PAIA Manual

Last updated: 31 July 2026

This manual is published in terms of section 51 of the Promotion of Access to Information Act 2 of 2000 ("PAIA"). Some identity fields below are still being confirmed and are marked accordingly. Where a detail is not yet published, contact [email protected] and we will provide it.

1. Identification of the private body

  • Trading / product name: EasyQuo
  • Legal operator: Being confirmed. Formal enquiries: [email protected].
  • Entity type: Being confirmed.
  • Registration number: Being confirmed.
  • Head of the private body: Being confirmed. Requests may be addressed to [email protected] in the interim.
  • Information Officer: Not yet published. Address requests to the Information Officer at [email protected].
  • Information Officer registration reference: Registration with the Information Regulator is being completed.
  • Postal / physical address: Being confirmed. Requests are accepted by email at [email protected] in the interim.
  • Telephone: Not published. Email is the published contact route.
  • Email for PAIA requests: [email protected]
  • Email for privacy and POPIA enquiries: [email protected]
  • Website: https://easyquo.com
  • Country: South Africa

Where a field above is marked as being confirmed, we have chosen not to publish an unverified detail. Email [email protected] and we will supply the current details in writing so a request can be submitted properly.

2. Legal framework

PAIA gives effect to the constitutional right of access to information. It requires a private body to compile a manual describing the records it holds and how a person may request access to them. This manual is that document.

Two statutes and one regulator are relevant to information requests involving EasyQuo:

  • PAIAgoverns requests for access to records held by us, whether the requester is seeking their own information or someone else's.
  • POPIA (the Protection of Personal Information Act 4 of 2013) governs how personal information is processed, and gives data subjects rights of access, correction, and objection. Requests for access to your own personal information are usually handled under POPIA and our Privacy Policy, though PAIA may also apply.
  • The Information Regulator (South Africa) (opens in a new tab) oversees both statutes. It receives PAIA manuals, handles complaints, and issues guidance and the prescribed forms.

3. Categories of records we hold

The categories below describe the kinds of records EasyQuo keeps in the ordinary course of operating the platform. Listing a category here does not mean every record in it will be disclosed on request - each request is assessed on its own facts against the grounds for refusal in section 5.

  • Company and governance records: founding and registration documents, resolutions, and internal governance records, to the extent they exist.
  • Financial and tax records: accounting records, invoices issued and received, bank and payment-processor records, VAT and SARS submissions, and audit or review material.
  • Customer and subscription records: business (tenant) account records, plan and subscription state, billing history, trial and lifecycle events, and payment references.
  • User and account records: user profiles, roles and memberships, authentication metadata, and account activity relating to the EasyQuo application.
  • Contracts and supplier records: agreements with hosting, email, SMS, payment, and other service providers, and related correspondence.
  • Product and technical records: source code, architecture and design documentation, configuration, and release records.
  • Security and audit records: access logs, audit trails, incident records, and security assessment material.
  • Support and communication records: support tickets, contact-form submissions, and correspondence with users and businesses.
  • Human resources records, where applicable: employment and contractor agreements, payroll records, and related statutory submissions.
  • Marketing and website records: published marketing content, campaign material, and website operational records.
  • POPIA compliance records: this manual, privacy notices, data-subject and access request records, operator agreements, and records of security compromises where any have occurred.
  • Policies and internal procedures: internal standards, security policies, and operating procedures.

Records belonging to our customers. Businesses using EasyQuo store their own customer, quote, invoice, and communication records in the platform. For that data we generally act as an operatoron the customer's instructions rather than as the responsible party. A request for access to a business's records is normally a matter between that business and the requester, and we will usually redirect the request to the relevant business. See section 7 and our Privacy Policy.

4. Records available without a formal PAIA request

Some information is published and needs no request at all:

No records are currently listed in terms of section 52(2) of PAIA as being automatically available in the Government Gazette.

5. How to request access to a record

5.1 Use the prescribed form

A request for access must be made on the prescribed PAIA request form for a private body - commonly referred to as Form 2. The current form and its accompanying guidance are published by the Information Regulator:

We deliberately do not host our own copy of the form. The Regulator updates the prescribed forms from time to time, and a stale local copy would be worse than no copy. Always use the version currently published by the Regulator.

5.2 Where to send it

Send the completed form, and anything supporting it, to [email protected]. Where a physical address is required for service, request it at the same address and we will provide it in writing.

5.3 What the request must contain

  • Identification: sufficient particulars of the requester, including an address or electronic address in South Africa for our response.
  • Description of the record: enough detail for us to identify the record sought. Vague or open-ended descriptions slow the request down and may prevent us from locating anything.
  • The right being exercised or protected: PAIA requires a requester to identify the right they are seeking to exercise or protect, and to explain why the record is required for that purpose.
  • Form of access: the form in which you would prefer to receive the record, and whether you need it in a particular format for accessibility reasons (see our Accessibility Statement).
  • Proof of authority: where you are acting on behalf of another person, proof that you are authorised to do so.

5.4 Fees

PAIA provides for a request fee and, where applicable, an access fee for the time and materials involved in reproducing and preparing a record. The amounts are prescribed by regulation and are updated from time to time by the Minister; we do not set them and do not publish our own fee schedule. The fees applicable to your request will be quoted to you in writing before work proceeds, at the rates then prescribed. The current schedule is published by the Information Regulator (South Africa) (opens in a new tab).

Where a requester seeks access to a record containing their own personal information, PAIA does not require a request fee.

5.5 Our decision

We will process the request within the timelines PAIA allows and notify you in writing of the outcome. A request may be:

  • Granted in full;
  • Granted in part, with portions withheld or redacted where a ground for refusal applies to those portions only; or
  • Refused, with reasons.

Where a third party's interests are affected, PAIA may require us to notify that third party and allow them to make representations before we decide. That process can extend the timeline.

5.6 If you are unhappy with the outcome

A requester who is dissatisfied with a decision may lodge a complaint with the Information Regulator, or approach a competent court, as provided for in PAIA. Complaint forms and the current submission channels are published by the Information Regulator - complaints (opens in a new tab).

6. Grounds on which access may be refused

PAIA both permits and, in some cases, requires a private body to refuse access. Grounds that may apply to a request made to us include the protection of:

  • Third-party privacy - the personal information of someone other than the requester, where disclosure would be unreasonable.
  • Commercial information - trade secrets, financial or commercial information whose disclosure could harm the commercial or financial interests of us or a third party.
  • Confidential information - information supplied in confidence, where disclosure could reasonably be expected to prejudice the supplier or breach a duty of confidence.
  • Safety and security - records whose disclosure could endanger a person, or prejudice the security of property, systems, or information.
  • Legally privileged records - records privileged from production in legal proceedings.
  • Research information - research information of a third party or of ours, where disclosure could expose the researcher or the subject matter to serious disadvantage.
  • Records whose disclosure would be unlawful - or which another statute prohibits us from releasing.

This is a summary written to help a requester understand what may happen, not an exhaustive statement or interpretation of PAIA. The Act itself governs, including any public-interest override that may apply.

7. POPIA disclosures

The following mirrors our Privacy Policy, which remains the fuller description of how we handle personal information. Where the two differ, the Privacy Policy is the more detailed statement and should be read with this section.

7.1 Purpose of processing

We process personal information to create and operate accounts and business workspaces; to provide, secure, support, and improve the EasyQuo platform; to process subscriptions and payments; to communicate about the service, security, and support; to detect and prevent fraud and abuse; and to meet legal, tax, and accounting obligations.

7.2 Categories of data subjects

  • Users and account holders of the EasyQuo application
  • Representatives and staff of businesses that subscribe to EasyQuo
  • Customers, contacts, and suppliers whose details a business records in its own EasyQuo workspace
  • Website visitors and people who contact us
  • Our own employees, contractors, and suppliers, where applicable

7.3 Categories of personal information

  • Identity and contact details: name, email address, telephone number, business name and address, and role
  • Account information: credentials in hashed form, roles and permissions, and account activity
  • Transactional and financial information: subscription and billing state, payment references, and the quote, invoice, and payment records a business creates
  • Communication records: support correspondence, contact-form submissions, and messages sent through the platform
  • Technical information: IP address, device and browser information, and usage and diagnostic data

7.4 Recipients or categories of recipients

  • Hosting and infrastructure providers, email and SMS delivery providers, payment processors, and security and monitoring providers, each engaged as an operator under contract
  • Professional advisers, such as accountants, auditors, or attorneys
  • Regulators, courts, or law-enforcement authorities where the law requires it
  • An acquirer or successor in the event of a merger, acquisition, or sale of assets, subject to appropriate safeguards

7.5 Cross-border transfers

Some of our service providers process information outside South Africa. Where that happens we take the steps POPIA requires, which may include contractual safeguards binding the recipient to an adequate level of protection, or relying on another lawful basis for the transfer.

7.6 Security safeguards

We apply technical and organisational measures appropriate to the risk, including role-based access control, tenant isolation between business workspaces, encryption of credentials and secrets at rest, encryption in transit, audit logging, and due diligence on the providers we use. No online service can be guaranteed secure; we describe our approach rather than promise an outcome.

7.7 Our operator role for tenant data

For the customer, quote, invoice, and communication records a business creates in EasyQuo, that business is the responsible party and we are the operator. We process that information on the business's instructions. A data subject wanting access to, or correction of, those records should approach the relevant business directly. If a request reaches us instead, we will normally redirect it to that business and assist where we appropriately can.

8. Availability of this manual

This manual is available free of charge on this page at https://easyquo.com/paia. A copy will also be provided by email on request to [email protected], including in an alternative accessible format where you need one.

We review this manual periodically and when our operations or legal details change. The review date is shown at the top of this page.

This manual is provided for information and to support access-to-information requests. It is not legal advice and has not been certified by any authority. It must be reviewed by a qualified South African legal or compliance professional before it is treated as final.