PAIA Manual

Prepared under section 51 of the Promotion of Access to Information Act 2 of 2000 (PAIA), as amended by the Protection of Personal Information Act 4 of 2013 (POPIA).
Version 1.0 · 26 September 2026

1. About this manual

• PAIA gives everyone the right to ask for records held by a private body, when the record is needed to exercise or protect a right.
• POPIA gives everyone the right to know what personal information we hold about them, and to ask us to correct or delete it.
• This manual explains what records we hold, how to ask for them, what it costs, and how we process personal information.

2. About us

• Umami Food Studio (Pty) Ltd is a small Asian food studio in Midrand, Johannesburg.
• We run cooking classes and make and sell handmade Asian sauces, pickles, cordials, frozen food and kitchen products, online and from our studio.
• Registration no. 2017/200147/07 · VAT no. 4560306559

3. Contact details

• Head of the private body and Information Officer: Sung Ran (Rany) Jo, Director
• Email: Rany@umamifoodstudio.co.za
• Phone: 064 527 3067
• Street address: 1169 Augrabies Falls Blvd, Waterfall, Midrand, 2090, South Africa (visits by appointment only)
• Postal address: as above
• Website: www.umamifoodstudio.co.za

Send every request under PAIA or POPIA to the Information Officer by email.

4. The Information Regulator's Guide

• The Information Regulator has published a Guide on how to use PAIA and POPIA.
• The Guide explains the purpose of PAIA and POPIA, who to contact, how to request records, fees, the help available, and all remedies, including complaints to the Regulator and court applications.
• It is available in all official languages and in braille.
• Get a copy from the Regulator's website (inforegulator.org.za), or ask our Information Officer. You can inspect a copy at our studio by appointment.
• To request a copy from us or from the Regulator, use PAIA Form 1 (Request for a copy of the Guide).

Information Regulator

• Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg
• P.O. Box 31533, Braamfontein, Johannesburg, 2017
• enquiries@inforegulator.org.za · +27 10 023 5200 · inforegulator.org.za

5. Records available without a request (section 52)

• We have not published a notice under section 52(2) of PAIA.
• The following is freely available on our website and social media, without a formal request:
  • our policies (Delivery & Collection, Returns & Exchanges, Terms of Service, Privacy Policy, Cooking Class T&Cs) and this manual;
  • product information, prices and labels;
  • class schedules, menus and descriptions;
  • published reviews, brochures and marketing material.

6. Records kept under other laws

We keep records as required by these laws, where they apply to us:

• Basic Conditions of Employment Act 75 of 1997
• Companies Act 71 of 2008
• Compensation for Occupational Injuries and Diseases Act 130 of 1993
• Consumer Protection Act 68 of 2008
• Electronic Communications and Transactions Act 25 of 2002
• Foodstuffs, Cosmetics and Disinfectants Act 54 of 1972
• Income Tax Act 58 of 1962
• Labour Relations Act 66 of 1995
• Occupational Health and Safety Act 85 of 1993
• Protection of Personal Information Act 4 of 2013
• Tax Administration Act 28 of 2011
• Unemployment Insurance Act 63 of 2001
• Unemployment Insurance Contributions Act 4 of 2002
• Value-Added Tax Act 89 of 1991

This list is not complete. Records may also be kept under other laws that apply.

7. Subjects and categories of records we hold

Listing a record here does not mean access will be given. Every request is assessed under PAIA.

Company records

• Memorandum of Incorporation, CIPC registration documents, share register, director records, minutes and resolutions.

Financial and tax records

• Accounting records, invoices, bank statements, management accounts, VAT, income tax and PAYE records, insurance policies.

Employee records

• Employment contracts, payroll, tax and UIF records, leave, training, disciplinary and performance records, job applications.

Customer records

• Orders, class bookings, delivery and collection details, dietary information, correspondence (WhatsApp, email, website chat), claims and refunds, marketing consent.

Supplier and service provider records

• Contracts, quotes, invoices, delivery notes, correspondence, supplier contact and bank details.

Product and food safety records

• Recipes and methods (our intellectual property), ingredient specifications, labels, production and batch records, cleaning and food safety records.

Website and IT records

• Website analytics and cookie data, online store records, chat logs.

Marketing records

• Campaigns, email and WhatsApp subscriber lists, photos and content.

We do not operate CCTV.

8. How to request a record

1. Use the prescribed form: PAIA Form 2 (Request for access to record), under the PAIA Regulations, 2021. Get it from inforegulator.org.za or from our Information Officer.
2. Be specific: describe the record, the form of access you want (e.g. copy by email), and the right you want to exercise or protect, with reasons why you need the record for it.
3. Prove your identity: attach a copy of your ID. If you ask on behalf of someone else, attach proof of your authority.
4. Send it to our Information Officer by email.
5. Pay the request fee (section 10). We will tell you if an access fee or deposit is payable.

Timelines

• We decide within 30 days of receiving a complete request.
• We may extend this once, by up to 30 days, where PAIA allows. We will tell you why.
• If a request affects a third party, we tell them within 21 days, and they have 21 days to respond.
• If we grant access, you receive the record once all fees are paid.

9. Grounds for refusal

We may refuse access where PAIA allows, including to protect:

• the personal information of another person;
• commercial information of a third party, or confidential information we owe a duty to protect;
• the safety of people or property;
• records privileged from production in legal proceedings;
• our trade secrets and commercial information, including our recipes, methods and class content;
• research information.

We must disclose a record if it reveals a serious breach of the law or an imminent and serious public safety or environmental risk, and the public interest in disclosure clearly outweighs the harm (section 70).

10. Fees

Fees are set by the PAIA Regulations, 2021 (Annexure B, private bodies).

• Request fee: R140
• Photocopy or printed copy: R2 per A4 page
• Copy on flash drive (provided by you): R40
• Copy on compact disc: R40 if you provide it · R60 if we provide it
• Transcription of an audio record: R24 per A4 page
• Transcription or copy of visual images: at the cost quoted by a service provider
• Search and preparation: R145 per hour after the first hour, up to R435 in total
• Deposit: one third of the access fee, if the search will take more than 6 hours
• Postage, email or other transfer: actual cost

We will send you PAIA Form 3 (Outcome of request and fees payable) with the decision and any fees.

11. If your request is refused

• As a private body, we have no internal appeal.
• You may lodge a complaint with the Information Regulator (PAIA Form 5) or apply to court, within 180 days of our decision.
• A third party affected by our decision to grant access has the same remedies.

12. How we process personal information (POPIA)

More detail is in our Privacy Policy: www.umamifoodstudio.co.za/policies/privacy-policy

Purpose

• To process, deliver and support orders and class bookings.
• To prepare food and run classes safely, including for allergies and dietary needs.
• To contact customers about orders, deliveries, collections and classes.
• To handle questions, returns, claims and complaints.
• To send news and offers, only with consent.
• To employ and pay staff, and to assess job applicants.
• To pay suppliers and manage contracts.
• To prevent fraud, keep our systems secure and improve our products and website.
• To meet legal, tax and accounting duties.

Data subjects and personal information

• Customers and class guests: name, email, phone and WhatsApp number, delivery address, order and booking history, collection details, payment status (not full card details), messages, reviews and photos they post, marketing consent. Special personal information: allergies, intolerances and religious dietary needs, with consent.
• Website and chat users: device and browser details, IP address, pages viewed, cookie data, chat messages.
• Employees and job applicants: name, ID number, contact details, address, bank details, tax and UIF details, employment contract, pay, leave, training and performance records, CVs. Special personal information only where the law requires it.
• Suppliers and service providers: company and contact person details, bank details, contracts and invoices.

Recipients

• Our online store platform (Shopify) and payment providers.
• Our courier partners (name, address and phone number only, to deliver).
• Our messaging, email, chat and review providers (Meta and QuickReply for WhatsApp, Flodesk, ZipChat, our review provider).
• Google and Meta (website analytics and advertising).
• SARS, CIPC, the Department of Employment and Labour (UIF, COIDA) and other authorities when the law requires it.
• Our accountants, auditors, attorneys and banks.
• Any other party, only with the data subject's consent or where the law requires or allows it.

Planned transborder flows

• Some providers (for example Shopify, Google, Meta, Flodesk and ZipChat) store or process information outside South Africa.
• We only transfer personal information outside South Africa as allowed by section 72 of POPIA: to a country or provider bound by adequate data protection law, binding rules or agreements, or with the data subject's consent.

Security measures

• Only staff who need personal information for their work can access it.
• Our online systems are password-protected and hosted by established providers.
• Card payments are handled by our payment providers. We never see or store full card numbers.
• Paper records are kept at our studio, which is not open to the public (visits by appointment only).
• We delete personal information, or keep it only in anonymous form, when we no longer need it.

13. Your POPIA rights

• Access: ask us free of charge to confirm whether we hold your personal information. To request a copy, use PAIA Form 2 (section 8 above). Fees may apply.
• Objection: object to the processing of your personal information, using POPIA Form 1 (Objection to the processing of personal information).
• Correction or deletion: ask us to correct or delete personal information that is wrong, out of date, incomplete, misleading, excessive or unlawfully obtained, or to destroy a record we may no longer keep, using POPIA Form 2 (Request for correction or deletion of personal information or destroying or deletion of record of personal information).
• Marketing: opt out of marketing at any time (unsubscribe link, reply "STOP" on WhatsApp, or contact us).
• Complaints: contact us first. You may also complain to the Information Regulator (details in section 4).

POPIA forms are available at inforegulator.org.za, or from our Information Officer.

14. Availability of this manual

This manual is available free of charge:

• on our website: www.umamifoodstudio.co.za/pages/paia-manual;
• by email from our Information Officer;
• for inspection at our studio, by appointment;
• to the Information Regulator, on request.

Printed copies: R2 per A4 page.

15. Updates

The Information Officer reviews this manual at least once a year, and whenever our records or processing change.

• Version 1.0 · 26 September 2026 · Owner: Sung Ran (Rany) Jo, Director