PAIA Manual

Manual in terms of section 51 of the Promotion of Access to Information Act 2 of 2000 (PAIA). Last updated: 20 October 2026.

1. Introduction

1.1 This manual tells you what records the BlackLeaf group holds, how to request access to them, and how we process personal information. It is published under section 51 of PAIA and section 17 of the Protection of Personal Information Act 4 of 2013 (POPIA).

1.2 PAIA gives a person the right of access to a record held by a private body if the record is needed to exercise or protect a right. Access can be refused on the grounds in PAIA.

2. Companies covered

Company	Registration number
BlackLeaf Group Holdings (Pty) Ltd	2025/879490/07
BlackLeaf Wealth (Pty) Ltd	2024/680466/07
BlackLeaf Advisory Group (Pty) Ltd	2025/569905/07
BlackLeaf Fiduciary Management (Pty) Ltd	2025/569829/07
BlackLeaf Capital (Pty) Ltd	2025/368238/07
BlackLeaf Properties (Pty) Ltd (to operate as BlackLeaf Legal from November 2026)	2025/882331/07
BlackLeaf Business Marketplace (Pty) Ltd (to operate as BlackLeaf Accounting from November 2026)	2025/571978/07

Requests are made to the company that holds the record. If you are unsure, send the request to the group address below.

3. Contact details

Head of the private body	Daniel du Toit, Chief Executive Officer / Managing Director
Information Officer (POPIA)	Talita Clarke, Chief Operating Officer
Physical address	The Loft, 439 Diagonal Street, Pringle Bay, 7196
Telephone	+27 82 843 5788
Email for PAIA requests	[email protected]
Website	www.blackleaf.co.za

4. The Information Regulator's guide

The Information Regulator has a guide on how to use PAIA. You can ask the Regulator for it:

JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001 · [email protected] · www.inforegulator.org.za

5. Records available without a request

The following are available on our website or on request, without a PAIA request: this manual, the Terms of Use, Privacy Policy and Collection Notice, Cookie Notice, Shop Terms and Conditions of Purchase, Refund Policy, Complaints Procedure, and general marketing information about our services.

6. Records available under other laws

We keep records as required by the following laws, to the extent each applies to the company concerned: Companies Act 71 of 2008; Income Tax Act 58 of 1962; Value-Added Tax Act 89 of 1991; Tax Administration Act 28 of 2011; Financial Intelligence Centre Act 38 of 2001; Basic Conditions of Employment Act 75 of 1997; Labour Relations Act 66 of 1995; Employment Equity Act 55 of 1998; Skills Development Levies Act 9 of 1999; Unemployment Insurance Act 63 of 2001; Compensation for Occupational Injuries and Diseases Act 130 of 1993; Electronic Communications and Transactions Act 25 of 2002; Consumer Protection Act 68 of 2008; Protection of Personal Information Act 4 of 2013; Promotion of Access to Information Act 2 of 2000.

7. Subjects and categories of records we hold

Access is not automatic for these. A request is needed and some records may be refused on the grounds in section 11.

Subject	Categories of records
Company and governance	Incorporation documents, registers, resolutions, minutes, shareholder and director records, policies
Clients	Engagement letters, mandates, onboarding and identification records, beneficial ownership declarations, invoices, statements, correspondence, client files
Finance and tax	Accounting records, invoices, payment records, VAT and tax records, bank records
Human resources	Employment contracts, payroll, leave, training, recruitment and disciplinary records
Suppliers and partners	Contracts, non-disclosure agreements, operator agreements, correspondence
Compliance and legal	Compliance registers, complaints records, risk registers, legal correspondence
Technology	System logs, access records, security records
Marketing	Marketing lists, campaign records, website data, consent records

8. Processing of personal information (POPIA)

8.1 Purposes. To provide our services and shop orders; to identify and verify clients as the law requires; to bill and collect; to comply with law; to manage our staff; to respond to enquiries and complaints; to market with consent; to keep our systems secure.

8.2 Data subjects and information. Clients and prospective clients (names, identity and company details, contact details, financial and business information needed for the service, payment status); staff and applicants; suppliers and partners; website visitors (technical data, form and consent records).

8.3 Recipients. Group companies; our service providers (hosting by Host Africa; Google Workspace; Xero; ThisIsMe for statutory checks; PayFast for online payments; MailerLite for email marketing; Claude for AI-assisted work); professional partners and advisers; regulators and authorities where the law requires. Each service provider is bound by a written agreement as section 21 of POPIA requires.

8.4 Transfers outside South Africa. Google Workspace data is stored in South Africa. Some other providers may process information in other countries. We transfer information outside South Africa only as section 72 of POPIA allows.

8.5 Security. Named user accounts, access limited by role, multi-factor authentication where available, encryption in transit, backups and logging. A client's portal access ends 24 hours after offboarding.

8.6 Retention. We keep records for the longest period any applicable law requires.

8.7 No automated decisions. No decision with legal or substantial effect on a person is made by an automated system alone (POPIA s 71).

9. How to request access

9.1 Complete the prescribed request form (Form 2 under the PAIA regulations), which is available on the Information Regulator's website, and send it to [email protected] or deliver it to our physical address.

9.2 Give enough detail to identify the record and yourself. Say which right you want to exercise or protect and why the record is needed for it. Tell us how you want access. If you act for someone else, give proof of your authority.

9.3 We will decide within 30 days of receiving a correct request. We may extend by up to 30 days in the cases PAIA allows and will tell you.

9.4 If access is granted you may have to pay an access fee for search and reproduction.

10. Fees

• Request fee: R140.00, payable on submitting Form 2. It is not payable by a person asking for their own personal information.
• Search and preparation: R145.00 for each hour or part of an hour after the first hour, up to R435.00.
• Reproduction: R2.00 per printed A4 page and R40.00 for records on a flash drive.
• Deposit: if search and preparation will take more than six hours, a deposit of one-third of the estimated access fee is payable. It is refunded if access is refused.

Payment details are given when we acknowledge your request.

11. Grounds for refusing access

We may refuse a request on the grounds in Chapter 4 of Part 3 of PAIA, including to protect the privacy of another person, commercial information of a third party, confidential information, the safety of a person or property, and privileged records. We will say which ground applies.

12. If your request is refused

Private bodies have no internal appeal. You may complain to the Information Regulator or apply to a court.

13. Requests to correct or delete personal information

Under sections 23 to 25 of POPIA you may ask to see, correct or delete your personal information. Write to [email protected].

14. Availability and updates

This manual is on our website and available at our address on request. We update it when needed.