Whisprr

Legal

PAIA Manual

Version
1.0
Effective
Not yet effective

Private staging candidate — not yet effective or published.

Prepared under section 51 of the Promotion of Access to Information Act 2 of 2000, as amended

Registration number: 2026/405640/07

Date compiled: 28 September 2026

Version: 1.0

Contents

  1. Acronyms and definitions
  2. Purpose
  3. Company and Information Officer details
  4. The Information Regulator's PAIA Guide
  5. Records available without a formal request
  6. Records held under other legislation
  7. Subjects and categories of records held
  8. How to request a record
  9. Decision, fees and access
  10. Refusal and remedies
  11. Processing of personal information
  12. Availability, language and updates

1. Acronyms and definitions

  • DIO — Deputy Information Officer.
  • IO — Information Officer.
  • PAIA — Promotion of Access to Information Act 2 of 2000, as amended.
  • POPIA — Protection of Personal Information Act 4 of 2013.
  • Regulator — Information Regulator (South Africa).
  • Whisprr — Whisprr (Pty) Ltd.

Terms defined in PAIA or POPIA carry their statutory meanings.

2. Purpose

This Manual helps a requester understand:

a. Whisprr's contact details and records;

b. which records may be available without a formal request;

c. how to request access under PAIA;

d. applicable forms, fees, grounds of refusal and remedies;

e. where to obtain the Regulator's Guide; and

f. Whisprr's principal personal-information processing and safeguards.

Access remains subject to PAIA's requirements and lawful grounds of refusal. Publication of a category does not mean every record in it exists or must be disclosed.

3. Company and Information Officer details

Private body: Whisprr (Pty) Ltd

Registration: 2026/405640/07

Information Officer and head of private body: Jordan Albertyn

Information Officer status: Formally registered for Whisprr

Deputy Information Officer: None designated as at the compilation date

Email for PAIA and privacy requests: jordan@whisprr.co.za

Physical and postal address: 24 Woods Crescent, Eagle Canyon, Honeydew, Johannesburg, Gauteng 2170, South Africa

Website: https://whisprr.co.za

The same contact channel applies to a request for assistance with the prescribed form or an accessible copy of this Manual.

4. The Information Regulator's PAIA Guide

The Regulator has published the Guide contemplated in section 10 of PAIA. It explains how to exercise PAIA and POPIA rights, the assistance available, applicable forms and fees, and remedies.

The Guide is available in each official language and in Braille from the Information Regulator. Current electronic copies, PAIA forms and contact details are available at:

A requester may ask Whisprr's Information Officer for reasonable assistance in locating the Guide.

5. Records available without a formal request

The following may be available without Form 2, subject to law, confidentiality, security and the rights of others:

| Category | Typical availability |

|---|---|

| Company identity and contact information | Website or on request |

| Published legal documents, including Terms, Privacy Policy, Data Processing Terms, Acceptable Use Policy and this Manual | Website once effective |

| Public product, plan and sales information | Website or sales material |

| Customer's own current account, Order, invoices, acceptance records and tenant-scoped export | Authenticated dashboard or verified request, where available |

| Public notices, guides and support material | Website or on request |

A request for another person's information, security-sensitive information, confidential commercial information or a historical/internal record ordinarily requires the formal process and may be refused on a lawful ground.

Whisprr has not designated additional categories for automatic availability under section 52 of PAIA as at the compilation date.

6. Records held under other legislation

Whisprr may create or retain records under legislation including, where applicable:

  • Companies Act 71 of 2008;
  • Income Tax Act 58 of 1962;
  • Tax Administration Act 28 of 2011;
  • Value-Added Tax Act 89 of 1991;
  • Basic Conditions of Employment Act 75 of 1997;
  • Labour Relations Act 66 of 1995;
  • Employment Equity Act 55 of 1998;
  • Unemployment Insurance Act 63 of 2001;
  • Compensation for Occupational Injuries and Diseases Act 130 of 1993;
  • Electronic Communications and Transactions Act 25 of 2002;
  • Consumer Protection Act 68 of 2008;
  • Protection of Personal Information Act 4 of 2013;
  • Promotion of Access to Information Act 2 of 2000; and
  • Copyright Act 98 of 1978.

This list is indicative, not a representation that every statute applies to every activity or that Whisprr holds every possible record.

7. Subjects and categories of records held

Whisprr may hold the following records, subject to actual operations and lawful retention:

7.1 Corporate and governance

Incorporation, ownership, resolutions, statutory registers, policies, risk, compliance, insurance and professional-adviser records.

7.2 Finance and tax

Accounting records, management accounts, bank and payment-provider records, invoices, receipts, budgets, tax and statutory filings, and audit trails. Whisprr is not currently registered as a VAT vendor.

7.3 Customers and commercial relationships

Enquiries, proposals, due diligence, agreements, Orders, pricing and catalogue versions, acceptance and authority evidence, subscription and Credit records, payment status, support, complaints, renewals, cancellations and account correspondence.

7.4 Product, service and customer data

Account and user data, approved knowledge, messaging and conversation content, contact and channel identifiers, AI-assisted outputs, classifications, routing, escalation and human-takeover records, delivery metadata, tenant-scoped exports, diagnostics and product-usage records.

7.5 Technology, security and operations

System architecture, source code, configurations, database and infrastructure records, credentials, logs, backup and recovery records, incident and vulnerability records, access-control reviews, testing, change management, provider assessments and business-continuity material. Disclosure is subject to mandatory security, confidentiality and intellectual-property protections.

7.6 Providers and partners

Contracts, data-processing terms, private provider and subprocessor register, due diligence, service performance, billing, support and compliance records for cloud/database infrastructure, workflow automation, AI processing, dashboard/frontend infrastructure, business email/productivity, messaging/Meta and payment processing.

7.7 Personnel and applicants

Recruitment, identity, qualifications, contracts, remuneration, leave, performance, training, disciplinary, tax, benefits, access and separation records, if and when applicable.

7.8 Legal, regulatory and information requests

Legal advice, disputes, claims, law-enforcement and regulator correspondence, PAIA and POPIA requests, complaints, consent and objection evidence, litigation holds and records of compliance.

7.9 Intellectual property and marketing

Brands, domains, copyright material, designs, licences, product documentation, research, campaigns, sales content, public communications and feedback.

8. How to request a record

8.1 Complete the current prescribed Form 2 — Request for Access to Record and submit it to the Information Officer at jordan@whisprr.co.za. The current form is available from the Regulator's PAIA forms page.

8.2 A request should:

a. identify the requested record with enough detail to locate it;

b. identify the requester and provide reasonable proof of identity;

c. if made for another person, prove authority to act;

d. state the form and manner of access requested;

e. provide contact details for notices;

f. identify the right the requester seeks to exercise or protect and explain why the record is required for that purpose; and

g. state whether the requester needs assistance because of disability, language or another accessibility need.

8.3 Whisprr will assist a requester as PAIA requires and may ask for reasonable clarification. Identity and authority evidence will be used only to administer and secure the request.

8.4 A POPIA data-subject request that does not require PAIA may use the applicable POPIA prescribed form or a substantially similar request where law permits. The Information Officer will route the request appropriately rather than reject it solely for an incorrect label.

9. Decision, fees and access

9.1 Whisprr will decide and notify the requester within the period prescribed by PAIA, ordinarily 30 days after a compliant request, subject to a lawful extension. A notice will explain an extension where one is used.

9.2 The prescribed request fee, access fee, search and preparation deposit may apply. Personal requesters are exempt from the request fee where PAIA provides. Whisprr will issue the prescribed fee notice and will not charge more than the current statutory tariffs. Payment of a required fee may be required before further processing or access.

9.3 Access will be given in the requested form if reasonably possible and lawful. Whisprr may sever protected material and provide the remainder. If a record cannot be found or does not exist, the Information Officer will provide the affidavit or affirmation required by PAIA.

10. Refusal and remedies

10.1 PAIA permits or requires refusal in circumstances including unreasonable disclosure of a third party's personal information; commercial confidentiality; privileged records; safety or security risks; protection of research; and information whose disclosure would infringe copyright or another protected interest. Whisprr will apply the statute to the particular record and consider severability and any applicable public-interest override.

10.2 The decision notice will state the principal reasons, excluding information that would reveal the protected content, and the available remedy.

10.3 PAIA does not provide a compulsory internal appeal against a private body's decision. A requester may lodge a complaint with the Information Regulator using the current prescribed complaint form, ordinarily after the private body's decision or deemed refusal and within the statutory period, or may apply to a competent court as PAIA permits. Current instructions and forms are available from the Regulator's PAIA page.

11. Processing of personal information

11.1 Purposes

Whisprr processes personal information to evaluate and contract with customers; onboard and administer accounts; provide AI-assisted customer communication, routing, escalation, dashboard and support services; administer payments, subscriptions and Credits; secure, troubleshoot and improve the Service; communicate service and lawful marketing messages; manage providers and personnel; and comply with legal, accounting and regulatory duties.

11.2 Categories of data subjects and information

| Data subjects | Principal categories |

|---|---|

| Customers, prospects and representatives | Identity, business contact, authority, Order, correspondence, billing, support and acceptance records |

| Authorised users | Identity, contact, role, account, authentication, usage, audit and support records |

| Customers' contacts | Contact and channel identifiers, conversations and media, preferences, enquiries, classifications, AI output, routing, escalation and delivery metadata |

| Providers and advisers | Identity, contact, contract, due-diligence, billing, access and support records |

| Personnel and applicants | Identity, contact, application, employment, remuneration, tax, performance, access and statutory records, where applicable |

| Website and service users | Device, browser, IP, session, security, diagnostic and limited platform-insight information |

| Requesters and complainants | Identity, authority, request, correspondence, evidence and outcome records |

11.3 Recipients

Information may be disclosed to the relevant customer and authorised users; providers supporting cloud and database infrastructure, workflow automation, AI processing, dashboard/frontend infrastructure, business email/productivity, messaging/Meta, payment processing, security and support; professional advisers; a lawful business successor; and courts, regulators or public bodies where required or permitted.

Whisprr maintains a private provider/subprocessor register. Provider-specific disclosure is made where legally or contractually appropriate without gratuitously exposing security-sensitive architecture or know-how.

11.4 Cross-border processing

Some providers or support personnel may process information outside South Africa. Whisprr uses contractual or other lawful safeguards intended to satisfy section 72 of POPIA and assesses the relevant location, recipient and protection. Exact locations may depend on provider region and customer configuration.

11.5 Security measures

Reasonable measures include, where appropriate, tenant separation and access controls, least privilege, authentication controls, encryption in transit and at rest where supported, logging, backup and recovery, provider due diligence, secure change management, vulnerability management, incident procedures and periodic control review. No measure guarantees absolute security.

11.6 Retention

Customers may request an available tenant-scoped export during service and for 30 days after termination; this does not extend deletion. Subject to lawful exceptions and active-service needs, identifiable customer data in active systems is deleted or irreversibly de-identified as soon as reasonably practicable and no later than 60 days after termination or a valid deletion request. Protected backup copies expire under their normal lifecycle and are not used for ordinary processing. Genuinely de-identified development data may be kept for 24 months, then deleted or further aggregated; irreversible aggregate data may be kept longer. Legal, accounting, payment, security and dispute records may remain for their lawful periods.

Further detail appears in Whisprr's Privacy Policy and Data Processing Terms.

12. Availability, language and updates

12.1 Once approved and published, this Manual will be available without charge on Whisprr's website and from the Information Officer. A reasonable reproduction or delivery charge may apply to a non-electronic copy where law permits.

12.2 This Manual is currently available in English. The Information Officer will provide reasonable assistance to a requester who needs help because of language, literacy or disability and will consider an accessible format request. The Regulator's statutory Guide is available in all official languages and Braille.

12.3 The Information Officer will review this Manual periodically and update it when there is a material change to the contact details, records, processing or law. Superseded versions will be retained where required for accountability.

Information Officer: Jordan Albertyn

Email: jordan@whisprr.co.za

Address: 24 Woods Crescent, Eagle Canyon, Honeydew, Johannesburg, Gauteng 2170, South Africa