PAIA & POPIA Manual

For purposes of this Manual, unless the context indicates otherwise:

• Automate CRM means the CRM, lead management, partner management, booking, ticketing, education, billing, reporting, and automation platform operated by Think Tank T2 (Pty) Ltd.
• Client means any natural or juristic person who receives, has received, or applies to receive services from Automate CRM or Think Tank T2 (Pty) Ltd.
• Data Subject means the person to whom Personal Information relates.
• Information Officer means the Compliance Team or person responsible for access to information and privacy compliance.
• PAIA means the Promotion of Access to Information Act 2 of 2000.
• POPIA means the Protection of Personal Information Act 4 of 2013.
• Personal Information means information relating to an identifiable natural or juristic person, including names, contact details, account details, identity information, correspondence, usage data, financial information, and platform activity records.
• Processing means any operation concerning Personal Information, including collection, receipt, recording, storage, use, disclosure, deletion, or destruction.
• Record means any recorded information, regardless of form or medium, held by Automate CRM or Think Tank T2 (Pty) Ltd.
• Requester means a person requesting access to a record in terms of PAIA.

Automate CRM is a digital CRM and business automation platform operated by Think Tank T2 (Pty) Ltd. The platform assists organisations with managing leads, clients, partners, products, services, bookings, support tickets, training or education processes, billing, reporting, and operational workflows.

In providing these services, Automate CRM may collect, store, process, and manage Personal Information belonging to clients, client representatives, employees, users, learners, partners, suppliers, leads, prospects, and other relevant Data Subjects.

This Manual has been prepared in terms of section 51 of PAIA and to address the requirements of POPIA.

Automate CRM is owned and operated by Think Tank T2 (Pty) Ltd. Automate CRM provides CRM and automation functionality to help organisations manage business operations from one central platform.

The Information Regulator has published a PAIA Guide to assist members of the public in understanding how to exercise their rights under PAIA.

Automate CRM may hold and/or process the records listed below. Access is not automatic and each request will be considered in accordance with PAIA, POPIA, contractual obligations, confidentiality obligations, and applicable law.

Automate CRM and Think Tank T2 (Pty) Ltd may hold records in terms of applicable South African legislation, including but not limited to:

• Basic Conditions of Employment Act 75 of 1997
• Companies Act 71 of 2008
• Consumer Protection Act 68 of 2008
• Electronic Communications and Transactions Act 25 of 2002
• Employment Equity Act 55 of 1998
• Financial Intelligence Centre Act 38 of 2001
• Income Tax Act 58 of 1962
• Labour Relations Act 66 of 1995
• Occupational Health and Safety Act 85 of 1993
• Promotion of Access to Information Act 2 of 2000
• Protection of Personal Information Act 4 of 2013
• Unemployment Insurance Act 63 of 2001
• Value Added Tax Act 89 of 1991

A person who wishes to request access to a record must complete the prescribed PAIA request form and submit it to the Information Officer using the contact details in this Manual.

The request must contain enough detail to allow the Information Officer to identify:

1. the record requested;
2. the identity of the requester;
3. the form of access required;
4. the requester’s contact details;
5. the right the requester wishes to exercise or protect;
6. why the requested record is required to exercise or protect that right.

The standard response period is 30 days from receipt of a valid request. This period may be extended where permitted by PAIA.

Automate CRM may refuse access to records where PAIA allows or requires refusal. Grounds for refusal may include:

• protection of the privacy of a third party;
• protection of commercial information of a third party;
• protection of confidential information supplied by a third party;
• protection of the safety of individuals or property;
• protection of records privileged from production in legal proceedings;
• protection of Automate CRM or Think Tank T2 (Pty) Ltd commercial information;
• protection of software, source code, databases, systems, and intellectual property;
• requests that are frivolous, vexatious, or an unreasonable diversion of resources.

The prescribed PAIA fees may be payable for requesting and accessing records.

Automate CRM is committed to processing Personal Information lawfully, fairly, securely, and transparently. POPIA sets out eight conditions for lawful processing:

• Accountability
• Processing limitation
• Purpose specification
• Further processing limitation
• Information quality
• Openness
• Security safeguards
• Data subject participation

Categories of Data Subjects

Automate CRM may process Personal Information relating to:

• users, employees, contractors, and directors;
• client representatives and tenant users;
• prospects, leads, customers, learners, partners, affiliates, and resellers;
• suppliers, service providers, and website visitors;
• companies, tenants, training providers, and partner organisations.

Categories of Personal Information

Automate CRM may process:

• names, surnames, email addresses, phone numbers, and job titles;
• company names, addresses, account usernames, and user roles;
• lead details, client records, engagement history, and communication logs;
• learner records, course records, assessment results, and certificate records;
• billing, subscription, invoice, and payment records;
• IP addresses, device information, browser data, system logs, and analytics data.

Purposes for Processing

Automate CRM may process Personal Information to:

• create and manage user accounts;
• provide access to the Automate CRM platform;
• manage leads, clients, bookings, tickets, partners, and communications;
• provide education, training, assessment, and certification features where applicable;
• manage billing, subscriptions, payments, and invoices;
• send system notifications, reminders, confirmations, and service-related emails;
• maintain security, prevent fraud, and protect the platform;
• generate reports, analytics, and operational insights;
• comply with legal, tax, accounting, regulatory, and contractual obligations.

Automate CRM takes reasonable technical and organisational measures to protect Personal Information against loss, unauthorised access, misuse, disclosure, alteration, or destruction.

• secure user authentication;
• password hashing;
• role-based access control;
• session management;
• access permissions;
• server and database security controls;
• audit logs;
• data backups;
• secure hosting environments;
• monitoring and logging;
• incident response processes.

In terms of POPIA, Data Subjects may have the right to:

• request confirmation of whether Automate CRM holds Personal Information about them;
• request access to their Personal Information;
• request correction or deletion of Personal Information;
• object to the processing of Personal Information where permitted by law;
• object to direct marketing;
• request restriction of processing in certain circumstances;
• lodge a complaint with the Information Regulator;
• be notified of certain security compromises where required by law.