CPC LEGAL
PAIA Manual
PAIA Manual
Prepared in terms of section 51 of the Promotion of Access to Information Act 2 of 2000 (as amended)
Entity: Castor Project Consultants (Pty) Ltd
Registration number: 2021/161461/07
Date of compilation: 3 October 2026
Version: 1.0
TABLE OF CONTENTS
1. List of acronyms and abbreviations
2. Purpose of this PAIA Manual
3. Key contact details for access to information
4. Guide on how to use PAIA
5. Records available without a formal PAIA request
6. Records available in accordance with other legislation
7. Subjects and categories of records held by CPC
8. Processing of personal information
9. How to request access to a CPC record
10. Grounds for refusal, fees and remedies
11. Availability of this Manual
12. Updating of this Manual
1. List of acronyms and abbreviations
| Acronym | Meaning |
|---|---|
| CPC | Castor Project Consultants (Pty) Ltd |
| DIO | Deputy Information Officer |
| DSD | Department of Social Development |
| ECTA | Electronic Communications and Transactions Act 25 of 2002 |
| IO | Information Officer |
| NPO | Non-Profit Organisation |
| PAIA | Promotion of Access to Information Act 2 of 2000, as amended |
| POPIA | Protection of Personal Information Act 4 of 2013 |
| Regulator | Information Regulator (South Africa) |
| Republic | Republic of South Africa |
2. Purpose of this PAIA Manual
This Manual is intended to assist members of the public and other requesters to understand what records CPC holds, which records are publicly available, how to request access to a record, what personal information CPC processes, and what safeguards and remedies apply.
• identify categories of CPC records that are available without a formal PAIA request;
• understand the subjects on which CPC holds records and the categories of records held on each subject;
• obtain the contact details of CPC’s Information Officer for access-to-information requests;
• understand how to use the Information Regulator’s PAIA Guide and prescribed forms;
• understand CPC’s processing of personal information, data-subject categories, recipients, transborder flows and information-security measures; and
• understand the request, fee, refusal and complaint/court processes applicable under PAIA.
3. Key contact details for access to information
For a private juristic person, the head of the private body is the Information Officer by virtue of that position, subject to the registration requirements under POPIA. CPC currently identifies the following person as its Information Officer / Head of Private Body for PAIA and POPIA purposes:
| Item | Details |
|---|---|
| Information Officer / Head of Private Body | Stephan Haupt - Managing Director |
| Telephone | +27 81 645 9338 |
| stephan@castorprojects.com | |
| General access-to-information email | info@castorprojects.com |
| Physical / registered address | 27 Outeniqua Street, Noordheuwel, Krugersdorp, 1739, South Africa |
| Website | https://castorprojects.com |
| Secure NPO application | https://npoapp.castorprojects.com |
Deputy Information Officer: CPC has not designated a Deputy Information Officer at the date of compilation. CPC may designate and register one if its size, structure, processing activities or accessibility requirements make this reasonably necessary.
4. Guide on how to use PAIA
The Information Regulator has published a Guide in terms of section 10 of PAIA explaining how PAIA and POPIA access rights operate, the prescribed request forms, fees, available assistance and remedies. The Guide is available from the Information Regulator and may also be requested from CPC’s Information Officer.
Information Regulator website: https://inforegulator.org.za
Information Regulator eServices: https://eservices.inforegulator.org.za
| Information Regulator contact | Details |
|---|---|
| Physical address | Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, South Africa |
| Postal address | P.O. Box 31533, Braamfontein, Johannesburg, 2017 |
| Telephone | 010 023 5200 |
| General enquiries | enquiries@inforegulator.org.za |
5. Records available without a formal PAIA request
The following records are generally available without a formal PAIA request where they are published or otherwise intended for public access. Availability does not create a right to confidential, privileged, security-sensitive or client-specific information.
| Category | Examples | How available |
|---|---|---|
| Public corporate information | CPC name, contact details, public service descriptions, public notices | CPC website or direct enquiry |
| Customer-facing legal documents | Privacy & POPIA Policy; Terms of Use / Terms of Sale; Refund & Fix Guarantee; DSD Submission Disclaimer; this PAIA Manual | CPC website / application legal links or on request |
| Public marketing and educational content | Website pages, public articles, public product/Tier summaries and general guidance | CPC website |
| Public contact channels | General enquiry and support information | CPC website or email |
| Published statutory / regulatory information | Information CPC is required by law to make publicly available | Website or on request, as applicable |
CPC’s paid digital toolkits, templates, source material, secure application records and client-specific files are not automatically available merely because CPC holds them. Access remains subject to intellectual-property rights, confidentiality, POPIA, contractual restrictions and PAIA.
6. Records available in accordance with other legislation
CPC may create, maintain or make records available under the following South African legislation, where applicable to the particular record, transaction, employee, tax status or business activity:
| Legislation | Examples of relevant records |
|---|---|
| Companies Act 71 of 2008 | Company incorporation, Memorandum of Incorporation, statutory company records and resolutions |
| Promotion of Access to Information Act 2 of 2000 | PAIA Manual, access requests, outcomes, fee and request records |
| Protection of Personal Information Act 4 of 2013 | Privacy governance, consent/objection records, information requests, security-compromise and Information Officer records |
| Electronic Communications and Transactions Act 25 of 2002 | Electronic transaction, website and e-commerce records where applicable |
| Consumer Protection Act 68 of 2008 | Customer transactions, complaints, refund/remedy and consumer-facing records where applicable |
| Income Tax Act 58 of 1962 and Tax Administration Act 28 of 2011 | Tax, accounting and supporting business records where applicable |
| Basic Conditions of Employment Act 75 of 1997 | Employment-related records where applicable |
| Unemployment Insurance Act 63 of 2001 and related legislation | Employment and contribution records where applicable |
| Compensation for Occupational Injuries and Diseases Act 130 of 1993 | Employment and incident records where applicable |
This list is not exhaustive and does not mean every listed record exists in every period. CPC will apply the legislation actually applicable to its circumstances and the specific request.
7. Subjects and categories of records held by CPC
| Subject | Categories of records |
|---|---|
| Corporate governance | Incorporation documents, company registers, resolutions, contracts, policies, insurance and governance records |
| Finance and tax | Invoices, quotations, orders, payment records, bank/payment references, reconciliations, refunds, accounting and tax records |
| Clients and NPOs | Client/NPO master profiles, contact records, CPC References, service records, orders, permissions, compliance-cycle records, assistance cases and communications |
| CPC NPO Platform | User accounts, roles/permissions, authentication linkage, audit/security events, entitlements, downloads, uploads, scan records, configuration and integration/event logs |
| Documents and intellectual property | Master templates, toolkits, document versions, issued documents, licence records, document mapping/supporting records and proprietary methodologies |
| Projects and consulting | Proposals, scopes, reports, project records, correspondence, deliverables, stakeholder records and client-supplied information |
| Marketing and communications | Enquiries, campaign records, communication preferences, consent records, unsubscribe/suppression records and delivery events |
| Suppliers and service providers | Contracts, due diligence, invoices, contact information, service/system records and provider governance |
| Human resources / contractors | Personnel, contractor, remuneration, leave, performance, training, disciplinary and statutory employment records, where applicable |
| Legal, risk and compliance | Policies, legal agreements, complaints, incidents, data-subject requests, PAIA requests, security/compliance registers and audit trails |
| IT and security | System configurations, credentials metadata, security logs, backups/exports, recovery records, change/release records and access-control records |
8. Processing of personal information
8.1 Purpose of processing personal information
CPC processes personal information for legitimate business, contractual, legal, security and service-delivery purposes. These include operating the public website and CPC NPO Platform, registering and supporting users/NPOs, providing products and professional services, processing orders and payments, managing document release and uploads, communicating with customers and stakeholders, protecting systems and records, meeting legal obligations, maintaining audit trails and carrying out lawful marketing subject to preference/consent controls.
8.2 Categories of data subjects and personal information
| Data-subject category | Personal information that may be processed |
|---|---|
| Website visitors and enquirers | Name, organisation, contact details, enquiry/message, source page, device/IP and basic usage/security information |
| Prospective and existing clients | Contact and organisation details, correspondence, contracts, service requirements, billing/payment references and project information |
| NPO users and office bearers | Name, email, mobile number, role/authority, NPO membership, account/security data, governance/contact information and supporting evidence where required |
| NPOs / organisations | Registration details, sector/type, address/location, financial year-end, compliance/service history and organisational records |
| Client personnel / project stakeholders | Identity/contact, role, organisation, project and correspondence information relevant to the engagement |
| Suppliers / operators / professional advisers | Contact details, registration/tax information, contracts, invoices, bank/payment details and service records |
| Employees / contractors | Identity/contact, employment/contract, remuneration, leave, performance, qualification and statutory records where applicable |
| Marketing / imported contacts | Name, organisation/NPO, email, geographic/sector information, source, consent/preferences, unsubscribe/suppression and delivery events |
| Payment counterparties | Order, payment reference/status, proof of EFT where supplied, refund and reconciliation information. CPC does not intentionally store raw card credentials. |
8.3 Recipients or categories of recipients
| Category of information | Recipients / recipient categories |
|---|---|
| Client/NPO and service records | Authorised CPC personnel/contractors and the authorised client/NPO users with a legitimate need to access the record |
| Platform/database/authentication/storage data | Approved cloud database, authentication, hosting and private-storage operators such as Supabase and related infrastructure providers |
| DNS/perimeter/security metadata | Approved DNS, CDN, WAF and security providers such as Cloudflare |
| Email/contact information and message events | Approved email-delivery provider such as Resend and intended message recipients |
| Uploaded files requiring malware scanning | Approved malware-scanning provider such as Cloudmersive, subject to CPC’s upload/quarantine process |
| Payment transaction data | Approved payment gateway, banks and payment processors as required to process or reconcile a transaction |
| Legal/regulatory information | Professional advisers, auditors, insurers, regulators, courts, law-enforcement or government bodies where lawfully required or justified |
8.4 Planned transborder flows of personal information
CPC uses or may use cloud and software service providers whose infrastructure, support, resilience, message delivery or security-processing systems may operate outside South Africa. Depending on provider configuration, personal information may therefore be processed in international cloud regions, including North America and other jurisdictions used by approved providers.
CPC applies section 72 of POPIA to cross-border processing and considers provider security, contractual terms, data location, necessity and the nature of the information. CPC seeks to minimise information sent to external providers and does not intentionally transmit more personal information than is reasonably necessary for the approved service.
8.5 General description of information-security measures
• HTTPS/TLS and provider-managed encryption controls where applicable;
• private storage and NPO-level data segregation;
• role-based access control, least privilege and server-side authorisation checks;
• row-level security and controlled database privileges;
• mandatory email verification and secure authentication/recovery controls;
• server-side protection of API keys and privileged operations;
• quarantine and malware scanning for permitted uploads before trusted use;
• audit/security-event logging for material actions;
• separate Development/Test and Production environments, with real production client data not ordinarily used in Development/Test;
• controlled backups/exports, restore procedures, release/change controls and rollback records; and
• provider, dependency and security review appropriate to CPC’s size, risk and processing activities.
9. How to request access to a CPC record
A person requesting access to a CPC record under PAIA must use the prescribed Form 2 - Request for Access to Record, or any replacement form prescribed by the Information Regulator, and submit it to CPC’s Information Officer at stephan@castorprojects.com or info@castorprojects.com.
For access to a record of a private body under section 50 of PAIA, the requester must identify the record sufficiently, comply with the procedural requirements, indicate the right the requester seeks to exercise or protect and explain why the record is required for that right.
A requester should provide sufficient identity, authority and contact information to allow CPC to verify the requester, locate the record and communicate the outcome. Where the requester acts for another person or organisation, proof of authority may be required.
Current PAIA forms are available from the Information Regulator: https://inforegulator.org.za/paia/
10. Grounds for refusal, fees and remedies
Access is not automatic merely because CPC holds a record. CPC may refuse access where PAIA permits or requires refusal, including to protect another person’s privacy, confidential commercial information, CPC’s or a third party’s intellectual property/trade secrets, privileged material, safety/security, research information or other protected interests.
CPC may charge the request, access, reproduction, search/preparation or other fees prescribed by PAIA and its Regulations. CPC will notify the requester where a prescribed fee or deposit is payable before further processing or release.
A private body does not have an internal PAIA appeal process. A requester who is dissatisfied with CPC’s decision may use the complaint process provided by the Information Regulator and/or approach a court in accordance with PAIA.
Information Regulator complaints / eServices: https://eservices.inforegulator.org.za
11. Availability of this Manual
A copy of this Manual will be made available:
• on CPC’s website at https://castorprojects.com, once published;
• at CPC’s principal place of business for inspection during reasonable business hours by prior arrangement;
• to a person upon request, subject to any fee lawfully prescribed for reproduction; and
• to the Information Regulator upon request or through the Regulator’s eServices portal where applicable.
This Manual is prepared in English. CPC will consider reasonable accessibility requirements and any further language/publication requirement applicable to CPC at the time of publication.
12. Updating of this Manual
CPC will review this Manual periodically and when there is a material change to its business, records, legal obligations, processing activities, service providers or contact details. Superseded versions may be retained for governance and audit purposes.
Issued by: Stephan Haupt
Capacity: Managing Director / Head of Private Body
For: Castor Project Consultants (Pty) Ltd