PAIA Section 51 Manual

• Company: ASDF Consulting (Pty) Ltd
• Author: ASDF Consulting (Pty) Ltd
• Registration Number: 2023/566704/07
• Information Officer: Frederick James (Ricky) Klopper (ricky@bill.co.za, 069 041 1717)
• Version: 1.6
• Date of initial publication: 19 March 2026
• Last reviewed: 2 October 2026

Published in terms of section 51 of the Promotion of Access to Information Act, No. 2 of 2000 (PAIA) as amended, read with the Protection of Personal Information Act, No. 4 of 2013 (POPIA).

1. General information

1.1. Introduction

1.1.1. This manual is published in terms of section 51 of the Promotion of Access to Information Act, No. 2 of 2000 (PAIA) as amended, and must be read together with the Protection of Personal Information Act, No. 4 of 2013 (POPIA). It is intended to facilitate the exercise of the constitutional right of access to information held by ASDF Consulting (Pty) Ltd.

1.1.2. The right of access to information is subject to justifiable limitations, including, but not limited to, limitations aimed at the reasonable protection of privacy, commercial confidentiality, and effective, efficient, and good governance.

1.2. Organisation details

1.3. Information Officer

2. The PAIA guide

2.1. The Information Regulator maintains the guide under Section 10, Promotion of Access to Information Act, 2000, to assist persons wishing to exercise their rights under that Act and POPIA. The guide and available translations can be obtained from the Information Regulator at inforegulator.org.za/paia-guidelines or by contacting the Information Officer. A person who cannot read the guide may ask the Information Regulator for assistance.

3. Information available without a formal request

3.1. This manual, the privacy policy, terms of service, cookie policy and refund policy are available on bill.co.za without a formal request under the Promotion of Access to Information Act, 2000. No financial statements or other private financial records are made automatically available by this list.

4. Records available under other legislation

4.1. The company keeps records required by the Companies Act 71 of 2008, tax legislation, employment legislation and POPIA, as applicable. These include company statutory records, accounting and tax records, employment records and privacy compliance records. Being held under another law does not make a record publicly available; access remains subject to that law and the Promotion of Access to Information Act, 2000.

5. Categories of records that may be requested

5.1. These categories describe records the company may hold. Listing a category does not give a requester a right to receive its records. Each request is assessed under the Promotion of Access to Information Act, 2000, including the right identified by the requester and the grounds for refusal in section 7.6.

6. Protection of Personal Information Act, 2013 (POPIA)

6.1. Purpose of processing personal information

6.1.1. ASDF Consulting processes personal information for the following purposes. The Bill privacy policy explains processing on the platform and website in more detail:

• 6.1.1.1. Operating the Bill platform, including time recording, billing and client communications for legal practitioners
• 6.1.1.2. Providing IT consulting and software development services to clients
• 6.1.1.3. Managing contractual relationships with clients, contractors, and suppliers
• 6.1.1.4. Administering payroll and human resources functions
• 6.1.1.5. Complying with legal and regulatory obligations (tax, labour law, etc.)
• 6.1.1.6. Marketing and business development activities (with consent where required)
• 6.1.1.7. Maintaining business records and accounts

6.2. Categories of data subjects

6.3. Recipients of personal information

6.3.1. ASDF Consulting may share personal information with the following categories of recipients:

• 6.3.1.1. The South African Revenue Service (SARS) and other regulatory authorities - as required by law
• 6.3.1.2. Banks and payment processors - for payroll, invoicing, and subscription billing purposes
• 6.3.1.3. Professional advisers (accountants, attorneys) - bound by confidentiality obligations
• 6.3.1.4. Cloud hosting and infrastructure providers - under data processing agreements
• 6.3.1.5. Messaging-gateway and email-delivery providers - for routing communications processed through the Bill platform
• 6.3.1.6. Artificial-intelligence and machine-learning providers - to support conversational features of the Bill platform, under data processing agreements
• 6.3.1.7. Web analytics providers - to measure use of the Bill marketing website, under data processing terms: a visit counter that sets no cookies, for every visitor, and analytics cookies only where the visitor consents to them
• 6.3.1.8. Google Ads - which advertisements led to sign-up link clicks on the Bill marketing website, and possibly later to booking link clicks and enquiries, reported by the website analytics; Google uses this under its own terms, not on ASDF Consulting’s behalf
• 6.3.1.9. Identity providers a Bill platform user chooses to sign in with, such as Google and Microsoft - for an invited user, the invitee’s email address, sent as a sign-in hint
• 6.3.1.10. Insurance providers - where relevant to business operations

6.3.2. ASDF Consulting does not sell personal information to third parties.

6.4. Transborder flows of personal information

6.4.1. Certain cloud-based services used by ASDF Consulting process data outside South Africa, principally in the European Union and the United States. Transfers must satisfy a basis under Section 72, Protection of Personal Information Act, 2013, such as an applicable law, binding corporate rules or binding agreement providing the required protection, the data subject’s consent, or the transfer being necessary for the performance of a contract between the data subject and ASDF Consulting, or for steps taken at the data subject’s request before one is concluded.

6.5. Information security measures

6.5.1. ASDF Consulting implements appropriate technical and organisational security measures to protect personal information against loss, damage, unauthorised access, disclosure, or misuse. These include:

• 6.5.1.1. Password-protected systems and two-factor authentication
• 6.5.1.2. Encrypted communications and data storage
• 6.5.1.3. Access controls restricting information to authorised personnel
• 6.5.1.4. Regular backups of critical data
• 6.5.1.5. Confidentiality obligations in contracts with employees, contractors, and service providers
• 6.5.1.6. Periodic review of security practices

6.6. Data subject rights and how to exercise them

6.6.1. A data subject may ask ASDF Consulting to:

• 6.6.1.1. Confirm, free of charge, whether or not ASDF Consulting holds personal information about the data subject, or request a record or description of that information, for which a prescribed fee may apply (Section 23, Protection of Personal Information Act, 2013)
• 6.6.1.2. Correct or delete personal information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading, or obtained unlawfully (Section 24, Protection of Personal Information Act, 2013)
• 6.6.1.3. Object, at any time, to the processing of personal information that relies on Section 11(1)(d) to (f), Protection of Personal Information Act, 2013 (protecting the data subject’s legitimate interest, a public body performing a public law duty, or pursuing a legitimate interest of ASDF Consulting or a third party), on reasonable grounds relating to the data subject’s particular situation, unless legislation provides for that processing; or to processing for direct marketing other than direct marketing by unsolicited electronic communications under Section 69. Once a data subject has objected, ASDF Consulting may no longer process the personal information (Section 11(3) and (4))
• 6.6.1.4. Withdraw consent previously given, where the processing is based on consent
• 6.6.1.5. Submit a complaint to the Information Regulator

6.6.2. An objection under Section 11(3), Protection of Personal Information Act, 2013, may be made on a form substantially similar to POPIA Form 1. A correction or deletion request under Section 24 may be made on a form substantially similar to POPIA Form 2. The POPIA Regulations, 2018, as amended, allow these requests through reasonably accessible channels, including email, hand delivery, post, SMS and WhatsApp; a telephone request must be recorded. Section 25 applies Sections 18 and 53 of the Promotion of Access to Information Act, 2000 to a request for access to personal information under Section 23. Follow that Act’s procedure in section 7 of this manual, including PAIA Form 02 and its applicable fees and response periods.

6.6.3. For objections and correction or deletion requests, contact the Information Officer through:

6.6.4. Requests for access to other records held by ASDF Consulting also follow section 7 of this manual and Section 53, Promotion of Access to Information Act, 2000.

7. How to request access to records

7.1. Who may request access

7.1.1. Any person (including a juristic person) may submit a request under the Promotion of Access to Information Act, 2000. Access to a private body’s record requires that the record be needed to exercise or protect a right, that the requester follow that Act’s procedure, and that no applicable ground of refusal prevents disclosure. Submitting a request does not guarantee access, including to annual financial statements.

7.2. How to submit a request

7.2.1. Access requests must be submitted in writing on the prescribed form - Form 02 (Request for Access to Record) under Regulation 7 of the Regulations relating to the Promotion of Access to Information, 2021 - available from the Information Regulator at www.inforegulator.org.za, and addressed to the Information Officer:

7.3. Information to include in a request

7.3.1. The request must include:

• 7.3.1.1. Requestor’s full name, identity or registration number
• 7.3.1.2. Requestor’s contact details (address, phone, email)
• 7.3.1.3. Description of the record requested with sufficient detail
• 7.3.1.4. Form in which access is required (copy, inspection, etc.)
• 7.3.1.5. The right the requestor seeks to exercise or protect, and why the record is required for that purpose
• 7.3.1.6. Proof of the capacity to act if requesting access on behalf of another person
• 7.3.1.7. Information sufficient to identify the requestor

7.4. Request fee

7.4.1. A request fee of R140.00, as prescribed in Annexure B to the Regulations relating to the Promotion of Access to Information, 2021, is payable before processing of a request commences. Persons seeking access to records about themselves (personal requesters) are exempt from the request fee. Access fees to cover reproduction, search, and preparation costs may also apply, as set out in Annexure B. Please contact the Information Officer for current payment details.

7.5. Response timeframe

7.5.1. ASDF Consulting will respond to a request within 30 (thirty) days of receipt, or within an extended period permitted under Section 57, Promotion of Access to Information Act, 2000 (not exceeding 30 additional days), where applicable.

7.6. Grounds for refusal

7.6.1. ASDF Consulting will assess each request against the grounds for refusal in the Promotion of Access to Information Act, 2000. Relevant grounds include:

• 7.6.1.1. Protection of the privacy of a third party
• 7.6.1.2. Confidential commercial information of a third party
• 7.6.1.3. The company’s own financial or commercial information where disclosure would likely harm its commercial or financial interests
• 7.6.1.4. Research information whose disclosure would be likely to expose the company (or, for a third party’s research, that third party), the researcher or the subject matter of the research to serious disadvantage
• 7.6.1.5. Records that would be privileged from production in legal proceedings
• 7.6.1.6. Records whose disclosure would endanger the safety or life of a person
• 7.6.1.7. Records whose disclosure would be likely to prejudice the security of a building, structure or system (including a computer or communication system), a means of transport or other property

8. Remedies available if access is refused

8.1. There is no internal appeal against a decision of the head of a private body under the Promotion of Access to Information Act, 2000. A requestor aggrieved by a refusal, a fee, or an extension decision may lodge a complaint with the Information Regulator within 180 days under Section 77A, using PAIA Form 05 available from inforegulator.org.za/paia. The complaint may be sent to PAIAComplaints@inforegulator.org.za. Court relief is governed by Sections 78 and 82.

8.2. ASDF Consulting will notify the requestor in writing of the grounds for any refusal and the applicable remedies.

9. Availability of this manual

9.1. Availability

9.1.1. Under Section 51(3), Promotion of Access to Information Act, 2000, this manual is available:

• 9.1.1.1. On bill.co.za/paia-manual
• 9.1.1.2. At the principal place of business of ASDF Consulting for public inspection during normal business hours (Block 2, Blaauwklip Office Park, Webersvallei Road, Stellenbosch, 7600)
• 9.1.1.3. To any person on request via email to the Information Officer at ricky@bill.co.za
• 9.1.1.4. To the Information Regulator on request

9.1.2. Public inspection at the principal place of business is free. Requests for a copy may be directed to the Information Officer; the Promotion of Access to Information Act, 2000 permits a reasonable charge.

9.2. Version history