This manual is prepared in terms of section 51 of the Promotion of Access to Information Act 2 of 2000 (“PAIA”), as amended by the Protection of Personal Information Act 4 of 2013 (“POPIA”), following the structure of the Information Regulator’s template for private bodies. It is reviewed at least once a year and whenever the information in it changes.
1. Introduction
1.1 Positack (Pty) Ltd (“PosiTack”, “the Company”) is a private body as defined in PAIA. PAIA gives effect to the constitutional right of access to information held by another person that is required for the exercise or protection of any right. POPIA gives effect to the constitutional right to privacy and regulates how personal information is processed.
1.2 This manual explains what records PosiTack holds, how to request access to them, and how PosiTack processes personal information. It is published on our website and is available at our office.
1.3 PosiTack provides cloud software (point of sale, kitchen display, stock, payroll, time and attendance, accommodation, loyalty and payments integration) to hospitality and retail businesses (“venues”) on subscription. Most personal information in our systems belongs to venues and their staff and customers; for that information PosiTack is an operator acting on the venue’s instructions, and the venue is the responsible party (see section 8).
2. Contact details (section 51(1)(a))
| Item | Detail |
|---|---|
| Legal name | Positack (Pty) Ltd |
| Registration number | 2026/210756/07 |
| VAT number | 4830290369 |
| Head of the private body and Information Officer | Armand Charles Moss, Director |
| Information Regulator registration number of the Information Officer | 2026-000958 (registered 22 January 2026) |
| Deputy Information Officer | None appointed |
| Physical and postal address | A1 Farm Holm Hill, Beacon Bay, East London, 5241, South Africa |
| Telephone | +27 83 439 4236 |
| Email for PAIA requests and POPIA matters | privacy@positack.co.za |
| General email | info@positack.co.za |
| Website | https://positack.co.za |
3. The Regulator’s guide on how to use PAIA (section 51(1)(b))
3.1 The Information Regulator has compiled a Guide, in terms of section 10 of PAIA, in each official language, to help anyone wishing to exercise a right under PAIA or POPIA. The Guide explains, among other things: the objects of the Acts; the contact details of information officers; how to make a request for access; the assistance available from information officers and the Regulator; remedies available; the fees payable; and the procedure for complaints and internal appeals.
3.2 The Guide is available from the Information Regulator:
- Website: https://inforegulator.org.za (PAIA section)
- Physical address: Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191
- Telephone: 010 023 5200 · Toll-free: 0800 017 160
- Email: enquiries@inforegulator.org.za · PAIAComplaints@inforegulator.org.za
3.3 A copy of the Guide may also be inspected at our office by appointment.
4. Records available without a request (section 52)
4.1 The following are available on our website without a PAIA request:
- Terms of Service, Schedule 1 (POPIA Operator Terms), Refund and Cancellation Policy, Privacy Policy, Cookie Notice, Developer Terms, and this manual;
- product descriptions, pricing and support documentation;
- company registration and contact details.
5. Records available in terms of other legislation (section 51(1)(d))
5.1 Records may be accessed under the following laws, subject to their conditions, without a PAIA request:
| Legislation | Records |
|---|---|
| Companies Act 71 of 2008 | Company records, securities register, directors’ details (via CIPC) |
| Basic Conditions of Employment Act 75 of 1997 | Employment records of PosiTack’s own employees (if any) |
| Income Tax Act 58 of 1962; Tax Administration Act 28 of 2011; VAT Act 89 of 1991 | Tax records, on request by SARS |
| Unemployment Insurance Act 63 of 2001; Skills Development Levies Act 9 of 1999 | UIF and SDL records |
| Protection of Personal Information Act 4 of 2013 | A data subject’s own personal information (section 23) |
| Electronic Communications and Transactions Act 25 of 2002 | Records of electronic transactions with consumers (section 43) |
| Consumer Protection Act 68 of 2008 | Records of consumer transactions |
| Compensation for Occupational Injuries and Diseases Act 130 of 1993 | Records, if applicable |
6. Records held by PosiTack (section 51(1)(e))
6.1 The following categories of records are held. Listing a record here does not mean it will be released; each request is assessed under Chapter 4 of Part 3 of PAIA (grounds for refusal).
| Category | Subject | Examples | Availability |
|---|---|---|---|
| Company and statutory records | Incorporation, governance | Memorandum of Incorporation, CIPC registration, share register, director resolutions, minutes | On request under PAIA; some public via CIPC |
| Financial records | Accounting and tax | Bank statements, invoices issued and received, VAT returns, income-tax returns, management accounts, accountant working papers | Restricted; on request under PAIA |
| Customer (venue) records | Our subscribers | Account details, plan, invoices, payment references, Terms acceptance records, support correspondence, contract notices | Available to the venue concerned; otherwise restricted |
| Venue-entered operational data | Data venues put into the software | Menus, sales, stock, bookings, accommodation, customer and loyalty records, staff and payroll records, clocking records, disciplinary records, documents | Held as operator for each venue. Requests must be made to the venue, which is the responsible party; PosiTack acts on the venue’s instruction |
| Personnel records | PosiTack’s own staff and contractors (if any) | Contracts, payroll, leave, performance, disciplinary records | Restricted |
| Supplier and contract records | Our suppliers | Agreements and correspondence with our hosting provider, Cloudflare, gateways, Meta, Intuit and other suppliers | Restricted |
| Marketing and website records | Prospects and visitors | Contact-form submissions, marketing consent and opt-out records, website server logs | Restricted |
| Developer portal records | Developers and agencies | Accounts, Developer Terms acceptance, website keys issued | Restricted |
| Technical and security records | Systems | Source code, system logs, access logs, backups, security configuration, incident records | Restricted; source code and security configuration will generally be refused under sections 66 and 68 (security of systems; PosiTack’s trade secrets and commercial information) |
| Intellectual property | Software, trade marks, designs, documentation | — | Restricted |
| Legal records | Disputes, regulator correspondence | Legal opinions, litigation files, Information Regulator correspondence | Restricted; legal privilege (section 67) |
7. How to request a record (section 51(1)(f))
7.1 Who may request. Any person may request access to a record of PosiTack if the record is required for the exercise or protection of a right (section 50). A public body may not request under this Part. A request may be made on behalf of another person with their authority.
7.2 Form. Complete Form 2 (Request for access to record of private body), prescribed under regulation 7 of the PAIA Regulations 2021, available from the Information Regulator’s website (https://inforegulator.org.za) or from us on request. Send it to the Information Officer at privacy@positack.co.za or to our physical address. The form must:
- identify the record or provide enough detail to identify it;
- state the right you seek to exercise or protect and why the record is required for it;
- state the form of access you want (inspection, copy, electronic copy);
- give your name, address and contact details, and, if you act for someone else, the capacity in which you act and proof of authority;
- state if you need the record in a particular form because of a disability.
7.3 Fees (PAIA Regulations 2021, GN R757, Government Gazette 45057 of 27 August 2021, Annexure B, Part II — private bodies; amounts as published by the Information Regulator):
| Item | Fee |
|---|---|
| Request fee (payable by every requester except a person requesting their own personal information) | R140.00 |
| Photocopy or printed black-and-white copy, A4, per page or part | R2.00 |
| Copy in computer-readable form on a flash drive or CD supplied by the requester | R40.00 |
| Transcription of visual images, A4 per page | Actual cost from service provider |
| Transcription of an audio record, A4 per page | R24.00 |
| Search and preparation, per hour or part, after the first hour | R145.00, to a maximum of R435.00 |
| Deposit where search and preparation will exceed 6 hours | One third of the estimated access fee |
| Postage, email or other electronic transfer | Actual cost |
Fees are VAT-inclusive where applicable. The request fee must be paid before the request is processed; access fees are payable before access is given. A requester may apply to a court against the payment of a fee.
7.4 Payment. When we receive your request, accounts@positack.co.za will send you an invoice for the fee due. Pay it by EFT to the bank account shown on that invoice, quoting the invoice number.
7.5 Timelines. We decide within 30 days of receiving a complete request and the request fee, and notify you in writing on Form 3. We may extend by up to 30 further days if the request is for many records, requires a search at another office, or requires consultation with a third party, and will tell you the reason. If we do not respond within the period the request is deemed refused (section 58).
7.6 Third parties. If the record contains information about a third party we may have to notify the third party and give them the opportunity to object before we decide (sections 71 to 73).
7.7 Grounds for refusal. We must or may refuse access where the record contains, among other things: another person’s personal information (section 63); commercial information of a third party or of PosiTack, including trade secrets and information whose disclosure would harm commercial interests (sections 64 and 68); information supplied in confidence (section 65); information whose disclosure would endanger safety or the security of property or systems (section 66); legally privileged material (section 67); or research information (section 69). Where a record can be severed, we give access to the part that may be disclosed (section 28).
7.8 Personal information requests under POPIA. A data subject asking for their own personal information (POPIA section 23) may use Form 2 or simply email privacy@positack.co.za; no request fee is charged, though a copy fee may apply for records. We respond within 30 days. If the information was entered by a venue (you are the venue’s employee or customer), PosiTack holds it as operator and will refer your request to the venue, which must decide it.
7.9 Remedies. PosiTack is a private body and has no internal appeal procedure. If your request is refused, or you are unhappy with a fee, the form of access or a delay, you may:
- lodge a complaint with the Information Regulator (Form 5 under the PAIA Regulations) at PAIAComplaints@inforegulator.org.za within 180 days of the decision; or
- apply to a court under section 78 of PAIA.
8. Processing of personal information (section 51(1)(c), read with POPIA)
8.1 Purpose of processing. PosiTack processes personal information (a) as responsible party, to provide, bill and support its software service to venues, run its website, communicate with prospects who consent, comply with law and protect its systems; and (b) as operator, on venues’ instructions, to run the software that venues use for their tills, kitchens, stock, bookings, staff, payroll and customer programmes.
8.2 Categories of data subjects and information.
| Data subjects | Categories of personal information | PosiTack’s role |
|---|---|---|
| Venue owners, managers and other Users | Names, contact details, business details, VAT and registration numbers, login records, billing and payment references, support correspondence, marketing preferences | Responsible party |
| Website visitors and enquirers | Contact-form details, IP address and server logs | Responsible party |
| Developers | Name, agency, email, acceptance records | Responsible party |
| Venues’ employees | Identity and contact details, ID/passport numbers, dates of birth, bank details, pay and tax records (PAYE, UIF, SDL, IRP5), medical-aid and retirement details, leave, clocking records, fingerprint templates (biometric — special personal information, POPIA s26, where enabled), disciplinary and grievance records (may include health and union information, and alleged criminal behaviour — special personal information, POPIA s26(b)) | Operator |
| Venues’ customers and guests | Name, contact details, ID/passport for accommodation, orders and payments, bookings, loyalty and wallet balances, debtor records, marketing consents, messages | Operator |
| Children (through a parent’s or guardian’s booking) | A child’s first name and age for party and accommodation bookings (POPIA ss34–35) | Operator |
| Venues’ suppliers’ staff | Names and contact details on invoices | Operator |
8.3 Recipients. Our hosting provider, Diamatrix CC (Domains.co.za) (South Africa); Cloudflare, Inc. (United States) for web security and, where a venue enables it, AI invoice scanning (Workers AI); Meta Platforms, Inc. (United States) for WhatsApp messaging where enabled (feature not yet live); Intuit Inc. (United States) for QuickBooks where enabled; payment gateways (PayFast, Ozow, Stitch, Transaction Junction, Yoco, Halo Dot, AddPay/PayCloud, Standard Bank PAX — South Africa); venues’ own email providers; PosiTack’s accountant; regulators, courts and law enforcement where required.
8.4 Planned transborder flows. Personal information is processed in South Africa: production is hosted in Johannesburg, backups are stored in South Africa, and limited copies may be held on PosiTack-controlled systems in South Africa for support, backup and testing. It is transferred outside South Africa only in the cases listed in 8.3, on the basis of written agreements with those providers that require an adequate level of protection (POPIA section 72(1)(a)), and, for optional features, on the venue’s instruction as responsible party.
8.5 General description of security measures (POPIA section 19). TLS on all connections; Cloudflare protection; a host firewall; AES-256-GCM encryption of staff ID numbers, tax and bank details, biometric templates, disciplinary and HR document contents and credentials, with the key held outside the database; salted hashing of passwords and PINs; tenant isolation of each venue’s data; role-based permissions; session expiry; server access restricted to the director, and administrative access through the admin console logged; automatic operating-system security updates; backup copies of the platform database kept in South Africa; card data handled only by payment gateways. A fuller description is in Schedule 1 to our Terms of Service.
9. Availability of this manual (section 51(3))
9.1 This manual is available free of charge:
- on our website at https://positack.co.za/paia;
- at our office, A1 Farm Holm Hill, Beacon Bay, East London, 5241, South Africa, during business hours by appointment;
- by email on request to privacy@positack.co.za;
- to the Information Regulator on request.
9.2 A copy will be provided in a language other than English on request where reasonably practicable.
10. Updating
10.1 The Information Officer will review this manual at least once a year, and whenever there is a material change to the records held, the recipients of personal information, the security measures, the fees or the law.
Armand Charles Moss, Director and Information Officer, Positack (Pty) Ltd.