PAIA Manual — Autopilot Agency

1. Abbreviations

• PAIA: Promotion of Access to Information Act 2 of 2000, as amended.
• POPIA: Protection of Personal Information Act 4 of 2013.
• Regulator: the Information Regulator (South Africa).
• IO: Information Officer.
• Minister: Minister of Justice and Correctional Services.
• Republic: the Republic of South Africa.
• We / us / Autopilot Agency: Autopilot Agency, a sole proprietorship owned and run by Tshiamo Black.

2. What this manual is for

This manual helps you to:

• see which of our records you can get without making a formal PAIA request;
• understand how to ask for access to a record we hold, and what subjects and categories of records we hold;
• know which records are available under other South African laws;
• find the contact details of our Information Officer, who will help you;
• find the Regulator's Guide on how to use PAIA and how to get it;
• know whether we process personal information, why, whose and what kind, who we may give it to, whether we plan to send it outside South Africa, and how we take reasonable steps to protect it.

3. Who we are and how to contact us

Autopilot Agency offers a free missed-call check and plans to build AI assistants and automation (for example an AI phone receptionist, missed-call text-back and booking tools; a website chat assistant will be on this website from launch) for small businesses. Our first clients are expected to be plumbers and electricians.

3.1 Head of the private body and Information Officer

Because we are a sole proprietorship, the owner is the head of the body and acts as Information Officer. We have no Deputy Information Officer at present.

• Name: Tshiamo Black
• Telephone: 068 074 9801
• Email: autopilotagency731@gmail.com
• Fax: none

3.2 Deputy Information Officer

None designated.

3.3 General contact for access to information

• Email: autopilotagency731@gmail.com

3.4 Business details

• Business name: Autopilot Agency
• Legal status: sole proprietorship of Tshiamo Black
• Registration number: not registered with CIPC
• VAT number: not registered for VAT
• Physical address (principal place of business): 117 Mira Fedrover, Pretoria, Gauteng, 0001, South Africa
• Postal address: same as physical address
• Telephone: 068 074 9801
• Email: autopilotagency731@gmail.com
• Website: https://autopilotagency.co.za

4. The Regulator's Guide on how to use PAIA

4.1 The Information Regulator has, under section 10 of PAIA, published a Guide that explains in plain language how to use PAIA and POPIA to exercise your rights. It describes, among other things: the objects of PAIA and POPIA; how to make a request to a public body or a private body; the help the Regulator and Information Officers can give; the remedies available (including a complaint to the Regulator and an application to court); the voluntary disclosure of categories of records; the notices about fees; and the regulations made under PAIA.

4.2 The Guide is available in the official languages and in braille from the Regulator.

4.3 You can get the Guide:

• from the Regulator's website: https://inforegulator.org.za (the current English PDF at the time of drafting: https://inforegulator.org.za/wp-content/uploads/2020/07/PAIA-Guide-English_20210905.pdf);
• by asking our Information Officer, who will tell you where to find it [or give you a copy: confirm whether we will keep a printed copy];
• from the Regulator's offices (JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001 per the Guide at the time of drafting; check the website for current details). Postal address: P.O. Box 31533, Braamfontein, Johannesburg, 2017.

4.4 A copy of the Guide is available for inspection by appointment, during normal business hours, in English [and a second official language: SPECIFY, as the template suggests two official languages].

5. Records available without a PAIA request (section 52 of PAIA, voluntary disclosure)

These are available on our website or on request by email, without a formal request. [Update this table to match what is actually published.]

6. Records available under other South African legislation

These records are created and kept in line with the laws below. [Attorney to check and complete this list; only list what actually applies.]

7. Subjects on which we hold records, and the categories on each

Access to these records is by a formal request under section 50 of PAIA (see paragraph 9). Holding a category here does not mean access will be granted; PAIA sets out grounds on which a request must or may be refused.

8. Processing of personal information (POPIA)

8.1 Purposes of processing

We process personal information to:

• reply to enquiries and follow up (up to two follow-ups) and arrange a call if we agree one;
• send tips and offers, only if you opted in;
• set up, run, support and bill our services for clients;
• plan to run AI phone, text and chat assistants for clients, which will include handling their callers' details on the client's instructions;
• take reasonable steps to protect our website, systems and accounts, and prevent spam and abuse;
• keep consent and opt-out records so we honour your choices;
• keep accounting and tax records and meet our legal obligations;
• deal with PAIA and POPIA requests and complaints.

8.2 Categories of data subjects and information

We do not knowingly process the information of children. We do not intend to collect special personal information (for example health information); where a client's callers may give such information (for example dental or clinic clients, which are outside our trades launch), additional safeguards apply. [Attorney to confirm wording.]

8.3 Recipients, or categories of recipients, to whom personal information may be supplied

We do not sell personal information. We share it only with service providers (operators) that help us run the business, under written terms that require them to take reasonable steps to protect it and to keep it confidential, and where the law requires or allows (for example to the South African Revenue Service or in response to a court order or lawful request).

8.4 Planned transborder flows of personal information (POPIA section 72)

Some of the service providers above store or process data outside South Africa. FormSubmit, Cloudflare (website hosting and Email Routing) and Google (Gmail) will be in use for this website from launch: once the website goes live, our domain autopilotagency.co.za is registered and email forwarding is set up. The others are planned and will only be used once we start working with clients and have signed the provider's data processing terms.

We only send personal information outside South Africa where (a) the recipient is bound by law, binding rules or an agreement that gives substantially similar protection to POPIA (for the EU, the GDPR; for US providers, their data processing terms with us), or (b) you consented, or (c) the transfer is needed to carry out your request or our agreement with you (POPIA section 72). Once the AI receptionist is available, calls to a client's AI receptionist will be processed by Retell and Twilio in the US and, where chosen, Ireland, and each client's operator agreement will say so, so the client can tell their callers.

8.5 General description of information security measures

We use the following measures to protect the confidentiality, integrity and availability of personal information. Some are in place and others are under implementation as we launch. [Owner to tick off what is true on publishing day; remove anything that is not.]

• Encrypted connections (HTTPS/TLS) on the website and between systems.
• Hashed IP addresses where we store them ourselves (our hosting and form providers may process raw IP addresses to deliver the service).
• Access controls: only the owner has access to client and prospect data; strong unique passwords and two-factor authentication on email, hosting, telephony, AI and payment accounts [confirm].
• Service providers chosen for security practices and bound by data processing terms; signed Data Processing Agreements with Retell and Twilio before any real client call.
• Logging of access and key actions on our systems.
• Limited retention: enquiries and chats that do not lead to work have their identifying details removed after 6 months; if you asked us to stop contacting you, your email address or number is kept on a do-not-contact list so that your request keeps being honoured; a minimal record may also be kept, as described in section 8 of our Privacy Policy, for [period - attorney to confirm]; call recordings are kept only as long as the client's agreement says; client records are kept for the length of the agreement and as long as the law requires (for example, tax records for 5 years); opt-out records are kept so we can honour them.
• Regular software updates and anti-malware protection on the devices used [confirm]; backups [confirm how and where].
• A process to tell you and the Information Regulator if a security breach puts your information at risk, as POPIA requires.

8.6 Records we hold for clients

For the planned AI receptionist, text-back and similar services, our client (the plumber, electrician or other business) will decide why and how its callers' information is used, so the client will be the responsible party and we will be the operator. If you want records about calls made to a client's business, please also ask that client. We will pass on or help with requests relating to those records as our operator agreement requires.

9. How to request access to a record (section 50 of PAIA)

9.1 Who can ask. Any person can ask us for a record. You are entitled to access to a record of a private body if the record is needed to exercise or protect a right, you follow the procedure in PAIA, and no ground for refusal in Chapter 4 of Part 3 of PAIA (sections 62 to 70) applies.

9.2 Use the prescribed form. Complete Form 2 (Request for Access to Record, Regulation 7) and send it to our Information Officer by email or post (details in paragraph 3). The form is available from the Regulator: https://inforegulator.org.za/paia-forms/ (form: https://inforegulator.org.za/wp-content/uploads/2020/07/InfoRegSA-PAIA-Form02-Reg7.pdf). Give enough detail for us to identify the record, say which form of access you want, give an address or email we can reply to, and, if you ask on someone else's behalf, include proof of your authority. If you cannot read or write, tell us and we will help you complete the form.

9.3 Proof of identity. We may ask for a copy of your ID so we release records only to the right person.

9.4 Fees. See paragraph 10.

9.5 Our reply. We will decide and tell you the outcome as soon as reasonably possible, and within 30 days of receiving your request. We may extend this once by up to a further 30 days in the cases PAIA allows, and will tell you if we do.

9.6 If we refuse. We will give our reasons and the PAIA ground we rely on, and tell you how to complain to the Regulator or apply to court.

9.7 Requests about your own personal information (POPIA). You can ask whether we hold your personal information and for a copy, and ask us to correct it, or ask us to remove the details that identify you. We remove them, and keep only the minimal record and do-not-contact entry described in section 8 of our Privacy Policy. You can also object to our processing of your personal information. Do any of this by emailing the Information Officer (see paragraph 3). POPIA forms 1 (objection) and 2 (correction or deletion) are on the Regulator's website [attorney to confirm form numbers and current links]. A request for your own information under POPIA does not have to follow the PAIA request-fee process.

9.8 Remedies. You may complain to the Information Regulator (https://inforegulator.org.za; PAIA complaints: PAIAComplaints@inforegulator.org.za [verify before publishing]; POPIA complaints: POPIAComplaints@inforegulator.org.za, the address used in our Privacy Policy), or apply to a court after our decision. Complaints to the Regulator must be in writing. See the Guide for the deadlines and steps.

10. Fees

10.1 A request fee is payable by a requester (other than a requester seeking access to their own personal information) before we process a request, and an access fee may be payable if access is granted: for copies and printing, copies on a flash drive or disc, transcriptions of audio or visual records, postage or electronic transfer, and time to search for and prepare the record beyond the first hour, up to a prescribed maximum. If we think a search will take more than 6 hours, we may ask for a deposit of up to one-third of the prescribed fee (Form 4 in the Regulations).

10.2 The current amounts are set in the PAIA Regulations (Annexure B, "Fees in respect of private bodies") and the Regulator's published fee notice. We do not set our own amounts. Please check the Regulator's website for the up-to-date schedule: https://inforegulator.org.za . [Before publishing, confirm the current amounts on the Regulator's site and either insert them here or keep this reference.]

10.3 A fee for a copy of this manual is payable per A4 photocopy, as set out in Annexure B of the Regulations. The manual is free to view on our website.

11. Availability of this manual

This manual is available:

• on our website at https://autopilotagency.co.za/paia (free to view and download);
• at our principal place of business, 117 Mira Fedrover, Pretoria, Gauteng, 0001, South Africa, for public inspection during normal business hours [HOURS, or "by appointment on request"];
• to any person on request to the Information Officer, on payment of the prescribed fee for a printed copy;
• to the Information Regulator, on request.

12. Updating this manual

The head of Autopilot Agency will update this manual regularly and whenever our details, providers or practices change materially.

Issued by:

Tshiamo Black

Owner and Information Officer, Autopilot Agency

Date: 25 October 2026