PAIA Manual

Version 1.0 · Prepared 19 September 2026 · Effective on publication

Prepared under section 51 of the Promotion of Access to Information Act 2 of 2000.

1. Introduction

The Promotion of Access to Information Act 2 of 2000 (PAIA) gives effect to the constitutional right of access to information. For a private body, access may be requested to a record that is required for the exercise or protection of a right, subject to PAIA.

This is the section 51 manual of Aurelua, registration number 2026/344331/07. It should be read with PAIA, its Regulations and the Information Regulator’s prescribed forms and guidance.

2. Aurelua’s details

3. The PAIA guide

The Information Regulator publishes a guide explaining how to use PAIA, the assistance available, applicable fees, remedies and contact details. It is available in South Africa’s official languages from the Information Regulator’s website at inforegulator.org.za/paia or on request from the Regulator.

Information Regulator. Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg. PO Box 31533, Braamfontein, Johannesburg, 2017. Telephone 010 023 5200. Email enquiries@inforegulator.org.za.

4. Automatically available information

Aurelua has not assumed that a formal section 52 notice has been published. The following public information can ordinarily be accessed without a PAIA request, subject to website availability and intellectual-property rights:

• the public website, store pages and product listings;
• published Terms of Use, Privacy Policy, Cookie Notice, refund policy and prohibited-products policy;
• public contact, pricing, support and company-identification information; and
• public announcements, help material and marketing content.

A request for a copy, historic version or non-public record may still require a formal PAIA request.

5. Legislation under which records may be held

Depending on Aurelua’s actual activities, staff, products and payment structure, records may be held under legislation including:

• Corporate and governance. Companies Act 71 of 2008 and regulations.
• Consumer and e-commerce. Consumer Protection Act 68 of 2008. Electronic Communications and Transactions Act 25 of 2002.
• Privacy and access. Protection of Personal Information Act 4 of 2013. Promotion of Access to Information Act 2 of 2000.
• Tax and accounting. Income Tax Act 58 of 1962. Value-Added Tax Act 89 of 1991 where applicable. Tax Administration Act 28 of 2011.
• Payments and financial crime. National Payment System Act 78 of 1998. Financial Intelligence Centre Act 38 of 2001 where applicable.
• Intellectual property. Copyright Act 98 of 1978. Trade Marks Act 194 of 1993. Counterfeit Goods Act 37 of 1997. Merchandise Marks Act 17 of 1941.
• Technology and security. Cybercrimes Act 19 of 2020. ECTA.
• Employment. Basic Conditions of Employment Act 75 of 1997. Labour Relations Act 66 of 1995. Employment Equity Act 55 of 1998. UIF and compensation legislation, if applicable.
• Product and category rules. Any law governing a listed category, including medicines, food and cosmetics, alcohol, tobacco and nicotine, second-hand goods and safety standards.

This list does not mean every Act applies or that every record exists. It is a practical description of records Aurelua may need to keep.

6. Records held

• Company and governance. Registration, constitutional, ownership, director, resolution, policy, insurance, adviser and statutory records.
• Finance and tax. Accounts, bank and settlement records, invoices, tax returns, reconciliations, fees, reserves, refunds and audit material.
• Customers and users. Account, contact, identity, consent, order, delivery, communication, support, complaint, return, dispute, refund and rights-request records.
• Sellers. Onboarding, business and identity, bank, verification, store, listings, authenticity and source, licences, performance, complaints, payouts, reserves, suspension and termination.
• Products and orders. Descriptions, images, prices, inventory, order records, tracking, delivery, returns, defects, recalls, prohibited-product review and takedown.
• Payments. Provider agreements, transaction references and status, payouts, bank verification, reversals, chargebacks, fraud review and settlement reports.
• Technology and security. Architecture, access, code and change, logs, backups, vulnerabilities, incidents, business continuity, vendor and device records.
• Privacy and PAIA. Data map, impact assessments, operator terms, transfer safeguards, consent, retention, incidents, training, requests and regulatory correspondence.
• Intellectual property. Trade marks, domains, licences, content permissions, infringement notices, counter-notices and enforcement.
• People. Employee, contractor, recruitment, payroll, performance, discipline, health and safety, and training records where applicable.
• Commercial. Customer, supplier, courier, technology, payment, identity, hosting, advertising and professional-services agreements.
• Marketing. Campaigns, audiences, consent and opt-out, claims evidence, analytics, competitions and advertising materials.

7. How to request access

1. Use the current prescribed Request for Access to a Record form (Form 2) available at inforegulator.org.za/paia-forms.
2. Send the completed form and proof of identity or authority to the Information Officer at info@aurelua.com or the address in section 2.
3. Identify the record clearly enough to locate it, the form of access requested, your contact details, the right you seek to exercise or protect, and why the record is required for that right.
4. If requesting for another person, provide proof of authority. If disability prevents completion, contact Aurelua for reasonable assistance.
5. Pay any prescribed request fee when lawfully required. Access fees may be charged before search, preparation, copying or delivery. A personal requester is not charged a request fee.

Submitting a request does not guarantee access. Aurelua may ask for clarification rather than rejecting an unclear request without assistance.

8. Fees

Only fees prescribed under PAIA and its Regulations may be charged. These may include a request fee for a non-personal requester, access and reproduction fees, postage and a deposit where the prescribed search and preparation threshold is exceeded. Current amounts and Form 3 (outcome and fees payable) are available from the Information Regulator’s PAIA forms page.

No informal administration fee may be added. If a fee is disputed, the requester may use the remedy stated in the outcome notice.

9. How a request is decided

Aurelua will decide within the period PAIA prescribes, subject to a lawful extension, and notify the requester in the prescribed manner. Access may be refused only on a ground allowed by PAIA. Grounds may protect:

• another person’s privacy;
• commercially confidential information or trade secrets;
• confidential information owed to a third party;
• safety of individuals or property;
• legally privileged material;
• research information; and
• Aurelua’s commercial information where PAIA permits refusal.

Aurelua will consider severing protected information and giving access to the remainder. It will follow PAIA’s third-party notice procedure where required. Mandatory disclosure in the public interest may override a refusal ground in the circumstances PAIA states.

10. Remedies

Because Aurelua is a private body, there is no internal PAIA appeal. A requester or relevant third party may complain to the Information Regulator using the prescribed Complaint Form (Form 5), or approach a competent court, within the periods allowed by PAIA. Forms and instructions are available at inforegulator.org.za/paia-forms.

PAIA complaints: PAIAComplaints@inforegulator.org.za. General Regulator enquiries: enquiries@inforegulator.org.za. A complainant should check the Regulator’s website for current channels before filing.

11. Aurelua services

Aurelua provides an online marketplace and e-commerce infrastructure through which independent Sellers may create stores, list products, receive Orders and use supported payment, payout, delivery-information and dispute-support features. Public service information is available at https://aurelua.com. Access to account-specific services requires registration and acceptance of applicable terms.

12. POPIA information

12.1 Purposes

Aurelua processes personal information to operate accounts, Sellers and stores; verify identity and bank information; form and fulfil Orders; facilitate payments and payouts; support delivery, returns, refunds and disputes; communicate; secure and improve the Platform; prevent fraud; market lawfully; and meet legal duties.

12.2 Categories of data subjects and information

• Visitors and prospects. Device and activity, cookie choices, enquiries, contact and marketing preferences.
• Buyers. Identity and contact, account, Order, recipient, delivery, payment reference and status, communications, returns, disputes and support.
• Sellers and their personnel. Identity, business, bank, verification and biometric result, tax and licence, store and listing, order, payout, performance and enforcement.
• Employees, applicants and contractors. Identity and contact, work history, qualifications, contracts, payroll, performance and legally required employment information.
• Suppliers and advisers. Contact, role, contract, invoice, banking, access and due-diligence information.
• Complainants, rights-holders and officials. Identity and contact, authority, complaint or request, evidence and outcome.

12.3 Recipients

Information may be shared, as necessary and lawful, with the other party to an Order; Payment Providers; banks; identity-verification services; couriers; hosting, database, security, analytics, communications and advertising providers; professional advisers; insurers; business successors; and courts, regulators or law-enforcement bodies.

12.4 Cross-border flows

Providers may process information outside South Africa, including in the European Union and United States. Aurelua must use a POPIA section 72 ground and adequate contractual or legal protection, as explained in the Privacy Policy.

13. Security safeguards

Aurelua uses safeguards appropriate to the information and risk, which may include encrypted transport, password hashing, access control, least privilege, logging, backups, secure development, vendor review, incident response and staff confidentiality. Safeguards are reviewed as the Platform and threats change.

14. Availability and updates

This Manual is available free of charge on Aurelua’s website and for inspection or copying at the address in section 2 during reasonable business hours by arrangement. A copy may be requested electronically. Prescribed reproduction or delivery fees may apply.

The Information Officer must review the Manual at least annually and when Aurelua materially changes its records, services, corporate details, processing, providers or legal obligations.