South Africa
PAIA Manual
TABLE OF CONTENTS
- INTRODUCTION AND PURPOSE OF THIS MANUAL
- CONTACT DETAILS
- GUIDE IN TERMS OF SECTION 10 OF THE ACT
- NOTICE(S) IN TERMS OF SECTION 52(2) OF THE ACT
- INFORMATION / DOCUMENTS AVAILABLE IN ACCORDANCE WITH OTHER LEGISLATION .
- SUBJECTS AND CATEGORIES OF INFORMATION HELD BY PAYU
- AVAILABILITY OF THE MANUAL
- PROCEDURE FOR OBTAINING ACCESS TO INFORMATION
- PRESCRIBED FEES
- DESCRIPTION OF PERSONAL INFORMATION PROCESSING IN TERMS OF POPIA
- GROUNDS FOR REFUSAL
- REMEDIES AVAILABLE WHEN PAYU REFUSES A REQUEST FOR INFORMATION
Last updated July 2026
1. INTRODUCTION AND PURPOSE OF THIS MANUAL
- PayU is a private body conducting business as an online payments provider, as authorised by the payment system management body recognised by the South African Reserve Bank.
- The purpose of this manual is to assist requesters and potential requesters as to the procedure to be followed when requesting access to information / documents from PayU as contemplated in terms of the Act and to assist data subjects with understanding inter alia the types of personal information processed by PayU, the purpose of such processing, whether such personal information will be transferred outside the Republic and which security measures PayU applies to such personal information.
- The manual may be amended from time to time and, once amendments have been finalised, the latest version of the manual will be made available as required in terms of the Act.
- Any requester is advised to contact the Information Officer of PayU should they require any assistance in respect of the utilisation of this manual and / or the requesting of documents / information from PayU.
- The following words will bear the following meaning in this manual –
- “Act” – means the Promotion of Access to Information Act, No. 2 of 2000, as amended from time to time, together with all relevant regulations published;
- “Information Officer” – means the person described in 2.4 below
- “Information Regulator” – means the Information Regulator of South Africa;
- “manual” – means this manual as available from the offices of PayU or as made available online on the website of PayU (as the case may be) and to the Information Regulator from time to time upon request ;
- “POPIA” – means the Protection of Personal Information Act, No. 4 of 2013, as amended from time to time, together with all relevant regulations published;
- “requester” –means any person or entity requesting information / documents from PayU as contemplated in terms of the Act
- “Republic” – means the Republic of South Africa.
2. CONTACT DETAILS
- Name of private body: PayU Payment Solutions Proprietary Limited
- Head of private body: Ariel Shtilman
- Email of head of private body: [email protected]
- Designated Information Officer: Moran Bergman Morag
- E–mail of Information Officer: [email protected]
- Registered address of PayU: 3rd Floor Pier Place Heerengracht Street Cape Town 8001
- Postal address of PayU: 3rd Floor Pier Place Heerengracht Street 8001
- PayU Telephone: +27 285 0050
- Website of PayU: https://www.rapyd.net/
3. GUIDE IN TERMS OF SECTION 10 OF THE ACT
- A guide has been compiled by the Information Regulator in terms of section 10 of the Act and in accordance with POPIA. It contains information required by a person wishing to exercise a right contemplated by the Act.
- The guide is available for inspection, inter alia, at the offices of the Information Regulator at Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191 , on its website at https://inforegulator.org.za and on request from the Information Regulator during normal business hours in each of the official languages.
- Contact details of the Information Regulator:
| 3.3.1 | Physical Address: | Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191 |
| 3.4.2. | Postal Address: | P.O. Box 31533, Braamfontein, Johannesburg, 2017 |
| 3.3.2 | Telephone: | 010 023 5200 |
| 3.3.3 | Website: | https://inforegulator.org.za/ |
| 3.3.4 | E–mail: | [email protected] |
4. NOTICE(S) IN TERMS OF SECTION 52(2) OF THE ACT
At the time of writing no notice(s) has / have been published.
5. INFORMATION / DOCUMENTS AVAILABLE IN ACCORDANCE WITH OTHER LEGISLATION
PayU keeps information / documents in accordance with the following legislation. A requester may request information which is available in terms of the following legislation, provided that the requester complies with the requirements set out in such legislation, this manual and the Act.
- Companies Act 71 of 2008
- Income Tax Act 58 of 1962
- Value–Added Tax Act 89 of 1991
- Customs and Excise Act 91 of 1964
- Basic Conditions of Employment Act 75 of 1997
- Employment Equity Act 55 of 1998
- Compensation for Occupational Injuries and Diseases Act 130 of 1993
- Insolvency Act 24 of 1936
- Occupational Health and Safety Act 85 of 1993
- South African Reserve Bank Act 90 of 1989
- Labour relations Act 66 of 1995
- Skills Development Act 97 of 1998
- Skills Development Levies Act 9 of 1999
- Unemployment Insurance Act 63 of 2001
- Unemployment Insurance Contributions Act 4 of 2002
- Compensation for Occupational Injuries and Diseases Act 130 of 1993
- Copyright Act 98 of 1978
- Trade Marks Act 194 of 1993
- Arbitration Act 42 of 1965
- Consumer Protection Act 68 of 2008
- Electronic Communications and Transactions Act 25 of 2002
- Electronic Communications Act 13 of 2000
- Protection of Personal Information Act 4 of 2013 Note that this is not an exhaustive list.
6. SUBJECTS AND CATEGORIES OF INFORMATION HELD BY PAYU
- This section sets out the subject and categories of records held by PayU. The inclusion of any subject or category of records should not be taken as an indication that records falling within those subjects and/or categories will be made available under the Act. In particular, certain grounds of refusal set out in the Act and hereunder may be applicable to a request for such records
- The subjects and categories of records held by PayU are as follows.
| Subject | Category |
| Company records | Constitutional documents (including incorporation documents and the memorandum of incorporation)
Share registers, share certificates, registers and details concerning shareholder meetings and resolutions Details concerning the identity of directors, directors’ meetings, director resolutions Statutory registers and minute books |
| Financial records | Budget reports Bank records
Financial statements Management accounts Audit reports Insurance records Tax records |
| Strategic and operational information | Business plans Budget reports
Minutes of management meetings Minutes of board meetings Annual reports |
| Assets | Asset register Share certificates
Trade marks schedule Debtors information Bank account reconciliation |
| Liabilities | Loan agreements
General ledger |
| Information technology | Asset register
Repair and maintenance records Software programmes Software licences IT policies and procedures Software records |
| Compliance | B-BBEE compliance records
Proof of membership with industry bodies General policies and procedures |
| Human resources | Staff records
Contracts of employment Statutory records Training and skills development records Employment equity records Leave records Beneficiary records |
| HR policies and procedures Disciplinary procedures Salary information
Pension fund information Medical aid information |
|
| Contractual relationships | Leases
Contracts with clients Contracts with service providers |
| Website information (as noted at 2.9 above)
PayU has made available the following records that are automatically available without a person having to request access in terms of this Manual. |
PayU group of companies profile (including PayU group company strategy, values, vision, footprint, history, directors, country management)
Online payment solution overview (including product descriptions and payment partners) Secured merchant portal for online merchants that subscribe to PayU’s services A developer hub containing the information needed by developers to integrate with PayU to use PayU’s services How to contact PayU, PayU support and PayU’s FAQS Our payment terms and policies (including but not limited to website terms of use and product services, compliance statement, privacy portal containing privacy principles, privacy statement containing processing of personal information activities, cookie policy and preference centre regarding the use of cookies on the website and payment platform) PayU’s required certifications to operate (including but not limited to its Systems Operator certificate and third party payment provider certificate and attestation of compliance for PCI DSS Level 1) |
7. AVAILABILITY OF THE MANUAL
- This manual is available for inspection at the offices of PayU (as detailed in 2.6 above), free of charge, during normal business hours.
- This manual is also available for inspection on the website of PayU (as detailed in 2.9 above), free of charge.
8. PROCEDURE FOR OBTAINING ACCESS TO INFORMATION
- A request for access to information must be made in the prescribed form to the Information Officer. The prescribed form is available on the website of the Information Regulator at https://inforegulator.org.za/paia–forms/ or on request from the Information Officer.
- All required fields on the prescribed form must be completed in full and in a legible form. The form (as well as any additional pages attached thereto) must be signed by the person submitting the form.
- The requester must provide enough detail on the request form to enable the Information Officer to identify the record and the requester. The requester should also indicate which form (mode/method) of access is required. The requester should indicate if it requires notice of the decision of the Information Officer in any manner, other than in writing.
- Once the prescribed form has been submitted, the Information Officer will notify the requester of the prescribed fee (if any) payable before further processing the request.
- The requester must identify the right that is sought to be exercised or to be protected and provide an explanation of why the requested record is required for the exercise or protection of that right.
- If a request is made on behalf of another person, the requester must submit proof of the capacity in which the requester is making the request to the satisfaction of the Information Officer.
9. PRESCRIBED FEES
The following applies to requests:
- A requestor is required to pay the prescribed fees before a request will be processed.
- The Information Officer must by notice, require the requester to pay the prescribed fee, if any, before further processing the request.
- After the Information Officer has decided on the request, the requester must be notified in the required form.
- A requestor may lodge an application with a court against the tender/payment of the request fee and/or deposit.
- If the request is granted, a further access fee must be paid for the search, reproduction, preparation and for any time, in excess of the prescribed hours, required to search and prepare for the record disclosure.
- The fee structure is available from the website of the Information Regulator at https://inforegulator.org.za or on request from the Information Officer.
10. DESCRIPTION OF PERSONAL INFORMATION PROCESSING IN TERMS OF POPIA
- PayU processes personal information as follows:
| Subject | Category |
| Purpose of the processing | Sale of products and services
To market products and services to clients To comply with statutory obligations Customer relations purposes To conduct market research surveys Security, administrative and legal purposes To fulfil contractual obligations that we have with clients or third parties |
| Data subject categories and their personal information | Employees: record of employee life cycle
General public: general enquiries and viewing the company website Industry bodies: membership records Media: records of media interactions Service providers: record of service provider life cycle Clients: identity and account log-in information, contact information, financial information, payments information (transactional information) usage and technical information. |
| Recipients of personal information | Employee pension funds
Financial institutions Industry bodies |
| Law enforcement Medical aid schemes
Operators (service providers) Statutory authorities |
|
| Expected transnational transfer of personal information | Transfer of personal information to operators (service providers)
Transfer of personal information to other members in the group |
| Security measures to protect personal information | Physical security measures
|
For mre information on how we process personal information, please refer to our privacy statement available at https://southafrica.payu.com/privacy–statement–south–africa/
11. GROUNDS FOR REFUSAL
- We may have to refuse you access to certain records in terms of PAIA on the following basis:
- Mandatory protection of privacy of third party who is a natural person;
- Mandatory protection of the commercial information of a third party;
- Mandatory protection of confidential information of third parties if it is protected in terms of any agreement or legislation;
- Mandatory protection of the safety of individuals and the protection of property;
- Mandatory protection of records that would be regarded as privileged in legal proceedings;
- The research information of PayU or a third party, if its disclosure would disclose the identity of the institution, the researcher or the subject matter of the research and would place the research at a serious disadvantage; and
- Requests for information that are manifestly frivolous, or which involve an unreasonable diversion of resources.
- We will notify you in writing whether your request has been approved or denied within 30 calendar days after we have received a completed request for access form. If we cannot find any requested record or it does not exist, then we will notify you by way of affidavit or affirmation that it is not possible to give access to that particular record.
12. REMEDIES AVAILABLE WHEN PAYU REFUSES A REQUEST FOR INFORMATION
- If your request for access to information is denied, you may:
- apply to a court with appropriate jurisdiction, or
- lodge a complaint with the Information Regulator, for the necessary relief.