PAIA Manual

1. Purpose and scope

1.1 Purpose

This manual is published under section 51 of the Promotion of Access to Information Act 2 of 2000 (PAIA), as amended by the Protection of Personal Information Act 4 of 2013 (POPIA), and the Regulations Relating to the Promotion of Access to Information, 2021 (the PAIA Regulations). It tells you:

• what records Omnea (Pty) Ltd holds;
• how to request access to them, and what it costs;
• how Omnea processes personal information; and
• what you can do if a request is refused.

1.2 Scope

This manual applies to all records held by Omnea (Pty) Ltd as a private body, whether created before or after PAIA came into force, and to any person who wishes to request access to those records.

Back to top

3. Definitions

• Head: the head of Omnea as a private body under section 1 of PAIA, being the Chief Executive Officer, or the person duly authorised by them.
• Information Officer: the person who acts as Omnea’s information officer for PAIA and POPIA purposes, as appointed under PI-03.
• Personal requester: a requester who asks for a record containing their own personal information.
• Record: any recorded information, in any form or medium, in Omnea’s possession or under its control, whether or not Omnea created it.
• Requester: any person, including a public body, making a request for access to a record of Omnea, or a person acting on their behalf.
• Guide: the guide on how to use PAIA, published by the Information Regulator under section 10 of PAIA.

Back to top

5. Manual

5.1 About Omnea

Omnea (Pty) Ltd is a South African payment facilitator, authorised by the Payments Association of South Africa as a Third-Party Payment Provider and System Operator, and part of the XEA Capital group. Omnea provides payment collection, payout and settlement services to businesses. It is an accountable institution under the Financial Intelligence Centre Act 38 of 2001 (FICA) for the payment services it provides.

5.2 Contact details (section 51(1)(a))

5.3 Guide on how to use PAIA (section 51(1)(b)(i))

The Information Regulator has published a Guide on how to use PAIA, in each official language and in braille. It explains how to exercise your rights under PAIA and POPIA. You can get the Guide from the Information Regulator’s website, or ask the Information Officer for a copy using Form 1 (see Annexure A). A copy is also available for public inspection at Omnea’s offices during normal business hours.

5.4 Records available without a request (section 51(1)(b)(ii))

Omnea has not published a notice under section 52(2) of PAIA. The following records are available on the website, or from the Information Officer, without a formal request:

• company profile and description of products and services;
• PI-10 Privacy Policy and this PAIA Manual;
• contact details and office locations; and
• marketing brochures and press releases.

5.5 Records kept in terms of other legislation (section 51(1)(b)(iii))

Omnea keeps records required by the following legislation, as it applies to Omnea’s business. Some of these records may be available only to the people or authorities specified in that legislation.

5.6 Subjects and categories of records held (section 51(1)(b)(iv))

The following records are not automatically available and must be requested under section 5.9. Listing a category does not mean that access will be granted. Each request is assessed against the grounds for refusal in section 5.12.

5.7 Processing of personal information (section 51(1)(c))

(a) Purposes of processing. Omnea processes personal information to:

• provide payment collection, payout and settlement services to clients;
• carry out customer due diligence and meet its obligations under FICA and other financial sector legislation, including detecting and reporting fraud and money laundering;
• manage relationships with clients, suppliers and partners, including contracting, invoicing and support;
• recruit and employ staff and meet employment, tax and labour law obligations;
• operate and secure its information systems, premises and website; and
• market its services where permitted by section 69 of POPIA.

(b) Categories of data subjects and personal information.

(c) Recipients or categories of recipients. Personal information may be shared with:

• banks, payment system operators, card schemes, clearing and settlement participants, and the Payments Association of South Africa, to process payments;
• the Financial Intelligence Centre, the South African Reserve Bank and other regulators, SARS and law enforcement agencies, where required by law;
• identity verification, fraud prevention and credit bureau service providers;
• operators such as cloud hosting, software, payroll and communication providers, under written agreements (POPIA sections 20 and 21);
• XEA Capital group companies, for shared business functions; and
• auditors, insurers and professional advisers.

(d) Planned transborder flows. Some operators, mainly cloud hosting, software-as-a-service and communication providers, may store or process personal information outside South Africa. Omnea transfers personal information outside South Africa only where section 72 of POPIA permits it.

(e) Security measures. Omnea operates an information security management system aligned with ISO/IEC 27001. Measures include risk assessment, access control and multi-factor authentication, encryption of data in transit and at rest, logging and monitoring, secure software development, supplier security reviews, backups and business continuity planning, staff screening and awareness training, and incident and breach management, including notification under section 22 of POPIA.

5.8 Access to your own personal information

If you want access to personal information Omnea holds about you, you may use the procedure in section 5.9 (POPIA section 23). No request fee is payable by a personal requester. To ask for correction or deletion of personal information, use Form 2 under the POPIA Regulations, 2018. To object to processing, use Form 1 under those Regulations. These forms are available from the Information Officer and the Information Regulator’s website.

5.9 How to request access (section 53)

• Complete Form 2 (Request for Access to Record) under the PAIA Regulations (see Annexure A) and send it to the Information Officer by email, post or hand delivery, using the details in section 5.2.
• Give enough detail to identify the record(s) and yourself, and state the form and manner of access you want.
• Identify the right you want to exercise or protect, and explain why the record is needed for that purpose (section 53(2)(d)).
• Attach a copy of your identity document. If you are acting for someone else, attach proof of your authority to do so.
• Say how you want to be told of the decision (email, post or other).

If you cannot complete the form because of illiteracy or a disability, the Information Officer will help you make the request.

5.10 Fees (section 54)

Fees are prescribed in Annexure B to the PAIA Regulations, 2021 and may be changed by the Minister. Omnea charges the prescribed fees only.

• Request fee: payable by every requester except a personal requester, before the request is processed.
• Access fee: payable if access is granted, covering reproduction and the time reasonably needed to search for and prepare the record.
• Deposit: if the search and preparation will take more than six hours, Omnea may require a deposit of up to one third of the access fee.

Omnea will notify you of fees payable using Form 3. You may apply to court against the fee or deposit required (section 54(3)(b)).

5.11 Timelines (sections 56–58)

Omnea will decide on a request within 30 days of receiving it in the required form. This period may be extended once, by up to 30 more days, in the circumstances set out in section 57, and Omnea will tell you the reasons for the extension. If Omnea does not decide within the required period, the request is regarded as refused (section 58).

5.12 Grounds for refusal (sections 62–70)

Omnea may or must refuse access to a record on the grounds set out in Chapter 4 of Part 3 of PAIA, including where disclosure would:

• unreasonably disclose personal information about a third party who is a natural person (section 63);
• disclose a third party’s trade secrets or commercial, financial, scientific or technical information, or information supplied in confidence (sections 64 and 65);
• endanger the life or physical safety of a person, or the security of property or systems (section 66);
• disclose a record privileged from production in legal proceedings (section 67);
• disclose Omnea’s trade secrets or commercial, financial, scientific or technical information, or harm its commercial or negotiating position (section 68); or
• disclose research information of Omnea or a third party (section 69).

Despite these grounds, access must be granted where section 70 (mandatory disclosure in the public interest) applies. Where a request involves a third party’s information, Omnea will notify the third party and consider their representations before deciding (sections 71–73).

Omnea will also take account of its confidentiality obligations under FICA, including the prohibition on disclosing reports made to the Financial Intelligence Centre, when assessing a request.

5.13 Remedies (sections 77A–78)

Omnea does not have an internal appeal procedure. If you are dissatisfied with a decision, including a refusal, the fees charged, an extension of time, or the form of access granted, you may within 180 days of being notified of the decision:

• lodge a complaint with the Information Regulator using Form 5 under the PAIA Regulations; or
• apply to a court with appropriate jurisdiction for relief.

5.14 Availability and updating of this manual

This manual is available:

• on the Omnea website, www.omnea.co.za;
• for inspection, free of charge, at Omnea’s offices during normal business hours; and
• from the Information Regulator, on request.

A printed copy may be requested from the Information Officer at the prescribed reproduction fee. Omnea updates this manual whenever its contact details, records, processing activities or the applicable law change materially, and reviews it at least once a year.

Back to top

Annexure A: Prescribed forms

The forms below are prescribed by the PAIA Regulations, 2021. The official versions published by the Information Regulator govern. A request that is substantially in the prescribed form will be accepted.

• Official forms: www.inforegulator.org.za/paia
• Form 2: Request for Access to Record (PDF)

A.1 Sending Form 2 to Omnea

Address your request to: The Information Officer, Omnea (Pty) Ltd. Email: support@omnea.co.za · Post: PO Box 41407, Garsfontein East, 0060 · Tel: +27 (0)12 470 4800.

Attach: a copy of your identity document, and proof of authority if you are requesting on behalf of another person.

The form asks for: your particulars; the particulars of anyone you are acting for; a description of the record; the type of record and form of access; the manner of access; the right you want to exercise or protect and why the record is needed; fees and how you want to be told of the decision; and your signature.

Back to top