Contents
- List of Acronyms and Abbreviations
- Purpose of This Manual
- Key Contact Details
- Guide on How to Use PAIA
- Records Available Without a Formal Request
- Records Available Under Other Legislation
- Subjects and Categories of Records Held
- Processing of Personal Information
- Availability of This Manual
- Updating of This Manual
1. List of Acronyms and Abbreviations
| Abbreviation | Meaning |
|---|---|
| CEO | Chief Executive Officer |
| IO | Information Officer |
| DIO | Deputy Information Officer |
| PAIA | Promotion of Access to Information Act 2 of 2000 (as amended) |
| POPIA | Protection of Personal Information Act 4 of 2013 |
| Regulator | Information Regulator (South Africa) |
| Republic | Republic of South Africa |
| SaaS | Software as a Service |
2. Purpose of This Manual
This PAIA Manual has been compiled by FusionSys Technologies (Pty) Ltd trading as Surveyz ("the Company") to assist members of the public in exercising their right of access to information as contemplated in the Constitution of the Republic of South Africa, 1996, and PAIA. In particular, this manual enables the public to:
- Check the categories of records held by the Company that are available without submitting a formal PAIA request;
- Understand how to make a formal request for access to a record, including the subjects on which the Company holds records and the categories of records held on each subject;
- Know the description of records available under other legislation;
- Obtain the contact details of the Information Officer who will assist with access requests;
- Know the description of the Regulator's Guide on how to use PAIA and how to obtain access to it;
- Understand how the Company processes personal information, the purpose of such processing, and the categories of data subjects and information concerned;
- Know the recipients or categories of recipients to whom personal information may be supplied;
- Know whether the Company plans to transfer personal information outside the Republic;
- Know whether the Company has appropriate security measures in place to ensure the confidentiality, integrity, and availability of personal information it processes.
3. Key Contact Details
3.1 Information Officer
Name: Taurique Toufique Toffie
Organisation: FusionSys Technologies (Pty) Ltd (trading as Surveyz)
Company registration number: 2026/336607/07
Registered address: 19 Collings Road, Oostersee, Parow, Cape Town, 7500, Western Cape
Email: [email protected]
Telephone / WhatsApp: +27 79 728 9360
Website: www.surveyz.co.za
Registration with Information Regulator: Registered on 13 May 2026 pursuant to POPIA
3.2 Deputy Information Officer
No Deputy Information Officer has been designated at this time. All requests should be directed to the Information Officer at [email protected].
3.3 General Access to Information Contact
Email: [email protected]
Contact form: www.surveyz.co.za/#contact
4. Guide on How to Use PAIA and How to Obtain Access to the Guide
The Information Regulator has, in terms of section 10(1) of PAIA as amended, updated and made available a revised Guide on how to use PAIA ("the Guide") in an easily comprehensible form and manner, as reasonably required by a person wishing to exercise any right under PAIA and POPIA.
The Guide is available in each of the official languages and in braille. Members of the public may inspect or make copies of the Guide from the offices of the Regulator during normal business hours. The Guide can also be obtained:
- Upon request to the Information Officer of the Company;
- From the website of the Information Regulator: inforegulator.org.za
The Guide is made available in English and Afrikaans for public inspection during normal business hours at the offices of the Regulator.
5. Records Available Without a Formal PAIA Request
The following categories of records are made voluntarily available by the Company and can be accessed without submitting a formal PAIA request:
| Category of Record | Types of Record | On Website | On Request |
|---|---|---|---|
| Privacy Policy | Full privacy policy describing data collection and processing | Yes | Yes |
| Terms of Service | Platform terms and conditions of use | Yes | Yes |
| POPIA Compliance Notice | Summary of POPIA obligations and data subject rights | Yes | Yes |
| Cookie Policy | Description of cookies and storage mechanisms used | Yes | Yes |
| PAIA Manual (this document) | This manual | Yes | Yes |
| API Documentation | Public API reference for developers | Yes | Yes |
| API Terms | Developer Agreement, Data Processing Addendum, Acceptable Use Policy | Yes | Yes |
6. Records Available Under Other Legislation
The following categories of records are created and maintained in accordance with applicable South African legislation:
| Category of Records | Applicable Legislation |
|---|---|
| Memorandum of Incorporation | Companies Act 71 of 2008 |
| Financial records, invoices, and tax records | Income Tax Act 58 of 1962; Value-Added Tax Act 89 of 1991; Companies Act 71 of 2008 |
| PAIA Manual | Promotion of Access to Information Act 2 of 2000 |
| POPIA compliance records and consent records | Protection of Personal Information Act 4 of 2013 |
| Employee records (if applicable) | Labour Relations Act 66 of 1995; Basic Conditions of Employment Act 75 of 1997 |
7. Subjects and Categories of Records Held
The Company holds records across the following subjects:
| Subject | Categories of Records |
|---|---|
| User Accounts | Registered user profiles (name, email, hashed password, subscription tier); OAuth provider links; API keys (hashed); account audit logs; billing history and subscription status |
| Survey Records | Survey definitions, questions, answer options, and branching logic; survey themes and branding settings; survey publication status and share links; survey analytics metadata |
| Survey Responses | Respondent answers to all survey questions; respondent identity data (name, email — if provided at consent gate); respondent consent records (consent flag, timestamp, IP address, consent version); draft in-progress responses |
| Distribution Lists | Contact names, email addresses, and WhatsApp numbers imported by survey creators; distribution campaign logs |
| Billing and Financial | PayFast payment references; subscription plan history; invoice amounts and dates; payment status records (held for 5 years per SARS requirements) |
| Communication Records | Transactional email logs (welcome emails, password reset, verification); OTP delivery records; survey distribution email records |
| Security and Audit Logs | Login attempt records; IP addresses associated with actions; data change audit trails; rate-limiting and anomaly detection logs |
| Legal and Compliance | PAIA Manual; POPIA compliance notices; data subject request records; consent records; data breach notification records (if applicable) |
| Technical and Operational | Application error logs; server infrastructure records; SSL/TLS certificates; API usage logs |
8. Processing of Personal Information
8.1 Purpose of Processing Personal Information
The Company processes personal information for the following purposes:
- To create and manage registered user accounts and provide the Surveyz SaaS platform;
- To authenticate users and maintain the security of accounts;
- To process subscription payments and generate invoices;
- To send transactional communications (account verification, password reset, billing notifications);
- To collect and store survey responses on behalf of survey creators (acting as an Operator under POPIA);
- To deliver surveys to respondents through distribution lists, on the instruction of the survey creator;
- To maintain security audit logs and prevent fraudulent activity;
- To comply with legal obligations under POPIA, PAIA, and applicable tax legislation;
- To provide optional, consent-gated usage analytics to improve the platform (Google Analytics 4).
8.2 Categories of Data Subjects and Information Processed
| Category of Data Subject | Personal Information Processed |
|---|---|
| Registered Users (Account Holders) | Full name (display name); email address; mobile number (optional); hashed password; OAuth provider ID; subscription status and billing references; IP address (in audit logs); account creation and login timestamps; API key (hashed) |
| Survey Respondents | Name and email address (if provided at the survey consent gate); all survey question responses; IP address; browser user-agent; consent timestamp and consent version; draft response data (held temporarily in browser local storage) |
| Distribution List Contacts | Name; email address; WhatsApp mobile number — provided by the survey creator (who is the Responsible Party for this data) |
8.3 Recipients or Categories of Recipients to Whom Personal Information May Be Supplied
| Recipient / Processor | Category of Personal Information | Purpose | Location |
|---|---|---|---|
| PayFast (DPO PayTech) | Name, email address, payment amount | Payment processing and subscription billing | South Africa |
| Google LLC — OAuth | OAuth token (provider ID and email) | Social sign-in (optional) | USA |
| Google LLC — Analytics | Anonymised page-view events, IP address (truncated by GA4) | Optional usage analytics (consent-gated) | USA |
| Google LLC — reCAPTCHA | Browser behavioural signals, IP address | Bot and fraud prevention on sign-in form | USA |
| Microsoft Corporation — OAuth | OAuth token (provider ID and email) | Social sign-in (optional) | USA |
| LinkedIn Corporation — OAuth | OAuth token (provider ID and email) | Social sign-in (optional) | USA |
| Azure Communication Services | Email address, display name | Transactional email (welcome, password reset, verification) | South Africa (Azure ZA North) |
| Cloudflare, Inc. | All inbound HTTP request data, including IP addresses and request metadata | Content delivery, DDoS protection, and DNS — processes all inbound requests to the platform | USA & global edge |
| Anthropic, PBC | Survey content and responses submitted for AI analysis (may contain personal information) | Optional AI insights (only when the account holder enables AI features) | USA |
| PostgreSQL Hosting Provider | All platform data at rest | Database hosting | South Africa (production) |
| Information Regulator (South Africa) | Data subject request records, breach notification records | Legal compliance reporting | South Africa |
8.4 Planned Transborder Flows of Personal Information
The Company transfers certain personal information to recipients outside the Republic of South Africa as part of delivering the platform. These transfers are to processors acting on the Company's instruction and are governed by data processing agreements:
| Recipient | Country | Categories of Personal Information |
|---|---|---|
| Cloudflare, Inc. | USA & global edge | All inbound HTTP request data, including IP addresses and request metadata |
| Google LLC (OAuth, Analytics, reCAPTCHA) | USA | OAuth tokens, anonymised analytics events, browser signals |
| Microsoft Corporation (OAuth) | USA | OAuth tokens |
| LinkedIn Corporation (OAuth) | USA | OAuth tokens |
| Anthropic, PBC | USA | Survey content and responses submitted for optional AI insights (may contain personal information) |
These transfers are made in accordance with POPIA Section 72, which requires that transborder transfers are made only to countries or recipients that provide an adequate level of protection, or where the data subject has consented, or where the transfer is necessary for the performance of a contract.
8.5 Information Security Measures
The Company implements the following security measures to ensure the confidentiality, integrity, and availability of personal information:
- Encryption in transit: All data is transmitted over HTTPS (TLS 1.2+). HTTP requests are automatically redirected to HTTPS.
- Password security: Passwords are hashed using BCrypt with a cost factor of 11. Plaintext passwords are never stored or logged.
- Token security: Password reset tokens and API keys are SHA-256 hashed before storage. Tokens are single-use and expire after 1 hour.
- Access control: All API endpoints require JWT authentication. Data is scoped to the authenticated user — no user can access another user's data.
- Security headers: Every response includes
X-Frame-Options: DENY,X-Content-Type-Options: nosniff, Content Security Policy, and HSTS. - Rate limiting: Per-IP rate limiting is applied to all API endpoints to prevent brute-force and denial-of-service attacks.
- Audit logging: All material changes to survey data and billing data are logged with timestamps and IP addresses.
- Bot protection: Google reCAPTCHA v3 is applied to authentication flows to prevent automated account creation and credential stuffing.
- Least privilege: Database connections use the minimum required permissions.
- Cloud security: The platform is hosted on Microsoft Azure. Microsoft Defender for Cloud is used to monitor security posture.
9. Availability of This Manual
A copy of this manual is available:
- On the Company's website at www.surveyz.co.za/paia-manual.html;
- Upon request to the Information Officer at [email protected] — a copy will be provided within 5 business days;
- To the Information Regulator upon request.
A reasonable fee for reproduction may be charged in accordance with the PAIA Regulations, Annexure B.
10. Updating of This Manual
The Information Officer of FusionSys Technologies (Pty) Ltd will review and update this manual on a regular basis or whenever a material change occurs in the categories of records held, the processing activities, or the contact details of the Information Officer. The date of revision is reflected in the document header above.
How to submit a PAIA access request: Send your request in writing to [email protected] with the subject line "PAIA Access Request". Include your full name, contact details, a description of the record(s) you are requesting, and the right you are seeking to exercise or protect. The Company will acknowledge your request within 3 business days and respond within 30 days as required by PAIA Section 56. A request fee as prescribed under PAIA may be payable before the request is processed.
Information Regulator — Contact Details
If you are dissatisfied with the outcome of a PAIA request, you may lodge a complaint with the Information Regulator:
Website: inforegulator.org.za
Email: [email protected]
Telephone: 010 023 5200
Issued by:
Taurique Toufique Toffie
Information Officer
FusionSys Technologies (Pty) Ltd (trading as Surveyz)
Date: 24 May 2026