PAIA Manual

1. About AFTERLEADS

AFTERLEADS is a private company registered in South Africa (enterprise number K2026762903). It operates AfterLeads, an online service that helps businesses follow up on enquiries until each one reaches a clear yes or no.

2. The Regulator's guide to PAIA

The Information Regulator publishes a guide, in each official language, on how to use PAIA and POPIA. It explains your rights and how to exercise them. You can get it from the Information Regulator's website, or from our Information Officer.

3. Records available without a request

These records are published and can be read without a formal request:

• our Privacy Policy and Terms of Service;
• this PAIA manual;
• product information, frequently asked questions and resources on www.afterleads.co.

4. Records we hold

Records kept under other laws

We keep records where these laws require it, as they apply to us: the Companies Act 71 of 2008, the Income Tax Act 58 of 1962, the Tax Administration Act 28 of 2011, the Value-Added Tax Act 89 of 1991, the Basic Conditions of Employment Act 75 of 1997, the Electronic Communications and Transactions Act 25 of 2002, the Consumer Protection Act 68 of 2008 and POPIA.

Categories of records

• Company records: registration documents, directors' records, resolutions and agreements.
• Financial and tax records: accounting records, invoices, bank records and tax returns.
• Supplier records: agreements and correspondence with the service providers listed in our Privacy Policy.
• Customer account records: account, business and team details, settings, consent records and support correspondence.
• Service records held for businesses: the opportunities, enquiries, follow-up history and messages each business keeps in AfterLeads. We hold these as that business's operator, so requests for them should normally go to that business.
• Security and operational records: sign-in, audit, delivery and incident records.
• Marketing records: follow up check report requests and marketing consent choices.

5. How to make a request

1. Complete Form 2 (Request for access to record) from the Information Regulator's website, or send an email that gives the same details.
2. Describe the record you want clearly enough for us to find it, say how you would like to receive it, and give your contact details.
3. If you ask for a record about someone else, explain which right you are trying to protect or exercise and why you need the record.
4. If you ask on behalf of someone else, include proof that you may act for them.
5. Send it to lebogang@afterleads.co. We will confirm receipt and may ask you to confirm your identity.

We will decide within 30 days. We may extend that once by up to 30 more days where PAIA allows, and we will tell you why. If you have a disability or cannot read or write, the Information Officer can help you make the request.

6. Fees

Asking for your own personal information is free. For other records, PAIA lets a private body charge the request fee and access fees set in the PAIA regulations, for example for copying, preparing or posting records. We will tell you any fee before we do the work, and you do not pay anything if your request is refused.

7. Grounds for refusal

PAIA requires or allows us to refuse access in certain cases, including to protect another person's privacy, commercial information of a third party or of AFTERLEADS, confidential information, the safety of people or property, legally privileged records, and research information. Where we refuse, we will explain why and, where possible, give access to the parts of the record that can be shared.

8. If you disagree with our decision

AFTERLEADS has no internal appeal process. If you are unhappy with our decision, you can complain to the Information Regulator within 180 days, or apply to court.

9. How we process personal information

Purposes

We process personal information to provide, secure and support the AfterLeads service, to keep account, billing and legal records, to answer enquiries and requests, and, only with consent or where the law allows, to send product news. Our Privacy Policy gives the detail.

People whose information we process, and what we hold

• Users and businesses: names, email addresses, roles, business details, settings and consent records.
• Customers and enquirers of businesses that use AfterLeads: names, contact details, enquiry details, notes and follow-up messages, held as the business's operator.
• People who take the follow up check or contact us: email address, optional name and business name, answers and marketing choice.
• Suppliers: contact and agreement details.

Who receives it

The service providers listed in our Privacy Policy, the businesses that own their customer records, and authorities where the law requires it.

Transfers outside South Africa

Our data is stored in the European Union, and some providers process it in the United States or on global networks. These transfers rely on the providers' written data-protection terms, as section 72 of POPIA allows.

Security measures

Data is encrypted in transit; provider credentials are encrypted at rest; each business's data is separated by database row-level security; access is limited to authenticated people who need it; sign-in and public forms are protected against bots; and we keep a written plan for responding to security incidents, including notifying the Information Regulator and affected people.

10. Updates to this manual

We review this manual at least once a year and whenever our processing changes. The latest version is always on this page.