PAIA Manual

Prepared in terms of section 51 of the Promotion of Access to Information Act 2 of 2000 · Compiled 13 September 2026 · Updated 5 October 2026

South African law gives you a right to ask any business for its records, and requires every business to publish a manual explaining what it holds and how to ask for it. This is ours. We have tried to write it the way we write everything else — plainly, so you can use it without a lawyer.

If you are one of our customers and you simply want a copy of your own information, you do not need this page at all. Ask us under the Protection of Personal Information Act instead: it is free, it is faster, and it is set out in section 13 of our Privacy Policy. This manual is for the formal route.

1. Who we are

Appetite Technology (Pty) Ltd, registration number 2023/849612/07, trading as Appetite Host, a private body as PAIA defines it.

350 Parkstation Road, Greenwood Park, Durban, 4051, South Africa (this is both our registered office and our postal address).
Phone: +27 31 012 5361 / +27 21 330 5844
Website: appetitehost.co.za

2. Who to contact

Head of the private body and Information Officer: Wesley Sing, director. Email support@appetitehost.co.za, or write to him at the address above.

He is registered as our Information Officer with the Information Regulator under reference 2026-066601, registered 13 September 2026. You can verify that yourself on the Regulator's eServices portal — you do not have to take our word for it.

We have not designated a Deputy Information Officer. We are a small company and every request reaches the Information Officer directly; we will designate deputies when the size of the business makes that necessary, and will say so here when we do.

3. The Regulator's guide to PAIA

The Information Regulator publishes a plain guide on how to use PAIA — how to frame a request, what a body may and may not refuse, and what to do if you are unhappy with the answer. It is available in English and nine other official languages.

You can get it free from inforegulator.org.za/paia, by asking the Regulator at enquiries@inforegulator.org.za or 010 023 5200, or by asking our Information Officer, who will send you a copy.

4. Records you can have without asking

These are published and free. You never need to make a PAIA request for them:

• This manual, our Terms of Service, our Privacy Policy and our Web Address Agreement — all on this website.
• Our pricing, what each package includes, and what happens when a subscription lapses — on our website.
• If you are a customer: your own website content, your payment history and your web address details, in your account dashboard at any time. A receipt for each payment is emailed to you, and we will send another copy, or a tax invoice, on request at no charge.
• The public registration record of any .co.za web address, which is held by the ZA Central Registry rather than by us, and which is public by registry policy.

5. Records we keep because other laws require them

• Companies Act 71 of 2008 — memorandum of incorporation, company registration records, director and shareholder records, annual returns, financial records.
• Tax Administration Act 28 of 2011 and Value-Added Tax Act 89 of 1991 — invoices, payment records, accounting records and supporting documents.
• Protection of Personal Information Act 4 of 2013 — our record of processing activities, this manual's companion privacy policy, and records of any security compromise.
• Promotion of Access to Information Act 2 of 2000 — this manual, and our records of requests received and how we answered them.
• Electronic Communications and Transactions Act 25 of 2002 — the information we are required to publish about who we are and what we sell.
• Basic Conditions of Employment Act 75 of 1997 and related labour law — employment records, if and when we have employees.

6. What we hold records about

• Customers and their websites — account details, the conversation you had with Naya, the brief she built from it, your website content and its revision history, what is published and when, and the messages and quote requests visitors send through a customer's website (held for the customer, for 12 months).
• Previews that never became purchases — the conversation and draft brief, held briefly and then deleted automatically.
• Web addresses — registrant details as the registry requires them, registration and renewal dates, registrar references, and the technical records that make an address resolve.
• Money — orders, invoices, payment gateway references, vouchers and discounts, subscriptions, renewals and failed payments.
• Company and statutory — incorporation, directors, tax, accounting and annual returns.
• Suppliers and contracts — agreements with the providers named in section 7 below, and our correspondence with them.
• Operations — system logs, job and error records, and the internal notes we keep when something goes wrong for a customer.

7. Personal information we process

Why. To build and run websites for the people who buy them: to generate a site from what you tell Naya, to take payment, to register and maintain a web address in your own name, to reach you about your account, and to meet our own legal obligations. The full account is in our Privacy Policy.

Whose. Prospective customers who start a free preview (business name and description, area, business contact details, email, a device identifier); customers (contact details, identity or company registration details required by the registry, billing records, website content); suppliers and their staff (business contact details); and our own directors and, in future, employees.

Who receives it. Only the providers who make the service work, each receiving only what it needs: Vercel and Cloudflare (serving and protecting websites), Supabase (our database), Anthropic (the model behind Naya), Resend (email delivery), Paystack (payments and card storage), Google (finding a customer's Google listing, showing their reviews and map, and, with consent, analytics on our own website), Slack (internal alerts to our own team), and our domain registrar together with the ZA Central Registry (registering your web address in your name, which places some details on the registry's public record). We do not sell or rent personal information. Anything beyond this list is disclosed only where the law compels it, and then only what is compelled.

Information that leaves South Africa. Yes — several of those providers store or process data abroad, principally in the European Union and the United States. We use them on the basis permitted by section 72 of POPIA: they are bound by laws or by contract terms giving your information protection substantially similar to POPIA's.

How we protect it. Encryption in transit, access controls, systems that can reach only what they need, and monitoring that tells us when something has gone wrong. If a security compromise ever affects you we will notify you and the Information Regulator, as POPIA requires.

8. How to ask us for a record

One thing to know before you start, because it is the part people are most often caught by: a private body must give access to a record where the record is required for the exercise or protection of any right (section 50 of PAIA). So your request needs to say which right you are exercising or protecting, and why you need this record for it. A request that does not explain that is one we may have to refuse, and we would rather you knew that at the start than after 30 days.

• Use Form 2, the prescribed request form for private bodies, from inforegulator.org.za/paia. Ask our Information Officer and he will email you a copy.
• Fill in enough detail to let us find the record, say which right you are exercising or protecting, and tell us how you would like to receive it and how we should reach you.
• Send it to support@appetitehost.co.za or to the postal address in section 1.
• If you are asking on someone else's behalf, include proof that you may do so.
• We will answer within 30 days. If the request is large or involves a lot of records we may extend that by up to a further 30 days, and we will tell you in writing why, before the first 30 days is up.

9. What it costs

Two fees can arise: a request fee, payable before we start, and an access fee for searching, preparing and reproducing the record, payable before we hand it over. We charge the amounts the Information Regulator prescribes and nothing on top.

• If you are asking for your own personal information, there is no request fee. That is the law, and we would not charge it in any event.
• Otherwise the request fee is R140.00.
• Access fees follow the Regulator's published schedule — currently R2.00 per printed A4 page, R40.00 for a copy on a flash drive, and a search and preparation fee of R145.00 an hour after the first hour.
• Where a search will take more than six hours we may ask for a deposit of one third of the estimated access fee before we begin.
• We will always tell you what a request will cost before you incur it, and you may withdraw the request at that point at no charge.

The Regulator's published fee structure is the authority here. If it changes, the gazetted amounts apply rather than the figures above, and we will update this page.

10. When we may say no

PAIA obliges us to refuse some requests, mainly to protect other people. We may or must refuse access where a record would unreasonably disclose someone else's personal information, reveal a third party's trade secrets or confidential commercial information, breach a duty of confidence we owe someone, endanger a person or property, disclose legally privileged material, or reveal our own trade secrets or information that would put us at a commercial disadvantage.

If we refuse, we will tell you in writing, give our reasons, identify the section of PAIA we rely on, and explain what you can do next. If only part of a record may be withheld, we will give you the rest.

11. If you are unhappy with our answer

There is no internal appeal against a private body's decision — PAIA does not provide one. Your options are:

• Complain to the Information Regulator, using Form 5 from inforegulator.org.za/paia. Post: PO Box 31533, Braamfontein, Johannesburg, 2017. Office: JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001. Email: PAIAComplaints@inforegulator.org.za.
• Apply to a court under section 78 of PAIA.

Before either, you are welcome to simply write to us and say you think we got it wrong. We would rather fix a mistake ourselves than have it corrected for us.

12. Where to get this manual

On this page, free, at any time. Also at our registered office during normal business hours, to any person who asks us for it, and to the Information Regulator on request. A printed copy may attract the photocopying fee in section 9; an emailed copy is free.

13. Keeping this manual current

The Information Officer reviews this manual at least once a year, and updates it whenever what we hold or how we handle it changes materially. The date at the top is the date of the version you are reading.

14. Contact

Appetite Technology (Pty) Ltd, trading as Appetite Host
Registration number: 2023/849612/07
350 Parkstation Road, Greenwood Park, Durban, 4051, South Africa
Phone: +27 31 012 5361 / +27 21 330 5844
Email: support@appetitehost.co.za
Information Officer: Wesley Sing