PAIA Manual
1. List of acronyms and abbreviations
| "IO" | Information Officer |
| "Minister" | Minister of Justice and Correctional Services |
| "PAIA" | Promotion of Access to Information Act 2 of 2000, as amended |
| "POPIA" | Protection of Personal Information Act 4 of 2013 |
| "Regulator" | Information Regulator (South Africa) |
| "Republic" | Republic of South Africa |
| "the company" | NRS TECH VENTURES (Pty) Ltd, registration number 2026/588319/07, trading as AfriLearn |
2. Purpose of this PAIA Manual
This Manual is useful for the public to: check the categories of records held by the company which are available without a person having to submit a formal PAIA request; understand how to make a request for access to a record, through a description of the subjects on which the company holds records and the categories of records held on each subject; know the description of the records available in accordance with any other legislation; access the contact details of the Information Officer who will assist the public with records they intend to access; know the description of the Regulator's Guide on how to use PAIA and how to obtain it; and know whether the company processes personal information, the purpose of processing, the categories of data subjects and information, the recipients, planned transborder flows, and the security measures applied.
3. Key contact details for access to information of NRS TECH VENTURES (Pty) Ltd
3.1 Information Officer
| Name | Nicolene Renske Steyn (Director) |
|---|---|
| Telephone | +27 76 380 6472 |
| nrstechven@proton.me |
No Deputy Information Officer has been designated; the company is a small private body and the Information Officer performs all functions under section 17(1) of PAIA and section 56 of POPIA.
3.2 Access to information general contacts
| Email for PAIA requests | nrstechven@proton.me (marked "PAIA request") |
|---|
3.3 National or head office
| Postal address | Unit 3, Cedar Park, 24 Cedar Street, Bryanston, Johannesburg, 2191 |
|---|---|
| Physical address | Unit 3, Cedar Park, 24 Cedar Street, Bryanston, Johannesburg, 2191 |
| Telephone | +27 76 380 6472 |
| nrstechven@proton.me | |
| Website | afrilearnai.co.za |
4. The Regulator's Guide on how to use PAIA, and how to obtain access to it
The Regulator has, in terms of section 10(1) of PAIA, updated and made available the revised Guide on how to use PAIA ("the Guide"), in an easily comprehensible form and manner, as may reasonably be required by a person who wishes to exercise any right contemplated in PAIA and POPIA. The Guide is available in each of the official languages and in braille.
The Guide contains descriptions of: the objects of PAIA and POPIA; the contact particulars of the information officer and deputy information officers of every public and private body; the manner and form of a request for access to a record of a public body (section 11) and of a private body (section 50); the assistance available from the IO of a public body and from the Regulator in terms of PAIA and POPIA; all remedies in law regarding acts, failures and rights under PAIA and POPIA, including the manner of lodging an internal appeal, a complaint to the Regulator, and a court application; the provisions of sections 14 and 51 requiring bodies to compile manuals; the provisions of sections 15 and 52 on voluntary disclosure; the notices regarding fees; and the regulations made under section 92.
Members of the public can inspect or make copies of the Guide from the offices of public and private bodies, including the office of the Regulator, during normal working hours. The Guide can also be obtained on request to the Information Officer, and from the Regulator's website at inforegulator.org.za. A copy of the Guide is available for public inspection on request to the company in English and Afrikaans.
5. Categories of records available without a formal PAIA request
| Category of records | Types of the record | Available on website | Available on request |
|---|---|---|---|
| Public course content | Marketing pages, the free Module 1, lesson previews | X | |
| Legal notices | Terms of Service, Privacy Notice, Disclaimer, Refunds and Cancellations, Cookie Notice, Company Information, this Manual | X | X |
| Certificate verification | For a given certificate ID: holder name, course, issue date and status, via the verification page | X |
6. Records available in accordance with other legislation
| Category of records | Applicable legislation |
|---|---|
| Memorandum of incorporation and statutory company records | Companies Act 71 of 2008 |
| PAIA Manual | Promotion of Access to Information Act 2 of 2000 |
| Tax and financial records | Tax Administration Act 28 of 2011; Income Tax Act 58 of 1962 |
| Electronic transaction records and consent records | Electronic Communications and Transactions Act 25 of 2002; Consumer Protection Act 68 of 2008 |
| Personal information processing records | Protection of Personal Information Act 4 of 2013 |
7. Subjects on which the company holds records, and categories of records held
| Subjects on which the company holds records | Categories of records |
|---|---|
| Learners and accounts | Account email addresses, hashed short-lived sign-in codes, server-stored course progress, guardian-consent records for learners under 18, checkout consent records |
| Certificates | Certificate ID, holder name, course, issue date, status, payment or class grant reference, claim token, email address |
| Class access | Email addresses on class lists, class labels, grant status |
| Finance | Payment provider transaction records, banking records, tax records |
| Company and governance | Incorporation documents, statutory registers, contracts with service providers, domain registration |
| Correspondence and support | Email correspondence with learners, guardians and third parties |
| Technical | Hosting, deployment and security logs held by service providers |
8. Processing of personal information
8.1 Purpose of processing personal information
Selling and delivering the AfriLearn course; operating learner accounts (email addresses and one-time sign-in codes); saving course progress against an account so it can be restored across devices; recording guardian consent for learners under 18; recording checkout consents; administering class access lists supplied by lecturers; issuing, emailing and publicly verifying certificates; keeping financial and tax records; and securing the service. There is no direct marketing.
8.2 Categories of data subjects, and personal information that may be processed
| Categories of data subjects | Personal information that may be processed |
|---|---|
| Learners and certificate holders | Name, email address, course progress, payment or class grant reference, certificate details |
| Learners under 18 and their guardians | Learner email and progress; guardian name, guardian email, consent records |
| Students on class lists | Email address, class label, grant status |
| Website visitors | Short-lived technical log data (IP address, pages requested) held by hosting providers |
| Service providers | Names, contact details, contractual records |
8.3 Recipients or categories of recipients to whom personal information may be supplied
| Category of personal information | Recipients or categories of recipients |
|---|---|
| Account, progress, consent, class and certificate records | Operators under POPIA section 20: Vercel (hosting and serverless functions), Supabase (database), Resend (sign-in and certificate email delivery) |
| Payment transaction information | PayFast, as an independent responsible party processing the payment |
| Certificate holder name, course, issue date, status | Any person to whom the certificate holder gives the certificate ID, via the public verification page |
| Any category, where the law requires | Courts, regulators and authorities with lawful entitlement |
8.4 Planned transborder flows of personal information
Account, progress, consent, class and certificate records are stored on cloud infrastructure operated by Vercel, Supabase and Resend located outside the Republic, including in the United States of America and the European Union, under contractual data protection terms, as described in the Privacy Notice.
8.5 General description of information security measures
Encrypted transport for all traffic; server-side restricted database credentials; cryptographically signed certificate identifiers and session tokens; sign-in codes stored only as hashes and expiring within 10 minutes; column-level and row-level database protections preventing public access to claim tokens, email addresses, progress, consent and class records; and least-data design, under which the company collects only a learner's name and email address to operate an account and holds no payment card data at any time, card details being handled entirely by the payment provider.
9. Availability of this Manual
A copy of this Manual is available: on the website at afrilearnai.co.za/paia; at the company's address in section 3 for public inspection during normal business hours; to any person on request, and on payment of any reasonable prescribed fee under Annexure B of the PAIA Regulations for an A4 photocopy; and to the Information Regulator on request. A request by email is free.
10. Updating of this Manual
The Information Officer of NRS TECH VENTURES (Pty) Ltd will update this Manual on a regular basis, and whenever the company's records, processing or contact particulars materially change.
Issued by
Nicolene Renske Steyn
Director and Information Officer, NRS TECH VENTURES (Pty) Ltd