Published by Keychat Solutions (Pty) Ltd in terms of section 51 of the Promotion of Access to Information Act, 2 of 2000 ("PAIA"), read with the Protection of Personal Information Act, 4 of 2013 ("POPIA") and the Regulations of 2021.
PAIA gives effect to the constitutional right of access to information. This manual tells you what records Keychat Solutions (Pty) Ltd ("Keychat", "we", "us") holds, and how to request access to them.
It is published in terms of section 51 of PAIA. Section 51(1) requires every private body to compile a manual describing the body, the records it holds, and the procedure for requesting access. This manual also contains the additional particulars required by the PAIA Regulations of 2021, which oblige a private body to describe how it processes personal information under POPIA.
This manual is available free of charge. Details of where to obtain it appear in section 13.
Keychat is a managed WhatsApp commerce platform. We enable South African food, retail, and service businesses to take orders, manage reservations, sell event tickets, run loyalty programmes, schedule deliveries, and provide customer support through WhatsApp.
Our clients are merchants. Their customers transact with them over a WhatsApp channel that we operate on the merchant's behalf. This distinction matters throughout this manual: for our own business records we are the responsible party, and for a merchant's customer records we act as an operator in terms of sections 20 and 21 of POPIA, processing only on that merchant's instruction.
In terms of section 51(1)(a) of PAIA and section 56 of POPIA, the following person is the Information Officer and the head of the private body. All requests, enquiries, and objections under PAIA or POPIA must be directed to them.
Section 10 of PAIA requires the Information Regulator to publish a guide, in each official language, explaining how to exercise rights under the Act. The guide covers the objects of PAIA, the contact details of information officers, the manner and form of a request, the assistance available, the remedies available, and the fees payable.
The guide is available from the Information Regulator:
Keychat has not published a notice in terms of section 52(2) of PAIA listing categories of records that are automatically available without a request.
The following information is nonetheless freely available on our website and requires no PAIA request:
In terms of section 51(1)(d) of PAIA, Keychat holds records in accordance with the following legislation. Listing an Act here does not mean the records are available on request — it records the legal basis on which they are kept.
| Legislation | Nature of records held |
|---|---|
| Companies Act, 71 of 2008 | Constitutional documents, registers of directors and shareholders, statutory returns, minutes and resolutions |
| Income Tax Act, 58 of 1962 | Tax returns, assessments, employee tax records, supporting schedules |
| Tax Administration Act, 28 of 2011 | Records retained for the prescribed five-year period |
| Value-Added Tax Act, 89 of 1991 | VAT registration, returns, tax invoices, input and output records |
| Basic Conditions of Employment Act, 75 of 1997 | Employment contracts, hours, leave and remuneration records |
| Labour Relations Act, 66 of 1995 | Disciplinary records, grievance records, workplace policies |
| Unemployment Insurance Act, 63 of 2001 | UIF contributions and declarations |
| Compensation for Occupational Injuries and Diseases Act, 130 of 1993 | Injury and return-of-earnings records |
| Skills Development Levies Act, 9 of 1999 | Levy contribution records |
| Protection of Personal Information Act, 4 of 2013 | Processing records, consents, operator agreements, data-subject requests, security-compromise records |
| Electronic Communications and Transactions Act, 25 of 2002 | Electronic transaction and communication records |
| Consumer Protection Act, 68 of 2008 | Customer agreements, terms, complaint records |
| Financial Intelligence Centre Act, 38 of 2001 | Where applicable, verification and transaction records |
In terms of section 51(1)(e) of PAIA, the subjects on which Keychat holds records, and the categories of record within each subject, are as follows.
| Subject | Categories of records |
|---|---|
| Company and statutory | Incorporation documents, memorandum of incorporation, share register, director records, board and shareholder resolutions, statutory filings |
| Financial | Annual financial statements, management accounts, ledgers, bank records, invoices, settlement and reconciliation records, tax records |
| Client and merchant | Onboarding records, service agreements, operator agreements, account configuration, billing records, correspondence, support tickets |
| End-customer data (held as operator) | Mobile numbers, names, delivery and collection addresses, order and transaction history, reservation and ticket records, loyalty balances, WhatsApp conversation records, marketing preferences and opt-out records |
| Personnel and human resources | Employment contracts, personal particulars, payroll, leave, performance, disciplinary and training records |
| Operational and technical | System architecture and configuration, integration records, access logs, audit trails, backup records, incident and change records |
| Marketing and business development | Prospect and enquiry records, campaign records, proposals, case study material |
| Supplier and service provider | Supplier agreements, operator agreements, service level records, invoices |
| Legal, risk and compliance | Contracts, correspondence with advisers, insurance, regulatory correspondence, data-subject requests, security-compromise records |
The particulars below are provided in terms of the PAIA Regulations of 2021, which require a private body to describe its processing of personal information in this manual. Our full Privacy Policy, published at keychat.co.za/privacy, contains the complete description.
We process personal information to take and fulfil orders, manage reservations and ticketing, arrange delivery and collection, process payments, operate loyalty programmes, provide customer support, send direct marketing where it is lawful to do so, prevent fraud and abuse, meet legal and tax obligations, and administer our contracts with merchants.
| Category of data subject | Personal information processed |
|---|---|
| Merchant representatives and staff | Name, job title, business email, mobile number, login and activity records, billing details |
| Customers of merchants (processed as operator) | Mobile number, name, delivery address, order and transaction history, reservation and ticket details, loyalty balances, conversation content, marketing preferences |
| Prospective clients | Name, business contact details, enquiry and meeting records |
| Employees and contractors | Identity, contact, banking, payroll, tax, and employment records |
| Suppliers and service providers | Contact details of representatives, contract and payment records |
| Website visitors | IP address, device and browser information, page interaction data |
We do not intentionally process special personal information as contemplated in section 26 of POPIA, nor the personal information of children as contemplated in section 34.
Personal information may be shared with the following categories of recipient, each engaged as an operator under written agreement, and only to the extent necessary to deliver the service: the WhatsApp Business Platform provider (Meta Platforms); payment providers (Paystack, Yoco); point-of-sale and e-commerce integration providers (Lightspeed, Pilot, Shopify, Ecwid, Sage); delivery providers (Uber Direct, Picup, and merchant-appointed drivers); hosting and infrastructure providers (Cloudflare, DigitalOcean); and analytics and scheduling providers (Google). Personal information is also disclosed to regulators, courts, or law enforcement where the law requires it.
Keychat does not sell, rent, or trade personal information, and does not share one merchant's customer data with another merchant.
Platform data is hosted in South African and European Union data centres. Certain service providers operate global infrastructure and may process personal information outside the Republic. Such transfers are made only on a basis permitted by section 72 of POPIA, and are governed by written data processing agreements.
In terms of section 19 of POPIA we maintain appropriate, reasonable technical and organisational measures, including encryption of data in transit and at rest, role-based access control, network and denial-of-service protection at the edge, logging and monitoring of access to personal information, regular backups with tested restores, contractual confidentiality obligations on staff, written processing agreements with every operator, and periodic review of these safeguards against reasonably foreseeable risks.
A request must be made on the prescribed Form 2 (Request for Access to Record of Private Body) contained in the PAIA Regulations, and delivered to the Information Officer at the address in section 3. The form is available from the Information Regulator's website.
We will decide on the request within 30 days of receiving it and notify you in writing of the outcome. That period may be extended by a further 30 days in the circumstances set out in section 57 of PAIA, in which case we will notify you of the extension and the reasons for it. If the request is refused, we will give adequate reasons, identify the provisions relied on, and explain the remedies available to you.
Where a request relates to a record containing personal information about a third party, we are obliged by section 71 of PAIA to take reasonable steps to inform that third party and give them an opportunity to make representations.
PAIA provides for two categories of fee: a request fee, payable on submission by a requester who is not a personal requester, and an access fee, covering the cost of searching for, preparing, reproducing, and delivering the record.
A personal requester — a person requesting a record containing their own personal information — does not pay a request fee, but may be required to pay an access fee for reproduction.
| Item | Fee |
|---|---|
| Request fee (requester other than a personal requester) | R140.00 |
| Photocopy or printed copy of an A4 page, or part thereof | R2.00 |
| Copy in computer-readable form, on flash drive | R40.00 |
| Transcription of visual images, per A4 page | R70.00 |
| Transcription of an audio record, per A4 page | R24.00 |
| Searching for and preparing the record, per hour or part thereof | R145.00 |
| Postage, email, or other delivery of the record | Actual cost |
Where the search and preparation is expected to exceed six hours, we may require a deposit of one third of the access fee before proceeding. If access is subsequently refused, any deposit paid is refunded. We may withhold a record until the applicable fee has been paid.
PAIA obliges or permits a private body to refuse access in defined circumstances. A request may be refused where granting it would involve:
A request may also be refused where the record does not exist or cannot be found after a reasonable search, in which case we will notify you by way of an affidavit or affirmation as section 55 requires.
Despite the above, section 70 of PAIA requires disclosure where the record reveals a substantial contravention of the law or an imminent and serious public safety or environmental risk, and the public interest in disclosure clearly outweighs the harm.
There is no internal appeal against a decision of the Information Officer of a private body. If your request is refused, or you are dissatisfied with the fee, the form of access, or the extension of the deadline, you may:
Information Regulator (South Africa)
Website: inforegulator.org.za
PAIA complaints: PAIAComplaints.IR@justice.gov.za
POPIA complaints: complaints.IR@justice.gov.za
General enquiries: enquiries.IR@justice.gov.za
This manual is available, free of charge, in English:
This manual is reviewed at least annually, and whenever there is a material change to our operations, the records we hold, or our processing of personal information. The effective date and version number recorded at the top of this manual always reflect the current version.