PAIA Manual
This manual is published in terms of section 51 of the Promotion of Access to Information Act, 2 of 2000 (PAIA), and incorporates the processing information required by the Protection of Personal Information Act, 4 of 2013 (POPIA). Elev8r IO (Pty) Ltd trades through three divisions, which are not separate legal entities: Elev8r (elev8r.co.za), EngaigeNow (engaigenow.com, app.engaigenow.com) and Learnrv8 (learnrv8.com). Because these are all part of one juristic person, this single manual covers all of them.
1. Company and Information Officer contact details
| Registered name | Elev8r IO (Pty) Ltd |
|---|---|
| Registration number | 2023/566721/07 |
| Information Officer | Andrew Flinders (registered with the Information Regulator) |
| andrew@flinders.co.za | |
| Telephone | +27 10 141 2563 |
| Address | 1st Floor, Cradock Square, Rosebank, Johannesburg, 2196 |
| Websites | elev8r.co.za · engaigenow.com · app.engaigenow.com · learnrv8.com |
Requests for access to records, and all PAIA or POPIA enquiries, should be directed to the Information Officer at the details above.
2. The Guide referred to in section 10 of PAIA
The Information Regulator has published a Guide, in each official language, on how to use PAIA. It is available from the Information Regulator (JD House, 27 Stiemens Street, Braamfontein, Johannesburg; enquiries@inforegulator.org.za).
3. Records available in terms of other legislation
The Company keeps records under, among others, the Companies Act 71 of 2008, the Income Tax Act 58 of 1962 and Tax Administration Act 28 of 2011, the Value-Added Tax Act 89 of 1991, the Basic Conditions of Employment Act 75 of 1997, the Labour Relations Act 66 of 1995, the Unemployment Insurance Act 63 of 2001, COIDA 130 of 1993, the Electronic Communications and Transactions Act 25 of 2002, the Consumer Protection Act 68 of 2008 and POPIA. Where such legislation grants a right of access, those records are available in terms of that legislation.
4. Records automatically available (no PAIA request needed)
- The content of the Company's websites listed above;
- The privacy policy of each division, published at /privacy on each website;
- Marketing and product information, pricing pages and user guides;
- This manual.
5. Records held by the Company
Listing a category here does not mean access will be granted — every request is assessed under Part 3 of PAIA, including the grounds for refusal in Chapter 4.
- Corporate and administrative: statutory company records, financial and tax records, contracts, insurance policies;
- Personnel: employment contracts, remuneration and performance records;
- EngaigeNow division: business customer, onboarding and billing records; patron loyalty profiles (mobile number, optional name, points); receipt submissions; collection orders; guest WiFi consent logs; reviews; engagement analytics; security audit logs;
- Learnrv8 division: employer (tenant) records; learner identity records supplied by employers; training, assessment and competency records; WhatsApp channel linking and message records; security audit logs;
- Elev8r division: email enquiries; leads captured through the website chat assistant;
- Information technology: system and access logs, backups, configuration records.
6. Processing of personal information (POPIA)
Purposes: providing the platforms and services above; account administration and billing; loyalty programmes, order fulfilment, guest WiFi and workplace training; responding to enquiries and sales leads; security, fraud prevention, audit logging and legal compliance.
Data subjects and categories of information: business customers and their staff (contact and billing details, account credentials); patrons (mobile number, optional name, loyalty and purchase history, receipt images, WiFi consent logs); learners (identity details supplied by employers, training and competency records); website visitors (chat messages and volunteered lead details); employees (employment records).
Recipients: service providers processing on the Company's behalf, each limited to its function — Google Cloud (hosting), Cloudflare (CDN), Anthropic (AI reading of menus, receipts and website chat), Meta/WhatsApp Business Platform (Learnrv8 WhatsApp channel), payment providers (Paystack; Yoco, Ozow or iKhokha on the venue's own account), SendGrid (email) and SMS providers (Infobip, Twilio) — plus regulators or courts where disclosure is required by law. The Company does not sell personal information and does not share it for advertising.
Transborder flows: some providers process information outside South Africa; such transfers are made under section 72 of POPIA to recipients bound by protections substantially similar to POPIA's conditions.
Security measures (s19): encrypted connections (HTTPS), encrypted secrets and hashed passwords, tenant isolation at database level, role-based access, security audit logging, and breach notification under section 22.
Data subject participation: access, correction, deletion and objection requests go to the Information Officer. Where the Company processes as an operator for a responsible party (an employer on Learnrv8, a venue on EngaigeNow), the request will be coordinated with that responsible party. Complaints: POPIAComplaints@inforegulator.org.za.
7. How to request access to a record
- Complete Form 02 (Request for Access to Record), available from inforegulator.org.za, and send it to the Information Officer;
- Identify the record and the right you seek to exercise or protect;
- Pay the prescribed fees in Annexure B of the PAIA regulations where applicable (individuals requesting their own personal information pay no request fee);
- The Company responds within 30 days. If refused, you may complain to the Information Regulator or apply to court.
8. Availability of this manual
This manual is available on each of the Company's websites at /paia, at the Company's address above for inspection during business hours, from the Information Officer on request, and to the Information Regulator on request. It is reviewed at least annually.