PAIA Manual

Acronyms and Abbreviations

Purpose of This Manual

This manual helps you to:

• see which records EventU makes available without a request;
• understand how to request access to a record EventU holds;
• see which records EventU keeps because other laws require them;
• find the contact details of the Information Officer and Deputy Information Officer;
• find the Regulator’s Guide on how to use PAIA;
• know why EventU processes personal information, about whom, who receives it, whether it leaves South Africa, and how it is kept secure.

Key Contact Details

The Guide on How to Use PAIA

Under section 10 of PAIA, the Regulator has published an updated Guide on how to use PAIA and POPIA. It explains your rights, how to make a request to a public or private body, the fees, and the help and remedies available to you. It is available in every official language and in braille.

You can get the Guide from the Information Officer on request, or from the Regulator’s PAIA resources page. The Information Officer keeps a copy for public inspection during normal office hours in [EventU to confirm: the two official languages the PAIA Guide is kept in].

The Regulator’s contact details:

• Physical address: Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191
• Telephone: 010 023 5200
• General enquiries: enquiries@inforegulator.org.za
• PAIA complaints: PAIAComplaints@inforegulator.org.za
• POPIA complaints: POPIAComplaints@inforegulator.org.za
• Website: inforegulator.org.za

Records Available Without a Request

Records Kept Under Other Laws

EventU keeps records under the following laws, where they apply to it:

Subjects and Categories of Records

Processing of Personal Information

Purpose of Processing

EventU processes personal information to:

• sell and deliver tickets and run check-in at events;
• pay organisers, vendors and resale sellers through Paystack;
• process refunds and handle payment disputes;
• connect organisers with vendors and support event catering;
• send service messages, and marketing to people who opted in;
• prevent fraud and keep the platform secure;
• meet its tax, accounting and other legal obligations.

Data Subjects and Their Information

Who Receives It

Transfers Outside South Africa

EventU’s database is in Ireland, in the European Union (Supabase), and its servers are in Germany, in the European Union (Hetzner, Falkenstein). Some of the providers listed above, including Meta, Google, Anthropic and Hostinger, may process personal information in other countries. EventU transfers personal information outside South Africa only as section 72 of POPIA allows.

Security Measures

• The site is served only over encrypted connections (HTTPS).
• Each organisation’s data is kept apart by row-level security rules in the database.
• Full card numbers never reach EventU’s systems; payments run through Paystack. Of Paystack’s payment record, only the payment’s own details are stored.
• Door staff are added for one event and can scan only that event’s tickets; removing them ends their access.
• Staff roles are held in the database where users cannot change them.
• API tokens are stored as one-way hashes, and webhook deliveries are signed.
• Confidential documents are stored outside the public web folder and shown only to authorised members of the organisation and to EventU staff.
• Checkout and other sensitive actions are rate-limited.
• Organiser and administrator actions are recorded in audit logs.
• Marketing opt-outs are checked before every WhatsApp message and are kept after an account is deleted.

How to Request Access to a Record

• Complete Form 02, Request for Access to Record, and send it to the Information Officer at privacy@eventu.co.za or the postal address above.
• Describe the record clearly enough for it to be found, say how you want access, and state the right you want to exercise or protect and why you need the record for it.
• Include proof of your identity. If you ask on behalf of someone else, include proof that you may act for them.
• For your own personal information you can also use your privacy dashboard.

Fees. A requester other than a personal requester pays the request fee prescribed for private bodies, currently R140. Access fees for copies, search and preparation may also apply, and a deposit may be asked for. The current amounts are in the Regulator’s fee structure.

Timing. EventU decides a request within 30 days of receiving it. It may extend this once, by up to 30 more days, and will tell you why. If a record concerns someone else, EventU tells that person and lets them respond before deciding.

Refusal. PAIA lets a private body refuse access on the grounds in Chapter 4 of its Part 3, for example to protect another person’s privacy, confidential or commercial information, someone’s safety, or legally privileged records. A refusal is given in writing with reasons. Access must still be given where PAIA’s public interest test requires it.

If you disagree. You may complain to the Regulator using its Form 05, Complaint Form, or apply to court, within the time PAIA allows.

Availability of This Manual

This manual is available:

• on this page;
• for inspection at EventU’s office during normal business hours, at [EventU to confirm: physical address];
• to anyone on request, for the prescribed copying fee;
• to the Regulator on request.

Updating This Manual

EventU reviews this manual regularly and updates it when its records or processing change. The date at the top shows the current version.

Issued by [EventU to confirm: Information Officer's name], Information Officer, [EventU to confirm: registered name of the business that operates EventU].