PAIA Manual — Browns Digital

1. Acronyms and abbreviations

• PAIA: Promotion of Access to Information Act 2 of 2000.
• POPIA: Protection of Personal Information Act 4 of 2013.
• IO: Information Officer.
• DIO: Deputy Information Officer.
• Regulator: Information Regulator of South Africa.
• ECTA: Electronic Communications and Transactions Act 25 of 2002.
• CPA: Consumer Protection Act 68 of 2008.

2. Purpose

This manual explains how to request records, which public records do not require a formal request, the subjects and categories of records held or maintained as applicable, relevant legislation, how to obtain the Regulator's PAIA Guide, and how personal information is processed. Listing a category does not mean every possible record exists or that confidential records are automatically public.

3. Key contact details

Address formal requests to the IO. If you cannot use email or the form, telephone the IO for assistance with an accessible way to submit the request. Do not send unnecessary identity documents or sensitive information through public channels.

4. Guide on how to use PAIA and access to the Guide

The Regulator publishes the section 10 Guide explaining PAIA/POPIA, how to make requests, assistance available, fees, refusal grounds and remedies. Its PAIA guidelines page links to the Guide and language versions: https://inforegulator.org.za/paia-guidelines/. Ask the IO for assistance obtaining or inspecting an appropriate available version. Use Form 2 linked in section 11.

Regulator contact details:

• Website: https://inforegulator.org.za/.
• General enquiries: enquiries@inforegulator.org.za.
• PAIA complaints: PAIAComplaints@inforegulator.org.za.
• POPIA complaints: POPIAComplaints@inforegulator.org.za.
• Telephone: 010 023 5200. Toll free: 0800 017 160.
• Physical address: Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191.
• eServices: https://eservices.inforegulator.org.za/.

5. Records available without a formal request

Ordinary website access is free apart from your connectivity costs. These records are available through the links above. Access to your own authenticated project or billing information through the supplied interface is separate from public access; it does not make those records public.

6. Records available or maintained under other legislation

The following describes applicable record-keeping categories, to the extent the company holds the records or the legislation applies. Access remains subject to that legislation and PAIA; this table does not make every listed record public.

7. Subjects and categories of records

PAIA applies to existing records under our control; it does not normally require creating a new analysis to answer a question.

8. Processing of personal information

Pulse is the AI assistant built into Studio. Pulse runs on OpenAI's GPT Luna models. Its profiles are Pulse 1 and Pulse 1 Flash. Studio users must be 13 or older. Users aged 13 to 17 need a parent or guardian's consent; that parent or guardian agrees to the Terms on their behalf and is responsible for the account. Paid plans require purchase by a user aged 18 or older or by a parent or guardian. The AI site builder, labelled in the editor toolbar and the Pulse menu, uses Pulse to generate whole multi-page sites, sections and edits from briefs and clarification answers on Build, Forge and Architect with sufficient credits. The Replace all pages action saves replacement project pages; publishing is separate. Pulse is Browns Digital's AI product and Studio integration, not a foundation model trained by Browns Digital.

8.1 Purposes

Account authentication, service delivery, website/project storage and hosting, Pulse AI operations, including automatic image-inspector descriptions, collaboration, domain connection, payments/credits, support, security and abuse prevention, legal compliance and permitted marketing. The Privacy Policy (https://brownsdigital.org/policies/privacy/) gives the full purpose and retention detail. For processing on a customer's behalf, the DPA applies (https://brownsdigital.org/policies/dpa/).

8.2 Data subjects and information categories

Special personal information and children's information must not be supplied to Pulse or the AI site builder. Customers' own sites may collect children's information; the customer is then the responsible party and is responsible for lawful consent where required and appropriate POPIA safeguards. This is distinct from Studio account eligibility. A parent or guardian may contact support@brownsdigital.org or legal@brownsdigital.org to review or delete their child's information. If a user is under 13, or under 18 without the required consent, we may close the account and delete their information, subject only to legally required retention. We rely on competent-person consent under POPIA section 35(1)(a) for a child's account, collect only what is needed and do not use children's information for marketing.

8.3 Recipients

Authorised staff/contractors, Supabase, Spaceship for web hosting and Spacemail mailboxes, Resend for transactional/product email sending, OpenAI's GPT Luna models for Pulse processing including automatic image-inspector descriptions, Paystack for payments and Better Stack for the status page, as relevant to their functions. Resend sends our emails; Spacemail (Spaceship, Inc., United States) hosts our mailboxes. Cloudflare, Inc. (United States) provides custom-domain ingress, routing and certificate services through its global network. Independent sign-in, community, CDN and customer-selected integration providers receive information described in the Privacy Policy. Advisers and legally entitled authorities receive only what is lawfully necessary. Publicly published content is accessible to visitors.

8.4 Cross-border flows

• Supabase database project storage: Ireland (eu-west-1).
• Hosting: cPanel shared hosting provided by Spaceship, Inc., servers in the United States, on Namecheap infrastructure.
• OpenAI: global processing in the United States and other countries in OpenAI's published API subprocessor list, including Ireland and the United Kingdom (https://openai.com/policies/sub-processor-list/). Processing takes place internationally.
• Resend: Ireland (eu-west-1) for sending; United States for account data, including email metadata, logs and API records, and primary processing operations. Ireland sending is not EU-only storage.
• Incoming mail and mailboxes: Spacemail (Spaceship, Inc., United States). Spaceship's privacy policy describes United States-based servers and processing: https://www.spaceship.com/legal/privacy-policy/.
• Custom-domain ingress, routing, DNS verification and certificates: Cloudflare, Inc. (United States), with processing through its global network. POPIA section 72(1)(a) protection is provided through its standard data processing terms. Published site files remain hosted by Spaceship.
• Paystack: AWS storage in Ireland under Paystack's South African privacy policy; other Paystack entities and service providers may also process information internationally.
• Better Stack: Better Stack publishes primary EU processing and default EU storage, with possible United States and other global subprocessor processing.

The Privacy Policy section 8 is the common provider list. Operator-data transfers outside South Africa require adequate-protection agreements under POPIA section 72(1)(a), including onward-transfer safeguards. We rely on each provider's standard data processing terms (OpenAI, Resend, Spaceship, Supabase, Paystack and others listed), which bind them to protect personal information to a standard substantially similar to POPIA. The Privacy Policy also distinguishes specific valid consent under section 72(1)(b) and contractual necessity under section 72(1)(c), where their conditions actually apply.

Account deletion is requested at support@brownsdigital.org. We verify the account owner or a parent or guardian's authority to act for a child before confirming the request. Support handles the Privacy Policy's 30-day grace/export period and primary deletion. Backups are kept by our hosting and database providers and are overwritten in their normal cycle, within 60 days. The 60-day period runs from primary deletion.

8.5 Security measures

We use Supabase authentication, row-level security on public database tables, server-side access checks, HTTPS, request limits and activity logging. Our duties include confidentiality, least-privilege access, appropriate safeguards, verification and updating under POPIA section 19 and immediate operator breach notification. The binding operator measures appear in the DPA Annex A. Backups are kept by our hosting and database providers and are overwritten in their normal cycle, within 60 days. The 60-day period runs from primary deletion.

9. Availability of this manual

We make this manual available at https://brownsdigital.org/policies/paia/, from the IO on request, at the company's head office for free inspection during normal business hours, and to the Regulator on request. Contact the IO to arrange inspection without affecting the right to inspect. An electronic copy is provided free; a requested printed copy may carry the prescribed reproduction charge.

10. Updating and responsibility

Patrick Robert Brown, as head and IO, is responsible for keeping this manual current and approving it for publication. The provider list and records inventory are updated when operations change.

The IO maintains an access-request register and handles the Regulator's annual reporting request under PAIA section 83(4). The Regulator's current annual-report page describes an annual 1 April to 30 June submission window; the applicable year's notice and portal instructions determine what must be submitted. Source: https://inforegulator.org.za/paia-annual-report/.

11. Request procedure and Form 2

1. Use current Form 2, Request for Access to Record, Regulation 7: https://inforegulator.org.za/wp-content/uploads/2020/07/InfoRegSA-PAIA-Form02-Reg7.pdf. The Regulator's guidelines page above is an alternative starting point if its file URL changes.

2. Send the completed form to legal@brownsdigital.org for the IO, or deliver it at the completed physical address in section 3. Give sufficient particulars to locate the record, identify the right you seek to exercise/protect and explain why the record is required for that right, where PAIA section 50 requires this. State your preferred form of access and correspondence.

3. Supply proportionate proof of identity and, if acting for someone else, authority. We assist with completing the request where reasonably needed and do not demand irrelevant information.

4. We tell you about applicable request/access fees and any lawful deposit before incurring chargeable work. Confirmation under POPIA section 23(1)(a) of whether we hold your personal information is free. Any applicable lawful fee exceptions are respected.

5. We decide and notify you as soon as reasonably possible and within 30 days of receipt, subject to lawful provisions governing the request. A permitted extension is at most a further 30 days; notice gives reasons and your challenge rights. No response within the applicable period can constitute a deemed refusal.

6. If access is granted we explain the form of access and any payable access fee. If refused, we give adequate reasons, applicable legal grounds and remedies, subject to the law. Lawful refusal grounds can include another person's privacy, protected confidential/commercial information, privilege or safety; applicable public-interest overrides and severance of exempt parts must be considered.

There is no statutory internal PAIA appeal for this private body. You may ask us to reconsider without losing other remedies. A complaint may be lodged with the Regulator using current Form 5, generally within 180 days of the relevant decision/deemed refusal, subject to the applicable Act and any permitted condonation. The Regulator's contact/form guidance is at https://inforegulator.org.za/contact-us/. PAIA also provides court remedies within statutory time limits. Nothing here requires waiting for an informal discussion before protecting a deadline.

Requests about a customer's hosted visitor records may need to be directed to that responsible party; we assist under the DPA rather than treating all customer records as our own account records.

12. Prescribed fees

The prescribed private-body fee tariff is set out below and at https://inforegulator.org.za/paia-fees-structure-2/. PAIA, its regulations and applicable exemptions prevail if the tariff changes. Fees are not charged merely for inspecting this manual or for a free POPIA confirmation. Confirmation that we hold personal information is distinguished from a fee-bearing request for a copy.

A requester may challenge fees and claim any legally applicable exemption. We do not apply public-body income exemptions as though they automatically apply to private bodies. A lawful deposit is refunded where the regulations require, including when access is refused.