PAIA Manual

1. Introduction

RESOURCERPRO (PTY) LTD, trading as Sociaal ("Sociaal", "we") operates the creator platform at https://sociaal.co.za and the short-link and profile service at sca.al. Sociaal is a private body as defined in PAIA.

PAIA gives effect to the constitutional right of access to information held by another person that is required for the exercise or protection of any right. This manual explains what records we hold, how to request access to them, and how we process personal information. It is published in terms of section 51 of PAIA and the Regulations of 2021.

2. Contact details (section 51(1)(a))

Name of private body	RESOURCERPRO (PTY) LTD, trading as Sociaal
Registration number	2024/424902/07
Head of the body	Darko Arnautovic
Information Officer	Darko Arnautovic
Postal and physical address	4 Eastwood Avenue, Randpark Ridge, Johannesburg, South Africa
Telephone	072 956 6923
Email	privacy@sociaal.co.za
Website	https://sociaal.co.za

All requests under PAIA and all questions about this manual go to the Information Officer at the email address above.

3. The Information Regulator's guide (section 51(1)(b))

The Information Regulator has compiled a guide, in each official language, on how to use PAIA. It explains the objects of the Act, the contact details of information officers, how to make a request, the remedies available, and the fees. The guide is available from the Regulator:

• Website: inforegulator.org.za
• Physical address: JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001
• Postal address: P.O. Box 31533, Braamfontein, Johannesburg, 2017
• General enquiries: enquiries@inforegulator.org.za
• PAIA complaints: PAIAComplaints@inforegulator.org.za
• POPIA complaints: POPIAComplaints@inforegulator.org.za

4. Records available in terms of other legislation (section 51(1)(d))

Where applicable, records are kept in accordance with, and may be available under, the following legislation:

• Companies Act 71 of 2008
• Income Tax Act 58 of 1962, Value-Added Tax Act 89 of 1991 and Tax Administration Act 28 of 2011
• Consumer Protection Act 68 of 2008
• Electronic Communications and Transactions Act 25 of 2002
• Protection of Personal Information Act 4 of 2013
• Financial Intelligence Centre Act 38 of 2001 (creator identity and bank verification)
• Basic Conditions of Employment Act 75 of 1997, Labour Relations Act 66 of 1995, Unemployment Insurance Act 63 of 2001 and Compensation for Occupational Injuries and Diseases Act 130 of 1993, to the extent we employ staff
• Films and Publications Act 65 of 1996

5. Records available without a PAIA request (section 51(1)(c))

The following are available on our website to anyone, free of charge:

• Terms of Service
• Privacy Policy
• Acceptable Use Policy
• This PAIA Manual
• Public information about the platform, its features and pricing

In addition, every registered user can see and correct their own account details, and download their own earnings records, from their dashboard without a formal request.

6. Subjects and categories of records we hold (section 51(1)(e))

Subject	Categories of records
Company records	Incorporation documents, shareholder and director records, minutes, statutory registers, policies
Financial records	Bank records, accounting records, tax returns, invoices, payment-processor (Paystack) statements, payout records
Registered users (creators, fans, brands)	Account details, profile information, login and security records, consent records, correspondence
Creators	Identity verification (KYC) documents, bank account details, earnings, payouts, content and products, connected social-account statistics, link-page and analytics data
Fans	Subscriptions, purchases, tips and receipts
Brands and agencies	Company details, campaign briefs, deposits and escrow records, campaign agreements and deliverables, invoices
Platform operations	Content reports and moderation decisions, support correspondence, system logs, email delivery records
Personnel and contractors	Contracts, remuneration and tax records, to the extent we have staff or contractors
Marketing	Waitlist and outreach lists, newsletter consent records

7. Processing of personal information (section 51(1)(c) read with POPIA)

7.1 Purpose of processing. We process personal information to register and run user accounts; to publish creator pages and content; to take payments from fans and brands and pay creators; to verify creators' identities and bank accounts as the law requires before paying them; to run brand campaigns; to send service and, with consent, marketing emails; to keep the platform secure; to handle complaints and content reports; and to meet our legal obligations.

7.2 Categories of data subjects and personal information.

• Creators: name, username, email, phone number, profile and biography, photos and content, identity document and selfie, bank account details, legal name, earnings and payout history, connected social-account statistics, usage and analytics data.
• Fans: name, username, email, subscription, purchase and tip history.
• Brands and agencies: contact person's name and email, company details, campaign and payment records.
• Website visitors: hashed IP address and browser details, pages visited, aggregate analytics.
• Staff, contractors and suppliers: contact, contract and payment details.

7.3 Recipients. Personal information is shared only with the service providers that help us run the platform and only for that purpose: Paystack (payments and payouts), Cloudflare (hosting of images, videos and files, and network security), Google (website analytics), InsightIQ / Phyllo Inc. (connected social-account statistics), our email provider, and professional advisers. We disclose personal information to regulators, courts and law enforcement where the law requires it. We do not sell personal information.

7.4 Cross-border transfers. Cloudflare, Google and Phyllo Inc. are headquartered in the United States and may process data outside South Africa; Paystack may process data elsewhere in Africa. Each is bound by a contract or by privacy rules that give protection substantially similar to POPIA. Details are in section 17 of our Privacy Policy.

7.5 Security measures. Encryption in transit (HTTPS) for every page; passwords stored as one-way hashes; emailed one-time codes for logins and for changes to passwords, email addresses and bank details; identity documents and paid content kept in private storage reachable only through short-lived signed links; role-based access to admin functions; IP addresses stored hashed; regular dependency updates; and a tested backup and restore process. Our Privacy Policy describes these in more detail.

7.6 Objections and rights. Data subjects may ask what we hold about them, ask for corrections, object to processing, withdraw consent, and ask for deletion, by emailing the Information Officer. Account holders can also delete their own account from the Login & security page. Our Privacy Policy sets out these rights and how we respond.

8. How to request access to a record (section 51(1)(f))

8.1 Form. Complete the prescribed request form (Form 2 in the 2021 PAIA Regulations), available from the Information Regulator's website, and send it to the Information Officer at privacy@sociaal.co.za. Say which record you want, in enough detail for us to find it, how you would like to receive it, and which right you need it to exercise or protect, with proof of identity. If you ask on behalf of someone else, include proof of your authority.

8.2 Fees. A request fee of R100 is payable before we process the request (not payable by a person requesting their own personal information). Access fees for copying, printing and transcribing are charged at the rates in the Regulations, and we may ask for a deposit where preparing the record will take more than six hours.

8.3 Timing. We will decide on a request within 30 days of receiving it, extendable once by up to 30 days where the Act allows, and tell you in writing.

8.4 Refusal. We may refuse access on the grounds set out in Chapter 4 of Part 3 of PAIA, for example to protect another person's privacy, commercial information, or legally privileged records. If we refuse, we will give reasons.

8.5 Remedies. As a private body we have no internal appeal procedure. A requester who is unhappy with our decision may lodge a complaint with the Information Regulator (section 3 above) or apply to a court, within the time limits in the Act.

9. Availability of this manual (section 51(1)(g))

This manual is available on our website at https://sociaal.co.za/paia, by email from the Information Officer, and at our registered address on request. A copy has been provided to the Information Regulator. We review it at least once a year and whenever our processing changes.