Draft v1.0 · fixed URL /paia/v1.0 · Envy Fincorp (Pty) Ltd t/a Beedee · placeholders marked [TO CONFIRM]
Prepared under section 51 of the Promotion of Access to Information Act 2 of 2000 (PAIA), as amended by the Protection of Personal Information Act 4 of 2013 (POPIA) · Version 1.0 (draft) · Date: [publish date]
1. About this manual
This manual tells you what records Envy Fincorp (Pty) Ltd t/a Beedee ("Beedee", "we") holds for the Beedee business hub, how to ask for access to them under PAIA, and how we process personal information under POPIA. Envy Fincorp (Pty) Ltd is a private body under PAIA.
Envy Fincorp (Pty) Ltd also trades as Indawo AI. Beedee and Indawo AI are trading names of the same company, which is one responsible party under POPIA with one Information Officer (section 3). This manual covers the records held for the Beedee business. [TO CONFIRM: Scope - confirm: either widen this manual to cover Indawo AI records too, or cross-refer to the Indawo AI manual.]
The manual is available free of charge:
- on our website, beedee.co.za [TO CONFIRM: link - confirm URL, for example beedee.co.za/paia];
- at our principal place of business (address in section 2) during normal business hours; and
- to the Information Regulator on request.
If you ask for a printed copy, we may charge a reasonable fee for printing (PAIA Regulations, Annexure B: R2 per A4 page).
2. Our details
| Name | Envy Fincorp (Pty) Ltd, trading as Beedee (formerly BizKraal); also trades as Indawo AI |
| Registration number | 2021/756475/07 |
| Type of body | Private company (private body under PAIA) |
| Address (and address for legal notices) | 102 Churchill Street, Wendywood, 2090 |
| Postal address | [TO CONFIRM: postal address - confirm, or "as above"] |
| Phone | [phone number - to be added] |
| privacy@beedee.co.za [TO CONFIRM: confirm mailbox] | |
| Website | beedee.co.za |
| Business | Online business hub: tender and lead discovery, tender pipeline and action plans, compliance (KYC) document vault, leads CRM and outreach planning tools for South African businesses |
3. Head of the body and Information Officer
| Head of the private body | [TO CONFIRM: director name - confirm], Director |
| Information Officer | Mr D Mhlaba |
| Deputy Information Officer | [name, if appointed] |
| Email for requests | privacy@beedee.co.za [TO CONFIRM: confirm mailbox] |
| Address | 102 Churchill Street, Wendywood, 2090 |
| Information Regulator registration number | [TO CONFIRM: IR registration number - confirm] |
4. The Information Regulator's PAIA Guide
The Information Regulator has published a Guide on how to use PAIA and POPIA (PAIA section 10). It explains your rights, how to make a request, fees and how to complain. You can get it:
- on the Regulator's website, www.inforegulator.org.za; or
- from the Information Regulator, Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191; P.O. Box 31533, Braamfontein, Johannesburg, 2017; phone 010 023 5200; email enquiries@inforegulator.org.za.
You may also inspect a copy of the Guide at our office during normal business hours.
5. Records available without a request (PAIA section 52)
We have not published a notice under section 52(2). The following are available on our website without a PAIA request: the Beedee Terms of Service, Privacy Notice, Subscription Agreement, Credits and Referral Terms, Direct Marketing Consent rules, this manual, and product and pricing information.
6. Records available under other laws
We keep records as required by, among others:
- Basic Conditions of Employment Act 75 of 1997
- Companies Act 71 of 2008
- Compensation for Occupational Injuries and Diseases Act 130 of 1993
- Consumer Protection Act 68 of 2008
- Electronic Communications and Transactions Act 25 of 2002
- Employment Equity Act 55 of 1998
- Income Tax Act 58 of 1962
- Labour Relations Act 66 of 1995
- Promotion of Access to Information Act 2 of 2000
- Protection of Personal Information Act 4 of 2013
- Skills Development Levies Act 9 of 1999
- Tax Administration Act 28 of 2011
- Unemployment Insurance Act 63 of 2001 and Unemployment Insurance Contributions Act 4 of 2002
- Value-Added Tax Act 89 of 1991 (to the extent it applies)
Some of these records may be available to the public or to specific people under those laws (for example company records at CIPC). This list is not complete.
7. Subjects and categories of records we hold
A record listed here is not necessarily available: access is subject to the grounds of refusal in PAIA (section 9).
| Subject | Categories of records |
| Company and statutory | Memorandum of Incorporation; CIPC registration documents; registers of directors and shareholders; minutes and resolutions; statutory returns |
| Finance and tax | Annual financial statements; accounting records; bank statements; invoices; tax returns and SARS correspondence |
| Users and subscribers | Sign-up records; acceptance logs (terms, privacy notice, subscription agreement); business profiles; plans, invoices and payments; credit ledger; referral and share records; support correspondence |
| Subscriber content (held as operator) | Compliance documents in the KYC vault, leads, contacts, tender records and outreach plans uploaded by subscribers for their own use. These belong to the subscriber as responsible party. Requests for them should be sent to the subscriber; we will forward requests we receive. |
| Opportunity listings | Tender and opportunity records collected from public sources, including issuer contact details |
| Marketing | Waitlist and demo requests, marketing consent and opt-out records, suppression lists, outreach consent request logs |
| Product and technology | Software source code, system design and security documents, audit and server logs, backup records |
| Suppliers and operators | Supplier and operator contracts, invoices and correspondence |
| Staff | Employment and contractor contracts, payroll and tax records, leave and training records, confidentiality undertakings |
| Legal and compliance | Contracts, legal opinions, litigation records, POPIA and PAIA records (requests, incident register, processing records), Information Regulator correspondence |
8. Processing of personal information (POPIA, PAIA section 51(1)(c))
8.1 Purposes of processing
We process personal information to: create and run user accounts and the teaser dashboard; sign users in with one-time codes; match businesses with tenders and opportunities; show opportunity listings from public sources; run the credits, referral and share programme; unlock, bill and support paid subscriptions; verify businesses and prevent fraud and self-referrals; keep the platform secure; send service emails and, with consent, marketing; meet our legal, tax and accounting duties; employ staff; buy from suppliers; and, as operator, store and process the documents and records subscribers upload for their own use.
8.2 Categories of data subjects and information
| Data subjects | Categories of personal information |
| Users (individuals at subscriber businesses) | Name, work email, business name, sectors and provinces of interest, one-time sign-in code data (hashed), IP address, acceptance records, usage and audit logs |
| Subscribers (businesses, including juristic persons) | Registered name, registration number, VAT number, address, B-BBEE level, contact persons, plan, invoices, payments, credit ledger, referral and share records |
| People in subscriber content (as operator) | Directors' and staff details and ID documents in compliance documents (restricted access), lead and contact details, information on race in B-BBEE documents (special personal information) |
| Contact persons in opportunity listings | Names and work contact details published by tender issuers |
| Referred businesses and people | Business name, email, referral code, sign-up and payment status for the referral reward |
| Waitlist, demo and marketing contacts | Name, email, company, segment, consent wording and date, opt-outs |
| Suppliers and staff | Contact, bank, tax and contract or employment details |
8.3 Recipients of personal information
- Our operators (service providers): hosting [TO CONFIRM: hosting provider - confirm, South Africa]; email delivery [TO CONFIRM: email delivery provider - confirm]; card payments [TO CONFIRM: payment provider - confirm].
- Users of the same subscriber business (according to their roles).
- A referrer sees the name of a business it referred and whether the referral was credited.
- Professional advisers, auditors, insurers, banks, SARS and other regulators, courts and law enforcement, where the law requires or to protect our rights.
- A buyer of our business, under confidentiality.
We do not sell personal information.
8.4 Planned transfers outside South Africa
Our servers are in South Africa. [TO CONFIRM: Email delivery provider - confirm country.] [TO CONFIRM: Payment provider - confirm country.] We transfer information only where POPIA section 72 allows.
8.5 Security measures
We use appropriate, reasonable technical and organisational measures, including: hosting in South Africa; HTTPS throughout; passwordless one-time sign-in codes stored only in hashed form; server-side sessions with idle and absolute expiry; protection against cross-site request forgery; strict separation of each subscriber's data; encryption of vault files at rest (AES-256-GCM, a separate key per file); restricted access to director ID documents; an audit log, and append-only credit ledger and consent logs; rate limits; written operator contracts; staff confidentiality; and a security compromise response procedure, including notice to the Information Regulator and affected people under POPIA section 22.
9. How to request access to a record
1. Complete Form 2 (Request for Access to Record) of the PAIA Regulations, 2021. It is on the Information Regulator's website, or we will send it to you on request.
2. Send it to the Information Officer at privacy@beedee.co.za [TO CONFIRM: confirm mailbox] or 102 Churchill Street, Wendywood, 2090.
3. Give enough detail for us to identify the record, say how you want access (copy, inspection, electronic), and give your contact details.
4. Show the right you want to exercise or protect and why the record is needed for it (PAIA section 53(2)(d)).
5. If you ask on behalf of someone else, attach proof of your authority.
6. If you cannot read or write or have a disability, you may ask orally; we will complete the form for you and give you a copy.
To ask for your own personal information, to correct or delete it, or to object to its processing, you may also simply email privacy@beedee.co.za (POPIA sections 23 to 25 and 11(3); POPIA Forms 1 and 2). Confirming whether we hold your information is free.
We will decide within 30 days and tell you in writing. We may extend this once by up to 30 days, with reasons (PAIA section 57). If we do not answer within the time, the request is regarded as refused.
10. Fees
Fees are set in Annexure B of the PAIA Regulations, 2021 (private bodies):
| Item | Fee |
| Request fee (not payable if you ask for your own personal information) | R140.00 |
| Photocopy or printed copy, per A4 page | R2.00 |
| Copy on flash drive (you provide) | R40.00 |
| Copy on compact disc (you provide / we provide) | R40.00 / R60.00 |
| Transcription of an audio record, per A4 page | R24.00 |
| Search and preparation, per hour or part, after the first hour | R145.00 (maximum R435.00) |
| Deposit if search and preparation take more than 6 hours | Up to one third of the access fee |
| Postage, email or electronic transfer | Actual cost, if any |
We will tell you the fees in writing before we do the work. Fees may change when the Regulations change.
11. Grounds for refusal
We may or must refuse access in the cases set out in PAIA Chapter 4 of Part 3, including to protect: the privacy of other people (s63); commercial information of third parties (s64) and of Beedee (s68); confidential information of third parties (s65); the safety of people and property (s66); records privileged from production in legal proceedings (s67); and research information (s69). We will give reasons for any refusal. We must grant access if the public-interest override in section 70 applies.
12. Remedies
There is no internal appeal for private bodies. If you are not satisfied with our decision, you may, within 180 days:
- lodge a complaint with the Information Regulator (PAIA section 77A) using PAIA Form 5, by email to PAIAComplaints@inforegulator.org.za or on the eServices portal; or
- apply to court (PAIA section 78).
Complaints about how we process your personal information may be sent to the Information Regulator at POPIAComplaints@inforegulator.org.za or on the eServices portal.
13. Updates
We review this manual at least once a year and update it when our details or processing change.
Issued by the head of the private body: [TO CONFIRM: director name - confirm], Director · Date: [publish date]