About this manual
South Africa’s Promotion of Access to Information Act, 2000 (PAIA) gives everyone the right to ask for records held by a private body when they need them to exercise or protect a right. Section 51 of PAIA asks private bodies to publish a manual explaining what records they hold and how to ask for them. This is Bona’s manual.
It also covers what section 51 asks about personal information under the Protection of Personal Information Act, 2013 (POPIA). To ask for your own personal information, you can use our data request form instead.
The manual is on this website, and we’ll send a copy free of charge to anyone who asks.
Our contact details
- Name: Bona, a trading name, run from South Africa
- Head and information officer: Kevin Mpofu, Co-founder
- Email: [email protected]. Start your message with “Information officer” so it reaches the right person.
- Phone: +27 62 203 7228
- Street address: 15 Bromhead Rd, Zamokuhle, Kloof, Durban, 3610, South Africa
- Postal address: the same as the street address
- Website: bonasecure.co.za
We have no deputy information officers. The information officer handles every request under PAIA and POPIA.
The Information Regulator’s guide
The Information Regulator publishes a guide on how to use PAIA and POPIA, in every official language. You can get it from the Regulator’s website or by contacting the Regulator:
- Address: Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191
- Phone: 010 023 5200, or toll-free 0800 017 160
- Email: [email protected]
Records you can get without asking
We haven’t published a notice under section 52 of PAIA. Everything on this website is freely available, including our product, pricing, security, privacy policy, terms of service and refund policy.
Records we keep because the law requires it
Depending on how we’re set up and who we employ, we may keep records under these laws, among others:
- Protection of Personal Information Act, 2013
- Electronic Communications and Transactions Act, 2002
- Income Tax Act, 1962
- Tax Administration Act, 2011
- Value-Added Tax Act, 1991
- Consumer Protection Act, 2008
- Companies Act, 2008
- Basic Conditions of Employment Act, 1997
- Labour Relations Act, 1995
- Unemployment Insurance Act, 2001
Records we hold
- Business records: registration documents, agreements between the founders, and correspondence with authorities.
- Financial and tax records: invoices, payment confirmations from PayFast, bank statements, accounting records and tax returns.
- Customer records: account and subscription details, agents’ names and email addresses, orders, invoices and support correspondence.
- Records we process for our customers: when a business uses Bona, we hold some information for it, such as chat messages and, if the business switches them on, chat transcripts. That business decides how this information is used, so please ask the business first. We’ll help it respond.
- Supplier records: agreements and correspondence with the companies that provide services to us, such as hosting, email and payments.
- Marketing records: the business contact details of people we contact about Bona, our outreach log, clicks on links in our emails, and our do-not-contact list.
- Website records: enquiries sent through our contact form, booked calls and website analytics.
- Technical and security records: server logs, audit logs and records of security incidents.
- People records: records about the founders and anyone who works with us, such as contracts and payment records.
- Legal and compliance records: our policies, legitimate interests assessments, contracts and any legal correspondence.
How we process personal information
Section 51 of PAIA asks us to describe how we process personal information under POPIA. Our privacy policy has the full details. In short:
- Why we process it: to provide and secure Bona, to reply to enquiries and arrange calls, to tell businesses about Bona, to bill for paid plans, to see how this website is used, and to meet our legal obligations.
- Whose information, and what: our customers’ account holders and agents (names, work email addresses, sign-in details); people who contact us (what they send through our contact form); business contacts (name, job title, work email address and company); website visitors (pages viewed, browser and device type, approximate location); and, for businesses that use Bona, their visitors (the page address and title, chat messages, and any name or email the business passes to Bona).
- What we never see: the shared page itself travels browser to browser, end-to-end encrypted, and passwords, card numbers, one-time codes and private fields are masked on the visitor’s device before anything is sent.
- Who receives it: the service providers listed in our privacy policy, such as Cloudflare (hosting), PayFast (card payments), Google (website analytics), our email providers and business-data providers, and authorities when the law requires us to share it.
- Sending it outside South Africa: Cloudflare runs its network in many countries, and Google and some of our other providers are based in the United States. We send personal information outside South Africa only as section 72 of POPIA allows, for example where the provider is bound to protect it.
- How we protect it: information is encrypted in transit, access is limited to the people who need it, and the most sensitive fields never leave the visitor’s device. Our security page explains more.
How to ask for a record
- Fill in Form 2 (Request for access to a record), which is published with the PAIA Regulations on the Information Regulator’s website, and email it to our information officer at [email protected].
- Give enough detail for us to find the record, and say which right you want to exercise or protect and why you need the record for it.
- Say how you’d like to receive the record, for example by email.
- If you’re asking on behalf of someone else, include proof that you may act for them.
- If you need help with the form, contact our information officer and we’ll help you.
To ask for your own personal information, or to correct or delete it, you can use our data request form or email us. Under POPIA, South Africans can also use Form 1 to object to processing and Form 2 of the POPIA Regulations to ask for a correction or deletion.
Fees
We don’t charge for requests about your own personal information. For other records, PAIA lets us charge the request and access fees set in the PAIA Regulations. If a fee applies, we’ll tell you how much before we do any work, and you can then decide whether to go ahead.
What happens next
- We decide on your request within 30 days and tell you in writing.
- If the request is for a large number of records, or we need to search for them or consult others, we may extend this once, by up to 30 more days. We’ll tell you why before the first 30 days end.
- If we refuse all or part of your request, we’ll explain why and tell you how to challenge the decision.
When we may refuse
PAIA lists the grounds on which a private body may or must refuse access. They include protecting other people’s privacy, a third party’s commercial or confidential information, the safety of people and property, records privileged in legal proceedings, and our own commercial information. We must still give access where the public interest in the record clearly outweighs the harm, as section 70 of PAIA requires.
If you disagree with our decision
Bona is a private body, so there is no internal appeal. Within 180 days of our decision, you can complain to the Information Regulator at [email protected] or apply to a court. Complaints about personal information go to [email protected].
Updates to this manual
We review this manual at least once a year and whenever our records or contact details change. We’ll post the new version on this page and update the date at the top.