PAIA Manual

Document approval and control

This manual forms part of LE LIEN's privacy and information-governance framework. It should be read with the company's privacy notice, processing inventory, retention schedule, operator records, security-compromise procedure and related governance evidence.

Revision history

Availability

A current copy of this manual is intended to be available without charge on LE LIEN's website at www.le-lien.co.za/paia and for inspection at the registered office, by appointment, during reasonable business hours. A copy may also be requested from the Information Officer.

Language availability: This controlled version is in English. The Information Regulator currently states that PAIA manuals must be available in multiple languages. LE LIEN will maintain or provide additional official-language versions as required and will review publication requirements during each governance review.

Contents

1. Purpose and scope

This manual is prepared for LE LIEN, a private company and private body for purposes of PAIA. Its purpose is to assist a person who wishes to identify records held by LE LIEN and, where necessary, request access to a record in order to exercise or protect a right.

The manual also records information required by section 51 of PAIA and relevant POPIA-related disclosures concerning categories of personal information, data subjects, recipients, processing locations and security safeguards.

A reference to a category of record in this manual does not mean that a record exists in every case, that it is held indefinitely, or that access will automatically be granted. Each request is assessed on its facts and against PAIA, POPIA and any other applicable legal restriction.

2. Company profile

LE LIEN provides professional services and specialist product sourcing. Its operations may include customer engagement, quotations, sourcing, sales administration, contracting, invoicing, payment processing, supplier and service-provider engagement, document management, CRM activities, marketing and associated governance and administration.

3. Contact details and Information Officer

PAIA requests should be addressed to the Information Officer using the existing company contact information above. Physical inspection should be arranged in advance.

4. Guide on how to use PAIA

The Information Regulator has published a Guide explaining PAIA, the rights of requesters, the procedures for requesting access, available remedies, applicable forms and related matters. The Guide and prescribed forms are available from the Information Regulator.

The Regulator makes the PAIA Guide available in English and other South African official languages. A requester may consult the Regulator's website for the current Guide, forms, fees, procedures and complaint channels.

5. Records available without a formal PAIA request

Certain information may be made publicly or routinely available without requiring a formal Form 2 request. Availability may change over time and publication does not waive any applicable intellectual-property, privacy, confidentiality or contractual restriction.

• Company and service information published on LE LIEN's website or public communications.
• The current PAIA Manual and public privacy notice.
• Public company particulars and records obtainable from public registers such as CIPC, subject to the rules of those registers.
• Public marketing material, brochures, product or service descriptions, contact details and notices.
• Records voluntarily supplied to a person about that person or their own transaction, subject to identity verification and lawful restrictions.

LE LIEN may submit or update a notice of automatically available records through the Information Regulator's eServices where appropriate.

6. Records held in accordance with legislation

Depending on the company's activities and the applicability of particular legislation, LE LIEN may create, receive or retain records under legislation including the following. This list is indicative and not exhaustive.

7. Categories of records held by LE LIEN

LE LIEN predominantly keeps records digitally. Lumen is used for document management and Relay is used for CRM and invoicing. Some physical records, including visitor-register entries and records received in hard copy, may also exist.

8. How to request access to a record

A requester seeking a record from a private body must use the prescribed Form 2 (Request for Access to Record) and submit it to the Information Officer. The current prescribed form should be obtained from the Information Regulator's PAIA forms page.

8.1 Information required

1. Provide sufficient particulars to identify the requester and, where applicable, the person on whose behalf the request is made.
2. Attach proof of identity. If acting for another person, attach proof of authority or mandate.
3. Describe the requested record, or the relevant part of it, with enough detail to enable LE LIEN to locate it.
4. Identify the right that the requester seeks to exercise or protect and explain why the requested record is required for the exercise or protection of that right.
5. Specify the preferred form of access and any relevant contact particulars.
6. Provide any other information required by the prescribed Form 2 or reasonably necessary to process the request.

8.2 Submission

Completed requests may be sent to info@le-lien.co.za or delivered to the registered office by prior arrangement. LE LIEN may request additional information where reasonably necessary to identify the record, verify identity or authority, or understand the right relied upon.

9. Fees and forms of access

Any request fee, access fee, reproduction charge, search/preparation charge or deposit will be dealt with in accordance with PAIA and the current regulations and fee schedule. LE LIEN will not invent or apply fees outside the prescribed framework.

Where a fee is lawfully payable, the requester will be notified of the amount and payment requirements. Access may be provided by inspection, electronic copy, printed copy, transcription or another lawful form, depending on the record, the requester's stated preference, practicality, accessibility needs and the applicable regulations.

Current fees and forms should be verified against the Information Regulator's published PAIA resources at the time of the request.

10. Decision, extension, refusal and severability

10.1 Decision period

LE LIEN will process a valid request within the period prescribed by PAIA, ordinarily 30 days, subject to any lawful extension. A requester will be notified of the decision and, where applicable, fees, the form of access, reasons for refusal, and available remedies.

10.2 Extension

Where PAIA permits an extension, LE LIEN will notify the requester of the extension, its duration and the reasons for it.

10.3 Grounds for refusal

Access may be refused only on grounds permitted or required by PAIA or other applicable law. Depending on the record, these may include protection of third-party privacy, commercial information, confidential information, safety, privileged material, research information, or other protected interests recognised by PAIA.

10.4 Severability

Where only part of a record is protected and the protected portion can reasonably be severed, LE LIEN will consider providing access to the remainder as required by PAIA.

10.5 Records that cannot be found or do not exist

If reasonable steps have been taken to locate a requested record and it cannot be found or does not exist, the Information Officer will deal with the request in accordance with PAIA, including the required affidavit or affirmation process where applicable.

11. Remedies and complaints

A private body does not ordinarily provide the same internal-appeal route applicable to certain public bodies. If a requester is dissatisfied with a refusal, deemed refusal, fee, extension or other PAIA decision, the requester may use the remedies available under PAIA.

• A complaint to the Information Regulator may be submitted using prescribed Form 5 after the applicable prerequisites are met.
• The Information Regulator currently states that a complaint in respect of a private body should generally be lodged within 180 days of the relevant refusal, deemed refusal or other decision, subject to the Act and any applicable condonation process.
• A requester or third party may also seek appropriate relief from a court in accordance with PAIA.

12. POPIA processing disclosures

LE LIEN processes personal information as a responsible party for its own business activities unless a written arrangement establishes another role for a specific activity. It may also receive information in systems or workflows where contractual roles and instructions determine the applicable responsible-party/operator relationship.

12.1 Categories of data subjects

• Customers and prospective customers, including individuals and representatives of business customers.
• Suppliers, vendors, contractors, professional advisers and service-provider representatives.
• Directors, workers, contractors and persons assisting LE LIEN.
• Website visitors, leads, marketing contacts and correspondents.
• Visitors to company premises or controlled locations.
• Users of Lumen, Relay and other company systems.
• Persons whose information is contained in documents supplied to LE LIEN or uploaded by authorised Lumen clients, including third parties.

12.2 Categories of personal information

• Identity and contact information.
• Business, employment, role and professional information.
• Customer, supplier, contractual and transaction information.
• Financial, banking, invoicing and payment-related information.
• Electronic identifiers, account information, authentication/security events and audit information.
• Communications, correspondence, enquiries, complaints and support information.
• Visitor and access-control information.
• Marketing preferences, consent and objection records.
• Documents and document metadata supplied to LE LIEN or stored in Lumen or Relay.
• Where lawfully processed and necessary, special personal information or information concerning children, health, biometrics, criminal matters, financial affairs or identity documents that may be contained in client-supplied records.

12.3 Purposes of processing

• Providing professional services and specialist product sourcing.
• Customer onboarding, CRM, quotations, contracting, sales, invoicing, payment administration and support.
• Supplier sourcing, procurement, fulfilment and service-provider management.
• Operating Lumen, Relay and related business systems.
• Document storage, retrieval, OCR, classification, approval, retention, legal holds and auditability.
• Security, authentication, access control, fraud/abuse prevention, incident response and business continuity.
• Accounting, banking, tax, legal, regulatory and governance compliance.
• Marketing, lead management and business development subject to applicable law and preferences.
• Managing contractors, workers, advisers and authorised users.
• Establishing, exercising or defending legal rights and responding to lawful requests.

13. Recipients, operators and service providers

Personal information may be disclosed to internal authorised persons and to external recipients where necessary for the stated purpose, contract performance, legal compliance, security, administration or another lawful basis. Access is intended to be limited according to role and need.

Lumen infrastructure is configured in AWS. LE LIEN will maintain more detailed operator, subprocessor and processing-location records in its governance evidence where required. Appointment of a provider does not itself authorise processing beyond an approved purpose.

14. Cross-border processing

LE LIEN's governance preference is to keep approved Lumen infrastructure and primary document storage in South Africa where practicable. AWS infrastructure identified for Lumen is in the Cape Town region (af-south-1).

Some service providers, including approved external AI or internet-based service providers, may process or support information outside South Africa or through international infrastructure. Before material cross-border processing, LE LIEN should assess the transfer under POPIA section 72 and record the applicable contractual, legal, consent or other safeguard relied upon. The actual provider configuration and data flow at the time of processing governs, not merely the provider's corporate address.

15. Information security safeguards

LE LIEN applies technical and organisational safeguards appropriate to its systems, risks and available controls. The Lumen repository and governance evidence record a security architecture that includes the following implemented or intended safeguards, subject to operational validation and change control.

• Mandatory TOTP multi-factor authentication for Lumen accounts and role/permission-based access controls.
• Tenant scoping and access controls designed to prevent one client workspace from accessing another client's records.
• Application-level AES-256-GCM encryption for stored Lumen documents, with separate encryption-key management and encrypted sensitive metadata.
• Private protected and quarantine object storage, AWS KMS-backed server-side encryption and restricted infrastructure access for the deployed Lumen environment.
• File quarantine, malware scanning using ClamAV, content reconstruction/sanitisation controls and controlled document-processing pipelines.
• HTTPS, secure session controls, CSRF protection, security headers, rate limiting and security/audit event logging.
• Retention review, legal holds and controlled disposition workflows.
• Incident recording, evidence preservation and security-compromise escalation procedures.
• Access-control records, visitor registers and governance review of authorised users.

16. Retention, legal holds and disposal

LE LIEN retains records only for an approved operational, legal, contractual, evidentiary or governance purpose. Retention periods are maintained in a separate retention schedule because different record classes have different statutory and operational requirements.

Expiry of a retention period triggers review rather than automatic destruction where a legal hold, dispute, investigation, statutory preservation duty, unresolved request or other legitimate hold applies. Lumen governance uses controlled disposition and evidence of deletion decisions. Backup expiry is treated separately from primary-record deletion.

Physical records, where held, should be securely destroyed when lawful disposal is approved. Electronic records should be deleted or rendered inaccessible using the applicable system's controlled process, taking account of backups, audit requirements and legal holds.

17. Lumen and Relay information systems

17.1 Lumen DMS

Lumen is LE LIEN's document-management environment and is designed as a multi-tenant system. It supports document upload and versions, metadata, OCR and text extraction, classification and tags, approvals, audit history, expiry tracking, privacy-request cases, retention policies, review dates and legal holds. Client-supplied documents may contain broad categories of business and personal information, including restricted or special categories where a client lawfully uploads them.

Lumen includes optional AI-assisted capabilities. OpenAI has been approved as an external AI provider for configured use, but individual AI features and data flows remain subject to LE LIEN's approved settings, minimisation, contractual/transfer review and governance controls.

17.2 Relay

Relay is used for CRM and invoicing and may contain customer and prospect records, communications, quotations, invoices, transaction history and associated sales and administrative information.

17.3 Access control

Access to company systems is restricted to authorised persons. Lumen uses TOTP multi-factor authentication and granular permissions. LE LIEN also maintains visitor-register records as part of physical access control. Access rights should be reviewed and removed when no longer required.

18. Availability and updating of this manual

This manual will be reviewed at least annually and when there is a material change to LE LIEN's business, record categories, processing purposes, Information Officer details, systems, service providers, processing locations or applicable legal requirements.

The current controlled version is intended to be published at www.le-lien.co.za/paia and retained in Lumen as governance evidence. A physical copy will be available for inspection at the registered office by appointment.

The Information Regulator currently provides an eServices facility for PAIA Manual uploads and annual PAIA reporting. LE LIEN should keep its Information Officer registration and relevant eServices submissions current.

Annexure A - Record category schedule

The "access status" column is descriptive only. Final access is determined under PAIA and other applicable law.

Annexure B - PAIA request checklist

Use this checklist as an operational aid. The prescribed Form 2 remains the formal request instrument.

Annexure C - Key references and prescribed forms

Source and evidence note

Company particulars in this manual were verified against LE LIEN's CIPC COR14.3 Registration Certificate. Governance particulars, Information Officer registration, contact details, Lumen governance roles, publication intentions and review dates were aligned with the LE LIEN Privacy and Information Governance Signing Pack prepared on 21 September 2026. Technical descriptions of Lumen were aligned with the LLDMS repository implementation and security registers current on 21 September 2026. Regulatory procedure and form references were checked against the Information Regulator's current PAIA resources on 21 September 2026.

Where the company's operations, systems, service providers or legal requirements change, the underlying governance records and this manual should be updated together.

Approval

This manual is approved for publication and operational use by LE LIEN's Information Officer and Director. Signed approval records are retained in LE LIEN's governance evidence.