PAIA Manual

PAIA MANUAL

1. Introduction and Purpose

Quote To Invoice (Pty) Ltd ("Company") operates the Quote to Invoice software-as-a-service Platform available through https://www.quotetoinvoice.co.za/, https://www.quotetoinvoice.co.za/signup and https://app.quotetoinvoice.co.za/. The Platform provides business tools for creating and managing quotations, invoices, statements, expenses and related records.

This Manual is prepared in terms of section 51 of the Promotion of Access to Information Act 2 of 2000, as amended ("PAIA"). Its purpose is to help a requester understand the categories of records held by the Company, how to request access, the applicable procedures and fees, and the circumstances in which access may lawfully be refused. It also describes the Company's processing of personal information for POPIA purposes.

2. Company and Contact Details

3. The Information Regulator and PAIA Guide

The Information Regulator has published a Guide on how to use PAIA, together with prescribed forms and guidance. The Guide and Form 2 (Request for Access to Record) are available from the Information Regulator's website.

• Information Regulator physical address: Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191, South Africa
• Postal address: P.O. Box 31533, Braamfontein, Johannesburg, 2017
• Telephone: 010 023 5200; Toll-free: 0800 017 160
• Email: enquiries@inforegulator.org.za
• Website: https://inforegulator.org.za/

4. Records Generally Available Without a Formal PAIA Request

The following information is generally available without a formal PAIA request, subject to authentication, security and lawful access controls:

• Public website pages, published policies, help material, product information and public blog or educational content.
• A registered User's own account profile and business information available through the Platform.
• A registered User's own quotations, invoices, statements, expense records and related documents that remain available in its Account.
• Publicly shared Generated Documents where the relevant User has intentionally enabled or distributed a public link.
• Company contact information and other information that the Company has intentionally placed in the public domain.

This list is not a notice under section 52 unless the Company separately publishes one in the prescribed manner. Availability may change for security, privacy, legal or operational reasons.

5. Records Held in Accordance with Legislation

Where applicable to the Company's operations, records may be maintained under legislation including:

• Companies Act 71 of 2008;
• Promotion of Access to Information Act 2 of 2000;
• Protection of Personal Information Act 4 of 2013;
• Electronic Communications and Transactions Act 25 of 2002;
• Consumer Protection Act 68 of 2008;
• Income Tax Act 58 of 1962;
• Value-Added Tax Act 89 of 1991;
• Tax Administration Act 28 of 2011;
• Basic Conditions of Employment Act 75 of 1997 and other employment legislation, if applicable;
• Cybercrimes Act 19 of 2020 and other laws relevant to information security or electronic operations, where applicable.

The inclusion of legislation does not imply that every category of record exists or that every provision applies to the Company at all times.

6. Categories of Records Held by the Company

6.1 Corporate and governance records

• CIPC and incorporation records, director or officer information, internal resolutions, policies, governance documents and statutory registers where applicable.

6.2 Financial, tax and accounting records

• Annual financial records, accounting records, bank and payment records, tax returns, VAT records, invoices from suppliers, expense records and supporting documents where applicable.

6.3 Customer, supplier and commercial records

• Contracts, correspondence, service-provider records, supplier details, support records, complaints, commercial proposals and business correspondence.

6.4 Platform and information-technology records

• System documentation, source code, algorithms, calculation logic, database structures, architecture, configuration, security controls, logs, vulnerability information, incident records, access-control records and intellectual property. Sensitive technical information may be refused where PAIA protects security, trade secrets, confidential commercial information or intellectual property.

6.5 User account and subscription records

• User account details, authentication records, business profiles, account status, support records, communications and billing/subscription information where applicable.

6.6 User-generated business records

• Quotations, invoices, customer statements, expenses, line items, payment records, notes, attachments and other documents created or stored by Users.

6.7 Client Data processed as an Operator

• Names, contact information, addresses, business details and transaction information relating to a User's clients. Requests relating to Client Data may need to be directed to the relevant User as Responsible Party, depending on the circumstances.

6.8 Marketing and public-content records

• Website content, SEO content, campaigns, communications, analytics and public educational material where applicable.

6.9 Human-resources records

• Employee, contractor, payroll, recruitment, disciplinary, leave, performance and training records, if and to the extent such records exist.

7. Processing of Personal Information Under POPIA

The Company processes personal information to operate and secure the Platform, authenticate Users, generate and manage business documents, provide support, administer commercial relationships, comply with law, prevent fraud and protect legal rights. Categories of data subjects may include Users, prospective Users, Users' clients, suppliers, service-provider personnel, employees or contractors and other business contacts.

Personal information may be disclosed to authorised cloud, hosting, communications, security, analytics, professional and payment service providers where applicable; to lawful authorities; and to other persons where authorised or legally permitted. Cross-border processing may occur through enterprise cloud infrastructure and is managed in accordance with section 72 of POPIA. Further details appear in the Privacy Policy.

8. Procedure for Requesting Access to a Record

A requester seeking access to a record of the Company must use the prescribed Form 2 (Request for Access to Record) and provide enough information to enable the Company to identify the requester and the record sought. For a request to a private body, the requester must identify the right that is to be exercised or protected and explain why the requested record is required for that purpose, unless a different rule applies by law.

• Email submission: support@quotetoinvoice.co.za
• Form: Form 2 available from the Information Regulator's PAIA forms page.
• Identity: the Company may require reasonable proof of identity, authority or mandate before disclosing a record.
• Representative requests: where a requester acts for another person or entity, proof of authority may be required.
• Describe the record precisely enough to locate it and state the preferred form of access, subject to PAIA.

9. Prescribed PAIA Fees for Private Bodies

The following current prescribed private-body fees are reflected in the Information Regulator's 2026 PAIA fee structure. Statutory fees are subject to amendment and the tariff in force at the time of a request will prevail.

Fees verified as at 27 August 2026. These amounts are prescribed by regulation and change from time to time. Confirm the current tariff with the Information Regulator before relying on them.

A requester seeking access to their own personal information may have different fee treatment under POPIA/PAIA. The Company will apply the legislation and prescribed tariff applicable to the particular request.

10. Decision Period and Extension

The Company will deal with a valid request within the period prescribed by PAIA, generally 30 days from receipt, subject to any lawful extension. Where PAIA permits an extension, the requester will be notified as required. Failure to respond within the statutory period may have the consequences provided for in PAIA.

11. Grounds for Refusal or Limited Access

Access is not automatic merely because a record is listed in this Manual. The Company may refuse, redact or defer access where PAIA requires or permits it, including to protect:

• Personal information and privacy of third parties;
• Confidential information supplied by third parties;
• Commercial information, trade secrets and financial interests of the Company or a third party;
• Source code, security architecture, credentials, vulnerability information, algorithms, calculation logic and other confidential intellectual property;
• Safety of individuals and security of systems or property;
• Legally privileged records;
• Research information or other categories protected by PAIA;
• Records whose disclosure is prohibited by another law or would unlawfully prejudice rights of another person.

Where reasonably possible and lawful, access may be granted to a severable part of a record after protected information is removed.

12. Remedies and Complaints

If a requester is dissatisfied with the outcome of a request to this private body, the requester may have the right to lodge a complaint with the Information Regulator and/or approach a competent court, subject to PAIA's procedures, time limits and prerequisites. The Information Regulator's PAIA forms and complaint channels are available on its website.

13. Availability of this Manual

This Manual is intended to be made freely available electronically on https://www.quotetoinvoice.co.za/ and https://app.quotetoinvoice.co.za/. A copy must also be available for inspection at the Company's principal place of business during normal business hours once the physical address in this Manual has been completed. A printed copy may be provided subject to any lawful reproduction charge.

A private-body PAIA Manual is not required to be published in multiple languages, although the Information Regulator recommends appropriate accessibility for the people served by the body. The Company may publish translations or accessible formats where appropriate.

14. Review and Revision

This Manual will be reviewed periodically and updated where the Company's details, record categories, processing activities, statutory requirements, prescribed fees or Information Regulator details materially change. The revision date shown on the published copy identifies the current version.