PAIA Manual

Prepared under section 51 of the Promotion of Access to Information Act 2 of 2000.
Date of compilation: 15 November 2026

1. Words used in this manual

• PAIA: the Promotion of Access to Information Act 2 of 2000.
• POPIA: the Protection of Personal Information Act 4 of 2013.
• Regulator: the Information Regulator (South Africa), established under section 39 of POPIA.
• Zuttle, we, us: Zuttle (Pty) Ltd.
• Record: recorded information in our possession or under our control, in any form, whether or not we created it.
• Requester: a person who asks us for access to a record.

2. Purpose of this manual

PAIA gives everyone the right to ask for access to records that a private body holds, where the record is required for the exercise or protection of a right. This manual explains who to contact, where to find the Regulator's guide, which records we hold, how to ask for a record and what it costs, why we may refuse and what you can do then, and how we process personal information (PAIA section 51(1)(c)).

Zuttle is a booking platform: it connects travellers in South Africa with licensed shuttle and transport companies ("operators") and acts as their booking agent. It does this through the Zuttle app, the Zuttle Driver app, the operator web portal and zuttle.io.

3. Contact details

Send requests for access to records to the Information Officer at the email or address above.

4. The Regulator's guide to PAIA

The Information Regulator has published a guide on how to use PAIA and POPIA (the "Guide"), as section 10 of PAIA requires. It is available in English and other official languages, and describes the objects of PAIA and POPIA, how to request a record from a public or private body, the help the Regulator can give, and all legal remedies, including complaints to the Regulator and going to court.

You can get the Guide:

• on the Regulator's website, inforegulator.org.za/paia;
• at the Regulator's offices (section 11); or
• from our Information Officer, free of charge, using Form 1 of the PAIA Regulations ("Request for a Copy of the Guide from an Information Officer") or by email.

A copy in English is at our address for inspection during normal business hours.

5. Records available without a request

You can read these without a PAIA request:

• this manual, at zuttle.io/paia;
• our privacy policy, at zuttle.io/privacy;
• our terms of use, at zuttle.io/terms, and our cancellation and refund policy, at zuttle.io/cancellations;
• our account deletion page, at zuttle.io/delete-account;
• the company information on zuttle.io/legal and the rest of zuttle.io; and
• operator profiles and reviews, which are public in the Zuttle app.

This list is for convenience. It is not a notice under section 52 of PAIA.

6. Records kept under other laws

We keep records as these laws require. Where another law gives you access to a record, you can use that law.

This list is not complete. A law appears here because it may require us, or the operators and drivers who give us records, to keep certain records. It does not mean the law applies in every case.

7. Subjects and categories of records

A category listed here does not mean you will get access. Every request is decided under PAIA, including the grounds for refusal in section 10.

8. How to request access

Under section 50 of PAIA, we must give access to a record if you need it to exercise or protect a right, you follow this procedure, and no ground for refusal in section 10 applies.

1. Fill in Form 2 of the PAIA Regulations, "Request for Access to Record", from inforegulator.org.za/paia-forms or from our Information Officer, who will help you fill it in free of charge.
2. Give enough detail to identify the record and you.
3. Give a postal address or fax number in South Africa, and any other way you want our decision sent (for example email).
4. Say which form of access you want (for example a copy or an inspection).
5. Say which right you want to exercise or protect, and why you need the record for it. For your own personal information, you can name your right of access under section 23 of POPIA.
6. Attach proof of identity, and if you act for someone else, proof of your capacity.
7. Send it to the Information Officer at support@zuttle.io, or by post or by hand to our address in section 3.

What happens next

• We tell you the request fee, if any, and you pay it before we process the request (PAIA section 54).
• We decide as soon as reasonably possible, and within 30 days after we receive the request with all the details it needs (section 56).
• We may extend that once, by up to 30 days, only on the grounds in section 57(1) or with your written consent, and we tell you why.
• We give our decision on Form 3 of the PAIA Regulations, with any access fee, the form of access and, if we refuse, our reasons.
• If we do not decide in time, the request is treated as refused (section 58).

Your own personal information. Under POPIA section 23 you may ask us, free of charge, to confirm whether we hold personal information about you, and ask for a copy or description of it, including the third parties or categories of third parties who have had access to it. Use the procedure above (POPIA section 25). For your own personal information, POPIA allows only a prescribed fee, if any, and we tell you in writing before charging. To correct or delete your information (POPIA section 24), use Form 2 of the POPIA Regulations or write to us in your own words, free of charge; we reply in writing within 30 days. To object to processing based on legitimate interest (POPIA section 11(3)), use Form 1 of the POPIA Regulations or write to us, free of charge.

9. Fees

Fees for private bodies under Annexure B of the PAIA Regulations, 2021:

• Deposit: if search and preparation will take more than 6 hours, we ask for a deposit of no more than one third of the access fee, and repay it if we refuse the request (PAIA section 54(2) and (4); PAIA Regulations, regulation 8(3)).
• Inspection at our address is free, by appointment; the request fee and any search fee still apply.
• We may withhold a record until the fees are paid (section 54(5)).
• You may challenge a fee or deposit by complaining to the Regulator or applying to court within 180 days (sections 77A and 78).

10. Grounds for refusal

Chapter 4 of Part 3 of PAIA sets out when a private body must or may refuse a request, in whole or in part.

We must refuse access if:

• it would unreasonably disclose personal information about another individual, including one who has died (section 63);
• the record contains another person's trade secrets (section 64(1)(a)), or financial, commercial, scientific or technical information whose disclosure would likely harm that person's commercial or financial interests (section 64(1)(b)), or information given in confidence whose disclosure could disadvantage that person in negotiations or competition (section 64(1)(c));
• disclosure would breach a duty of confidence owed to another person under an agreement (section 65);
• disclosure could reasonably be expected to endanger someone's life or physical safety (section 66(a));
• the record is privileged from production in legal proceedings, unless privilege is waived (section 67); or
• the record contains another person's research and disclosure would seriously disadvantage that person, the researcher or the subject (section 69(1)).

We may refuse access if:

• disclosure would likely prejudice the security of property, including a building, a computer or communication system or a means of transport, or the methods and systems that protect it or the public (section 66(b));
• the record contains our own trade secrets, or financial, commercial, scientific or technical information whose disclosure would likely harm us, or disclosure could disadvantage us in negotiations or competition (section 68(1)(a) to (c));
• the record is a computer program we own, unless it is needed to give access to a record we grant (section 68(1)(d)); or
• the record contains our own research and disclosure would seriously disadvantage us (section 69(2)).

Some grounds fall away if the person concerned consents in writing (sections 63(2)(a), 64(2)(a)), if the information is already public (section 63(2)(b)), or if the record holds results of testing that reveal a serious public safety or environmental risk (sections 64(2)(b), 68(2)). We must still give access where disclosure would reveal a substantial contravention of the law or an imminent and serious public safety or environmental risk, and the public interest clearly outweighs the harm (section 70).

If we refuse part of a record, we give access to the parts we can reasonably separate (section 59). If a record cannot be found or does not exist, we say so in an affidavit or affirmation describing our search (section 55). If a request concerns another person's information, we may notify them first so they can make representations (sections 71 to 73).

11. If you are not satisfied

PAIA has no internal appeal against a private body's decision. Within 180 days of our decision you may:

• complain in writing to the Information Regulator, on Form 5 of the PAIA Regulations, to PAIAComplaints@inforegulator.org.za (section 77A); or
• apply to a court (section 78). The Guide explains the procedure. If you complain to the Regulator, the complaint process must end (or you must withdraw it) before you apply to court.

This covers refusals (including deemed refusals), fees and deposits (section 54), extensions (section 57(1)) and the form of access (section 60). A third party affected by our decision may also complain or apply to court (sections 77A(3)(c), 78(3)(c)), within 30 days after we tell them our decision, failing which we give the requester access (section 73).

The Information Regulator (South Africa)

• Physical address: Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191
• Postal address: P.O. Box 31533, Braamfontein, Johannesburg, 2017
• Telephone: 010 023 5200; toll-free 0800 017 160
• General enquiries: enquiries@inforegulator.org.za
• PAIA complaints: PAIAComplaints@inforegulator.org.za
• POPIA complaints: POPIAComplaints@inforegulator.org.za
• Website: inforegulator.org.za

12. Processing of personal information

PAIA section 51(1)(c) requires this part. Our privacy policy (zuttle.io/privacy) gives the full detail.

12.1 Purposes

We process personal information to: create and run accounts for travellers, drivers and operators; take bookings, match travellers with operators and drivers, show live ride progress and send trip notifications; take payments, issue receipts, and pay operators, which pay their drivers; record acceptance of terms; handle a charter cancellation for a death or hospitalisation and check the proof; check driver and vehicle documents and monitor driving for passenger safety; review operator, driver and charter applications; record a ride's route and speeds for safety and disputes; show operator ratings and reviews; prevent fraud and keep the service secure; run our waitlist and onboard operators; contact transport companies that may want to join Zuttle; answer messages, deletion requests and PAIA and POPIA requests; and keep the records the law requires and run the company.

12.2 Categories of data subjects and their information

12.3 Recipients

• Operators and their drivers, and travellers, within a booking.
• Travellers, who also see the nearby-vehicles map (approximate positions) and on-demand driver profiles.
• Operators, who see their own drivers' and vehicles' location and records, and reviews about them.
• The public: operator profiles and reviews.
• Our bank and our payment processor.
• Our service providers: Paystack, Railway, Cloudflare, Google (Firebase Cloud Messaging, Maps Platform, Fonts), Apple (Push Notification service), Resend, GoDaddy, Notion, GitHub and WhatsApp (Meta).
• Professional advisers, and authorities when the law requires it or to protect someone's safety.

12.4 Planned transborder flows

Our servers and database run in the Netherlands (European Union). Resend, Notion and GitHub store information in the United States. Google, Apple, GoDaddy and WhatsApp (Meta) process it in the United States and other countries. Cloudflare stores our uploaded files outside South Africa. Our payment processor may process information in other countries where its group operates. We rely on POPIA section 72 for these transfers, as section 8 of the privacy policy explains.

12.5 Security measures

• Passwords are stored only as secure hashes.
• Information travels over encrypted connections (HTTPS).
• Compliance documents open only through links that expire after 15 minutes.
• We never hold full card numbers; payment notifications with masked card numbers are deleted after 90 days.
• Admin tools are limited to authorised staff and record who approved, verified or paid what.
• Repeated sign-in attempts are limited.
• If a security compromise affects personal information, we notify the people affected and the Regulator (POPIA section 22).

13. Where this manual is available

As PAIA section 51(3) requires, this manual is available on zuttle.io/paia; at our address in section 3 for inspection during normal business hours; to anyone who asks (a printed copy costs R2.00 per A4 page; an emailed copy is free); and to the Information Regulator on request.

14. Updates

We update this manual when the information in it changes, and review it at least once a year. The date of compilation at the top shows the latest version.

Issued by Jean Hannah, Information Officer and head of Zuttle (Pty) Ltd.