PAIA Manual

01About us & contact

• PAIA gives everyone the right to ask for records held by a private body, when the record is needed to exercise or protect a right.
• POPIA gives everyone the right to know what personal information we hold about them, and to ask us to correct or delete it.
• This manual explains what records we hold, how to ask for them, what it costs, and how we process personal information.

Umami Food Studio (Pty) Ltd is a small Asian food studio in Midrand, Johannesburg. We run cooking classes and make and sell handmade Asian sauces, pickles, cordials, frozen food and kitchen products, online and from our studio.

02The Regulator's Guide

• The Information Regulator has published a Guide on how to use PAIA and POPIA.
• The Guide explains the purpose of PAIA and POPIA, who to contact, how to request records, fees, the help available, and all remedies, including complaints to the Regulator and court applications.
• It is available in all official languages and in braille.
• Get a copy from the Regulator's website, or ask our Information Officer. You can inspect a copy at our studio by appointment.
• To request a copy from us or from the Regulator, use PAIA Form 1 (Request for a copy of the Guide).

Information Regulator

03Records we hold

Available without a request (section 52)

We have not published a notice under section 52(2) of PAIA. The following is freely available on our website and social media, without a formal request:

• our policies (Delivery, Collection & Returns, Returns & Exchanges, Terms of Service, Privacy Policy, Public Cooking Class, Corporate Event and Private Event T&Cs) and this manual;
• product information, prices and labels;
• class schedules, menus and descriptions;
• published reviews, brochures and marketing material.

Kept under other laws

We keep records as required by these laws, where they apply to us:

• Basic Conditions of Employment Act 75 of 1997
• Companies Act 71 of 2008
• Compensation for Occupational Injuries and Diseases Act 130 of 1993
• Consumer Protection Act 68 of 2008
• Electronic Communications and Transactions Act 25 of 2002
• Foodstuffs, Cosmetics and Disinfectants Act 54 of 1972
• Income Tax Act 58 of 1962
• Labour Relations Act 66 of 1995
• Occupational Health and Safety Act 85 of 1993
• Protection of Personal Information Act 4 of 2013
• Tax Administration Act 28 of 2011
• Unemployment Insurance Act 63 of 2001
• Unemployment Insurance Contributions Act 4 of 2002
• Value-Added Tax Act 89 of 1991

This list is not complete. Records may also be kept under other laws that apply.

Subjects and categories

Listing a record here does not mean access will be given. Every request is assessed under PAIA.

We do not operate CCTV.

04How to request a record

1. Use PAIA Form 2 (Request for access to record), under the PAIA Regulations, 2021. Get it from the Regulator's website or from our Information Officer.
2. Describe the record, the form of access you want (for example a copy by email), and the right you want to exercise or protect, with reasons why you need the record for it.
3. Attach a copy of your ID. If you ask on behalf of someone else, attach proof of your authority.
4. Email it to our Information Officer.
5. Pay the request fee (see Fees). We will tell you if an access fee or deposit is payable.

Forms

Timelines

• We decide within 30 days of receiving a complete request.
• We may extend this once, by up to 30 days, where PAIA allows. We will tell you why.
• If a request affects a third party, we tell them within 21 days, and they have 21 days to respond.
• If we grant access, you receive the record once all fees are paid.

05Fees & refusals

Fees

Set by the PAIA Regulations, 2021 (Annexure B, private bodies).

We will send you PAIA Form 3 (Outcome of request and fees payable) with the decision and any fees.

Grounds for refusal

We may refuse access where PAIA allows, including to protect:

• the personal information of another person;
• commercial information of a third party, or confidential information we owe a duty to protect;
• the safety of people or property;
• records privileged from production in legal proceedings;
• our trade secrets and commercial information, including our recipes, methods and class content;
• research information.

We must disclose a record if it reveals a serious breach of the law or an imminent and serious public safety or environmental risk, and the public interest in disclosure clearly outweighs the harm (section 70).

If your request is refused

• As a private body, we have no internal appeal.
• You may lodge a complaint with the Information Regulator (PAIA Form 5) or apply to court, within 180 days of our decision.
• A third party affected by our decision to grant access has the same remedies.

06Personal information (POPIA)

More detail is in our Privacy Policy →

Purpose

• To process, deliver and support orders and class bookings.
• To prepare food and run classes safely, including for allergies and dietary needs.
• To contact customers about orders, deliveries, collections and classes.
• To handle questions, returns, claims and complaints.
• To send news and offers, only with consent.
• To employ and pay staff, and to assess job applicants.
• To pay suppliers and manage contracts.
• To prevent fraud, keep our systems secure and improve our products and website.
• To meet legal, tax and accounting duties.

Data subjects and personal information

Recipients

• Our online store platform (Shopify) and payment providers.
• Our courier partners (name, address and phone number only, to deliver).
• Our messaging, email, chat and review providers (Meta and QuickReply for WhatsApp, Flodesk, Zipchat Inc. and its AI providers such as OpenAI, our review provider).
• Google and Meta (website analytics and advertising).
• SARS, CIPC, the Department of Employment and Labour (UIF, COIDA) and other authorities when the law requires it.
• Our accountants, auditors, attorneys and banks.
• Any other party, only with the data subject's consent or where the law requires or allows it.

Planned transborder flows

• Some providers (for example Shopify, Google, Meta, Flodesk and Zipchat) store or process information outside South Africa.
• We only transfer personal information outside South Africa as allowed by section 72 of POPIA: to a country or provider bound by adequate data protection law, binding rules or agreements, or with the data subject's consent.

Security measures

• Only staff who need personal information for their work can access it.
• Our online systems are password-protected and hosted by established providers.
• Card payments are handled by our payment providers. We never see or store full card numbers.
• Paper records are kept at our studio, which is not open to the public (visits by appointment only).
• We delete personal information, or keep it only in anonymous form, when we no longer need it.

07Your POPIA rights

POPIA forms are available on the Regulator's website, or from our Information Officer.

08About this manual

Availability

This manual is available free of charge:

• on this page;
• by email from our Information Officer;
• for inspection at our studio, by appointment;
• to the Information Regulator, on request.

Printed copies: R2 per A4 page.

Updates

The Information Officer reviews this manual at least once a year, and whenever our records or processing change.