Kostra — PAIA Manual

1. Introduction

[Company (Pty) Ltd] ("Kostra", "the Company") operates Kostra, a private software service at kostra.co.za that lets PSIRA-registered security businesses find PSIRA-registered security officers available for relief, spare, standby or shift cover in a given area, and contact them directly to arrange cover. This manual is published in terms of section 51 of PAIA to assist any person who wishes to request access to a record held by the Company, and to set out the records the Company holds and how access to them may be requested. It should be read together with the Company's Privacy Policy and Terms of Use.

2. Particulars of the private body (section 51(1)(a))

• Registered name: [Company (Pty) Ltd]
• Registration number: [reg no]
• Registered / principal address: [registered address]
• Postal address: as above
• Telephone: (contact via email below)
• Website: https://kostra.co.za
• Email: support@kostra.co.za

3. Information / Deputy Information Officer (section 51(1)(a))

• Information Officer: [name]
• Email: support@kostra.co.za
• Postal address: [registered address]

All requests for access to records held by the Company must be directed to the Information Officer at the above email address.

(The Information Officer must be registered with the Information Regulator of South Africa before the Company processes personal information. Registration number: [to be inserted on registration].)

4. The Guide of the Information Regulator (section 51(1)(b))

The Information Regulator has, in terms of section 10 of PAIA, published a Guide on how to use PAIA, available in each official language. The Guide contains information reasonably required by a person who wishes to exercise a right under PAIA, and can be obtained from the Information Regulator:

• The Information Regulator (South Africa)
• JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001
• PO Box 31533, Braamfontein, Johannesburg, 2017
• Email: inforeg@inforegulator.org.za · PAIAComplaints@inforegulator.org.za
• Website: https://inforegulator.org.za

5. Records held by the Company (section 51(1)(d) and (e))

5.1 Records that may be requested under PAIA

The following categories of records are held by the Company and may be the subject of a request for access (subject to the grounds for refusal in PAIA):

• Company / statutory records: incorporation documents, Memorandum of Incorporation, registers, beneficial ownership, annual returns, and related CIPC filings.
• User / personal information records: registration details of security businesses and officers (name, company name, PSIRA registration number, officer grade, SA ID number, province), contact details (email, mobile number), base location / service areas, published availability, and verification records and outcomes — subject to the protection of third-party personal information.
• Introduction / audit records: records of contacts and introductions made through the Service (which business contacted which officer, and when), created as part of the Service's compliance audit trail.
• Financial records: subscription, payment, invoicing and tax records (payments are processed by PayFast; the Company does not store card numbers).
• Operational records: contracts with operators / service providers (see clause 6), policies, and correspondence.
• Marketing and website records: website content, the Terms of Use and Privacy Policy.

5.2 Records available without a PAIA request

The following are freely available on the Company's website and do not require a PAIA request: the Terms of Use, the Privacy Policy, this PAIA Manual, and general information about the service and pricing.

6. Records held in terms of other legislation (section 51(1)(c) and (e))

Records are also kept in accordance with, among others: the Companies Act 71 of 2008; the Protection of Personal Information Act 4 of 2013 (POPIA); the Private Security Industry Regulation Act 56 of 2001 (in respect of the PSIRA registration details Kostra verifies); the Income Tax Act 58 of 1962 and the Tax Administration Act 28 of 2011; the Consumer Protection Act 68 of 2008; and the Electronic Communications and Transactions Act 25 of 2002. Access to a record under another statute is not precluded by this manual.

7. How to request access to a record (section 51(1)(e))

• Complete the prescribed Form 2 (Request for Access to Record) under the PAIA Regulations. The form is available from the Information Regulator's website or on request from the Information Officer.
• Submit the completed form to the Information Officer at support@kostra.co.za.
• Provide sufficient detail to identify the record and the requester, the form of access required, and the right the requester seeks to exercise or protect (where access is sought to protect a right).
• Pay the prescribed request fee and any access fee as set out in the PAIA Regulations (the Information Officer will advise the applicable fees). Fees may be waived or are not payable in the circumstances provided for in PAIA.
• The Information Officer will respond within 30 days (extendable as permitted by PAIA), granting or refusing access and giving reasons where access is refused.

Grounds for refusal

The Company may refuse access on any of the grounds set out in Chapter 4 of Part 3 of PAIA, including (among others) the mandatory protection of the privacy of a third party who is a natural person, the protection of commercial information of a third party or of the Company, and the protection of records privileged from production in legal proceedings.

Remedies

A requester who is dissatisfied with a decision may lodge a complaint with the Information Regulator, or apply to court, as provided for in PAIA.

8. Availability of the manual (section 51(3))

This manual is available: (a) on the Company's website at https://kostra.co.za; (b) at the Company's principal place of business for inspection during office hours; and (c) on request to the Information Officer, and to the Information Regulator. Copies may be subject to the prescribed fee.

9. Updating

This manual will be reviewed and updated as necessary. The latest version is the version published on the Company's website.