PAIA & POPIA MANUAL

Manual on the Protection of Personal Information Act, 2013 and the Promotion of Access to Information Act, 2000

Effective Date: 24 August 2026 · Version: 1.0

Registered Organisation	Scriptura AI Assistant (Pty) Ltd
Company Registration No.	2026/210982/07
Tax Reference No.	9264577272
Registered Address	543 Pipeline, Agnes Road, Randburg, Gauteng, 2169, South Africa
Information Officer	Juan le Roux
Information Regulator Registration No.	2026-004268
Registration Date	20 March 2026
Compliance Contact Email	info@scripturaaiassistant.co.za
Effective Date of this Manual	24 August 2026
Version	1.0

1. Introduction and Purpose

This Manual is published by Scriptura AI Assistant (Pty) Ltd ("Scriptura", "we", "us", or "our") in terms of Section 51 of the Promotion of Access to Information Act 2 of 2000 ("PAIA") and to fulfil our obligations as a Responsible Party under the Protection of Personal Information Act 4 of 2013 ("POPIA").

Scriptura operates the Scriptura AI Assistant platform, including its Bible study, prayer wall, community, and business marketplace features, accessible at scripturaaiassistant.co.za. In the course of operating this platform, Scriptura collects and processes personal information from users, business/merchant partners, affiliates, and website visitors.

The purpose of this Manual is to:

• Explain what personal information Scriptura holds and why;
• Explain how a data subject or member of the public may request access to a record held by Scriptura;
• Explain how a data subject may request correction or deletion of their personal information;
• Set out the internal procedures Scriptura follows when handling such requests; and
• Provide the contact details of Scriptura's Information Officer.

2. Legislative Framework

This Manual is prepared with reference to the following South African legislation:

• Protection of Personal Information Act 4 of 2013 (POPIA);
• Promotion of Access to Information Act 2 of 2000 (PAIA), as amended by the Protection of Personal Information Act;
• The Regulations Relating to the Promotion of Access to Information, 2021; and
• Guidance published by the Information Regulator of South Africa (inforegulator.org.za).

Where any provision of this Manual is inconsistent with PAIA, POPIA, or a binding directive of the Information Regulator, the legislation and the Regulator's directive take precedence.

3. Details of the Information Officer and Deputy Information Officers

Scriptura's Information Officer is responsible for encouraging compliance with POPIA, dealing with requests made under PAIA and POPIA, and cooperating with the Information Regulator.

Information Officer	Juan le Roux
Organisation	Scriptura AI Assistant (Pty) Ltd
Regulator Registration No.	2026-004268
Registration Date	20 March 2026
Email	info@scripturaaiassistant.co.za
Postal / Physical Address	543 Pipeline, Agnes Road, Randburg, Gauteng, 2169, South Africa
Deputy Information Officer(s)	None appointed

All requests, queries, or complaints relating to access to information or the processing of personal information should be directed to the Information Officer at the email address above.

4. Guide on How to Use PAIA (Regulator's Guide)

Section 10 of PAIA requires the South African Human Rights Commission (SAHRC) to publish, in each official language, a guide containing information reasonably required by a person who wishes to exercise a right under PAIA. This guide is available from the SAHRC and/or the Information Regulator at:

• Information Regulator website: https://inforegulator.org.za
• South African Human Rights Commission: https://www.sahrc.org.za

5. Categories of Records Held by Scriptura AI Assistant

Scriptura holds records falling broadly within the following categories. Not every record in a category will necessarily be available for public access — see Section 11 (Grounds for Refusal) below.

5.1 User / Account Records

• Name, surname, email address, date of birth (for 18+ verification)
• Account credentials and authentication logs (Firebase Authentication)
• Profile information, subscription status, referral code
• Journal entries, prayer wall posts, AI conversation history (Bible study queries)

5.2 Business / Merchant Marketplace Records

• Business registration details (business name, contact email, phone, address)
• Product/service listing content and images
• Payout and banking details (bank name, account holder, account number, branch code) or payment-gateway merchant IDs (Stitch / Paystack)
• Sales, commission, and pending-payout records

5.3 Affiliate Records

• Affiliate/referral identifiers and referral link activity
• Commission earned and payment records

5.4 Communications and Support Records

• Contact form submissions and email correspondence
• Audit logs of sensitive account and administrative actions

5.5 Website and Technical Records

• Cookies and analytics data (device type, browser, interaction logs)
• Server and security logs

5.6 Corporate and Compliance Records

• Company registration and tax records
• This Manual, the Privacy Policy, Terms of Service, and related compliance documentation

6. Records Available Without Having to Submit a Formal Request

The following records are freely available on our website and do not require a formal PAIA request:

• Privacy Policy (scripturaaiassistant.co.za/privacy-policy.html)
• Terms of Service (scripturaaiassistant.co.za/terms-of-service.html)
• This PAIA/POPIA Manual (scripturaaiassistant.co.za/paia-popia-manual.html)
• General marketing and public-facing content on the Scriptura website

7. Description of Subjects and Categories of Personal Information Processed

In accordance with good POPIA record-keeping practice, the table below summarises the categories of data subjects and the personal information processed about each:

Data Subject	Personal Information Processed	Purpose of Processing
App Users	Name, email, date of birth, journal/prayer/AI query content	Account creation, service delivery, age verification (18+), personalisation
Business / Merchant Partners	Business & contact details, banking/payout details, listing content	Marketplace operation, commission payout, merchant verification
Affiliates	Referral code, referral activity, commission records, banking details	Affiliate program administration and commission payment
Website Visitors	Device/browser data, cookies, analytics	Site performance, security, analytics
Job Applicants / Correspondents (if applicable)	Name, contact details, correspondence content	Responding to enquiries; recruitment (if applicable)

8. How to Submit a PAIA Request for Access to Records

Any person wishing to request access to a record held by Scriptura (other than the records listed in Section 6 above) must submit a completed "Form 2" request form, prescribed under PAIA, as follows:

1. Download Form 2 from the Information Regulator's website: https://inforegulator.org.za
2. Complete the form in full, including sufficient detail to identify the record requested and the form in which access is required.
3. Submit the completed form to the Information Officer by email at info@scripturaaiassistant.co.za, or by post to the registered address above.
4. The requester may be asked to provide proof of identity.
5. Scriptura will respond within 30 (thirty) calendar days of receiving a valid request, as required by PAIA. If the request is refused, reasons for refusal will be provided in writing.

If a request is made on behalf of another person, proof of authority to act on that person's behalf must be provided (e.g. power of attorney, or proof of parental/guardianship authority).

9. How to Submit a POPIA Request (Access, Correction, or Deletion)

As a data subject, you have the right under POPIA to request confirmation of whether we hold personal information about you, to request access to that information, and to request its correction or deletion. To exercise these rights:

1. Download and complete Form 2 (the same form used for PAIA requests, also used by the Regulator for POPIA access/correction/deletion requests).
2. Submit the completed form to the Information Officer at info@scripturaaiassistant.co.za.
3. For identity verification, you may be asked to confirm account credentials or provide a copy of your South African ID or equivalent identification.
4. Once your identity is verified, Scriptura will action the request — providing access, making the correction, or permanently destroying/de-identifying the record, as applicable.
5. Written confirmation of the action taken will be sent to you within 30 (thirty) calendar days of receiving a valid request.

You may also withdraw consent for processing (e.g. by closing your account) at any time; this will trigger deletion of your data in accordance with Section 14 (Data Retention) below, though withdrawal will prevent continued use of the relevant features.

10. Fees

In accordance with the PAIA Regulations, Scriptura may levy the prescribed request and access fees for PAIA requests for access to records. No fee is charged for a data subject's own POPIA access, correction, or deletion request, save where the request is manifestly unfounded or excessive, in which case a reasonable fee may be charged or the request may be refused, as permitted by POPIA.

Current prescribed PAIA fees (request fee and, where applicable, access/reproduction fees) are published by the Information Regulator and may be confirmed with the Information Officer before a request is processed.

11. Grounds for Refusal of Access

Scriptura may refuse a request for access to a record only on the grounds permitted under Chapter 4 of PAIA, which include (without limitation):

• Protection of the privacy of a third party who is a natural person (including a deceased person), per Section 34 of PAIA;
• Protection of commercial information of a third party, per Section 36 of PAIA;
• Protection of records privileged from production in legal proceedings, per Section 40 of PAIA;
• Records that would jeopardise the safety of individuals or property, per Section 38 of PAIA;
• Records related to operations of public bodies, where applicable; and
• Any other ground for mandatory or discretionary refusal set out in Chapter 4, Part 2 and Part 3 of PAIA.

Where a request is refused, in full or in part, Scriptura will provide adequate reasons for the refusal, with reference to the specific section of PAIA relied upon, as required by Section 25(3) of PAIA.

12. Third Parties and Operators Who Process Information on Our Behalf

Scriptura uses the following third-party service providers ("Operators", as defined in POPIA) to process personal information on our behalf. Scriptura remains the Responsible Party and requires each Operator to maintain appropriate security safeguards.

Operator	Role
Google Firebase / Firestore	Secure database storage, cloud hosting, and user authentication.
Google Gemini API	Processes and generates responses to Bible study / theological queries submitted by users.
Stitch	Secure payment gateway for marketplace transactions and merchant payouts (PCI-DSS compliant); Scriptura does not store card or bank details processed by Stitch.
Paystack	Secure payment gateway (PCI-DSS compliant).
Hostinger	Application server hosting and transactional email routing.

Scriptura (Pty) Ltd is an independent entity and does not control, and cannot be held liable for, security breaches, vulnerabilities, or downtime originating from these third-party Operators. Users are encouraged to review each Operator's own privacy policy.

13. Cross-Border Transfers of Personal Information

Some Operators (notably Google, in respect of Firebase/Firestore and the Gemini API) process personal information on servers located outside the Republic of South Africa. In accordance with Section 72 of POPIA, such transfers occur only where at least one of the following applies:

• The recipient is subject to a law, binding corporate rules, or binding agreement providing an adequate level of protection substantially similar to POPIA;
• The data subject has consented to the transfer;
• The transfer is necessary for performance of a contract between the data subject and Scriptura, or to implement pre-contractual measures taken at the data subject's request; or
• The transfer is for the benefit of the data subject and it is not reasonably practicable to obtain consent, but the data subject would likely give it if asked.

By submitting a query to the AI features, a user consents to the text of that query being transferred to and processed by Google's Gemini API outside South Africa for the purpose of generating a response.

14. Data Retention and Destruction

In accordance with Section 14 of POPIA, Scriptura retains personal information only for as long as necessary to fulfil the purpose for which it was collected, or to meet legal, regulatory, or reporting requirements:

• Active user and merchant accounts: personal information is retained for the duration of active use of the platform.
• Closed or dormant accounts: personal records are securely archived and retained for up to 5 (five) years before being permanently deleted or de-identified, unless a shorter period is requested or a longer period is required by law (e.g. financial/tax record-keeping obligations).
• Records subject to a valid legal hold, dispute, or regulatory investigation will be retained until that matter is resolved.

15. Security Safeguards

Scriptura implements appropriate, reasonable technical and organisational measures to protect personal information against loss, damage, unauthorised destruction, and unlawful access or processing, including:

• Encrypted connections (HTTPS/TLS) between users and Scriptura's servers;
• Access controls restricting internal access to personal information to authorised personnel on a need-to-know basis;
• Role-based database security rules (Firebase Firestore Security Rules and Storage Security Rules) restricting read/write access to a user's own records, business owners' own records, and administrators;
• Audit logging of sensitive administrative and payout-related actions;
• Reliance on PCI-DSS-compliant payment gateway Operators for handling of banking and card information, such that Scriptura itself does not store full card or bank account numbers where an integrated gateway is used;
• Staff confidentiality undertakings and role-based access reviews conducted on a periodic basis;
• An internal incident response procedure for identifying, containing, and remediating suspected security incidents.

16. Data Breach Notification Procedure

Where Scriptura has reasonable grounds to believe that personal information has been accessed or acquired by an unauthorised person, Scriptura will, in accordance with Section 22 of POPIA:

• Notify the Information Regulator as soon as reasonably possible after discovering the compromise;
• Notify affected data subjects as soon as reasonably possible, unless a public body responsible for the prevention, detection, or investigation of offences requests a delay;
• Include, to the extent known, a description of the possible consequences of the breach, the measures taken or to be taken to address it, and recommended steps data subjects can take to mitigate adverse effects.

17. Your Right to Lodge a Complaint with the Information Regulator

If you believe Scriptura has processed your personal information unlawfully, or has not adequately addressed a complaint raised with the Information Officer, you may lodge a complaint with:

Regulator	Information Regulator (South Africa)
Website	https://inforegulator.org.za
Complaints Email	POPIAComplaints@inforegulator.org.za

18. Availability of this Manual

This Manual is available:

• On the Scriptura AI Assistant website, alongside the Privacy Policy and Terms of Service;
• On request from the Information Officer at info@scripturaaiassistant.co.za; and
• For inspection at Scriptura's registered address during normal business hours, by prior arrangement.

This Manual will be reviewed periodically and updated as Scriptura's processing activities, service offerings, or applicable law change.

19. Annexure A: PAIA Request Form (Form 2)

The prescribed Form 2 (Request for Access to Record) must be used for both PAIA access requests and POPIA access/correction/deletion requests. The current version of Form 2 is published by the Information Regulator and is available at:

• https://inforegulator.org.za (see "PAIA Forms" / "POPIA Forms" sections)

Requesters should NOT rely on a version of Form 2 reproduced in this Manual, as the Regulator periodically updates the prescribed forms. Always download the current version directly from the Regulator's website before submission.

A completed Form 2 should be emailed to: info@scripturaaiassistant.co.za, addressed to the Information Officer, Juan le Roux.

20. Annexure B: Internal Record of Processing Activities (Summary)

This summary is maintained for internal accountability purposes and to support responses to PAIA/POPIA requests. It should be kept up to date by the Information Officer as systems and processes change.

Processing Activity	System / Location	Legal Basis	Retention
User account creation & authentication	Firebase Authentication / Firestore	Consent; contractual necessity	Duration of account + up to 5 yrs after closure
AI Bible-study query processing	Google Gemini API (cross-border)	Explicit consent (special personal information)	As per account retention
Marketplace listing & image storage	Firebase Storage / Firestore	Contractual necessity	Duration of listing + up to 5 yrs
Merchant payout & banking details	Firestore (private subcollection), Stitch / Paystack	Contractual necessity; legal obligation	As required by financial record-keeping law
Affiliate commission tracking	Firestore	Contractual necessity	Duration of affiliate relationship + up to 5 yrs
Website analytics & cookies	Site analytics tooling	Consent (non-essential) / legitimate processing (essential)	Per cookie policy

— End of Manual —

---

© 2026 Scriptura AI Assistant (Pty) Ltd. All Rights Reserved.
Company Registration No: 2026/210982/07 · Tax Reference No: 9264577272 · Registered Address: 543 Pipeline, Agnes Road, Randburg, Gauteng, 2169, South Africa
Information Regulator Registration No: 2026-004268 · Information Officer: Juan le Roux