PAIA Policy

Access to Information and Privacy Manual — in2books

Last updated: 1 November 2026

1. Purpose of this manual

This manual explains how in2books handles requests for access to records under the Promotion of Access to Information Act 2 of 2000 (“PAIA”), and how it protects, processes and enables rights over personal information under the Protection of Personal Information Act 4 of 2013 (“POPIA”).

in2books provides cloud software that helps accounting, audit and bookkeeping practices manage workflows, tasks, audits, timekeeping, billing, statutory deadlines, share registers, certificates and reporting. In doing so, in2books may process personal information in two broad ways:

1. As a responsible party — for its own business information, such as employee, user, prospect, supplier, billing and website data.
2. As an operator/processor — when client firms enter or upload their own data into the in2books platform. In that case, the client firm remains responsible for the data, and in2books processes it on the client’s instructions and under the applicable agreement.

This manual also explains how to request access to records, how to object to processing, and how to request correction or deletion of personal information.

2. Contact point for PAIA and POPIA matters

Information Officer: [name]
Email: [email]
Telephone: [number]

Deputy Information Officer: [name]
Email: [email]
Telephone: [number]

Physical address: [address]
Postal address: [address]

Requests, objections and privacy queries should be directed to the Information Officer or Deputy Information Officer using the details above.

3. Legal framework

PAIA gives people a route to request records held by public and private bodies where the record is needed to exercise or protect a right. It gives effect to the constitutional right of access to information.

POPIA sets conditions for lawful processing of personal information. It gives data subjects rights to be informed, to access their information, to request correction or deletion, to object to certain processing, and to complain to the Information Regulator.

This manual describes the records in2books holds, the personal information it processes, and the procedure for PAIA and POPIA requests.

4. Where to get guidance

4.1 PAIA guide

A PAIA guide is available from the South African Human Rights Commission (SAHRC) in any official South African language.

SAHRC PAIA contact details:
29 Princess of Wales Terrace, Corner York and St Andrews Street, Parktown, Johannesburg, 2193
Private Bag 2700, Houghton, Johannesburg, 2041
Tel: 011 484 8300
Fax: 011 484 7146/7
Email: PAIA@sahrc.org.za
Website: www.sahrc.org.za

4.2 POPIA guidance and complaints

POPIA guidance and complaints are handled by the Information Regulator South Africa.

Information Regulator contact details:
JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001
P.O. Box 31533, Braamfontein, Johannesburg, 2017
Complaints: complaints.IR@justice.gov.za
General enquiries: inforeg@justice.gov.za
Website: www.justice.gov.za/inforeg/index.html

5. How in2books approaches POPIA

in2books applies the POPIA processing conditions to personal information for which it is responsible. In summary, in2books aims to ensure that personal information is:

• collected and used lawfully, fairly and openly;
• used for identified and lawful purposes;
• not reused for incompatible purposes;
• relevant, adequate and not excessive;
• accurate and kept up to date where necessary;
• retained only for as long as required;
• protected by appropriate technical and organisational safeguards;
• handled with respect for data-subject rights.

Where in2books acts as an operator for a client firm, it processes client data on the client’s documented instructions, subject to the service agreement and data-processing terms.

Data-subject rights

Subject to applicable law and record-keeping obligations, data subjects may:

• be told that their personal information is being collected;
• be told about a data breach where required;
• ask whether in2books holds personal information about them and request access;
• ask for incorrect, excessive, outdated, incomplete, misleading or unlawfully obtained information to be corrected or deleted;
• object to processing and request deletion, subject to lawful retention requirements;
• object to direct marketing by unsolicited electronic communications;
• complain to the Information Regulator and pursue civil remedies where applicable.

6. Why in2books processes personal information

in2books processes personal information for the following broad purposes:

• providing and operating the in2books platform;
• enabling client firms to manage tasks, workflows, audits, timekeeping, billing, deadlines, registers, certificates and reports;
• creating and administering user accounts;
• communicating with clients, users, prospects and suppliers;
• billing, payment administration and account management;
• identity verification and platform security;
• monitoring, logging and auditing system activity for quality, training, security, fraud prevention and investigation;
• detecting, preventing and investigating crime or misuse;
• complying with legal, tax, regulatory and contractual obligations;
• enforcing or defending legal rights;
• managing relationships with clients, suppliers and other stakeholders;
• any additional purpose authorised by the data subject or notified to the data subject.

The processing may include collection, recording, organisation, storage, retrieval, consultation, use, disclosure, transmission, alignment, restriction, erasure and destruction.

7. Categories of data subjects and information

in2books may process personal information relating to:

Cross-border processing

Because in2books is a cloud platform, personal information may be processed or stored outside South Africa. POPIA permits cross-border transfers where, among other grounds:

• the destination has adequate protection;
• the data subject consents;
• the transfer is necessary for a contract with the data subject;
• the transfer is necessary for a contract with a third party in the data subject’s interest; or
• the transfer benefits the data subject and consent cannot reasonably be obtained.

in2books should ensure appropriate safeguards are in place for any cross-border processing.

8. Legislation relevant to in2books records

Records may be held or processed in terms of legislation including:

• Companies Act 71 of 2008
• Employment Equity Act 55 of 1998
• Labour Relations Act 66 of 1995
• Basic Conditions of Employment Act 75 of 1997
• Unemployment Insurance Act 63 of 2001
• Unemployment Insurance Contributions Act 4 of 2002
• Compensation for Occupational Injuries and Diseases Act 130 of 1993
• Occupational Health and Safety Act 85 of 1993
• Skills Development Act 97 of 1998
• Skills Development Levies Act 9 of 1999
• Consumer Protection Act 68 of 2008
• Income Tax Act 80 of 1961
• Value-Added Tax Act 89 of 1991
• Electronic Communications and Transactions Act 25 of 2002
• Promotion of Access to Information Act 2 of 2000
• Protection of Personal Information Act 4 of 2013
• Broad-Based Black Economic Empowerment Act 53 of 2003
• Tax Administration Act 28 of 2011
• Constitution of the Republic of South Africa, 1996
• Regulation of Interception of Communications and Provision of Communication-Related Information Act 70 of 2002
• Auditing Profession Act 26 of 2005
• Applicable SAICA and IRBA requirements

9. Records held by In2books

Records are classified according to whether they may be disclosed, may not be disclosed, or are subject to limited disclosure.

Record categories

10. Who may request a record

A requester may ask for a record if the record is needed to exercise or protect a right. A request may be made:

• by a person asking for their own record;
• by an agent acting for another person with consent;
• by a third party asking for another person’s record with consent;
• by a public body, subject to PAIA requirements.

11. How to make a PAIA request

1. Use the prescribed PAIA request form:
   http://www.treasury.gov.za/PAIA/PAIA - Form A.pdf
2. Submit the request to the Information Officer using the contact details in section 2.
3. Give enough detail to identify the record and the requester.
4. State the right being exercised or protected and explain why the record is needed for that right.
5. Indicate the preferred form of access.
6. If acting for another person, provide proof of authority.
7. If the request is incomplete or does not follow PAIA, it may be refused.

For POPIA objections, correction or deletion requests, use the Information Regulator’s form:
https://inforegulator.org.za/wp-content/uploads/2020/07/FORM-1-OBJECTION-TO-THE-PROCESSING-OF-PERSONAL-INFORMATION.pdf

12. Fees

A person requesting their own personal information does not pay the request fee. Other requesters pay a R50.00 request fee before the request is processed further.

If access is granted, further fees may apply for search, reproduction, preparation and time beyond the prescribed hours (currently six hours). A deposit of one third may be required. Postage is payable where records must be posted.

13. Decision and notification

In2books will decide within 30 days of receiving a compliant request. If the request involves a large volume of information and cannot reasonably be handled within that period, in2books may extend the period by up to a further 30 days and will notify the requester in writing.

If access is granted, the requester will be told:

• the access fee payable;
• the form in which access will be given;
• that the fee may be challenged in court.

If access is refused, the requester will be told:

• the reasons for refusal;
• that the refusal may be challenged in court.

14. Grounds for refusal

Access may be refused where PAIA requires or permits refusal, including where disclosure would:

• unreasonably invade a third party’s privacy;
• reveal trade secrets;
• harm commercial or financial interests;
• breach a duty of confidence;
• endanger individuals or property;
• reveal legally privileged material;
• harm research information of in2books or a third party.

15. Appeals and review

A requester who is unhappy with a refusal may apply to a court with jurisdiction within 30 days of being notified of the decision, for appropriate relief.

In2books
Small Business Accounting 
Email  : legal@in2books.co.za
Phone :  +27 78 066 9126
© 2022–2026 APP INA BOX (Pty) Ltd t/a In2books