PAIA Manual
BluBerri Press Content House (Pty) Ltd | Version 1.2 | Effective date: 7 July 2026 Prepared in terms of section 51 of the Promotion of Access to Information Act 2 of 2000 (as amended), read with the Protection of Personal Information Act 4 of 2013.
1. Acronyms
"IO" — Information Officer · "PAIA" — Promotion of Access to Information Act 2 of 2000 (as amended) · "POPIA" — Protection of Personal Information Act 4 of 2013 · "Regulator" — Information Regulator (South Africa) · "Republic" — Republic of South Africa · "the Company"/"BluBerri" — BluBerri Press Content House (Pty) Ltd.
2. Purpose of this PAIA Manual
This Manual is published in terms of section 51 of PAIA to assist members of the public to: check the categories of records available without a formal request; understand how to make a request for access to a record; know which records are available under other legislation; access the contact details of the Information Officer; know how to obtain the Regulator's Guide on how to use PAIA; and know whether and how the Company processes personal information, the categories of data subjects and information, the recipients, planned trans-border flows, and the security measures applied (section 8 below serves as the POPIA section 17 record of processing).
3. Key Contact Details
BluBerri Press Content House (Pty) Ltd (Registration No. 2026/169849/07) is a private body under PAIA.
3.1 Head of the Private Body and Information Officer: Everhardt Theodorus (Theon) Jansen van Rensburg — Director. As head of the private body, the Director serves as the Information Officer for PAIA and POPIA purposes. · Information Regulator registration number: 2026-061370 (registered 7 July 2026) · hello@bluberripress.com · bluberripress.com
No Deputy Information Officer is designated at this stage; given the size of the Company, the Information Officer performs all duties. This Manual will be updated if one is appointed.
3.2 Postal and physical address: 24 Gregory Avenue, Melrose North, Johannesburg, Gauteng, 2196 · General email: hello@bluberripress.com
3.3 Information Regulator (South Africa): Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg · P.O. Box 31533, Braamfontein, Johannesburg, 2017 · enquiries@inforegulator.org.za · https://inforegulator.org.za/
4. The Regulator's Guide on How to Use PAIA
The Regulator has, under section 10(1) of PAIA, published a Guide on how to use PAIA and POPIA, in all official languages and braille, covering the objects of both Acts, the manner and form of requests, available assistance and remedies, and the applicable fees and regulations. The Guide is available from the Regulator at https://inforegulator.org.za/ or from the Information Officer on request. This Manual is available in English; the Company will make reasonable arrangements to assist requesters requiring another official language.
5. Categories of Records Available Without a Formal Request
| Category | Types of record | On website | On request |
|---|---|---|---|
| Company policies | Privacy Policy, Website Terms of Use, Service Agreement, Refund & Cancellation Policy, Cookie Notice | Yes | Yes |
| This PAIA Manual | PAIA Manual | Yes | Yes |
| Service information | Service descriptions, subscription tiers and pricing, demonstration content | Yes | Yes |
| Company information | Registered name, registration number, contact details (ECTA disclosure) | Yes | Yes |
6. Records Available in Accordance with Other Legislation
Memorandum of Incorporation, company registers, and director records (Companies Act 71 of 2008); this Manual and request records (PAIA); records of processing, data-subject request records, and security-compromise records (POPIA); tax, VAT, and financial records (Income Tax Act 58 of 1962; VAT Act 89 of 1991; Tax Administration Act 28 of 2011); client contracts and consumer-transaction records (Consumer Protection Act 68 of 2008; ECTA 25 of 2002); employment records when staff are engaged (BCEA 75 of 1997; LRA 66 of 1995).
7. Subjects on Which the Company Holds Records
Clients and service delivery (contact details, Brand Profiles, uploaded materials, brief and generation records, communications, acceptance records); prospective clients via /try (emails, demo photographs, brand responses, consent records); finance and billing; corporate and governance; compliance and data protection; technical and system records; team and internal records. Availability of any record is subject to the grounds for refusal in PAIA.
8. Processing of Personal Information (POPIA section 17 record)
8.1 Purposes of processing
Service provision; operation of the /try demo; billing and payment management; client and prospect communication (marketing only with consent); security and fraud prevention; legal compliance; and corporate, banking, and regulatory administration in respect of the Company's directors.
8.2 Categories of data subjects and personal information
| Data subjects | Personal information processed |
|---|---|
| Clients (business owners / signatories) | Full name, business name, email address, website URL, Instagram handle, billing address, transaction metadata (incl. last four digits of card as received from PayFast), Terms-acceptance records (timestamp, IP, version) |
| Prospective clients (/try users) | Email address, uploaded product photograph (may contain identifiable persons), brand-question responses, consent records (timestamp, IP, consent version, separate marketing consent) |
| Individuals depicted in uploaded materials | Images of identifiable persons in client-uploaded reference, lifestyle, or on-body photographs; these may include children, particularly for children's-product brands. Processing relies on the client's warranty, confirmed at onboarding, that each identifiable person — or, for a child, a parent or guardian — has consented. No biometric identifiers are extracted. |
| Website visitors | IP address, browser and device type, pages visited, session duration |
| Directors / team | Names, email addresses, identity numbers, tax numbers, and bank details held for CIPC, SARS, and banking purposes |
Brand Profile information is predominantly business information; where a client is a sole trader it may constitute personal information and is treated with the same care.
8.3 Recipients to whom personal information may be supplied
Supabase (database and file storage); Clerk (authentication); OpenAI (approved brief specifications, brand context, and uploaded product photographs as generation references — no contact details); Anthropic (brand context and brief data — no contact details); Higgsfield (video brief specifications — no contact details); PayFast (payment data, processed directly); Resend (email address and name); Google Workspace (correspondence); Vercel and Cloudflare (IP addresses and technical logs); and SARS, CIPC, regulators, and courts as required by law. The Company does not sell personal information.
8.4 Planned trans-border flows of personal information
Transfers outside the Republic occur only as permitted by section 72 of POPIA, on the basis of binding written operator agreements providing an adequate level of protection (data processing agreements incorporating contractual safeguards, including standard contractual clauses where offered), and/or where the transfer is necessary for the performance of the contract with the data subject.
| Operator | Location of processing | Categories |
|---|---|---|
| Supabase | European Union | All client and lead personal data |
| Clerk | United States | Authentication and identity data |
| OpenAI | United States | Brand context and uploaded product photographs (no contact details) |
| Anthropic | United States | Brand context (no contact details) |
| Higgsfield | Data processing agreement being finalised | Video brief specifications (no contact details) |
| Resend | United States | Email address and name |
| Google Workspace; Vercel; Cloudflare | United States / global CDN | Correspondence, IP addresses, technical logs |
| PayFast | South Africa (no cross-border transfer) | Billing and transaction data |
8.5 Information security measures
HTTPS/TLS encryption on all traffic; row-level security isolating each client's data; private storage buckets with file access only via short-lived signed URLs; authentication and session management through Clerk with multi-factor authentication on administrative access; access controls on a need-to-know basis; written data processing agreements with operators, reviewed annually; defined retention periods and deletion methods per data category; and a security-compromise notification procedure aligned with section 22 of POPIA.
9. How to Request Access to a Record (PAIA)
- Complete the prescribed Form 2 (Request for Access to Record of Private Body), available from the Regulator's website or from the Information Officer on request.
- Submit it to the Information Officer at hello@bluberripress.com.
- Provide sufficient detail to identify the record, your identity, the form of access required, and the right you seek to exercise or protect, with an explanation of why the record is required for that right.
- Fees are as prescribed in the PAIA Regulations, 2021: a request fee plus access and reproduction fees where applicable. No request fee is payable by a personal requester — a person requesting a record containing their own personal information.
- The Information Officer responds within 30 days, subject to permitted extension, and notifies you of the decision and any fees.
- Access may be refused on the grounds in Chapter 4 of Part 3 of PAIA, including the mandatory protection of third-party privacy and commercial information.
- If dissatisfied, you may lodge a complaint with the Regulator or apply to court, as described in the Guide.
10. Requests Under POPIA (data subject rights)
A data subject may, on proof of identity and free of charge, request confirmation of whether the Company holds personal information about them and a description of that information. A data subject may request correction or deletion of personal information (Form 2 under the POPIA Regulations), or object to processing (Form 1), submitted to the Information Officer at hello@bluberripress.com. They may also withdraw any consent previously given and opt out of direct marketing at any time. The Information Officer processes these requests as soon as reasonably possible and confirms the outcome in writing.
11. Availability of this Manual
On the Company website at bluberripress.com/paia; from the Information Officer on request during normal business hours; to any person on request on payment of the prescribed reproduction fee; and to the Information Regulator on request.
12. Updating of this Manual
The Information Officer updates this Manual whenever there is a material change to the Company's records, processing activities, operators, or contact details, and reviews it at least annually.
Issued by: Everhardt Theodorus (Theon) Jansen van Rensburg — Director, Head of the Private Body, and Information Officer (IR reg. no. 2026-061370), for and on behalf of BluBerri Press Content House (Pty) Ltd
Reg No. 2026/169849/07 | Version 1.2