Legal
PAIA Manual
PAIA Manual of Propagated Gradients (Pty) Ltd (trading as Pinion CRM), prepared in terms of section 51 of the Promotion of Access to Information Act 2 of 2000 (as amended).
Date of compilation: 7 September 2026 · Date of last revision: 7 September 2026
A copy of this manual can be saved or printed from this page. This manual follows the Information Regulator's template for private bodies.
1. List of acronyms and abbreviations
- “IO”
- Information Officer;
- “Minister”
- Minister of Justice and Correctional Services;
- “PAIA”
- Promotion of Access to Information Act No. 2 of 2000 (as amended);
- “POPIA”
- Protection of Personal Information Act No. 4 of 2013;
- “Regulator”
- Information Regulator; and
- “Republic”
- Republic of South Africa
2. Purpose of PAIA Manual
This PAIA Manual is useful for the public to—
- check the categories of records held by a body which are available without a person having to submit a formal PAIA request;
- have a sufficient understanding of how to make a request for access to a record of the body, by providing a description of the subjects on which the body holds records and the categories of records held on each subject;
- know the description of the records of the body which are available in accordance with any other legislation;
- access all the relevant contact details of the Information Officer who will assist the public with the records they intend to access;
- know the description of the guide on how to use PAIA, as updated by the Regulator, and how to obtain access to it;
- know if the body will process personal information, the purpose of processing of personal information and the description of the categories of data subjects and of the information or categories of information relating thereto;
- know the description of the categories of data subjects and of the information or categories of information relating thereto;
- know the recipients or categories of recipients to whom the personal information may be supplied;
- know if the body has planned to transfer or process personal information outside the Republic of South Africa and the recipients or categories of recipients to whom the personal information may be supplied; and
- know whether the body has appropriate security measures to ensure the confidentiality, integrity and availability of the personal information which is to be processed.
3. Key contact details for access to information of Propagated Gradients (Pty) Ltd
3.1 Information Officer
Name: Sholto Armstrong (Director)
Tel: 072 139 5000
Email: [email protected]
3.2 Deputy Information Officer
No Deputy Information Officer has been designated.
3.3 Access to information general contacts
Email: [email protected]
3.4 Head Office
Physical address: 3 Macbeth Avenue, Witkoppen, Johannesburg, 2191, South Africa
Postal address: same as physical address
Telephone: 072 139 5000
Email: [email protected]
Website: https://pinioncrm.com
4. Guide on how to use PAIA and how to obtain access to the Guide
- The Regulator has, in terms of section 10(1) of PAIA, as amended, updated and made available the revised Guide on how to use PAIA (“Guide”), in an easily comprehensible form and manner, as may reasonably be required by a person who wishes to exercise any right contemplated in PAIA and POPIA.
- The Guide is available in each of the official languages and in braille.
- The aforesaid Guide contains the description of: the objects of PAIA and POPIA; the contact details of the Information Officers and Deputy Information Officers of public and private bodies; the manner and form of a request for access to a record of a public body and of a private body; the assistance available from the IO of a public body and from the Regulator in terms of PAIA and POPIA; all remedies in law available regarding an act or failure to act in respect of a right or duty conferred or imposed by PAIA and POPIA, including the manner of lodging an internal appeal, a complaint to the Regulator, and an application with a court; the provisions of sections 14 and 51 requiring a public body and private body, respectively, to compile a manual, and how to obtain access to a manual; the provisions of sections 15 and 52 providing for the voluntary disclosure of categories of records; the notices issued in terms of sections 22 and 54 regarding fees to be paid in relation to requests for access; and the regulations made in terms of section 92.
- Members of the public can inspect or make copies of the Guide from the offices of public and private bodies, including the office of the Regulator, during normal working hours.
- The Guide can also be obtained upon request to the Information Officer, or from the website of the Regulator at https://inforegulator.org.za.
- A copy of the Guide is also available in the following two official languages, for public inspection during normal office hours: English and Afrikaans.
5. Categories of records available without a person having to request access
| Category of records | Types of the record | How to access |
|---|---|---|
| Marketing and product information | Website pages, pricing, product descriptions | On the website (pinioncrm.com) |
| Legal and policy documents | Terms of Service, Privacy Policy, Refund & Cancellation Policy, Operator Agreement, sub-processor list, this PAIA Manual | On the website (see the legal page) |
6. Records available in accordance with any other legislation
| Category of records | Applicable legislation |
|---|---|
| Memorandum of incorporation and company statutory records | Companies Act 71 of 2008 |
| PAIA Manual | Promotion of Access to Information Act 2 of 2000 |
| Tax and financial records | Income Tax Act 58 of 1962; Tax Administration Act 28 of 2011 |
7. Subjects on which the body holds records, and categories of records held
| Subject | Categories of records |
|---|---|
| Company & statutory | Incorporation documents, CIPC records, resolutions |
| Finance | Accounting records, bank records, tax records, billing receipts |
| Customers | Account registration records, subscription and payment records, support correspondence |
| Customer content (held as operator) | Client, job, invoice, inventory and photo records created by customers in their own accounts |
8. Processing of personal information
8.1 Purpose of processing personal information
Personal information is processed to provide the Pinion CRM software-as-a-service to customers: creating and securing user accounts, billing subscriptions, providing customer support, and — on customers' instructions, as operator — storing the client, job and invoice records customers keep in the product.
8.2 Categories of data subjects and of the information relating thereto
| Categories of data subjects | Personal information that may be processed |
|---|---|
| Customers / account users | Name, email address, authentication records, payment transaction records (masked card details), support correspondence, IP addresses |
| Customers' clients (processed as operator on the customer's instructions) | Name, contact details, addresses, job and invoice history, photos attached to jobs |
8.3 Recipients or categories of recipients to whom personal information may be supplied
| Category of personal information | Recipients or categories of recipients |
|---|---|
| Account and content data, for hosting and service provision | The sub-processors listed at pinioncrm.com/subprocessors (Supabase, Cloudflare, Paystack, Google) |
| Billing information, if audited | South African Revenue Service |
| Any category, if legally compelled | Courts, law enforcement or regulators with a binding order |
8.4 Planned transborder flows of personal information
Personal information is stored outside the Republic: the database, authentication and file storage are hosted by Supabase in the eu-west-1 region (Republic of Ireland, European Union), and the website and application are delivered through Cloudflare's global content delivery network. The European Union's data protection law (GDPR) provides safeguards substantially similar to POPIA's conditions for lawful processing.
8.5 General description of information security measures
Encryption of data in transit (TLS) and at rest; per-organization data isolation enforced by database row-level security; least-privilege administrative access with multi-factor authentication; card payment data handled exclusively by the payment processor and never stored on our systems.
9. How to request access to a record
- Complete Form 2 — Request for Access to Record (Regulation 7 of the PAIA Regulations, 2021), available from the Regulator's website at inforegulator.org.za/paia-forms.
- Send the completed form to the Information Officer at [email protected], identifying the record, the right you seek to exercise or protect, and why the record is required for that right.
- The prescribed request fee for a private body (currently R140, per Annexure B of the PAIA Regulations) and any prescribed access fees may be payable; personal requesters asking for their own personal information pay no request fee.
- We will respond within 30 days as PAIA requires.
10. Availability of the manual
A copy of this Manual is available—
- on the website, at pinioncrm.com/paia;
- at the head office of Propagated Gradients (Pty) Ltd for public inspection during normal business hours;
- to any person upon request and upon the payment of a reasonable prescribed fee (per A4-size photocopy, as contemplated in Annexure B of the Regulations); and
- to the Information Regulator upon request.
11. Updating of the manual
The head of Propagated Gradients (Pty) Ltd will on a regular basis update this manual.
Issued by
Sholto Armstrong
Director and Information Officer, Propagated Gradients (Pty) Ltd