PAIA manual
Prepared under section 51 of the Promotion of Access to Information Act 2 of 2000. It sets out what records this company holds, how to ask for them, what that costs, and what to do if we say no.
Last updated 5 October 2026
1.The company this manual belongs to
Protein Platform collects protein market prices and conditions, works them into forecasts and written analysis, and makes the result available to subscribing organisations.
2.Why this manual exists
Section 32 of the Constitution gives everyone the right of access to information held by another person where that information is required to exercise or protect a right. PAIA is the law that makes the right usable, and section 51 requires every private body to publish a manual explaining how.
The right is not unlimited. PAIA also protects privacy, commercial confidentiality and other interests, and clause 10 sets out the grounds on which a request can be refused.
3.Who to contact
No Deputy Information Officer has been designated. POPIA section 56 allows for one; this is a small company and the Information Officer answers requests personally. If that changes, this clause changes with it.
4.The Regulator's guide on how to use PAIA
Section 10 of PAIA requires the Information Regulator to publish a plain-language guide on exercising the right of access. It explains the objects of PAIA and POPIA, how to make a request, what help is available, and what to do when a request is refused. It is free, and it is more useful to a first-time requester than this manual is.
5.Records held under other laws
Some records exist because another statute says they must. They are listed so a requester can see what is likely to be held, not because PAIA gives automatic access to them.
- Companies Act 71 of 2008
- Income Tax Act 58 of 1962, and the Tax Administration Act 28 of 2011
- Value-Added Tax Act 89 of 1991, if and when the company registers for VAT
- Protection of Personal Information Act 4 of 2013
- Electronic Communications and Transactions Act 25 of 2002
- Consumer Protection Act 68 of 2008, where it applies
- Basic Conditions of Employment Act 75 of 1997 and the Labour Relations Act 66 of 1995, once the company has employees. It has none at the date above.
6.Records you can have without asking
Available on www.protein-platform.com, free, with no form and no fee:
- What the platform does, and what each plan includes
- Current subscription prices
- The privacy notice and the terms of service
- This manual
- A public summary of recent market movement, shown on the home page as an aggregate with no contributor named
7.Records available on request
Everything below exists. Whether a particular record is released depends on clause 10 - most client data is somebody else's personal or commercial information, and refusing to hand it over is usually an obligation rather than a choice.
| Subject | What it covers | Form |
|---|---|---|
| Statutory | Registration documents, the memorandum of incorporation, director and shareholder records | Electronic |
| Financial | Invoices, bank records, annual financial statements, tax returns and assessments | Electronic |
| Client accounts | Client organisations, the people linked to them, plans, subscription status, billing history and account correspondence | Electronic |
| Market data | Price submissions and who made them, processed price history, supply and demand records, market condition signals | Electronic |
| Client activity | Watchlists, generated briefs, forecast and analyst reports, uploaded purchase records used for benchmarking | Electronic |
| Marketplace | Listings, offers and confirmed transactions between clients | Electronic |
| Platform | Source code, database schema, infrastructure configuration and prediction accuracy records | Electronic |
| Suppliers | Agreements with the service providers named in clause 8, and correspondence with them | Electronic |
8.POPIA particulars: how personal information is processed
Required by section 51(1)(c) to (e) of PAIA, as amended by POPIA. The privacy notice says the same things at more length and in plainer words.
Categories of data subject, and why their information is processed
| Who | Purpose |
|---|---|
| Client organisations and their users | Running the account, providing the plan they pay for, taking payment, sending briefs and account notices, and answering support requests |
| People who submit market data | Recording the submission, checking it for outliers, and building the aggregated market intelligence that is the product |
| Marketplace counterparties | Listing, offering and confirming trades between clients, and billing the success fee that follows |
| Prospective clients | Creating and running a trial account, and telling them when it is about to end |
| Suppliers | Managing the relationship and paying invoices |
Categories of personal information
- Name, email address and the organisation a person belongs to
- Authentication data. Passwords are stored only as hashes and are not recoverable by anyone, including us
- Plan, subscription status, billing dates, and references issued by the payment provider. No card details
- Submitted prices and purchase records, and the account that submitted them
- Activity on the platform: watchlists, questions put to the AI analyst, reports generated
Who else receives it
| Recipient | What for |
|---|---|
| Supabase | Database and authentication |
| Vercel | Application hosting and request logs |
| Paystack | Payments, and the card details we never see |
| Anthropic | Generating written analysis, briefs and analyst answers |
| Our mail host | Delivering account and billing notices |
Information sent outside South Africa
The database is hosted in the European Union, and the hosting and AI providers process outside South Africa. POPIA section 72 permits this where the recipient is bound by a law or agreement upholding principles substantially similar to POPIA; the providers are engaged under data processing terms to that effect.
Security measures
- Access rules are enforced by the database itself, on every query, rather than only by the application
- All traffic travels over an encrypted connection
- Passwords are stored as hashes; privileged credentials are held as server-side environment variables and never sent to a browser
- Administrative functions are separated from client functions and are reachable only by platform staff
9.How to make a request, and what it costs
The procedure
- Use Form 2 of the PAIA Regulations, available from the Information Regulator's website, and send it to the Information Officer at the address in clause 3.
- Give enough detail to identify the record and yourself, say what form of access you want, and state the right you are trying to exercise or protect and why the record is needed for it.
- If you cannot read or write, or a disability prevents it, you may make the request orally and the Information Officer will fill in the form for you.
- You will have a decision within 30 days. That period can be extended under section 57, and you will be told if it is, and why.
- The decision is given in writing, substantially in the form of Form 3, with reasons if access is refused.
Prescribed fees
These are set by regulation, not by us. Nothing on this page is a fee we chose, and there is no fee for anything not on this list.
| Fee | |
|---|---|
| Request fee, payable by every requester | R140.00 |
| Photocopy or printed A4 page, black and white | R2.00 |
| Copy on a flash drive you provide | R40.00 |
| Copy on a CD you provide | R40.00 |
| Copy on a CD we provide | R60.00 |
| Transcription of an audio record, per A4 page | R24.00 |
| Search and preparation, per hour or part of an hour, excluding the first hour | R145.00 |
| Maximum search and preparation charge per request | R435.00 |
| Postage or electronic transfer | At cost |
- The request fee is payable before the request is considered. Access fees are quoted after a request is approved.
- Where a search is likely to take more than six hours, a deposit of one third of the estimated access fee is payable first.
- A record can be withheld until the access fees are paid.
- Asking whether we hold personal information about you is free. So is a copy of the Regulator's section 10 guide.
10.When a request can be refused
PAIA sets these grounds out in Chapter 4 of Part 3. Several of them are obligations rather than choices - protecting someone else's personal information is not discretionary.
- It would unreasonably disclose another person's personal information
- It would disclose commercial information belonging to a third party, or to us, including trade secrets and information whose release would harm a party's commercial or financial interests
- It would breach a duty of confidence owed to a third party
- It would endanger a person's life, safety or property
- The record is privileged in legal proceedings
- The request is manifestly frivolous or vexatious, or granting it would divert resources unreasonably
Where part of a record can be released without triggering any of these, that part will be.
11.If you are not satisfied
There is no internal appeal. PAIA does not provide one for private bodies, and the Information Officer's decision is the company's final word on a request.
You can complain to the Information Regulator (South Africa) using Form 5 of the PAIA Regulations, sent to PAIAComplaints@inforegulator.org.za. POPIA complaints go through the Regulator's own online portal instead.
You may also apply to a court for relief, within 180 days of the decision.
12.Availability and updates
This manual is available on www.protein-platform.com, free, and at the registered address in clause 1. A copy will be sent on request to the Information Officer. It is updated whenever the law or what the company does changes, and the date at the top moves with it.
See also the privacy notice and the terms of service.