Effective date: 13 November 2026 · Version 1.0
PAIA manual of Dinnative Technologies (Pty) Ltd, registration number 2017/280514/07. Prepared in terms of section 51 of the Promotion of Access to Information Act 2 of 2000 (as amended).
Date of compilation: 13 November 2026. Date of last revision: 13 November 2026.
1. List of acronyms and abbreviations
| Term | Meaning |
|---|---|
| B-BBEE | Broad-Based Black Economic Empowerment |
| CEO | Chief Executive Officer |
| Dinnative, we, us | Dinnative Technologies (Pty) Ltd |
| DIO | Deputy Information Officer |
| Guide | The Guide on how to use PAIA, published by the Regulator under section 10 of PAIA |
| IO | Information Officer |
| Manual | This PAIA manual |
| PAIA | Promotion of Access to Information Act 2 of 2000 |
| POPIA | Protection of Personal Information Act 4 of 2013 |
| Regulations | Regulations relating to the Promotion of Access to Information, 2021 (Government Notice R757 of 27 August 2021) |
| Regulator | The Information Regulator of South Africa |
| Republic | The Republic of South Africa |
2. Purpose of this manual
Dinnative is a private body for the purposes of PAIA. This manual is useful to the public because it helps you to:
- check the categories of records we hold that are available without a formal PAIA request;
- understand how to make a request for access to a record, through a description of the subjects on which we hold records and the categories of records held on each subject;
- know which of our records are available under other legislation;
- find the contact details of our Information Officer;
- find the Regulator’s Guide on how to use PAIA, and learn how to get it;
- know whether we process personal information, why, and about whom, as well as the recipients of that information, any planned transfers outside the Republic, and a general description of the security measures we use.
3. Key contact details
3.1 Head of the private body and Information Officer
Our Chief Executive Officer is the head of the private body and is also our Information Officer. Requests for access to records are made to the Information Officer.
| Name | Refilwe Lediga |
|---|---|
| Position | Chief Executive Officer (head of the private body) and Information Officer |
| Telephone | +27 82 346 2417 |
| [email protected] |
3.2 Deputy Information Officer
We have not designated a Deputy Information Officer. Please send all requests to the Information Officer.
3.3 General contact details
| Company | Dinnative Technologies (Pty) Ltd, registration number 2017/280514/07 |
|---|---|
| Physical address (principal place of business) | 74 Montrose Avenue, Northgate, Randburg, 2162, South Africa |
| Postal address | 74 Montrose Avenue, Northgate, Randburg, 2162, South Africa |
| Telephone | +27 82 346 2417 |
| General email | [email protected] |
| Website | https://dinnative.co.za |
4. The Guide on how to use PAIA, and how to obtain it
The Regulator has, under section 10 of PAIA, updated and published a Guide on how to use PAIA. It is written in an easily understandable form for anyone who wishes to exercise a right under PAIA or POPIA. The Guide describes, among other things:
- the objects of PAIA and POPIA;
- the contact details of the Information Officers and Deputy Information Officers of public and private bodies;
- the manner and form of a request to a public body and to a private body;
- the assistance available from the Regulator;
- the remedies available when a body acts, or fails to act, in respect of a right or duty under PAIA or POPIA, including how to lodge a complaint with the Regulator or apply to a court;
- the duty on public and private bodies to compile a manual, and how to get one;
- the voluntary disclosure of categories of records by public and private bodies;
- the notices about fees to be paid for requests for access; and
- the regulations made under section 92 of PAIA.
Where to get the Guide
- From the Regulator’s website: inforegulator.org.za/paia-guidelines. The English Guide is at inforegulator.org.za/wp-content/uploads/2020/07/PAIA-Guide-English_20210905.pdf.
- On request to our Information Officer, using the contact details in section 3.
- For inspection or copying at our principal place of business during normal business hours, and at the Regulator’s office.
Languages
The Regulator’s template states that the Guide is available in each of the official languages and in braille. The Regulator’s website offers the Guide in English, Afrikaans, isiNdebele, isiXhosa, isiZulu, Siswati, Sepedi, Sesotho, Setswana, Tshivenda and Xitsonga. A copy of the English Guide is available for public inspection at our principal place of business during normal business hours.
The Regulator’s contact details
| Physical address | Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191 |
|---|---|
| Postal address | P.O. Box 31533, Braamfontein, Johannesburg, 2017 |
| Telephone | 010 023 5200 (toll free 0800 017 160) |
| General enquiries | [email protected] |
| PAIA complaints | [email protected] |
| POPIA complaints | [email protected] or the Regulator’s eServices portal, eservices.inforegulator.org.za/complaints |
| Website | inforegulator.org.za |
5. Records available without a request
The records below are available without a formal PAIA request. This does not stop us from refusing access to other records on the grounds in PAIA, and it does not limit anyone’s right to make a request.
| Category of records | Types of record | On our website | On request |
|---|---|---|---|
| Website content | Descriptions of our services, case studies, company information and contact details at dinnative.co.za | Yes | Yes |
| Product information | Public information about MemberSavi (membersavi.com) and CareSavi (caresavi.com), as published on those sites | Yes (on the product sites) | Yes |
| Legal and compliance notices | Privacy policy (dinnative.co.za/privacy-policy/), terms of use, and this PAIA manual, in web page and PDF form; the CareSavi privacy notice (caresavi.com/privacy) | Yes | Yes |
| Marketing material | Material that we have made public, such as brochures | Where published | Yes |
You can ask for these records by email to [email protected] or by telephone. A charge may apply to a printed copy of this manual (see section 10).
6. Records available under other legislation
We keep records that the following legislation requires or permits, and which may be available under that legislation. We list only the Acts that apply to a South African private company that builds and operates software and employs staff.
| Category of records | Applicable legislation |
|---|---|
| Memorandum of incorporation, company registers, annual returns, director and shareholder records, financial statements | Companies Act 71 of 2008 |
| Income tax records, returns and assessments; employees’ tax (PAYE) | Income Tax Act 58 of 1962; Tax Administration Act 28 of 2011 |
| VAT invoices, returns and registration records | Value-Added Tax Act 89 of 1991 |
| Employment contracts, working-time, leave and remuneration records | Basic Conditions of Employment Act 75 of 1997 |
| Disciplinary, grievance, dismissal and dispute records; workplace policies | Labour Relations Act 66 of 1995 |
| Employment equity plans and reports, and related workforce records | Employment Equity Act 55 of 1998 |
| Skills development, training and learnership records | Skills Development Act 97 of 1998 |
| Skills development levy returns and payments | Skills Development Levies Act 9 of 1999 |
| Unemployment insurance declarations and contributions | Unemployment Insurance Act 63 of 2001; Unemployment Insurance Contributions Act 4 of 2002 |
| Injury-on-duty records and registrations with the Compensation Fund | Compensation for Occupational Injuries and Diseases Act 130 of 1993 |
| Workplace health and safety records | Occupational Health and Safety Act 85 of 1993 |
| B-BBEE certificate, scorecard and verification records | Broad-Based Black Economic Empowerment Act 53 of 2003, and its codes of good practice |
| Personal information processing records, security compromise records, this manual | Protection of Personal Information Act 4 of 2013; Promotion of Access to Information Act 2 of 2000 |
| Electronic contracts, electronic records and transaction records | Electronic Communications and Transactions Act 25 of 2002 |
| Consumer agreements, quotations, invoices and marketing records | Consumer Protection Act 68 of 2008 |
7. Subjects on which we hold records, and the categories of records
The list below describes the subjects on which we hold records and the categories of records held on each subject. A listed record is not automatically available. Access is subject to the request procedure in section 9 and to the grounds for refusal in PAIA.
| Subject | Categories of records |
|---|---|
| Company secretarial | Registration documents, memorandum of incorporation, share and director registers, resolutions, minutes, annual returns, B-BBEE ownership records |
| Finance and tax | Annual financial statements, management accounts, general ledger, bank records, invoices and receipts, budgets, tax and VAT returns, payroll and levy records, audit and accounting working papers |
| Human resources | HR policies and procedures, advertisements for posts, applications and CVs, employment contracts, employee personal files, payroll and leave records, training records, performance and disciplinary records, employment equity and skills records, health and safety records |
| Clients and contracts | Enquiries and proposals, quotations, master service agreements, statements of work, subscription and licence agreements, correspondence, project and support records, invoices and statements, client demo access records, case studies |
| Products and platform data | Product plans, designs and documentation, source code and technical documentation, release records, user and account records, and client data held on the MemberSavi and CareSavi platforms (see the note below) |
| IT and security | Systems and hosting records, access and administrator accounts, security logs, backup records, incident and security compromise records, IT policies, licence records |
| Marketing and communications | Website content, brand assets, newsletters and campaign records, social media content, contact form enquiries, consent records, press and public relations material |
| Suppliers | Supplier and subcontractor agreements, registration, tax and B-BBEE documents, quotations, purchase orders, invoices and payment records, correspondence |
Note on client data on our platforms. When we run MemberSavi and CareSavi for a client, the client decides why and how the member, patient or other personal information on the platform is used. We hold that information on the client’s behalf, as an operator under POPIA. If you want a record about yourself that sits on one of those platforms, such as a membership record, an appointment or a health record, please ask the client (the association, practice or other organisation you deal with) first. We may refer your request to that client. Requests to us for such records are subject to our contracts with the client and to the grounds for refusal in PAIA, including the protection of the privacy and confidential information of third parties.
8. Processing of personal information
This section is provided under section 51(1)(c) of PAIA and section 18 of POPIA. It is consistent with our website privacy policy, which gives more detail about personal information collected through our website. Our products have their own privacy notices.
8.1 Purpose of processing personal information
We process personal information to:
- read and respond to enquiries, and discuss whether we can work with you;
- provide, support, host, secure and improve our software, apps, websites, AI and WhatsApp solutions, MemberSavi and CareSavi;
- perform our contracts with clients and suppliers, and to invoice and collect payment;
- on a client’s instructions, process member, patient and other data on the client’s behalf in our products (as an operator);
- employ, pay and manage staff, and to recruit;
- keep the company and financial records that company, tax, labour and B-BBEE laws require;
- keep our website, systems and clients’ data secure, and prevent fraud and abuse;
- send communications that you have asked for, or are lawfully allowed to receive; and
- protect our legal rights, and comply with the law and requests from authorities.
8.2 Categories of data subjects and of personal information
| Data subjects | Personal information that may be processed |
|---|---|
| Website visitors and enquirers | Name, email address, telephone number (optional), organisation (optional), area of interest, message, consent record with date and time; a hashed version of an IP address for spam protection; technical request data processed by Cloudflare |
| Clients and prospective clients (our own business records) | Names and contact details of representatives, organisation and registration details, VAT numbers, contracts, billing and payment details, support correspondence |
| Clients’ members (MemberSavi, as operator) | Member records and contact details, membership and payment records, and communications sent to members. The platforms send about 2–3 million emails a month |
| Clients’ patients and practice staff (CareSavi, as operator) | Patient contact details, appointment records, consent records, and health information entered by practices; messages sent through WhatsApp and AI features |
| Employees and job applicants | Identity and contact details, qualifications, CVs, employment history, bank and tax details, remuneration, leave and attendance, performance and disciplinary records, and demographic information needed for employment equity and B-BBEE reporting |
| Suppliers and service providers | Names and contact details, registration, VAT and tax details, B-BBEE information, bank details, agreements and invoices |
| Directors and shareholders | Names, identity details, contact details, shareholding and directorship records |
Our website and contact form are not meant to collect sensitive information. Health information is processed only inside CareSavi, on a practice’s instructions.
8.3 Recipients or categories of recipients
We share personal information only where needed for the purposes above. We do not sell personal information.
| Category of personal information | Recipients or categories of recipients |
|---|---|
| Website enquiries and business email | Google (email service); Cloudflare (website delivery and security); our hosting providers; authorised Dinnative staff |
| Client and supplier records | Our accountants, auditors and banks, where needed to keep our finances and pay or collect money |
| Product and platform data | The client that is the responsible party for that data; infrastructure, messaging and AI providers that help us run the platforms (see section 8.4) |
| Employee and tax records | The South African Revenue Service, the Department of Employment and Labour, the Unemployment Insurance Fund, the Compensation Fund, and payroll and benefit providers where applicable |
| Company and ownership records | The Companies and Intellectual Property Commission; B-BBEE verification agencies |
| Any category, where the law requires it | Courts, regulators and law enforcement, and our legal advisers, to comply with the law or protect our legal rights |
8.4 Planned transborder flows of personal information
Some of our service providers process personal information outside South Africa:
- Google. Our email is provided by Google (Gmail), which stores and processes email on servers that may be in other countries. Website enquiries are copied to this email service.
- Cloudflare. The website runs behind Cloudflare, which operates a global network. An IP address and basic request details may be processed in data centres outside South Africa.
- CareSavi. Patient records are stored in Johannesburg. The WhatsApp and AI providers used by CareSavi process some messages outside South Africa. See the CareSavi privacy notice at caresavi.com/privacy.
Where personal information is sent to another country, we rely on section 72 of POPIA. In practice, we send it only where the recipient is subject to law, binding rules or an agreement that gives a similar level of protection, where the data subject has consented, or where the transfer is needed to perform a contract or to deal with the data subject’s request.
8.5 General description of information security measures
We take reasonable and appropriate steps to protect the confidentiality, integrity and availability of the personal information in our care. These include:
- serving our websites over HTTPS (an encrypted connection);
- security filtering by Cloudflare in front of our website;
- limiting administrator access to the website to authorised administrators with their own logins;
- anti-spam checks on the contact form, and storing only a hashed IP address for a short time to limit abuse;
- limiting access to website enquiries to staff who need to respond to them;
- storing CareSavi patient records in Johannesburg; and
- a duty to notify the Regulator and affected data subjects of a security compromise, as POPIA requires.
No system is completely secure. We do not claim any security certification or audit unless we state it in this manual or in a product notice.
8.6 Retention
We keep personal information only as long as needed for the purpose it was collected for, or as the law requires. Under our privacy policy, website enquiries that do not become clients are kept for 24 months and then deleted. Records about clients, staff, suppliers and tax are kept for the periods required by company, tax and labour laws. Client data on our platforms is kept as the client instructs and as our contract with the client provides.
8.7 Your rights over your personal information
Under POPIA you may ask us whether we hold personal information about you and ask for a copy, ask us to correct or delete it, object to its processing, and complain to the Regulator. Write to the Information Officer (section 3). A request for your own personal information may also be made as a PAIA request, in which case section 9 applies.
9. How to request access to a record
9.1 Who may request, and on what basis
Under section 50 of PAIA, we must give a requester access to a record of ours if:
- the record is required for the exercise or protection of any right;
- the requester complies with the procedural requirements in PAIA; and
- access is not refused on a ground for refusal in PAIA.
You must therefore say which right you wish to exercise or protect, and explain why the record is needed for that.
9.2 The request form
Requests must be made on Form 2 (Request for access to record), prescribed by Regulation 7 of the Regulations. The Regulator publishes the form at inforegulator.org.za/wp-content/uploads/2020/07/InfoRegSA-PAIA-Form02-Reg7.pdf. It is also available on request from our Information Officer.
Please:
- complete the form in full, including a clear description of the record, the form of access and manner of access you prefer, and the right you wish to exercise or protect;
- attach a copy of your identity document or other proof of identity;
- if you are making the request for someone else, attach proof that you are authorised to do so;
- pay the request fee (see 9.4); and
- send the form to the Information Officer.
Address the form to the Information Officer, Dinnative Technologies (Pty) Ltd, 74 Montrose Avenue, Northgate, Randburg, 2162, South Africa. You may also email it to [email protected], with a copy to [email protected]. If you cannot complete the form because of a disability or because you cannot read or write, we will help you, and you may also ask the Regulator for help. If we cannot comply with a request because of a defect in the form, we will tell you and give you a chance to correct it.
9.3 Time frames
- We must decide on your request and notify you as soon as reasonably possible, and within 30 days after receiving the request.
- We may extend the 30 days once, by not more than a further 30 days, if the request is for a large number of records, requires a search for records in an office that is not in the same town or city, or needs consultation that cannot reasonably be completed within 30 days, or if you agree to the extension. We will tell you the length of and the reason for the extension, and of your right to complain to the Regulator or apply to court.
- If we do not respond within the 30 days (or the extended period), the request is treated as refused. This is called a deemed refusal.
- If we cannot find a record, or it does not exist, we will give you an affidavit or affirmation that says so and describes the steps taken to find it.
9.4 Fees
The fees below are those prescribed for private bodies in Annexure B of the Regulations, as published by the Regulator at inforegulator.org.za/paia-fees-structure-2. The Regulator may change them. The current notice applies if it differs from this table.
- Request fee. We must, by notice, require the requester to pay the prescribed request fee before we process the request any further.
- Access fee. If your request is granted, you pay the access fee for reproduction and for any search and preparation time beyond the first hour. We will tell you the amount before we give you access.
- Deposit. If we believe the search will take more than six hours, we may ask for a deposit of not more than one-third of the access fee. If the request is refused, we repay the deposit.
- We may withhold the record until the applicable fees have been paid.
| Item | Fee |
|---|---|
| Request fee (payable by every requester) | R140.00 |
| Photocopy or printed black-and-white copy, per A4 page or part of a page | R2.00 |
| Copy in computer-readable form: flash drive (supplied by the requester) | R40.00 |
| Copy in computer-readable form: compact disc (supplied by the requester) | R40.00 |
| Copy in computer-readable form: compact disc (supplied by us) | R60.00 |
| Transcription of visual images, per A4 page or part of a page | Outsourced; depends on the service provider’s quotation |
| Copy of visual images | Outsourced; depends on the service provider’s quotation |
| Transcription of an audio record, per A4 page | R24.00 |
| Copy of an audio record: flash drive (supplied by the requester) | R40.00 |
| Copy of an audio record: compact disc (supplied by the requester) | R40.00 |
| Copy of an audio record: compact disc (supplied by us) | R60.00 |
| Search for and preparation of the record, per hour or part of an hour, excluding the first hour | R145.00 (the total may not exceed R435.00) |
| Deposit, if the search will exceed six hours | One-third of the amount calculated from the reproduction items above |
| Postage, email or other electronic transfer | Actual expense, if any |
9.5 Notice to third parties
If a record contains personal information about another person, or contains that person’s trade secrets, financial, commercial or technical information, or information that we hold in confidence, we must try to notify that third party (and tell you we have done so) within 21 days after receiving your request. The third party may consent to the disclosure or give reasons why access should be refused. We will decide whether to give access within 30 days after the notice was sent to the third party, and will tell both you and the third party of the decision and of their rights of complaint and court application.
9.6 Grounds for refusal
We may or must refuse access in the cases listed in Chapter 4 of Part 3 of PAIA. In summary, these include:
- unreasonable disclosure of personal information about another person;
- commercial information of a third party, and confidential information that we owe a duty of confidence on;
- information that could endanger the safety of an individual or the security of property;
- records privileged from production in legal proceedings;
- our own commercial information, if disclosure could harm our commercial or financial interests; and
- research information, if disclosure could expose the researcher or the research to serious disadvantage.
If only part of a record falls under a ground for refusal, we will consider giving access to the rest of the record. A ground for refusal does not apply in certain public-interest cases that PAIA lists. If we refuse a request, our written reasons will refer to the specific provisions of PAIA that we rely on.
9.7 Remedies if you are not satisfied
- Internal appeal. There is no internal appeal against a decision of the head of a private body (or a deemed refusal).
- Complaint to the Regulator. A requester or a third party may complain to the Regulator in writing about our decision, including a refusal, a demand for the request fee or deposit, an extension of time, or the form of access given. The complaint must be made within 180 days of the decision, on PAIA Form 5, which you can email to [email protected]. The Regulator’s contact details are in section 4. The Regulator does not accept complaints by telephone, but it must give reasonable help to anyone who needs it. The complaint procedure is in section 77A of PAIA.
- Court application. A requester or third party who is aggrieved by our decision may apply to a court (the Magistrate’s Court or the High Court with jurisdiction). The application must be filed within 180 days of the decision (section 78 of PAIA). A court may allow a late application if the interests of justice require it. You do not have to complain to the Regulator before going to court, but you cannot apply to court while a complaint is still pending with the Regulator.
Complaints about how we process personal information (as opposed to a PAIA request) go to the Regulator under POPIA, using the POPIA complaint details in section 4.
10. Availability of this manual
This manual is available:
- on our website, as a web page and as a PDF, at dinnative.co.za/paia-manual;
- at our principal place of business, 74 Montrose Avenue, Northgate, Randburg, 2162, for public inspection during normal business hours;
- to any person on request to the Information Officer, on payment of the reasonable prescribed fee for copies, which is R2.00 per A4 page or part of a page under Annexure B of the Regulations; and
- to the Regulator on request.
11. Updating this manual
The head of the private body will update this manual regularly, and when our details, records, processing or the law change. The effective date and version number are shown at the top of the manual.
Issued by
- Refilwe Lediga, Chief Executive Officer (head of the private body) and Information Officer
- Dinnative Technologies (Pty) Ltd
- 13 November 2026