PAIA manual
Access to information manual.
Social Mediator (Pty) Ltd · Compiled 29 October 2026 · Last updated 29 October 2026
The short version.
- This manual explains how to ask Social Mediator (Pty) Ltd for access to records we hold, as the Promotion of Access to Information Act (PAIA) requires.
- Send requests to our Information Officer, Matthew Alexandre, at matt@socialmediator.net, using the Regulator's Form 2.
1. List of acronyms and abbreviations
- CEO — Chief Executive Officer
- DIO — Deputy Information Officer
- IO — Information Officer
- Minister — Minister of Justice and Correctional Services
- PAIA — Promotion of Access to Information Act 2 of 2000 (as amended)
- POPIA — Protection of Personal Information Act 4 of 2013
- Regulator — Information Regulator (South Africa)
- Republic — Republic of South Africa
2. Purpose of this manual
This manual is prepared in terms of section 51 of PAIA. It tells you what records Social Mediator (Pty) Ltd holds, how to ask for access to them, and how we process personal information under POPIA. PAIA gives effect to the right of access to information in section 32 of the Constitution, subject to limits that protect privacy, commercial confidentiality and good governance.
3. Key contact details for access to information
- Private body
- SOCIAL MEDIATOR (PTY) LTD, registration number 2017/178643/07
- Head of the body (CEO) and Information Officer
- Matthew Alexandre
- Deputy Information Officer
- Luke Alexandre
- Physical and postal address
- 4 Vida Privada, 79 Fairlie Road, Port Alfred, 6170, South Africa
- Phone
- +27 72 342 9085
- Website
- socialmediator.net
4. The Regulator's guide on how to use PAIA, and how to get it
The Regulator has published a guide, in terms of section 10(1) of PAIA, that explains in plain language how to use PAIA and POPIA. It is available in each of the official languages and in braille. The guide covers, among other things: the purpose of PAIA and POPIA; how to contact the Information Officer of any public or private body; the manner and form of a request for access to a record, the fees, and the remedies if a request is refused; the right to complain to the Regulator; and the rights of data subjects under POPIA.
You can get the guide:
5. Categories of records available without a request
These records are available on our website without a PAIA request:
6. Records available in terms of other legislation
Where the law allows, records may be requested under: the Companies Act 71 of 2008; the Income Tax Act 58 of 1962 and the Tax Administration Act 28 of 2011; the Value-Added Tax Act 89 of 1991; the Basic Conditions of Employment Act 75 of 1997 and the Labour Relations Act 66 of 1995; the Electronic Communications and Transactions Act 25 of 2002; the Consumer Protection Act 68 of 2008; and POPIA.
7. Subjects on which we hold records, and the categories of records
- Company records
- incorporation documents, share register, director and shareholder records, minutes and resolutions, statutory returns
- Financial records
- bank records, invoices and receipts, accounting records, tax returns, VAT records, audit and accountant's records
- Employee and contractor records
- contracts, payroll, leave, disciplinary and performance records, personal details
- Client records
- contracts and proposals, correspondence, invoices, contact details, service configuration (including WhatsApp account identifiers and access tokens held under Meta's terms), message logs and templates handled on the client's behalf
- Supplier records
- contracts, invoices, correspondence
- Marketing and website records
- enquiries, mailing lists, server logs
- Information technology records
- software, source code, system documentation, security and access logs
Listing a category here does not mean every record in it will be released. Each request is assessed under PAIA, which allows access to be refused on grounds such as the protection of other people's privacy, confidential commercial information, and legal privilege.
8. Processing of personal information
Purpose of processing. To provide social media marketing, AI systems and automated WhatsApp messaging services to businesses; to reply to enquiries; to manage client, supplier and employee relationships; to invoice and keep records the law requires; and to secure our services.
Categories of data subjects and of personal information.
- People who contact us or visit the website: name, email, phone, business name, the content of their messages, server logs.
- Clients and their staff: contact and billing details, correspondence, logins.
- Clients' customers (processed as operator on the client's instructions): WhatsApp number and profile name, the content of messages and media sent to or from the client's connected number, delivery status, and any details the customer shares in a conversation.
- Employees and contractors: identity, contact, employment and payroll details.
- Suppliers: contact and payment details.
Recipients. Our service providers, who may only use the information to provide their service to us: Meta (WhatsApp Business Platform) and, for some existing services, Twilio; OpenAI and Anthropic (AI replies) and Perplexity (web look-ups); Vapi, Deepgram, Microsoft Azure and ElevenLabs (voice); Vercel, Neon and Amazon Web Services (hosting and storage); Google Workspace, Postmark and Mailgun (email); our accountants and legal advisers; and any regulator or court where the law requires.
Planned transborder flows. Most of these providers store or process information in the United States, and some in the European Union. We only use providers bound by contract to protect the information to a standard similar to POPIA, and our AI providers may not use it to train their models.
Security measures. Access controls and two-factor login on our systems; encryption in transit; encryption of stored access tokens; each client's data kept separate; access limited to the people who need it; regular review of access and logs; and a procedure for telling affected clients and the Regulator of any breach, as POPIA requires.
9. How to request access, and fees
- Complete the Regulator's prescribed Form 2 (Request for Access to Record of Private Body), available from the Regulator's website or from our Information Officer.
- Send it to the Information Officer (section 3). Give enough detail for us to identify the record, say how you want access (for example a copy by email), and tell us the right you are seeking to exercise or protect and why the record is needed for that.
- If you are asking on someone else's behalf, include proof that you may.
- A request fee and access fees apply, as prescribed in Annexure B of the PAIA Regulations. We will tell you the amount before we start. A request for your own personal information carries no request fee.
- We decide within 30 days of receiving the request and the fee, and may extend once by up to 30 days where the Act allows. If we refuse, we give reasons and tell you how to complain to the Regulator or apply to court.
10. Availability of this manual
A copy of this manual is available: on our website at socialmediator.net/paia; at our principal place of business for public inspection during normal business hours; on request, at the prescribed fee for a copy; and to the Information Regulator on request.
11. Updating of this manual
The head of the private body updates this manual whenever our details or records change, and reviews it at least once a year. The dates at the top show when it was compiled and last updated.