PAIA Manual

Digidan (Pty) Ltd (registration number 2017/184017/07) is a private company incorporated in the Republic of South Africa. It trades as DeploySeal and operates the DeploySeal service at deployseal.com, a hosted tool with which teams review websites before a release, capture issues with evidence, and seal a signed release record.

This manual is published under section 51 of the Promotion of Access to Information Act 2 of 2000 (“PAIA”), as amended by the Protection of Personal Information Act 4 of 2013 (“POPIA”), and follows the Information Regulator’s guidance on the form of a manual for a private body. It was first published on 11 October 2026 and is reviewed when the company’s records or processing change.

The Information Regulator publishes a guide, in each official language, on how to use PAIA and how to exercise the rights it gives. The guide is available from the Regulator free of charge at inforegulator.org.za, by email to inforeg@justice.gov.za, and at its offices: JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001. We will also point anyone who asks us to it.

Records we keep because another law requires it, and which that law may entitle a person to request, include records under:

• the Companies Act 71 of 2008 (incorporation documents, registers, financial records);
• the Income Tax Act 58 of 1962, the Value-Added Tax Act 89 of 1991 and the Tax Administration Act 28 of 2011;
• the Electronic Communications and Transactions Act 25 of 2002 (the information in section 18 of our terms of service);
• the Protection of Personal Information Act 4 of 2013 (the records in sections 7 and 8 below);
• the Consumer Protection Act 68 of 2008, where it applies to a transaction.

Under section 52(2) of PAIA, these records are available to anyone automatically, on this website, without a request or fee:

• The privacy policy, terms of service, data processing agreement and refund policy.
• This manual.
• Product documentation at deployseal.com/docs, including the public API and webhook references.
• The live service status page at deployseal.com/status.
• The sample sealed report, which shows what a release record contains.
• Pricing at deployseal.com/pricing.

Product records belong to the customer organisation that created them. We hold them as that organisation’s operator under the data processing agreement, and a request for them is normally answered by directing the requester to that organisation, as section 9 explains.

Purpose. We process personal information to run the DeploySeal service: creating and securing accounts, running website reviews, recording issues and the evidence for them, producing signed release records, sending transactional email, keeping an audit trail, keeping the service secure, answering enquiries, and meeting legal obligations. The privacy policy describes each purpose in full.

Categories of data subjects and of personal information.

Recipients. The sub-processors listed below, each bound by contract; the issue trackers, chat tools and webhook endpoints a customer chooses to connect, on that customer’s instruction; sign-in providers a user chooses (Google, Microsoft); and authorities where the law requires.

Cross-border flows. Primary processing is in South Africa. Flows to the sub-processors outside South Africa are made under section 72(1)(a) of POPIA, each recipient being bound by contract to a standard of protection substantially similar to POPIA. The data processing agreement adds the EU Standard Contractual Clauses on request.

Security measures. TLS for all traffic; encryption at rest; AES-256-GCM for stored secrets; passwords and tokens stored as hashes; signed digests for sealed records held in Azure Key Vault; per-organisation isolation at the data-access layer; role-based access; two-factor authentication for operations tools; dependency and image scanning; retention schedules with automatic deletion; daily backups. Annex 3 of the data processing agreement lists them.

This manual is available free of charge on this website at deployseal.com/paia, and at our registered address on request. A copy has been provided to the Information Regulator. It is published in English; a request for it in another official language will be met where reasonably possible.

1. Use the prescribed form. Complete Form 02 (Request for access to record) from the Regulator’s website. Say which record you want, in enough detail for us to find it, which right you are exercising or protecting and why the record is needed for it, how you would like to receive it, and how we should contact you.
2. Send it to the Information Officer at desk@deployseal.com or to our registered address.
3. Pay the request fee if we ask for one. A request fee of R140.00 is payable before the request is processed, except by a person requesting their own personal information, who pays no request fee. Where search and preparation would exceed six hours, a deposit of one third of the estimated fee may be required.
4. We will decide on the request within 30 days of receiving it, and may extend that period once by up to 30 days where PAIA allows; we tell you in writing if we do. The decision states any access fee due and the form in which the record will be given.
5. If we refuse, we will say which ground in Chapter 4 of Part 3 of PAIA applies. Common grounds are the protection of another person’s privacy, of commercial information of a third party, of legal privilege, and of records a customer organisation holds as responsible party, which we are not entitled to disclose on its behalf.

Access fees, as prescribed by the PAIA Regulations, 2021, and charged only for reproducing a record:

Records a customer holds. Issues, evidence and sealed records belong to the organisation that created them. If you are a tester, signer or team member of such an organisation, ask it first; it can give you the record directly. If you ask us, we will forward the request to that organisation within five business days and tell you we have done so.

Your own personal information. You do not need a PAIA request. Email us and we will tell you what we hold, correct it, or delete it within 30 days, as the privacy policy sets out.

There is no internal appeal against a private body’s decision. If you are unhappy with our decision, or we do not answer in time, you may lodge a complaint with the Information Regulator (Form 05) within 180 days, or apply to a court. The Regulator can be reached at inforegulator.org.za, PAIAComplaints@inforegulator.org.za, or JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001.

The Information Officer reviews this manual at least once a year, when the company’s records or processing change, and when the Regulator’s requirements change. The date at the top shows the current version.