PAIA Manual

← Back to the Trust Centre

1. Purpose

This manual is published by xlabs (Pty) Ltd ("xlabs", "we") under section 51 of the Promotion of Access to Information Act 2 of 2000 (PAIA). It explains what records we hold, how to ask for access to them, and how we process personal information under the Protection of Personal Information Act 4 of 2013 (POPIA).

xlabs is a private body. We build and run Clara, an AI operating layer for South African businesses that connects email, documents and business systems, does the admin and prepares next steps for a named person to approve.

2. Contact details

Please send all PAIA requests and questions by email. We have not appointed deputy information officers; the Information Officer handles every request.

3. The Information Regulator's guide

Section 10 of PAIA requires the Information Regulator to publish a guide on how to use PAIA and POPIA. The guide explains the rights each Act gives and how to exercise them.

It is available in the official languages on the Regulator's website at inforegulator.org.za. You may also ask the Regulator for a copy:

• Website: inforegulator.org.za
• Email: enquiries@inforegulator.org.za

You may ask us to show you the guide or send you a copy by email.

4. Records available without a request

The following are available to anyone without a PAIA request, on getclara.co.za:

• This manual, the POPIA statement and the privacy policy.
• The other documents published in the Clara Trust Centre.
• Product information, help content and release notes.

We have not published a section 52 notice. Other records need a request under this manual.

5. Records held under other legislation

We keep records as required by, among others, the following laws. Where they apply, records are available as those laws allow:

• Companies Act 71 of 2008
• Income Tax Act 58 of 1962 and Tax Administration Act 28 of 2011
• Value-Added Tax Act 89 of 1991
• Basic Conditions of Employment Act 75 of 1997 and Labour Relations Act 66 of 1995
• Unemployment Insurance Act 63 of 2001 and Skills Development Levies Act 9 of 1999
• Electronic Communications and Transactions Act 25 of 2002
• Protection of Personal Information Act 4 of 2013
• Consumer Protection Act 68 of 2008

6. Subjects and categories of records

Records an organisation stores in Clara, such as its client, policy, claim, order, financial and document records, belong to that organisation. A request for them should go to the organisation itself. If we receive one, we refer it to the organisation and help it respond.

7. How to request access

1. Complete Form 2 (Request for access to record) in the PAIA regulations. It is available from the Information Regulator's website, or we will email it to you.
2. Describe the records clearly enough for us to find them, say how you want access (a copy, by email, or to inspect), and give an email address or other way to reach you.
3. If you ask on behalf of someone else, include proof of your authority to do so.
4. Identify the right you want to exercise or protect, and explain why the record is needed for it (section 53).
5. Send the form to miles@xlabs.co.za.

We decide within 30 days of receiving the request, and tell you in writing. We may extend this once by up to 30 days where section 57 allows, and will tell you why. If we do not reply in time, the request is regarded as refused.

If you cannot read, write or complete the form because of a disability, you may ask in another way and we will help you.

8. Fees

Fees are set by the PAIA regulations, not by us. The amounts in force are listed in the regulations and on the Information Regulator's website.

• Request fee: payable before we process a request, unless you are asking for your own personal information.
• Access fee: payable before we give access, to cover copying, searching for and preparing the records. If searching and preparing will take longer than the regulations allow without charge, we may ask for a deposit first.

We tell you the fees that apply in writing before you pay them. You may lodge a complaint with the Information Regulator about a fee, or ask for it to be waived where the regulations allow.

9. Grounds for refusal

We may refuse access only on the grounds in Chapter 4 of Part 3 of PAIA, including to protect:

• the privacy of a third party who is a natural person;
• commercial information of a third party or of xlabs;
• confidential information owed to a third party;
• the safety of people and property, and the security of our systems;
• records privileged from production in legal proceedings.

If we refuse, we give reasons. Where only part of a record is protected, we give access to the rest.

10. Remedies

We have no internal appeal procedure. If you are unhappy with our decision, you may, within 180 days, lodge a complaint with the Information Regulator or apply to a court (sections 77A and 78).

11. Processing of personal information

Purposes

• To provide, support, secure and improve Clara for the organisations that use it.
• To process records on each organisation's instructions, as its operator.
• To manage user accounts, billing and our relationships with customers and suppliers.
• To employ people and meet our legal, tax and regulatory duties.

Data subjects and their information

Some records may hold special personal information, such as health information for medical aid or gap cover. The organisation that stores it needs a lawful basis for it under sections 26 to 33 of POPIA.

Recipients

• The organisation that the information belongs to, and the users it grants access to.
• Our service providers: hosting and databases (Vercel and Supabase), AI service providers, email delivery, and the integrations an organisation turns on.
• Our professional advisers and auditors, and authorities where the law requires it.

We do not sell personal information, use it for advertising, or use it to train general-purpose AI models.

Cross-border flows

Clara's hosting and databases are currently in the European Union, and some AI and email service providers process information outside South Africa. Information leaves South Africa only under section 72 of POPIA: to recipients bound by law or binding agreements that give protection substantially similar to POPIA.

Security measures

• Each organisation's data is held in its own separate database.
• Data is encrypted in transit and at rest. Passwords, API keys and connection secrets sit in an encrypted vault.
• Every module needs an explicit grant. Access is further limited by policy type and record ownership.
• Every change to key records is written to an audit log, whatever made the change.
• Client-facing sends, payments and accounting writes run only after a named person approves them.
• Security testing is ongoing, and findings are tracked until resolved.

The POPIA statement describes these measures in more detail.

12. Availability of this manual

This manual is published at getclara.co.za/trust-centre/paia-manual. You may ask for a copy by email at no charge. A printed copy can be inspected by arrangement with the Information Officer.

13. Contact

Information Officer, xlabs (Pty) Ltd: Miles Marshall, CEO, miles@xlabs.co.za.
Information Regulator (South Africa): inforegulator.org.za

14. Review

We review this manual at least once a year, and whenever our records or processing change materially. The version and effective date above identify the current version.