PAIA Manual
Last updated: 25 October 2026
The Promotion of Access to Information Act, 2000 (PAIA) gives everyone the right to ask for records a private company holds, where they need them to exercise or protect a right. This manual, made under section 51 of PAIA, tells you what records Klyvelo holds and how to ask for them.
The short version
- Most of what people want is already free: our terms, privacy policy and prices are on our website, and owners can see and export their own data in Klyvelo.
- To ask for your own personal information, just e-mail us. There is no fee to ask.
- For other records, fill in Form 2 and send it to our Information Officer. We answer within 30 days.
- Records about a shop's customers belong to that shop: ask the shop.
1. About Klyvelo, and how to contact us
Klyvelo (Pty) Ltd is a private company that sells point of sale and loyalty software to South African shops, as a service online.
| Name | Klyvelo (Pty) Ltd |
|---|---|
| Registration number | 2026/842870/07, registered 21 October 2026 |
| Director | Jordan Richard Rudd |
| Information Officer | Jordan Richard Rudd (the head of Klyvelo, under section 1 of PAIA) |
| Deputy Information Officer | None for now: the Information Officer handles every request |
| our help address | |
| Phone | Our phone number will be published here. |
| Physical address | Our business address will be published here. |
| Postal address | Our business address will be published here. |
| Website | our website |
Klyvelo is not registered for VAT.
2. The Regulator's guide to PAIA
The Information Regulator has published a guide on how to use PAIA and POPIA to ask for information (section 10 of PAIA). It is available in every official language and in braille. You can read the English guide on the Regulator's website, ask the Regulator for a copy, or ask our Information Officer for one, free (in person or by e-mail).
| Information Regulator | Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191 |
|---|---|
| Phone | 010 023 5200, toll free 0800 017 160 |
| enquiries@inforegulator.org.za; complaints about access to records: PAIAComplaints@inforegulator.org.za | |
| Website | inforegulator.org.za |
3. Records available without a request
These records are free to see on our website, with no request needed.
- Our Terms of Service, Privacy Policy, Data Processing Terms, Cookie and Storage Policy, Acceptable Use Policy, Refunds and cancellation and this manual.
- Our plans and prices, and information about our products, on our website.
- For shop owners: your own account, business, billing and support records, and your shop's data, which you can see and export in Klyvelo at any time.
4. Records kept under other laws
We keep records as these laws require, where they apply to us. Some are available to the public under those laws (for example at CIPC):
- Companies Act 71 of 2008 (Memorandum of Incorporation, registers of directors and securities, beneficial ownership, minutes and resolutions, annual returns, financial statements)
- Tax Administration Act 28 of 2011 and Income Tax Act 58 of 1962
- Value-Added Tax Act 89 of 1991 (once Klyvelo registers for VAT)
- Protection of Personal Information Act 4 of 2013
- Promotion of Access to Information Act 2 of 2000
- Electronic Communications and Transactions Act 25 of 2002
- Consumer Protection Act 68 of 2008
- Basic Conditions of Employment Act 75 of 1997, Labour Relations Act 66 of 1995, Employment Equity Act 55 of 1998, Unemployment Insurance Act 63 of 2001, Skills Development Levies Act 9 of 1999, and Compensation for Occupational Injuries and Diseases Act 130 of 1993 (once Klyvelo has employees)
This list may not be complete. If a law requires a record we hold, it may be requested under this manual, subject to PAIA's grounds of refusal.
5. The records we hold
| Subject | Records |
|---|---|
| Company and statutory | Registration documents, Memorandum of Incorporation, registers of directors, securities and beneficial owners, resolutions, CIPC filings |
| Finance and tax | Accounting records, bank statements, invoices and receipts, tax returns and assessments, financial statements |
| Customers (shops) | Accounts and the people who sign in to them, business details, plans and subscriptions, payment records from Paystack, message bundle purchases, support requests, records of every support look and change and of every ID number opened, document check records (outcome, reviewer, date), feedback, agreements accepted and their versions |
| Sales representatives | Names and contact details, referral codes, the businesses they brought in, commission records and payments |
| Suppliers and service providers | Agreements and data processing agreements with our providers, invoices, correspondence |
| Product and technology | Source code, system documentation, security policies and logs, backup records, error reports, records of who at Klyvelo has access |
| Privacy and information | Information Officer registration, impact assessments, records of security compromises, requests from people about their personal information, PAIA requests and reports |
| Marketing | Website content, product material, records of consent and opt-outs |
| People | Records of employees and contractors, once Klyvelo has them |
6. Records we hold for shops
Klyvelo holds a great deal of information for the shops that use it: their sales, products, stock, staff, and their customers' and members' details. Each shop is responsible for its own records; Klyvelo keeps them only as the shop's operator, under our Data Processing Terms. If you want a record about you that a shop keeps (for example your points or what you bought), please ask that shop first. If you send the request to us, we will pass it on to the shop and help it answer, and we may treat it as a request to the shop rather than to Klyvelo.
7. How to ask for a record
Your own personal information
To find out what personal information we hold about you, or to ask for a copy, write to our Information Officer at our help address. You do not need a form, and there is no fee to ask (section 23 of POPIA). We may need to check who you are first.
Any other record
- Fill in Form 2, the Information Regulator's form to request a record from a private body (download Form 2), or ask us for a copy.
- Describe the record clearly enough for us to find it, say how you want it (a copy, a look at it, by e-mail or post), and give your contact details.
- Say which right you want to exercise or protect, and why you need the record for it (section 53 of PAIA).
- If you ask for someone else, say in what capacity, and include proof of your authority.
- Include a copy of your ID document.
- Send it to our Information Officer by e-mail to our help address, or by post or by hand to our business address. Our business address will be published here.
- Pay the request fee (section 8), unless you ask only for your own personal information. We tell you if a further fee or a deposit applies.
If you cannot read or write, or have a disability, you may make your request orally, and our Information Officer will fill in the form for you and give you a copy.
8. Fees
These are the fees in Annexure B of the PAIA Regulations, 2021, for private bodies. Klyvelo is not registered for VAT, so no VAT is added.
| Item | Fee |
|---|---|
| Request fee (not payable by someone asking only for their own personal information) | R140.00 |
| A printed or photocopied A4 page | R2.00 a page |
| A copy on a flash drive you provide | R40.00 |
| A copy on a CD you provide / that we provide | R40.00 / R60.00 |
| Transcription of an audio record | R24.00 a page |
| Searching for and preparing the record, for each hour after the first | R145.00 an hour, at most R435.00 |
| Deposit, when the search will take more than six hours | One third of the access fee |
| Postage, e-mail or other delivery | The actual cost |
We tell you the fees before we prepare a record. Records sent by e-mail usually cost only the request fee.
9. Our decision, and refusals
- We decide within 30 days of receiving a complete request, and tell you in writing (on Form 3) whether we give access, and the fees. We may extend this once, by up to 30 more days, if the request is for a large number of records or needs a search far away or consultation; we tell you why.
- If we do not answer within the time allowed, the request counts as refused.
- If the record concerns someone else (a third party), we tell them and give them 21 days to respond before we decide.
- We may refuse access only on the grounds PAIA sets out, including to protect: another person's privacy (section 63); another party's commercial information (section 64) or confidential information (section 65); the safety of people and property (section 66); records privileged in legal proceedings (section 67); Klyvelo's own trade secrets and commercial information, such as our source code and security arrangements (section 68); and research (section 69). We also refuse requests that are clearly frivolous or vexatious, or that would take an unreasonable amount of work. If we refuse, we give reasons and tell you how to challenge it.
- If a record cannot be found or does not exist, we tell you by affidavit or affirmation.
10. If you disagree
Klyvelo is a private body, so there is no internal appeal. If you are unhappy with our decision, our fees, an extension or the form of access, you may, within 180 days of the decision:
- complain to the Information Regulator (section 77A of PAIA), using Form 5 from the Regulator's PAIA forms, at PAIAComplaints@inforegulator.org.za; or
- apply to a court with jurisdiction (section 78).
11. How we process personal information
Section 51(1)(c) of PAIA asks us to set out the following. Our Privacy Policy has the full detail.
Why we process it
To provide our service to shops; to bill them and pay our sales representatives; for support and security; to meet our legal duties; to market our own service to our customers; and, as an operator, to run the point of sale, loyalty, messages and reports for each shop.
Whose information, and what
| People | Information |
|---|---|
| Shop owners and the people they add (admins, managers, staff) | Name, e-mail, mobile number, role, password hash, two-step sign-in status, sign-in and support records; the owner's own ID number in locked form, if they give it |
| Businesses (our customers) | Name, legal name, registration and VAT numbers, addresses, plan, payment history, Paystack references; identity documents and company certificates while they are checked, then the record of each check (outcome, reviewer, date) |
| Shops' customers and members (as operator) | Name, mobile number, e-mail, member number, points, purchases, account balance, consents; where the shop switches it on, date of birth, address, ID type and last four characters, and the outcome of an ID check; a full ID number in locked form, for support to confirm callers; vouchers |
| Shops' staff (as operator) | Name, role, PIN hash, shifts, cash-ups, sales, and contact details for alerts |
| Sales representatives | Name, e-mail, mobile number, referral code, commission and payment details |
| Providers and their contact people | Name, contact details, agreements and payment records |
| Website visitors and people who contact us | IP address and browser details, and what they write to us |
Who receives it
Our providers, each only for its job and under a written agreement: Supabase (database), xneelo (hosting, e-mail and backups), Meta (WhatsApp, switched off for now), Sentry (error reports), Paystack (payments), Cloudflare (domain, website and console traffic, console security), Expo (app updates) and Google Fonts. Also the Xero or Yoco account a shop connects, and authorities where the law requires it. The full list, with locations, is in our Data Processing Terms and Privacy Policy.
Information sent outside South Africa
Our main database is in Ireland (European Union). Meta, Sentry (Germany), Paystack's hosting (Ireland), Cloudflare, Expo and Google work outside South Africa. We transfer personal information only as section 72 of POPIA allows.
How we protect it
Encryption in transit and for backups; row-level security that keeps each business's data apart; hashed passwords and PINs; full ID numbers locked with a key only Klyvelo holds and opened only by our support team with a fresh two-step sign-in, each opening logged; two-step sign-in; support access that is logged and shown to the business; regular access reviews; and error reports that mask personal details. The annex to our Data Processing Terms has more.
12. Where to find this manual
This manual is on our website for anyone to see free of charge, and once our business address is published in section 1, a copy is kept there too. We e-mail a copy on request; a printed copy costs the page fee in section 8. We update it whenever our details or records change, and review it at least once a year.
Approved by Jordan Richard Rudd, Information Officer.