PAIA Manual

This manual is published by Providus Labs (Pty) Ltd, which operates Corbel, in terms of section 51 of the Promotion of Access to Information Act, 2000 ("PAIA"). It describes the records we hold and how a person may request access to them.

1. Purpose of this manual

PAIA gives effect to the constitutional right of access to information held by the State and by private bodies, where that information is required for the exercise or protection of any right. This manual is intended to help a requester decide whether we are likely to hold a record they need, and to explain the procedure for asking for it.

2. Particulars of the private body

• Registered name: Providus Labs (Pty) Ltd
• Trading name: Corbel
• Registration number: 2026/142873/07
• Physical and postal address: 649 Cicely Street, Pretoria, Gauteng, 0081, South Africa
• Telephone: +27736983755
• Website: https://corbel.co.za

3. Information Officer

The head of the private body is the Information Officer for the purposes of PAIA and POPIA. All requests for access to records, and all queries about the processing of personal information, must be addressed to the Information Officer at gareth@providuslabs.co.za or at the address in section 2.

4. The Information Regulator's guide

The Information Regulator has compiled a guide, in terms of section 10 of PAIA, containing information to help a person exercise their rights under the Act. It is available from the Regulator in each official language, free of charge:

• Website: inforegulator.org.za
• Email: inforeg@inforegulator.org.za
• Post: The Information Regulator (South Africa), PO Box 31533, Braamfontein, Johannesburg, 2017

5. Records available without a formal request

The following are published on our website and may be accessed at any time without submitting a PAIA request: our Terms of Service, Privacy Policy, Refund Policy, this manual, and our product and pricing information.

A customer may also export their own data from within the product at any time, and may request a copy of the personal information we hold about them under section 23 of POPIA without using the PAIA procedure. See our Privacy Policy.

6. Categories of records held

The subjects and categories below describe the records we hold. Listing a category here does not mean the records in it will be released; each request is assessed against the grounds for refusal in section 9.

• Company records — incorporation and CIPC records, share and director records, insurance, and internal policies.
• Customer account records — the name, email, phone number, firm name and role of each registered user, workspace membership, and invitations.
• Project and drawing records — construction drawings uploaded by customers, together with the measurements, conditions, estimates, bills of quantities and exports created from them. These belong to the customer whose workspace holds them.
• Billing records — subscriptions, invoices and payment history. Card data is processed by Paystack and is not held by us.
• Audit and activity records — a record of privileged actions taken in a workspace: who did what and when, and, for sign-in events, the IP address and browser used. The device data in these records is erased after twelve months; the record itself is kept for seven years.
• Support and correspondence records — email and in-product correspondence with customers.
• Supplier and contractor records — agreements with our service providers.

7. Records held under other legislation

We keep records in terms of, among others, the Companies Act 71 of 2008, the Income Tax Act 58 of 1962, the Tax Administration Act 28 of 2011, the Value-Added Tax Act 89 of 1991, the Protection of Personal Information Act 4 of 2013, and the Electronic Communications and Transactions Act 25 of 2002. Where we employ staff, we additionally keep records required by the Basic Conditions of Employment Act 75 of 1997, the Labour Relations Act 66 of 1995, the Unemployment Insurance Act 63 of 2001, the Compensation for Occupational Injuries and Diseases Act 130 of 1993, and the Skills Development Levies Act 9 of 1999.

8. How to request a record

A request must be made on the prescribed form, which is available from the Information Regulator's website, and delivered to the Information Officer at the address or email in section 2. The request must:

• provide enough detail to identify the record and the requester;
• identify the right the requester is seeking to exercise or protect, and explain why the record is required to exercise or protect it;
• state the form of access required and an address in South Africa for our reply; and
• be accompanied by proof of the capacity in which the requester is acting, if applicable.

We will respond within 30 days of receiving a complete request. That period may be extended by a further 30 days where the request is for a large number of records or requires a search through records held elsewhere; we will notify the requester if it is.

A request fee and an access fee may be payable, at the rates prescribed by regulation under PAIA. We will tell the requester what is payable before processing the request, and may require a deposit where the work involved is substantial. No fee is payable for a request for the requester's own personal information.

9. Grounds on which a request may be refused

PAIA requires or permits us to refuse access in certain cases, including where granting access would involve the unreasonable disclosure of personal information about a third party; where the record contains commercial information of a third party, or trade secrets, financial or technical information the disclosure of which would harm their commercial interests; where the record is protected by legal privilege; where the record contains our own trade secrets or commercial information; and where disclosure would prejudice research being carried out.

Customer drawings and project data are records of that customer's business and are treated as third-party commercial information. We will follow the third-party notification procedure in PAIA before considering any release.

10. If a request is refused

A requester who is dissatisfied with our decision may lodge a complaint with the Information Regulator, or apply to a court with jurisdiction, within the periods allowed by PAIA. There is no internal appeal against a decision of a private body.

11. Processing of personal information

The categories of data subjects whose personal information we process, the purposes of that processing, the recipients it may be supplied to, any cross-border transfers, and our security safeguards are set out in our Privacy Policy, which forms part of this manual.

12. Availability of this manual

This manual is available free of charge on our website at https://corbel.co.za/paia, on request at our registered address, and from the Information Regulator. It is reviewed annually and whenever our operations change materially.