This manual is published by 3cits (Pty) Ltd under section 51 of the Promotion of Access to Information Act 2 of 2000 (PAIA), as amended by the Protection of Personal Information Act 4 of 2013 (POPIA). It follows the structure recommended by the Information Regulator for private bodies.
1. Acronyms and abbreviations
| Term | Meaning |
|---|---|
| 3cits, the company | 3cits (Pty) Ltd, trading as 3cits Consulting (3 Coconuts IT Solutions) |
| IO | Information Officer |
| Minister | Minister of Justice and Correctional Services |
| PAIA | Promotion of Access to Information Act 2 of 2000 |
| POPIA | Protection of Personal Information Act 4 of 2013 |
| Regulator | Information Regulator (South Africa) |
| Republic | Republic of South Africa |
2. Purpose of this manual
This manual is useful to the public to:
- check the categories of records held by 3cits that are available without a person having to submit a formal PAIA request;
- understand how to request access to a record of 3cits, by giving a description of the subjects on which we hold records and the categories of records held on each subject;
- know the description of the records available under other legislation;
- access the contact details of the Information Officer, who will assist the public with the records they intend to access;
- know the description of the guide on how to use PAIA, as updated by the Regulator, and how to obtain access to it;
- know whether 3cits processes personal information, the purpose of the processing and the categories of data subjects and personal information concerned;
- know the recipients or categories of recipients to whom personal information may be supplied;
- know whether 3cits plans to transfer or process personal information outside the Republic, and the recipients concerned; and
- know whether 3cits has appropriate security measures to ensure the confidentiality, integrity and availability of the personal information it processes.
3. Company and contact details
| Name of private body | 3cits (Pty) Ltd, trading as 3cits Consulting (3 Coconuts IT Solutions) |
| Registration number | 2008/140553/23 |
| Head of the private body and Information Officer | The Information Officer of 3cits (Pty) Ltd |
| info@3cits.co.za (use the subject "PAIA request" or "POPIA request") | |
| Telephone | 087 898 7801 |
| Physical address | 35 Fifth Road, Sonneglans, Gauteng, 2158, South Africa |
| Postal address | P.O. Box 1218, Ferndale, 2160, South Africa |
| Website | www.3cits.co.za |
No Deputy Information Officer has been designated. All requests should be addressed to the Information Officer.
4. Guide on how to use PAIA
The Regulator has, under section 10(1) of PAIA, updated and made available the revised Guide on how to use PAIA (the Guide), in an easily comprehensible form and manner, as may reasonably be required by a person who wishes to exercise any right in terms of PAIA and POPIA.
The Guide describes, among other things, the objects of PAIA and POPIA; the contact details of the Information Officer of every public body; the manner and form of a request for access to a record; the assistance available from the Regulator; all remedies available in law for an act or failure to act in respect of a right or duty under PAIA and POPIA; the provisions of PAIA on prescribed fees; and the regulations made under PAIA.
The Guide is available:
- on the Regulator's website at inforegulator.org.za; and
- for public inspection at our office during normal business hours (address in section 3), on request to the Information Officer.
5. Records available without a request
The following records are available without a person having to request access under PAIA. No notice under section 52(2) of PAIA has been published.
| Category | Records | Available |
|---|---|---|
| Public information | Website content, our Privacy Notice, Website Terms of Use, Cookie Notice, Company Information, Responsible Disclosure policy and this manual | Freely on www.3cits.co.za |
| Marketing material | Company profile and service descriptions | Free of charge, on request by email |
| Statutory company information | Information that is publicly available from the Companies and Intellectual Property Commission (CIPC) | From CIPC, subject to its fees |
6. Records held under other legislation
3cits keeps records in accordance with the following legislation, as it applies to the company. Some of these records may be available only to the persons or bodies specified in that legislation.
- Basic Conditions of Employment Act 75 of 1997
- Companies Act 71 of 2008
- Compensation for Occupational Injuries and Diseases Act 130 of 1993
- Consumer Protection Act 68 of 2008
- Cybercrimes Act 19 of 2020
- Electronic Communications and Transactions Act 25 of 2002
- Employment Equity Act 55 of 1998
- Income Tax Act 58 of 1962
- Labour Relations Act 66 of 1995
- Occupational Health and Safety Act 85 of 1993
- Promotion of Access to Information Act 2 of 2000
- Protection of Personal Information Act 4 of 2013
- Skills Development Levies Act 9 of 1999
- Tax Administration Act 28 of 2011
- Unemployment Insurance Act 63 of 2001 and Unemployment Insurance Contributions Act 4 of 2002
3cits is not registered for value-added tax.
7. Subjects and categories of records held
| Subject | Categories of records |
|---|---|
| Company and statutory | Memorandum of Incorporation, CIPC registration documents, share register, director records, resolutions and minutes |
| Finance and accounting | Accounting records, ledgers, invoices, quotations, receipts, bank statements, management accounts and annual financial statements |
| Tax | Income tax returns and assessments, provisional tax and employer tax records, correspondence with the South African Revenue Service |
| Human resources | Employment contracts, payroll and leave records, job applications and CVs, policies, disciplinary and grievance records, training records |
| Clients | Proposals, quotations, engagement letters and contracts, statements of work, data processing agreements, project documentation, correspondence and deliverables |
| Suppliers and contractors | Supplier and contractor agreements, invoices, operator agreements and correspondence |
| Information technology | System and account records, software licences, source code, security, access and incident records |
| Legal and compliance | Policies, POPIA processing register, PAIA and POPIA request logs, incident register, insurance records, legal correspondence |
| Marketing and website | Website content, marketing material, marketing consents and opt-out records |
The listing of a category or subject does not mean that a record will be released. Every request is evaluated under PAIA and may be refused on the grounds in section 9.
8. How to request access
- Complete the prescribed request form, Form 2 of the PAIA Regulations, 2021 ("Request for access to record"). It is available from the Regulator's website, or from our Information Officer on request.
- Send the completed form to the Information Officer by email to info@3cits.co.za with the subject "PAIA request", or deliver it to the address in section 3.
- Give enough detail to enable the Information Officer to identify the record and you, state the form of access you want, give an email or postal address for our reply, and identify the right you want to exercise or protect and explain why the record is required to exercise or protect that right (section 53 of PAIA).
- If you are requesting on behalf of another person, state the capacity in which you make the request and attach proof of your authority.
- Pay the request fee, if it applies (section 10), and send proof of payment. We will tell you how to pay.
A person who cannot read or write, or who has a disability, may make the request orally. The Information Officer will complete the form on that person's behalf and give them a copy.
Timelines. We will decide on your request within 30 days of receiving it and notify you of the outcome on Form 3 of the PAIA Regulations, 2021. We may extend this period once, by up to 30 days, in the circumstances set out in section 57 of PAIA, and will tell you if we do. If we do not respond within the required period, the request is regarded as refused (section 58).
Third parties. If a request concerns a record containing information about a third party, we will take all reasonable steps to inform that third party and give them an opportunity to make representations before we decide (sections 71 to 73 of PAIA).
9. Grounds for refusal
Access may be refused on the grounds set out in Chapter 4 of Part 3 of PAIA, including where disclosure would:
- involve the unreasonable disclosure of personal information about a third party who is a natural person (section 63);
- disclose trade secrets or financial, commercial, scientific or technical information of a third party, or information supplied in confidence by a third party (sections 64 and 65);
- endanger the life or physical safety of an individual, or the security of property (section 66);
- disclose a record that is privileged from production in legal proceedings (section 67);
- disclose trade secrets of 3cits, or financial, commercial, scientific or technical information whose disclosure would be likely to cause harm to the commercial or financial interests of 3cits (section 68); or
- disclose research information of 3cits or a third party where disclosure would expose the researcher or the subject matter to serious disadvantage (section 69).
Despite these grounds, access must be granted where section 70 of PAIA (mandatory disclosure in the public interest) applies.
10. Fees
The fees below are prescribed in Annexure B of the PAIA Regulations, 2021, and are subject to change by the Minister. Where the Regulations change, the amounts in the Regulations apply. 3cits is not registered for VAT, so no VAT is added.
| Item | Fee |
|---|---|
| Request fee (not payable by a requester asking for their own personal information) | R140.00 |
| Copy of this manual, per A4 page (photocopy or printed) | R2.00 |
| Photocopy or printed copy of a record, per A4 page | R2.00 |
| Copy on a flash drive supplied by the requester | R40.00 |
| Copy on a compact disc supplied by the requester / supplied by 3cits | R40.00 / R60.00 |
| Transcription of an audio record, per A4 page | R24.00 |
| Copy of an audio record, on a flash drive or compact disc supplied by the requester / by 3cits | R40.00 / R60.00 |
| Transcription or copy of visual images | Service outsourced; cost as quoted by the service provider |
| Search for and preparation of a record, for each hour or part of an hour after the first hour, up to a maximum of R435.00 | R145.00 |
| Postage, email or other electronic transfer | Actual cost |
Deposit. If the search for and preparation of the record will take more than six hours, we may ask you to pay a deposit of one third of the access fee before we start. The deposit is refunded if access is refused.
Access fee. If access is granted, you must pay the access fee for the reproduction, search and preparation of the record before we give you access. Copies of this manual on www.3cits.co.za are free.
11. Remedies
3cits is a private body and has no internal appeal procedure. If you are not satisfied with our decision, or with a fee or an extension of time, you may:
- lodge a complaint with the Regulator within 180 days of the decision (section 77A of PAIA), using the PAIA complaint form on the Regulator's website or by email to PAIAComplaints@inforegulator.org.za; or
- apply to a court with appropriate jurisdiction within 180 days for appropriate relief (sections 78 and 82 of PAIA).
12. Processing of personal information
12.1 Purpose of processing
3cits processes personal information to:
- respond to enquiries and prepare proposals and quotations;
- conclude and perform contracts with clients, suppliers and contractors;
- deliver technology consulting, fractional CTO and CIO services, AI, cloud, data, fintech and debt management solutions, IT support, CRM, helpdesk and contact centre set-up, business development and startup investor-readiness support;
- invoice, keep accounting records and meet tax, company and labour law obligations;
- recruit, employ and manage staff and contractors;
- secure our website, accounts and systems;
- market our services where the law allows; and
- establish, exercise or defend legal rights.
When we process personal information on behalf of a client, we do so as the client's operator, only for the purpose of the engagement and under a written agreement.
12.2 Categories of data subjects and personal information
| Data subjects | Personal information |
|---|---|
| Clients and prospective clients (contact persons at organisations, and individual clients) | Name, job title, organisation, email address, telephone number, correspondence, contract and billing information |
| Suppliers, service providers and contractors | Name, contact details, company details, contract information, identity, tax and payment details required by law or contract |
| Employees and job applicants | Name, contact details, identity number, CV, qualifications, references, employment contract, remuneration, tax and payment details, leave and performance records |
| Website visitors and correspondents | Name, email address, telephone number and the content of correspondence. Website hosting and font delivery involve IP addresses received by GitHub and Google |
| Individuals whose personal information clients entrust to us as operator | As determined by the client and the engagement, processed only on the client's instructions |
12.3 Recipients of personal information
- Operators that process information for 3cits under written terms: Google Workspace (email and documents), Zoho Books (accounting and invoicing), ClickUp (project management) and GitHub (website hosting and source code).
- Professional advisers, including accountants, auditors and attorneys.
- Specialist contractors working on client engagements, under written agreements.
- Statutory and regulatory bodies where required by law, such as the South African Revenue Service, CIPC, the Department of Employment and Labour and the Regulator.
- Clients, in respect of information processed for them as operator.
12.4 Planned transborder flows
Our operators store and process information on servers that may be located outside the Republic, including in the United States and the European Union. 3cits transfers personal information outside the Republic only in accordance with section 72 of POPIA: where the recipient is subject to a law, binding corporate rules or a binding agreement that provides an adequate level of protection; where the transfer is necessary to perform a contract with the data subject or in their interest; or where the data subject consents.
12.5 Security measures
3cits applies appropriate, reasonable technical and organisational measures under section 19 of POPIA, including:
- multi-factor authentication and role-based access to business systems;
- encryption in transit and at rest provided by our cloud service providers;
- device security, including screen locks, disk encryption and regular software updates;
- written confidentiality and security terms with operators and contractors (sections 20 and 21 of POPIA);
- a preference for working inside clients' own environments, and use of masked or de-identified data for development and testing;
- a record retention and destruction schedule; and
- an incident response and security compromise notification procedure (section 22 of POPIA).
13. Availability of this manual
This manual is available:
- on our website at www.3cits.co.za/paia-manual.html;
- at our office (address in section 3) for public inspection during normal business hours; and
- from the Regulator, on request.
A printed copy is available on request, subject to the fee in section 10.
14. Updating this manual
The head of 3cits will update this manual when material changes occur, and review it at least once a year. The date at the top of the page shows when it was last updated.
Issued by the Information Officer, 3cits (Pty) Ltd.