PAIA Manual

The private body

Encircle Platform (Pty) Ltd
Trading as: Encircle
Registration number: 2026/810371/07
Incorporated in the Republic of South Africa
Website: encircle.co.za
Street and postal address: 203 Beyers Naude Drive
Telephone: 011 476 3932

Head of the body and Information Officer

Anton van Wyk, Information Officer and head of the body for the purposes of PAIA
Email: privacy@encircle.co.za
Telephone: 011 476 3932
Registered with the Information Regulator: 2026-069919

We have not appointed a Deputy Information Officer. Our size does not require one, and requests are dealt with by the Information Officer personally.

The Regulator’s guide on how to use PAIA

The Information Regulator has published a guide, in terms of section 10 of PAIA, on how to use the Act. It is available in each official language from the Regulator at inforegulator.org.za, or on request from:
The Information Regulator (South Africa)
JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001
Email: enquiries@inforegulator.org.za

Records available without a request

The following records are freely available on this website and need no PAIA request:

• Our Terms of Use, Privacy Policy, POPIA §18 Information Notice and security practices
• This manual
• Our published descriptions of the frameworks Encircle assesses and what the Platform does, across the frameworks, platform and pricing pages

We have not made any record automatically available in terms of section 52(2) of PAIA by notice in the Government Gazette.

Records of our own business

We hold records in the following subjects and categories. Listing a category here does not mean a record in it will be released: a request is decided against the grounds for refusal in Chapter 4 of PAIA, which protect, among other things, the personal information of other people and the commercial information of third parties.

• Company and governance records: founding documents, statutory registers, director and shareholder records, resolutions and minutes.
• Our financial records: our own annual financial statements, accounting records, tax and VAT records, banking records, invoices and payment records.
• Customer and subscription records: order forms, subscription and billing records, support correspondence.
• Employment and contractor records: contracts, payroll, leave and performance records, and recruitment records.
• Supplier and service provider records: contracts, operator agreements and correspondence with our hosting, email, analytics and payment providers.
• Compliance records: our own POPIA record of processing activities, Information Officer registration, security policies, incident and breach records, and PAIA request register.
• Intellectual property and product records: source code, framework mappings, scoring models, designs and trade marks.
• Marketing records: website analytics, enquiries submitted through the site, and marketing consent records.

What we hold about a customer’s evidence

We do not hold our customers’ documents. The Platform reads evidence where it already lives, in the customer’s own Google Drive, SharePoint, OneDrive or Nextcloud, over a read-only connection. The document is not uploaded to us and no copy of it is kept. There is therefore no annual financial statement, board pack, policy, contract or other customer document here to ask us for.

What we do hold for each customer is:

• Metadata about a document: its name, where it is stored, its dates, and the record of which control it satisfied.
• Assessment data: answers given, governance scores, gaps, remediation tasks and their owners, deadlines, and the board reports generated from them.
• Account and audit records: users, roles, logins and the log of who did what on the Platform.

We hold all of it as an operator for the customer, not as its owner. A request for a customer organisation’s records, including the documents behind its evidence, is properly directed to that organisation and not to us.

Records held under other legislation

We also hold records in terms of, among others, the Companies Act 71 of 2008, the Income Tax Act 58 of 1962, the Value-Added Tax Act 89 of 1991, the Tax Administration Act 28 of 2011, the Basic Conditions of Employment Act 75 of 1997, the Labour Relations Act 66 of 1995, the Protection of Personal Information Act 4 of 2013 and the Electronic Communications and Transactions Act 25 of 2002. Those records are not automatically available and remain subject to a PAIA request.

How to request a record

1. Complete the prescribed request form for access to a record of a private body (Form 2 of the PAIA Regulations, 2021), available from the Regulator’s website.
2. Send it to the Information Officer at privacy@encircle.co.za.
3. Give enough detail to identify the record and to identify you, state the form of access you want, and give an address or email for our decision. If you are asking for the record in order to exercise or protect a right, say which right and how the record is required for it.
4. If you are acting on behalf of someone else, attach proof of your authority.

We will decide the request within 30 days of receiving it and tell you the decision, the fee payable and how to appeal it. The 30 days may be extended by up to a further 30 days where PAIA allows it, and we will tell you in writing if that happens.

Fees

PAIA allows a private body to charge a request fee and an access fee. We charge the fees prescribed in the PAIA Regulations, as amended from time to time, and no more. We will tell you what is payable before we process the request, and no record is released until the fee is paid. A request for your own personal information carries no request fee.

Grounds for refusal

A request may be refused on the grounds set out in Chapter 4 of PAIA, including the mandatory protection of another person’s personal information, the commercial information of a third party or of ourselves, information held in confidence, legally privileged records, and records that would prejudice research or the safety of a person. If we refuse, we will tell you in writing which provision we relied on and how to take the decision further.

If you are unhappy with our decision

There is no internal appeal against a decision of a private body. You may lodge a complaint with the Information Regulator on the prescribed form, or apply to a court for appropriate relief within 180 days.

The Information Regulator (South Africa)
JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001
PAIA complaints: PAIAComplaints@inforegulator.org.za
Website: inforegulator.org.za

Availability of this manual

This manual is available on this page, and on request from the Information Officer in printed form or by email. It is reviewed at least annually and whenever our records or contact details change.