PAIA manual

1About this manual

The Promotion of Access to Information Act, 2000 (“PAIA”) gives you the right to request records held by a private body where you need them to exercise or protect a right. This manual is published under section 51 of PAIA by rano (“rano”, “we”).

It explains the records we hold, how we process personal information under the Protection of Personal Information Act, 2013 (“POPIA”), and how to ask for access to a record.

2Contact details

Send PAIA requests and POPIA queries to our Information Officer.

Trading name

rano

Email

privacy@rano.co.za

Website

rano.co.za

3The Information Regulator’s guide

Section 10 of PAIA requires the Information Regulator to publish a guide on how to use PAIA and POPIA. The guide is available in each official language from the Information Regulator, and we will email you a copy on request.

Website

inforegulator.org.za

General enquiries

enquiries@inforegulator.org.za

PAIA complaints

PAIAComplaints@inforegulator.org.za

POPIA complaints

POPIAComplaints@inforegulator.org.za

Phone

010 023 5200

Address

Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191

4Records available without a request

The following records are available on our website, without a formal request or fee:

• this manual;
• our privacy policy, cookie policy and website terms of use;
• our acceptable use policy;
• our published pricing and other information on this website.

5Records kept under other laws

We keep records as required by the laws that apply to our business, including:

• Companies Act, 2008
• Income Tax Act, 1962
• Value-Added Tax Act, 1991
• Tax Administration Act, 2011
• Basic Conditions of Employment Act, 1997
• Labour Relations Act, 1995
• Financial Intelligence Centre Act, 2001
• National Payment System Act, 1998
• Electronic Communications and Transactions Act, 2002
• Consumer Protection Act, 2008
• Protection of Personal Information Act, 2013

6Subjects and categories of records

• Company records: incorporation documents, registers, and resolutions and minutes
• Financial and tax records: financial statements, accounting records, tax returns and banking records
• Merchant records: applications, agreements, verification records, and payment and payout records
• Website and early-access records: early-access sign-ups and messages sent to us
• Employee records: contracts, payroll, leave and performance records
• Supplier records: agreements and correspondence
• Compliance records: policies, risk assessments, audit logs and regulatory correspondence

7Processing of personal information

Why we process it

• to provide payment services to merchants we have approved;
• to verify businesses and the people behind them, and to prevent fraud and money laundering, as the law requires;
• to reply to enquiries and run our early-access list;
• to employ staff and work with suppliers;
• to meet our legal, tax and regulatory obligations.

Whose information we hold

• Merchants and their directors, owners and staff: names, contact details, identity documents and numbers, business registration details and bank account details.
• Our merchants’ customers: payment details needed to process and reconcile a payment, such as amounts, references and bank account or card tokens. Full card numbers are not stored on our systems.
• Website visitors and people who contact us: names, email addresses, company names and messages.
• Employees and job applicants: contact details, identity numbers, employment and payroll information.
• Suppliers: contact and banking details of the people we deal with.

Who we share it with

Banks, card networks and other payment partners needed to process payments; service providers who host our systems and help us run the business, under written agreements; our professional advisers; and regulators, law enforcement or courts where the law requires it.

Information sent outside South Africa

Some service providers may store or process information outside South Africa. We do this only as section 72 of POPIA allows, where the recipient is bound by laws, binding corporate rules or an agreement giving a level of protection substantially similar to POPIA, or with consent.

How we protect it

Encryption in transit and at rest, access limited by role, two-factor authentication, audit logs of staff actions, and card details held by a specialist card vault rather than on our systems. Our security page has more detail.

8How to request a record

1. Complete the prescribed request form (Form 2), available from the Information Regulator’s website.
2. Email it to our Information Officer at privacy@rano.co.za, with proof of identity and, where you act for someone else, proof of your authority.
3. Identify the record you want and the right you are trying to exercise or protect, and explain why the record is needed for it.
4. We will decide within 30 days. PAIA allows us to extend this once, by up to 30 more days, and we will tell you if we need to.

9Fees

PAIA allows a request fee and an access fee, at rates set in the PAIA regulations and published by the Information Regulator. There is no request fee if you ask for your own personal information. We will tell you in writing about any fee, and any deposit, before we process your request.

10Grounds for refusal

We may refuse a request only on the grounds PAIA sets out, for example to protect another person’s privacy, a third party’s commercial information, confidential information, or the safety of people or property. If we refuse, we will tell you why.

11If you’re unhappy with our decision

We have no internal appeal process. If your request is refused, or you disagree with a fee or an extension, you can complain to the Information Regulator at PAIAComplaints@inforegulator.org.za within 180 days, or apply to court.

12Availability of this manual

This manual is available free of charge on our website. Email privacy@rano.co.za for a copy. We update it whenever our records or contact details change.