PAIA and POPIA Manual

This manual explains how to ask Crytation (Pty) Ltd for access to records we hold, what records we hold, and how we process personal information. It is available at crytation.com/paia and, free of charge, from our Information Officer on request.

• Name: Crytation (Pty) Ltd
• Registration number: 2023/243224/07
• Head of the private body (Director): Matthew Phillips
• Information Officer: Matthew Phillips
• Email: myaccountdata@crytation.com
• Physical address: 57 Crawford Drive, Douglasdale, Johannesburg
• Postal address: 134 Market Street, Johannesburg North, 2188
• Website: crytation.com

The Information Regulator publishes a guide on how to use PAIA and POPIA (section 10 of PAIA), in each official language. You can get it from the Regulator:

• Website: inforegulator.org.za
• Email: enquiries@inforegulator.org.za
• Phone: 010 023 5200
• Address: Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191.

You can also ask our Information Officer for a copy.

These are published on our website, and you don't need to make a request to see them:

• Privacy Policy (crytation.com/privacy)
• Terms of Service (crytation.com/terms)
• This manual (crytation.com/paia)
• Information about our service on crytation.com

We keep records as required by laws including:

• Companies Act 71 of 2008
• Income Tax Act 58 of 1962
• Tax Administration Act 28 of 2011
• Protection of Personal Information Act 4 of 2013
• Promotion of Access to Information Act 2 of 2000
• Electronic Communications and Transactions Act 25 of 2002
• Consumer Protection Act 68 of 2008

• Company records: incorporation documents, CIPC filings, registers of directors and shareholders, beneficial ownership records and resolutions.
• Financial and tax records: financial statements, accounting records, bank statements, invoices, tax returns and payment records.
• User records: account details, usage logs, saved articles and trials, notes, folders, projects, Evidence Briefs, feedback and support messages.
• Supplier records: agreements and correspondence with our service providers.
• Business-contact records: contact details and correspondence from outreach to institutions.
• Technical and security records: system logs and security records.

We may refuse access to some records on the grounds in Chapter 4 of Part 3 of PAIA, for example to protect another person's privacy or confidential commercial information.

• Complete Form 2 (Request for Access to Record), available on the Information Regulator's website, and email it to myaccountdata@crytation.com or post it to our postal address.
• Give enough detail for us to identify you and the record, say how you want access (for example, an electronic copy), and if you're asking for someone else, include proof that you may act for them.
• Say which right you want to exercise or protect, and why the record is needed for it (section 53 of PAIA).
• We'll respond within 30 days. If the law allows, we may extend this once by up to 30 days, and we'll tell you why.
• To see, correct or delete your own personal information, you can simply email myaccountdata@crytation.com; you don't need Form 2. You can also download a copy of your data in Settings.

Fees are those prescribed in the PAIA Regulations, 2021:

• Request fee: R140. You don't pay it if you're asking for your own personal information.
• Access fees: for example, R2 per printed page, or R40 for an electronic copy on your own flash drive. We usually email electronic copies.
• Search and preparation: R145 for each hour after the first hour, up to R435.
• If the search will take more than 6 hours, we may ask for a deposit of one third of the access fee.
• We'll tell you the fee before we process your request.

If we refuse your request, or you're unhappy with the fee or the time taken, you may complain to the Information Regulator (PAIAComplaints@inforegulator.org.za) within 180 days, or apply to court.

• Purposes: to provide Crytation, including searches, Evidence Briefs, your saved library and support; to keep the service secure, apply usage limits and improve it; to send marketing, only with consent; to contact staff at institutions about Crytation; and to meet our legal, tax and accounting duties.
• People and information: users (name, email address, password hash, optional avatar, searches, questions, saved content, feedback, usage logs and technical data); business contacts at institutions (name, work email, organisation and role, from public sources); and service providers (contact and payment details).
• Recipients: Base44 (hosting, database, email and AI processing), Microsoft 365 (our business email), the AI model provider Base44 uses, literature and trial databases (search terms only), Google Analytics (only with consent), our payment processor once paid plans launch, and authorities when the law requires.
• Information sent outside South Africa: our providers store and process data outside South Africa. We transfer it because this is necessary to provide the service, and we rely on our providers' data protection commitments, as our Privacy Policy explains.
• Security: encryption in transit (HTTPS), access controls that limit each user to their own data, admin-only access to internal records, regular security scans, a log of administrator access to personal information, an incident register for security compromises, and deletion in line with the retention periods in our Privacy Policy.

You can object to how we process your information, or ask us to correct or delete it, by emailing myaccountdata@crytation.com. If you're unhappy with our response, you may complain to the Information Regulator (inforegulator.org.za).

We review this manual at least once a year and update it when the way we process information changes.