PAIA
Manual.

Introduction

This manual is published under section 51 of the Promotion of Access to Information Act 2 of 2000 (PAIA), as amended by the Protection of Personal Information Act 4 of 2013 (POPIA). Sean van Tonder Photography is a private body: a private company, Sean van Tonder Photography (Pty) Ltd, carrying on business as a photographer and videographer.

This manual tells you:

• who to contact to request access to records;
• which records the business holds, and which are available without a formal request;
• how to make a request, what it costs, and when a request may be refused;
• what personal information the business processes, why, who receives it, and how it is protected.

This manual should be read with the Privacy & POPIA Notice, which explains in plain language how client and website-visitor information is handled.

Contact details

Sean van Tonder is the director and head of the company, and therefore its Information Officer under section 1 of PAIA and section 55 of POPIA. No Deputy Information Officer has been designated.

Please address PAIA and POPIA requests to the Information Officer by email, marked "PAIA Request" or "POPIA Request" in the subject line.

The Information Regulator's PAIA Guide

The Information Regulator has published a Guide on how to use PAIA, in all official languages, as required by section 10 of PAIA. It explains your rights under PAIA and POPIA and how to exercise them.

You can get a copy from the Regulator's website or offices, or ask the Information Officer for one. Copies are available for public inspection at the studio during normal business hours.

Records held by the business

4.1 Records available without a formal request

The following are freely available on the website, without a PAIA request or fee:

• Terms & Conditions
• Privacy & POPIA Notice
• Cancellation Policy and Refund Policy
• FAQ, service descriptions and portfolio
• This PAIA Manual

4.2 Records kept in terms of legislation

Records are kept as required by, among others:

• Income Tax Act 58 of 1962 and Tax Administration Act 28 of 2011
• Companies Act 71 of 2008
• Consumer Protection Act 68 of 2008
• Copyright Act 98 of 1978
• Electronic Communications and Transactions Act 25 of 2002
• Protection of Personal Information Act 4 of 2013
• Basic Conditions of Employment Act 75 of 1997 and Labour Relations Act 66 of 1995 [only if staff are employed]

4.3 Categories of records held

Requesting access to records

Access is granted under section 50 of PAIA when the record is needed to exercise or protect a right, the request follows the prescribed procedure, and no ground for refusal applies.

5.1 How to make a request

1. Complete Form 2 (Request for Access to Record), available from the Information Regulator's website or from the Information Officer.
2. Email it to sean@seanvantonder.co.za, or deliver it to the studio.
3. Give enough detail to identify the record, the form of access you want, and the right you are exercising or protecting.
4. If you are acting for someone else, include proof of your authority.
5. Pay the request fee, unless you are asking for your own personal information.

You will receive a decision within 30 days. This may be extended once, by up to 30 days, in the circumstances set out in section 57 of PAIA; you will be told in writing. No decision within the period is treated as a refusal.

To ask what personal information is held about you, or to correct or delete it, you can also simply email the Information Officer, as set out in the Privacy & POPIA Notice.

5.2 Fees

Fees are those prescribed for private bodies in Annexure B of the PAIA Regulations, 2021 (Information Regulator fee structure).

Records may be withheld until fees are paid. A deposit is refunded if the request is refused.

5.3 Grounds for refusal

Access may or must be refused on the grounds in Chapter 4 of Part 3 of PAIA (sections 62 to 70), including to protect:

• the privacy of a third party, such as other clients or people who appear in photographs;
• commercial information of the business or a third party;
• confidential information owed to a third party;
• the safety of individuals or property;
• records privileged from production in legal proceedings.

5.4 If your request is refused

There is no internal appeal against a decision of a private body. Within 180 days of the decision you may lodge a complaint with the Information Regulator, or apply to court.

Processing of personal information

The business processes personal information only to provide photography and videography services, run the business, and meet legal duties. It does not sell, rent or trade personal information.

6.1 Purposes of processing

• Responding to enquiries and preparing quotations
• Planning, photographing and delivering sessions, including online galleries
• Invoicing, payments and record-keeping required by tax law
• Sending marketing emails, only to people who have opted in
• Displaying work on the website and social media, subject to the client's right to opt out and to parental consent for minors
• Measuring website use and advertising, only where cookies are accepted
• Complying with legal obligations and protecting the business's legal rights

6.2 Data subjects and categories of information

Online payments on Pixsa and the website are processed by PayFast. Card and banking details are entered directly with PayFast and are never received or stored by the business; only a record of the transaction (amount, date and reference) is kept.

6.3 Recipients of personal information

Information is shared only with service providers (operators) who help run the business, and only as needed for their service:

6.4 Transfers outside South Africa

Several recipients store information outside South Africa. Transfers are made only to providers bound by law, binding rules or agreements that give protection substantially similar to POPIA, or with the data subject's consent, as section 72 of POPIA requires.

6.5 Security measures

• The website runs only over secure HTTPS connections
• The contact form is protected against spam and misuse
• Email, booking, gallery and storage systems are password-protected
• Access to client information is limited to the owner and, per session, to contractors who need it
• Client images are stored and delivered through ShootProof and Pixsa, which have built-in access controls and security settings; Pixsa requires a one-time code sent by email at each login
• Retention periods are applied: unbooked enquiries deleted within 12 months; booking and financial records kept for 7 years
• Security compromises will be reported to the Information Regulator and affected people as section 22 of POPIA requires

6.6 Your rights

You may ask to access, correct or delete your personal information, object to its processing, or withdraw consent, by emailing the Information Officer. You may lodge a POPIA complaint with the Information Regulator at any time.

Availability and updates

This manual is available on the website at www.seanvantonder.co.za and at the studio for inspection during business hours, free of charge. A copy may be requested from the Information Officer; the prescribed copying fee applies to printed copies.

The manual will be reviewed at least once a year, and whenever the business's details, services or service providers change. The Information Officer submits the annual PAIA report to the Information Regulator through its eServices portal.

Issued by Sean van Tonder, Information Officer, Sean van Tonder Photography (Pty) Ltd.

Date: 30 October 2026