PAIA manual

1. Purpose and terms used

This manual helps you identify records, contact the person responsible for access requests and understand how personal information is processed. It covers the company’s administration and VumaBill service records. A record category does not guarantee that a particular record exists or is publicly accessible.

PAIA means the Promotion of Access to Information Act 2 of 2000. POPIA means the Protection of Personal Information Act 4 of 2013. IO means Information Officer. The Regulator means the Information Regulator of South Africa.

2. Information Officer and contact details

Information Officer: contact the company’s Information Officer using the business email below.

Company: SHELVEO SPATIAL INTELLIGENCE (PTY) LTD. Registration: 2026/587671/07.

Email: support@vumabill.co.za. Website: https://vumabill.co.za.

Address requests to the Information Officer using these contact details. Email is our published contact channel; ask the Information Officer for any delegated request-handler details. You do not need a VumaBill account or paid subscription to make a request.

3. The Regulator’s PAIA guide

The Regulator’s guide explains access rights, completing a request, assistance, fees and remedies. Its website provides the guide in English and other South African languages, together with prescribed forms. Links appear under Official guides and forms below. You can also ask our Information Officer for a copy or help obtaining it.

Information Regulator: enquiries@inforegulator.org.za; telephone 010 023 5200; website https://inforegulator.org.za.

4. Records available without a formal PAIA request

Our public website provides this manual, company information, the Terms and conditions, Privacy policy, Cookie and storage policy, public feature descriptions and advertised plans. Public feature requests and approved public comments can be viewed on the feature-request board. Viewing these public pages does not require a PAIA form.

Help material and a user’s authorised workspace records are available through their normal app access. That access does not make private company records public. You may ask the Information Officer for public information by email.

5. Subjects and record categories

Company administration: incorporation, director and governance records; business correspondence and agreements.

Service and suppliers: service terms, provider arrangements, product guidance, pricing and operational correspondence.

Accounts and access: user identity and contact details, company memberships, invitations, permissions, session and security records.

Workspace business records: customers, catalogue items, projects, quotes, invoices, recurring schedules, statements, payments, credits, refunds, banking information and uploaded attachments.

Subscription and financial administration: orders, transaction references, payment verification, terms acceptance, billing, cancellation and refund correspondence, and accounting and tax records where applicable.

Support and privacy: requests, correspondence, replies and outcomes. Feature feedback includes requests, votes, comments and moderation decisions.

AI and service operation: submitted questions and available conversation records, business context used for assistance, usage records, system logs, deployment, backup and incident records. This does not mean every prompt or transient input is permanently retained.

Personnel and professional services: engagement, remuneration and employment-related records where held. To request a record not described here, provide enough detail for the Information Officer to identify it.

6. Records held under other legislation

Corporate and governance records: Companies Act 71 of 2008.

Access and personal-information records: PAIA and POPIA.

Accounting and tax records, where applicable: Income Tax Act 58 of 1962, Tax Administration Act 28 of 2011 and Value-Added Tax Act 89 of 1991. Listing VAT legislation does not state that the company is VAT registered.

Electronic transactions and consumer records, where applicable: Electronic Communications and Transactions Act 25 of 2002 and Consumer Protection Act 68 of 2008.

Employment-related records, where applicable: Basic Conditions of Employment Act 75 of 1997 and Labour Relations Act 66 of 1995. A statutory record-keeping duty does not automatically make a record publicly accessible; the applicable access requirements still apply.

7. How to request access

Complete the Regulator’s Form 2, linked below, and send it to support@vumabill.co.za for the Information Officer. Identify the records, your contact details and preferred access format. For a private-body PAIA request, identify the right to be exercised or protected and explain why the records are needed. Provide evidence of authority when acting for someone else.

Ask us for assistance if a disability or another difficulty prevents you from completing the form. Do not send passwords, card security codes or unnecessary identity-document copies. We may arrange proportionate identity and authority verification before disclosure.

8. Decisions, timeframes and fees

We will communicate our decision within 30 days of receiving a PAIA request, subject to lawful extensions or other provisions of the Act. If a permitted extension is needed, we will explain the reason and revised deadline. An extension may be for up to a further 30 days.

Where prescribed fees or a deposit apply, we will explain them and any applicable exemption before payment. Personal requesters are exempt from the request fee; lawful reproduction or access charges may still apply. There is no charge to read this online manual.

Access may be refused only on a lawful ground. We will explain a refusal and available remedies. Where information can lawfully be separated, we will consider access to the remaining part.

9. Complaints and remedies

You may complain to the Information Regulator about a refusal or failure to respond, using its Form 5 and published complaint process. For a private body there is no compulsory PAIA internal appeal. The Regulator’s guidance gives a 180-day complaint period; consult that guidance for the applicable starting date and late-complaint procedure. Court remedies may also be available. Asking us to reconsider does not suspend a statutory deadline.

10. Personal information: purposes and people affected

Visitors and prospective users: enquiries and technical connection information to provide the website, respond and protect the service.

Account holders, directors and workspace members: identity, contact, role, account and subscription information to deliver access, administer billing and secure accounts.

Workspace customers and contacts: business contact information, billing records, payment and banking information and attachments to provide the workspace’s requested billing services. Workspace businesses generally determine the purposes for their own customer records; VumaBill processes them to provide the service on their instructions.

Support requesters and feature-board participants: submitted messages, requests, votes and moderation outcomes to provide support and manage feedback.

Suppliers, contractors and personnel, where applicable: contact, engagement, payment and administration information to manage the business relationship.

AI help processes questions and recent context; Vumi uses relevant company records and summaries; comments are processed for moderation. Optional usage and performance measurement supports service improvement and can be turned off in Appearance and preferences. Pseudonymous measurement is not completely anonymous.

11. Recipients and processing outside South Africa

Recipients include authorised workspace members, personnel who need access for service delivery, contracted providers, payment recipients, professional advisers and authorities where lawfully required. Google Firebase and Google Cloud support hosting, authentication, records, storage, security, performance monitoring and Vertex AI. Brevo supports transactional email. Paystack processes online-payment information when used. Google Places receives address searches and Google Fonts receives normal connection information when those services load.

Google Cloud Functions operate in the United States and AI services can use global processing. Other providers may process information outside South Africa. Applicable POPIA section 72 transfer requirements must be met; we do not represent that all processing stays in South Africa. Ask the Information Officer for information about the relevant recipients and safeguards. A document payment or viewing link can be accessible to a person who possesses it, so share links carefully.

12. Information security and retention

Measures include authentication, company-scoped access permissions, restricted administrative access, session revocation, server-side payment checks, security monitoring and provider backup facilities. Access is limited according to role and purpose. These measures support confidentiality, integrity and availability; no system can guarantee absolute security.

Records are retained according to purpose, applicable duties and lawful holds. A deletion request does not automatically erase invoices another business must retain. Backup expiry can occur after deletion from active systems. Requests are assessed individually and any reason preventing deletion will be explained.

13. Personal-information requests

Account holders can submit access, correction, deletion or objection requests through Help → Support → Privacy request and follow replies in My requests. Everyone may contact the Information Officer by email, including people without an account. This intake route does not replace a prescribed form where the applicable procedure requires one.

We verify identity and authority before releasing or changing private records. A request concerning a workspace customer may need to be referred to the responsible business. See the Privacy policy for further information and the Regulator’s POPIA forms for the applicable prescribed procedures.

14. Availability and updates

This manual is available free of charge on our public website and can be printed or saved using your browser. Copies and public inspection at our principal place of business can be arranged with the Information Officer during normal business hours; contact us for practical arrangements. A reasonable prescribed copying charge may apply to a requested physical copy. The manual is also available to the Regulator on request.

The Information Officer maintains this manual and reviews it when material contact, processing or record changes occur, and at least annually. Publication date: 10 September 2026. Next scheduled review: September 2027.

Official guides and forms

• PAIA guide, forms, fees and complaint guidance
• Form 2: request access to a record
• Form 5: complaint to the Regulator
• POPIA request forms

Send completed access requests to support@vumabill.co.za.