PAIA Section 51 Manual

• Company: ASDF Consulting (Pty) Ltd
• Author: ASDF Consulting (Pty) Ltd
• Registration Number: 2023/566704/07
• Information Officer: Frederick James (Ricky) Klopper (ricky@bill.co.za, 069 041 1717)
• Version: 1.2
• Date of initial publication: 19 March 2026
• Last reviewed: 28 September 2026

Published in terms of section 51 of the Promotion of Access to Information Act, No. 2 of 2000 (PAIA) as amended, read with the Protection of Personal Information Act, No. 4 of 2013 (POPIA).

1. General information

1.1. Introduction

1.1.1. This manual is published in terms of section 51 of the Promotion of Access to Information Act, No. 2 of 2000 (PAIA) as amended, and must be read together with the Protection of Personal Information Act, No. 4 of 2013 (POPIA). It is intended to facilitate the exercise of the constitutional right of access to information held by ASDF Consulting (Pty) Ltd.

1.1.2. The right of access to information is subject to justifiable limitations, including, but not limited to, limitations aimed at the reasonable protection of privacy, commercial confidentiality, and effective, efficient, and good governance.

1.2. Organisation details

1.3. Information Officer

2. The PAIA guide

2.1. The Information Regulator maintains the guide under section 10 of PAIA to assist persons wishing to exercise their rights under PAIA and POPIA. The guide and available translations can be obtained from the Information Regulator at inforegulator.org.za/paia-guidelines or by contacting the Information Officer. A person who cannot read the guide may ask the Information Regulator for assistance.

3. Information available without a formal request

3.1. This manual, the privacy policy, terms of service, cookie policy and refund policy are available on bill.co.za without a formal PAIA request. No financial statements or other private financial records are made automatically available by this list.

4. Records available under other legislation

4.1. The company keeps records required by the Companies Act 71 of 2008, tax legislation, employment legislation and POPIA, as applicable. These include company statutory records, accounting and tax records, employment records and privacy compliance records. Being held under another law does not make a record publicly available; access remains subject to that law and PAIA.

5. Categories of records that may be requested

5.1. These categories describe records the company may hold. Listing a category does not give a requester a right to receive its records. Each request is assessed under PAIA, including the right identified by the requester and the grounds for refusal in section 7.6.

6. Protection of Personal Information Act (POPIA)

6.1. Purpose of processing personal information

6.1.1. ASDF Consulting processes personal information for the following purposes. The Bill privacy policy explains processing on the platform and website in more detail:

• 6.1.1.1. Operating the Bill platform, including time recording, billing and client communications for legal practitioners
• 6.1.1.2. Providing IT consulting and software development services to clients
• 6.1.1.3. Managing contractual relationships with clients, contractors, and suppliers
• 6.1.1.4. Administering payroll and human resources functions
• 6.1.1.5. Complying with legal and regulatory obligations (tax, labour law, etc.)
• 6.1.1.6. Marketing and business development activities (with consent where required)
• 6.1.1.7. Maintaining business records and accounts

6.2. Categories of data subjects

6.3. Recipients of personal information

6.3.1. ASDF Consulting may share personal information with the following categories of recipients:

• 6.3.1.1. The South African Revenue Service (SARS) and other regulatory authorities - as required by law
• 6.3.1.2. Banks and payment processors - for payroll, invoicing, and subscription billing purposes
• 6.3.1.3. Professional advisers (accountants, attorneys) - bound by confidentiality obligations
• 6.3.1.4. Cloud hosting and infrastructure providers - under data processing agreements
• 6.3.1.5. Messaging-gateway and email-delivery providers - for routing communications processed through the Bill platform
• 6.3.1.6. Artificial-intelligence and machine-learning providers - to support conversational features of the Bill platform, under data processing agreements
• 6.3.1.7. Web analytics providers - to measure use of the Bill marketing website, where the visitor consents to analytics cookies, under data processing terms
• 6.3.1.8. Insurance providers - where relevant to business operations

6.3.2. ASDF Consulting does not sell personal information to third parties.

6.4. Transborder flows of personal information

6.4.1. Certain cloud-based services used by ASDF Consulting process data outside South Africa, principally in the European Union and the United States. Transfers must satisfy a basis under section 72 of POPIA, such as an applicable law, binding corporate rules or binding agreement providing the required protection, or the data subject’s consent where applicable.

6.5. Information security measures

6.5.1. ASDF Consulting implements appropriate technical and organisational security measures to protect personal information against loss, damage, unauthorised access, disclosure, or misuse. These include:

• 6.5.1.1. Password-protected systems and two-factor authentication
• 6.5.1.2. Encrypted communications and data storage
• 6.5.1.3. Access controls restricting information to authorised personnel
• 6.5.1.4. Regular backups of critical data
• 6.5.1.5. Confidentiality obligations in contracts with employees, contractors, and service providers
• 6.5.1.6. Periodic review of security practices

6.6. Data subject rights and how to exercise them

6.6.1. A data subject may ask ASDF Consulting to:

• 6.6.1.1. Confirm, free of charge, whether or not ASDF Consulting holds personal information about the data subject, or request a record or description of that information, for which a prescribed fee may apply (POPIA section 23)
• 6.6.1.2. Correct or delete personal information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading, or obtained unlawfully (POPIA section 24)
• 6.6.1.3. Object to the processing of personal information on grounds relating to the data subject’s particular situation (POPIA section 11(3))
• 6.6.1.4. Withdraw consent previously given, where the processing is based on consent
• 6.6.1.5. Submit a complaint to the Information Regulator

6.6.2. An objection under section 11(3) of POPIA may be made on a form substantially similar to POPIA Form 1. A correction or deletion request under section 24 may be made on a form substantially similar to POPIA Form 2. The amended POPIA Regulations allow these requests through reasonably accessible channels, including email, hand delivery, post, SMS and WhatsApp; a telephone request must be recorded. For access to personal information under section 23 of POPIA, section 25 of POPIA applies PAIA sections 18 and 53. Follow the PAIA procedure in section 7 of this manual, including PAIA Form 02 and its applicable fees and response periods.

6.6.3. For objections and correction or deletion requests, contact the Information Officer through:

6.6.4. Requests for access to other records held by ASDF Consulting also follow section 7 of this manual and section 53 of PAIA.

7. How to request access to records

7.1. Who may request access

7.1.1. Any person (including a juristic person) may submit a PAIA request. Access to a private body’s record requires that the record be needed to exercise or protect a right, that the requester follow PAIA’s procedure, and that no applicable ground of refusal prevents disclosure. Submitting a request does not guarantee access, including to annual financial statements.

7.2. How to submit a request

7.2.1. Access requests must be submitted in writing on the prescribed form - Form 02 (Request for Access to Record) under Regulation 7 of the Regulations relating to the Promotion of Access to Information, 2021 - available from the Information Regulator at www.inforegulator.org.za, and addressed to the Information Officer:

7.3. Information to include in a request

7.3.1. The request must include:

• 7.3.1.1. Requestor’s full name, identity or registration number
• 7.3.1.2. Requestor’s contact details (address, phone, email)
• 7.3.1.3. Description of the record requested with sufficient detail
• 7.3.1.4. Form in which access is required (copy, inspection, etc.)
• 7.3.1.5. The right the requestor seeks to exercise or protect, and why the record is required for that purpose
• 7.3.1.6. Proof of the capacity to act if requesting access on behalf of another person
• 7.3.1.7. Information sufficient to identify the requestor

7.4. Request fee

7.4.1. A request fee of R140.00, as prescribed in Annexure B to the Regulations relating to the Promotion of Access to Information, 2021, is payable before processing of a request commences. Persons seeking access to records about themselves (personal requesters) are exempt from the request fee. Access fees to cover reproduction, search, and preparation costs may also apply, as set out in Annexure B. Please contact the Information Officer for current payment details.

7.5. Response timeframe

7.5.1. ASDF Consulting will respond to a request within 30 (thirty) days of receipt, or within an extended period permitted under section 57 of PAIA (not exceeding 30 additional days), where applicable.

7.6. Grounds for refusal

7.6.1. ASDF Consulting will assess each request against PAIA’s grounds for refusal. Relevant grounds include:

• 7.6.1.1. Protection of the privacy of a third party
• 7.6.1.2. Confidential commercial information of a third party
• 7.6.1.3. The company’s own financial or commercial information where disclosure would likely harm its commercial or financial interests
• 7.6.1.4. Research information that has not been published
• 7.6.1.5. Records that would be privileged from production in legal proceedings
• 7.6.1.6. Records whose disclosure would endanger the safety or life of a person
• 7.6.1.7. Records that would prejudice a pending civil or criminal proceeding

8. Remedies available if access is refused

8.1. There is no internal appeal against a decision of the head of a private body under PAIA. A requestor aggrieved by a refusal, a fee, or an extension decision may lodge a complaint with the Information Regulator within 180 days under section 77A of PAIA, using PAIA Form 05 available from inforegulator.org.za/paia. The complaint may be sent to PAIAComplaints@inforegulator.org.za. Court relief is governed by sections 78 and 82 of PAIA.

8.2. ASDF Consulting will notify the requestor in writing of the grounds for any refusal and the applicable remedies.

9. Availability of this manual

9.1. Availability

9.1.1. Under section 51(3) of PAIA, this manual is available:

• 9.1.1.1. On bill.co.za/paia-manual
• 9.1.1.2. At the principal place of business of ASDF Consulting for public inspection during normal business hours (Block 2, Blaauwklip Office Park, Webersvallei Road, Stellenbosch, 7600)
• 9.1.1.3. To any person on request via email to the Information Officer at ricky@bill.co.za
• 9.1.1.4. To the Information Regulator on request

9.1.2. Public inspection at the principal place of business is free. Requests for a copy may be directed to the Information Officer; PAIA permits a reasonable charge.

9.2. Version history