NUVATION BUSINESS SOLUTIONS

PAIA Manual

Version 1.0 · Effective 7 August 2026 · South Africa

1. Private body and contact details

Private body: Jaco du Toit, a South African sole proprietor trading as NuVation Business Solutions ("NuVation"). NuVation Business Solutions is a trading name and not a separate company.

Head of the private body and Information Officer: Jaco du Toit
Information Regulator registration: 2026-063948
Information Officer email: nuvationsolutions@gmail.com
Telephone: 061 051 3710
Website: nuvationbusiness.co.za

Physical, administrative and legal address: 16 Doorn Street, Potchefstroom, North West, 2531, South Africa. This is also the address for formal service of legal documents. It is a residential, online-business address and not a general customer walk-in venue. A lawful request for inspection at the principal place of business must be arranged in advance through the Information Officer so that access can take place safely during normal business hours.

No Deputy Information Officer is currently designated.

2. Purpose of this Manual

This Manual helps a requester to:

• understand which categories of records NuVation holds;
• identify records that are publicly available without a formal request;
• understand how to request access to a record under PAIA;
• find the Information Officer and Information Regulator contact details;
• understand NuVation's main personal-information processing activities; and
• understand the available complaint and court remedies.

3. PAIA Guide, forms and Information Regulator

The Information Regulator publishes the current PAIA Guide, prescribed forms and fee information in the official languages of South Africa. They are available from the Information Regulator's PAIA page. NuVation will provide an electronic link or electronic copy of the current English and Afrikaans Guides on request.

A formal request for access to a NuVation record must use the current prescribed Form 2: Request for Access to Record, or a substantially similar request that contains all legally required information. Send the completed request to the Information Officer at nuvationsolutions@gmail.com.

Information Regulator (South Africa)
Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg
P.O. Box 31533, Braamfontein, Johannesburg, 2017
Telephone: 010 023 5200
Email: enquiries@inforegulator.org.za
Website: inforegulator.org.za

4. Records available without a formal PAIA request

The following records are generally available on NuVation's website:

• public product descriptions, modules, allowances and advertised prices;
• public business identity, contact and support information;
• Terms of Service;
• Privacy Policy;
• Refund and Cancellation Policy;
• Supplier Information;
• Operator and Data Processing Terms; and
• this PAIA Manual.

Public availability does not make private customer records, internal security material, credentials, trade secrets or another person's personal information automatically available.

5. Records kept under legislation

Depending on the activity and whether the relevant record exists, NuVation may keep records under legislation including:

• Promotion of Access to Information Act 2 of 2000;
• Protection of Personal Information Act 4 of 2013;
• Electronic Communications and Transactions Act 25 of 2002;
• Consumer Protection Act 68 of 2008, where applicable;
• Income Tax Act 58 of 1962; and
• Tax Administration Act 28 of 2011.

This list does not imply that every listed law applies to every request or that every possible category of record currently exists.

6. Subjects and categories of records held

• Business administration: proprietor identity, contact details, policies, contracts and operational correspondence.
• Products and intellectual property: software, source materials, designs, documentation, product plans and testing records.
• Accounts and access: profiles, authentication identifiers, invitations, memberships, roles, permissions and agreement acceptance evidence.
• Subscriptions and payments: plans, modules, seats, capacity, periods, orders, payment references, fulfilment, cancellations, reversals and refunds.
• Customer-controlled ERP records: customer, supplier, inventory, quote, invoice, payment, receivables, bookkeeping, delivery, fleet, maintenance, appointment, asset, job, Job Card, project and analytics-supporting records.
• Support and communications: enquiries, complaints, correction requests and support correspondence.
• Security and continuity: access, rate-limit, security-event, incident, recovery and audit records that may lawfully be retained.
• Privacy and PAIA: Information Officer records, impact assessments, processing inventories, requests, verification, decisions, disclosures and annual reporting evidence.
• NuVation financial and tax administration: supplier, expense, payment, tax and bookkeeping records relating to NuVation's own business.
• Separate project services: enquiries, quotations, project agreements, source materials, deliverables and communications for separately agreed design, website, marketing or administrative work.

7. How to request access

1. Identify the requested record with enough detail for NuVation to locate it.
2. Explain the right that the record is required to exercise or protect and why the record is required for that purpose.
3. Provide adequate proof of identity and, where acting for another person or body, proof of authority.
4. State the preferred form of access and a reliable contact method.
5. Submit the current prescribed Form 2 or a substantially similar complete request to the Information Officer.
6. Pay a prescribed request, search, preparation or reproduction fee only if lawfully requested after written notice.

NuVation will process a valid request within the period required by PAIA, subject to any extension permitted by PAIA. A request does not automatically entitle a requester to another business's ERP records. NuVation may need to consult affected third parties, separate exempt material, redact protected information, refer the requester to the responsible customer business or refuse access on a lawful PAIA ground.

8. Decisions, fees and remedies

A decision will grant, partially grant or refuse access and will provide the information required by PAIA. Where fees are permitted, NuVation will use the current prescribed fee schedule and give the required written notice before charging a request-related fee.

PAIA does not provide an internal appeal against the head of a private body's decision. A requester may use the complaint process of the Information Regulator or approach a competent court, subject to the requirements and time periods in applicable law. Current complaint forms and instructions are available from the Regulator's PAIA page.

9. Processing of personal information

NuVation's Privacy Policy provides the detailed public notice. In summary, NuVation processes personal information to operate the public website and ERP, manage accounts and authorised access, provide requested workflows, support prepaid access and payment verification when enabled, respond to requests, protect the Service and meet legal obligations.

9.1 Categories of data subjects and information

• Website visitors and enquirers: communication details, message content and limited hosting/request information made available by the relevant service.
• Account holders and invited users: name or display name, email, account identifiers, profile type, membership, role, permissions, status and acceptance evidence.
• Business owners and customers: business identity, contact, address, subscription, order, payment-reference and support information.
• People recorded by a customer business: customer, supplier, employee, Professional, payer, driver, contact and other operational information selected and entered by that business.
• Service providers and advisers: contact, contract, support, billing and professional information.

9.2 Recipients or categories of recipients

• users and Professionals authorised by the relevant business account;
• hosting, authentication, database, storage, email, security and payment providers used for the stated service purpose;
• professional advisers and support providers subject to appropriate duties;
• competent regulators, courts, law-enforcement bodies or other recipients where disclosure is lawfully required; and
• a lawful successor to the business, subject to applicable safeguards and notice.

9.3 Processing outside South Africa

Some website, cloud, authentication, storage, email or support providers may process information outside South Africa. NuVation will permit a cross-border transfer only where a ground in section 72 of POPIA applies, including adequate protection under law or binding agreement, valid consent where appropriate, or a transfer necessary for an applicable contract. Current provider categories and material processing changes are described in the Privacy Policy.

9.4 General security measures

NuVation uses risk-based technical and organisational measures intended to protect confidentiality, integrity and availability. Depending on the relevant service, measures include authenticated access, role and permission controls, tenant separation, restricted server operations, input validation, rate limiting, security-event records, provider access controls, testing and an incident-response process. No security measure or online service eliminates all risk.

10. Customer-controlled ERP records

A customer business generally determines why and how its operational records are processed and is generally the responsible party for that information. NuVation generally acts as its operator. A PAIA or POPIA request about those records may need to be directed to the customer business. NuVation will not disclose another business's records merely because NuVation technically hosts or processes them.

11. Availability of this Manual

A copy of this Manual is available:

• free of charge on NuVation's website;
• as an electronic copy requested from the Information Officer;
• for public inspection at the principal place of business during normal business hours, arranged in advance because the address is residential and not a general walk-in venue; and
• to the Information Regulator on request.

A printed copy may be subject only to the reasonable prescribed reproduction fee applicable at the time. The public electronic copy is free.

12. Updating this Manual

The Information Officer will review this Manual at least annually and when NuVation's processing, providers, products, record categories, contact details or legal obligations materially change. The version and effective date identify the applicable public copy.

Issued by: Jaco du Toit, Head of the private body and Information Officer.