PAIA & POPIA Manual

This is the manual of dolledbysrara, a registered South African company, a private body under PAIA, compiled under section 51 of PAIA and section 51(1)(c) as amended by the Protection of Personal Information Act (POPIA).

• Head of the private body and Information Officer: Srara
• Physical and postal address: 344 Molefe Street, Emfihlweni Section, Tembisa, 1632, Gauteng
• Phone / WhatsApp: 068 288 0321
• Email: ugcbynoma@gmail.com

The Information Regulator publishes a guide on how to use PAIA and POPIA to request information. It is available in all official languages from the Regulator at inforegulator.org.za, or you can ask us for a copy.

Everything published on this website is available to anyone without a PAIA request: our services and prices, our Terms & Conditions and booking policy, our Privacy Policy, and this manual.

We keep records as required by, among others:

• the Companies Act 71 of 2008;
• the Tax Administration Act 28 of 2011 and the Income Tax Act 58 of 1962;
• the Value-Added Tax Act 89 of 1991, where it applies;
• the Consumer Protection Act 68 of 2008;
• the Electronic Communications and Transactions Act 25 of 2002;
• the Protection of Personal Information Act 4 of 2013.

• Company records: incorporation documents, statutory registers and resolutions.
• Financial and tax records: payments, deposits, refunds, invoices and tax returns.
• Client records: booking requests and appointments, shop orders, reference photos, messages and published reviews.
• Supplier records: agreements and correspondence with suppliers and service providers.
• Website and systems: the booking and shop database, email delivery logs and security logs.

Purpose

To take, manage and fulfil bookings and orders, take payments, deliver products, answer questions, publish reviews clients agree to share, keep the records the law requires, and keep our systems secure.

Whose information, and what

• Clients: name, phone number, email address, appointment details, notes (which may include health details, with consent), reference photos, delivery address, order and payment records, and reviews.
• Staff: contact details and dashboard sign-in records.
• Suppliers and service providers: business contact and payment details.
• Website visitors: IP addresses in short-lived server logs.

Who receives it

Our service providers, only to provide their service: Supabase (database and storage), Vercel (website hosting), Resend (email), Yoco (card payments), Google (calendar and maps), and PAXI or Uber Connect (deliveries). Also anyone the law requires us to disclose information to.

Information sent outside South Africa

Supabase and Resend store information in the European Union, and Vercel and Google in the United States. We use them only where they are bound to protect it to a standard at least equal to POPIA’s.

Security measures

Encrypted connections throughout, card details handled only by Yoco, a dashboard limited to Srara and the staff she authorises, database access rules, and automatic deletion of information we no longer need, as set out in our Privacy Policy.

• Use Form 2 of the PAIA Regulations (available from the Information Regulator) and send it to the email address above. Say which record you want, in what form, and which right you need it to exercise or protect.
• For your own personal information, simply WhatsApp or email us — see your rights. That is free of charge.
• We will decide on a request within 30 days, which PAIA allows us to extend once by up to 30 more days, with notice to you. Fees prescribed in the PAIA Regulations may apply to other requests, and we will tell you in advance.
• We may refuse access only on the grounds set out in PAIA, for example to protect another person’s privacy or confidential commercial information.
• If you are unhappy with our decision, you may complain to the Information Regulator at PAIAComplaints@inforegulator.org.za, or apply to a court.

This manual is on our website at all times, and a copy is available at the studio on request.