PAIA manual

1. About this manual

This is the manual that section 51 of the Promotion of Access to Information Act 2 of 2000 requires a private body to publish. It says who we are, which records we hold, and how to ask for one.

It also describes the personal information we process, as the regulations under the Protection of Personal Information Act 4 of 2013 require of a manual.

2. Who we are and how to reach us

South Design (Pty) Ltd, trading as Umbel, a private company registered in South Africa under registration number 2025/343417/07.

Street and postal address: 32 Kloof St, Gardens, Cape Town, 8000, South Africa.

Email: info@umbel.me. Website: umbel.me.

The head of the body for the purposes of the Act is the director of South Design (Pty) Ltd, who is also Umbel's Information Officer. Write to the head of the body at info@umbel.me.

We do not operate a telephone line or a fax line. Everything reaches us by email, and we answer in writing.

3. The Information Regulator's guide

Section 10 of the Act requires the Information Regulator to publish a guide on how to use the Act. It explains how to make a request, what a body may refuse, and what to do about a refusal.

The guide is published in the official languages and can be obtained from the Information Regulator of South Africa at inforegulator.org.za, or by writing to the Regulator at the address given there.

4. Records available without a request

We have not published a notice under section 52(2) of the Act, so no category of our records is automatically available in that way.

These records are published and need no request: our terms of service, our privacy policy, our pricing, our help pages and this manual, all at umbel.me.

5. Records available under other legislation

We keep records under the Companies Act 71 of 2008, the Tax Administration Act 28 of 2011, the Value-Added Tax Act 89 of 1991, the Protection of Personal Information Act 4 of 2013 and the Electronic Communications and Transactions Act 25 of 2002.

A right of access given by one of those Acts is exercised under that Act, not under this manual.

6. The records we hold

The company: registration and statutory records, financial and tax records, insurance, and agreements with our service providers.

Customers: account records, which are a name, an email address and a handle; the cards a person publishes; and plan and payment records.

Contacts held for customers: the contacts collected through a card's form, read from photographed paper cards, or imported by a customer. Those are the customer's records and we hold them as their operator, so a request for one is made to the customer.

Teams: team records, memberships, templates, and the cards and contacts a team owns.

Correspondence: messages to our mailbox, feedback sent from the apps, and reports about cards.

The website and the apps: measurement of how Umbel is used, and request and security logs.

7. How to ask for a record

Use Form 2, the form prescribed under the Act, and send it to the head of the body at info@umbel.me. The form is available from the Information Regulator at inforegulator.org.za.

Say which record you want and in what form, which right you are seeking to exercise and why the record is needed to exercise it, and how we should reply to you.

We decide within 30 days and tell you in writing. Where the Act allows it we may extend that period once, by no more than a further 30 days, and we will tell you if we do.

We may refuse a request on a ground in Chapter 4 of the Act, which includes the privacy of a third party, commercial information, and legally privileged records. A refusal says which ground it rests on.

If you are not satisfied with our decision, you may complain to the Information Regulator or apply to a court, as Part 4 of Chapter 1 of the Act provides.

8. Fees

The regulations under the Act set a request fee and an access fee. We will tell you what is payable before we process a request, and we do not start until it is paid.

A request for your own personal information carries no request fee.

9. The personal information we process

Why: to publish the cards our customers create, run their accounts, take payment, keep the service safe and working, answer messages, and keep the records the law requires.

Whose: people with an Umbel account, people who open a card, people whose details are in a customer's contacts, and members of teams.

What: names and contact details, what a person puts on a card, pictures, account and plan records, the contacts we hold for customers, and records of how the service was used.

Who receives it: the service providers that host Umbel, deliver our email, read a scanned card, check the share-back form for spam, take payment, read a purchase made in a phone app, and measure how Umbel is used; Apple and Google, for wallet passes and purchases made in their stores; and anybody the law requires.

Where it goes: some of it is processed outside South Africa, under section 72 of POPIA.

How it is kept safe: encrypted as it travels and where it is stored, access limited to what a role needs, and written terms with every provider.

All of this is set out in full in our privacy policy, at umbel.me/legal/privacy.

10. Where to find this manual

This manual is published at umbel.me/legal/paia and we will send a copy by email on request to info@umbel.me, as section 51(3) of the Act requires.

11. Updating this manual

We update this manual when the records we hold, or the way to reach us, change. The date above is the day it last changed.