logs and records of security incidents |
Records about a client's own website visitors are held for that client as its operator. A request for them is passed to the client, who decides it.
How to request a record
- Complete Form 2 (Request for access to a record) from the PAIA Regulations, 2021, available on the Information Regulator's website. Describe the record well enough for us to find it, say how you want access (a copy, an inspection, or electronically), and say which right you need it to exercise or protect.
- Send it to our Information Officer at hello@jov.co.za, with a copy of your identity document. If you are asking on someone else's behalf, include proof that you may.
- Fees. A requester asking for their own personal information pays no request fee. Other requesters pay the request fee prescribed in the PAIA Regulations. If access is granted, access fees for copying, preparing and delivering the record may apply, and we may ask for a deposit where the search and preparation will take long. We will tell you what is payable before doing the work.
- We will decide within 30 days of receiving the request, and may extend that once by up to 30 days where section 57 allows. We will tell you in writing if we do.
When access may be refused
Part 3, Chapter 4 of PAIA sets out the grounds. They include where giving access would:
- unreasonably disclose personal information about another person;
- disclose a third party's trade secrets or confidential commercial information;
- breach a duty of confidence owed to a third party;
- endanger someone's life or safety, or the security of a building, system or property;
- disclose a record privileged from production in legal proceedings;
- disclose our own trade secrets or commercial information that would harm our position;
- disclose research that would put the researcher or the subject at serious disadvantage.
A request that is manifestly frivolous or vexatious, or that would unreasonably divert our resources, may also be refused. If we refuse, we will give our reasons in writing.
If you disagree with our decision
We have no internal appeal. Within 180 days of our decision, you may complain to the Information Regulator under section 77A, or apply to a court under section 78.
Personal information we process
Why
To answer enquiries, deliver the work clients engage us for, host and support their websites and software, run the JOV Dashboard, keep our services secure, meet legal, tax and accounting obligations, and manage our suppliers and staff. Each purpose is set out in our privacy notice.
Whose, and what
| Data subjects | Information |
|---|---|
| Website visitors | Enquiry details, analytics under a random id where allowed, approximate location |
| Clients and prospective clients | Names, contact details, business details, correspondence, billing details |
| Dashboard users | Name, email address, picture, sign-in identifiers, access rights, activity in the dashboard |
| Visitors to our clients' websites | What each client has instructed us to collect, as the client's operator |
| Suppliers and contractors | Names, contact details, banking details, agreements |
| Staff | Identity, contact, tax, banking and employment details, where we employ people |
Who receives it
The service providers below, each on our instructions; our professional advisers, such as accountants and attorneys; and public bodies where the law requires it.
- Rackzar (Pty) Ltd, Centurion, Gauteng, South Africa
- Cloudflare, Inc., United States, with edge locations worldwide
- Google LLC, United States
- Microsoft Corporation, United States
- Amazon Web Services EMEA SARL (Amazon SES), Stockholm, Sweden
- OpenRouter, Inc., United States
- Functional Software, Inc. (Sentry), Germany (EU)
- PostHog, Inc., United States
Transfers outside South Africa
Our database and files are hosted in South Africa. Several providers above process information outside it, as our privacy notice explains. We rely on section 72(1)(a) of POPIA for each.
How it is secured
Traffic is encrypted in transit. Access is limited to people who need it and protected by single sign-on. Each client's data is separated at the database level. Secrets are kept out of source code, sign-ins are rate limited, systems are kept patched, and data is backed up and deleted on fixed retention schedules. Security incidents are handled under section 22 of POPIA.
Where this manual is available
On this website at jov.co.za/paia, and by email on request from hello@jov.co.za, free of charge. We review it at least once a year and whenever what we do changes.