The records we keep, and how to ask for them.

Download

Download the manual (PDF)

A copy is free of charge. Printed copies may carry the prescribed reproduction fee. How we handle information collected through this website is set out in our Privacy & POPIA notice.

Company details

Keystone HQ (Pty) Ltd, registration number 2026/816541/07.

30A Morris Shell Drive, Cape Town, Western Cape, 7441 (physical and postal address).

ops@keystonehq.co.za · +27 71 677 2631 · keystonehq.co.za

We design, build and support AI-powered business automation, AI assistants and workflow systems, with related consulting and audit services, for small and growing businesses.

Information Officer

Eduan Rohan Prince, Director, is the head of the company and its Information Officer under PAIA and POPIA.

Send all requests and queries to ops@keystonehq.co.za with the subject line "PAIA request" or "POPIA request", call +27 71 677 2631, or write to 30A Morris Shell Drive, Cape Town, 7441.

The Regulator's guide

The Information Regulator publishes a guide on how to use PAIA and POPIA, in all official languages, together with the prescribed forms.

Information Regulator: Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191 · enquiries@inforegulator.org.za · inforegulator.org.za

Available without a request

Our services, packages and published prices, our Privacy & POPIA notice, our contact details and this manual are freely available on this website.

We have not published a notice under section 52(2) of PAIA. Any other record must be requested as set out below.

Records kept under other laws

Companies Act 71 of 2008; Tax Administration Act 28 of 2011; Income Tax Act 58 of 1962; Value-Added Tax Act 89 of 1991 (once registered for VAT); Protection of Personal Information Act 4 of 2013; Promotion of Access to Information Act 2 of 2000; Electronic Communications and Transactions Act 25 of 2002; Consumer Protection Act 68 of 2008 (where it applies); Broad-Based Black Economic Empowerment Act 53 of 2003.

Once we have employees: Basic Conditions of Employment Act 75 of 1997, Labour Relations Act 66 of 1995, Unemployment Insurance Act 63 of 2001, Skills Development Levies Act 9 of 1999, and Compensation for Occupational Injuries and Diseases Act 130 of 1993.

Records we keep

Company and governance: Memorandum of Incorporation, CIPC registration documents, securities register, register of directors, beneficial ownership filings, resolutions and minutes, shareholders' agreement, annual returns.

Finance and tax: accounting records, invoices and quotes, bank statements, payment records, annual financial statements, tax registrations and returns.

Clients: client services agreements, order forms and quotes, audit questionnaires and reports, project scopes, workflow documentation, handover notes, support requests and correspondence.

Suppliers and contractors: agreements, non-disclosure agreements, invoices and correspondence.

Marketing and enquiries: contact-form messages, Plan a project submissions, audit requests and the newsletter subscriber list.

Intellectual property and IT: brand assets, design files, source code, templates, system access logs, user accounts, and security and backup records. Personnel records once we have employees.

Listing a category doesn't mean every record in it will be released. Access is subject to the grounds for refusal in PAIA.

How to request a record

Complete Form 2 (Request for Access to Record) from the PAIA Regulations, 2021, available on the Information Regulator's website or from us, and send it to the Information Officer by email, post or hand delivery. Describe the record clearly, say how you'd like to receive it, and include proof of identity. If you're asking on someone else's behalf, include proof of your authority.

Unless you're asking for your own personal information, the request fee prescribed in Annexure B of the PAIA Regulations is payable before we process the request. Prescribed access fees apply for searching, preparing and copying records. If preparation will take more than six hours we may ask for a deposit of up to one third of the access fee.

We'll tell you within 30 days of receiving a complete request whether access is granted. This may be extended once by up to 30 days under section 57 of PAIA, with written notice.

We may refuse access on the grounds in PAIA, for example to protect third parties' privacy or commercial information, confidential or privileged information, or the safety of people and property. If you're unhappy with our decision, you may complain to the Information Regulator or apply to court within 180 days.

Why we process personal information

To respond to enquiries and audit requests, prepare quotes and agreements, deliver, test and support our automation services, invoice and collect payment, send our newsletter to people who subscribed, meet our legal, tax and accounting obligations, and protect our systems and records.

When we build automations for a client, we process their customers' information as the client's operator, only on the client's instructions.

Whose information

Prospective and current clients and their staff: names, business details, job titles, contact details, questionnaire and brief answers, correspondence and billing details.

Our clients' customers (as operator): information in the client's systems and messages that our automations handle, such as names, contact details, enquiries, bookings and order or invoice details.

Newsletter subscribers: email address and subscription records. Suppliers and contractors: names, contact, company and banking details. Directors and shareholders: identity, contact and shareholding details.

Who receives it

Our directors and authorised subcontractors who need it for their work; service providers that host or process information for us, such as website hosting and database, email, newsletter, accounting, payment, design and AI providers; our professional advisers and bank; and authorities such as SARS, CIPC and the Information Regulator where the law requires it.

Some of these providers store information on servers outside South Africa. We use reputable providers with adequate protection, as section 72 of POPIA requires. For client work, cross-border transfers are made with the client's approval.

How we protect it

Least-privilege access to systems and client accounts, multi-factor authentication where available, secure handling of credentials, encrypted connections, database access limited to server-side processes, regular access reviews, backups, and confidentiality duties on everyone who works with us.

If personal information is compromised, we will notify the Information Regulator and the people affected, as section 22 of POPIA requires.

Your rights

You can ask whether we hold your personal information, see it, have it corrected or deleted, or object to its processing or to direct marketing. Contact the Information Officer. Objections and correction or deletion requests may be made on Forms 1 and 2 of the POPIA Regulations, 2018.

You may also lodge a complaint with the Information Regulator.