PAIA Manual

Manual in terms of section 51 of the Promotion of Access to Information Act, 2000 (PAIA), for HANDY LABS (PTY) LTD (trading as Thirdhand).

Effective date: 17 July 2026 · Version 1.0

1. Contact details (section 51(1)(a))

Private body: HANDY LABS (PTY) LTD, Registration No. 2026/563734/07

Head of the private body: Raa-id Ismail

Information Officer: Raa-id Ismail

Postal and physical address: 19 Burwood Road, Crawford, Cape Town, Western Cape, 7780

Email: raaid@westernambition.co.za | Website: https://thirdhand.co.za

2. The Information Regulator's guide (section 51(1)(b))

The Information Regulator has published a Guide (in terms of section 10 of PAIA) on how to use the Act, available in all official languages from the Information Regulator: JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001; enquiries@inforegulator.org.za; https://inforegulator.org.za.

3. Records available in terms of other legislation (section 51(1)(d))

Records are kept in accordance with legislation applicable to the business, including:

  • Companies Act 71 of 2008 — company records.
  • Income Tax Act 58 of 1962 and Value-Added Tax Act 89 of 1991 — financial and tax records.
  • Consumer Protection Act 68 of 2008 — records of transactions with consumers.
  • Electronic Communications and Transactions Act 25 of 2002 — electronic transaction records.
  • Protection of Personal Information Act 4 of 2013 — records of processing of personal information.

4. Subjects and categories of records held (section 51(1)(e))

  • Company records: founding documents, statutory registers, resolutions.
  • Financial records: accounting records, invoices, tax returns, bank statements.
  • Customer records (business users of Thirdhand): account details, agreements, billing and support records.
  • Service data processed as operator: WhatsApp message records, leads, appointments, and invoice data processed on behalf of business users.
  • Personnel records (if applicable): employment contracts, payroll records.
  • IT and operations: system documentation, security logs, service provider agreements.

5. Records automatically available (section 51(1)(c))

The following are available without a PAIA request, on our website https://thirdhand.co.za: marketing and product information, Terms of Service, Privacy Policy, and this manual.

6. How to request access to records (section 51(1)(e))

Complete FORM 2 (Request for Access to Record) prescribed under PAIA, available from the Information Regulator's website, and send it to the Information Officer at raaid@westernambition.co.za or 19 Burwood Road, Crawford, Cape Town, Western Cape, 7780. The request must identify the record, the right you seek to exercise or protect, and why the record is required for that right. The prescribed request fee and access fees (per the PAIA fee regulations) apply. We will respond within 30 days as required by the Act. If your request is refused, the reasons will be given, and you may apply to the Information Regulator or a court.

Personal information note: a data subject requesting their own personal information may do so under POPIA (section 23) without the PAIA request fee; Thirdhand business users can also use the in-app data export.

7. Processing of personal information (POPIA)

Purpose of processing: providing a WhatsApp-based business assistant service (automated customer responses, lead capture, appointments, reminders, invoicing), account management, and billing.

Categories of data subjects and information:

  • Business users: identity and contact details, business information, billing records.
  • Customers of business users: contact details, WhatsApp message content, appointment and invoice details (processed as operator on behalf of business users).
  • Employees and suppliers (if applicable): contact and contractual details.

Recipients: service providers required to operate the service — Meta Platforms (WhatsApp), Paystack (payments), Anthropic (AI processing), OpenAI (voice-to-text), Vercel and Neon (hosting) — and regulators where the law requires.

Cross-border flows: some providers process information outside South Africa, subject to section 72 of POPIA (contractual protection substantially similar to POPIA).

Security measures: encryption in transit, access control and tenant isolation, rate limiting, security review of system changes, and written agreements with operators and sub-operators.

8. Availability of this manual

This manual is available free of charge on our website at https://thirdhand.co.za/paia and on request from the Information Officer.