PAIA manual

1. About this manual

1.1 This manual is published under section 51 of the Promotion of Access to Information Act 2 of 2000 ("PAIA"), as amended by the Protection of Personal Information Act 4 of 2013 ("POPIA").

1.2 PAIA gives everyone a right of access to records held by a private body when the record is needed to exercise or protect a right, subject to the grounds for refusal in PAIA. This manual explains what records Underwing holds and how to ask for them.

1.3 It also describes how Underwing processes personal information, as section 51 of PAIA (as amended by POPIA) requires.

1.4 Underwing publishes this manual whether or not an exemption for small private bodies applies to it.

2. Words we use

• Information Officer: the person responsible for PAIA and POPIA compliance at Underwing. For a private body this is the head of the body by default.
• Personal information, data subject, responsible party, operator: as defined in POPIA.
• Record: any recorded information, in any form, that Underwing holds or controls.
• Requester: a person who asks for access to a record.
• Regulator: the Information Regulator.

3. Who we are, and how to contact us

Name	Under Bridges Entity (Pty) Ltd, trading as Underwing
Registration number	2016/469951/07
Head of the private body	P.J. Mbedzi, Director
Information Officer	P.J. Mbedzi
Deputy Information Officer	None designated
Email for PAIA and POPIA requests	privacy@underwing.co.za (reaches the Information Officer)
Telephone	071 095 0660
Physical address	127 East Road, 47 3rd on East, Pomona, Kempton Park, South Africa
Postal address	127 East Road, 47 3rd on East, Pomona, Kempton Park, South Africa
Website	underwing.co.za

Underwing is a South African subscription service providing security awareness training: it teaches organisations' teams to recognise and resist phishing, fraud, malware and other attacks, through short video lessons, quizzes, challenges and manager reports.

4. The Regulator's guide on how to use PAIA

4.1 The Information Regulator has updated and made available a guide on how to use PAIA and POPIA, as section 10 of PAIA requires. The guide explains, among other things, how to make a request, the help available, the fees, and the remedies if a request is refused.

4.2 The guide is available in each of the official languages:

• on the Regulator's website, inforegulator.org.za;
• from the Regulator's office, on request (using the form the PAIA Regulations prescribe for this, Form 1);
• in the Government Gazette.

4.3 You can also ask us for a copy, and you can inspect it at our office during business hours.

4.4 Information Regulator contact details:

• Address: Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191
• Telephone: 010 023 5200 (toll-free 0800 017 160)
• General enquiries: enquiries@inforegulator.org.za
• PAIA complaints: PAIAComplaints@inforegulator.org.za
• POPIA complaints: POPIAComplaints@inforegulator.org.za
• Website: inforegulator.org.za

Check the Regulator's website for its latest contact details.

5. Records available without a request

5.1 Underwing hasn't made a formal description of automatically available records under section 52 of PAIA. The following are, however, freely available on our website without a PAIA request:

• this manual;
• our privacy policy, terms of service, data processing agreement template and cookie notice;
• our trust centre: what we store, where, our processors, our security measures and how to report a vulnerability;
• product, pricing and programme information;
• Field Notes and other published articles.

5.2 Clients can download their own completion records, certificates and reports through the Service.

6. Records kept under other laws

Underwing keeps records in line with the laws that apply to it, which may include the following. This isn't a complete list, and some records held under these laws may be available only to the person or authority the law names.

• Basic Conditions of Employment Act 75 of 1997
• Companies Act 71 of 2008
• Compensation for Occupational Injuries and Diseases Act 130 of 1993
• Consumer Protection Act 68 of 2008
• Electronic Communications and Transactions Act 25 of 2002
• Employment Equity Act 55 of 1998
• Income Tax Act 58 of 1962
• Labour Relations Act 66 of 1995
• Promotion of Access to Information Act 2 of 2000
• Protection of Personal Information Act 4 of 2013
• Skills Development Levies Act 9 of 1999
• Tax Administration Act 28 of 2011
• Unemployment Insurance Act 63 of 2001 and Unemployment Insurance Contributions Act 4 of 2002
• Value-Added Tax Act 89 of 1991 (once Underwing is registered for VAT)

7. Records we hold

These are the subjects and categories of records Underwing holds. Listing a record here doesn't mean access will be granted; each request is considered under PAIA.

Subject	Categories of records
Company and governance	Registration documents, directors' records, resolutions, shareholder records
Finance and tax	Financial statements, accounting records, invoices, payment records, tax returns and SARS correspondence, bank statements
Clients	Client agreements, order forms, quotes, data processing agreements, correspondence, billing records, subscription history
Client service data	Organisation settings, manager accounts, learner enrolments, completion records, results by field mark, reports, certificates, audit logs (held mainly as operator for clients)
Suppliers and processors	Supplier agreements, data processing agreements, invoices, due diligence records
Staff and contractors	Employment and contractor agreements, payroll, tax and UIF records, leave records, training records, confidentiality undertakings
Security and compliance	Security policies, incident response plan, incident and breach records, access reviews, penetration test reports, POPIA and PAIA records, Information Officer registration
Content and intellectual property	Scripts, video lessons, designs, production records, licences, consents and releases from actors and contributors, trade mark records
Marketing	Marketing consents (Form 4), opt-out records, published content, event records
Website and systems	System documentation, technical logs, backups

8. How to request access

8.1 Use Form 2. Requests must be made on Form 2 of the PAIA Regulations (Request for access to record). It is available on the Regulator's website, or from us on request.

8.2 Send it to our Information Officer by email to privacy@underwing.co.za, or by hand or post to the address in section 3.

8.3 What to include:

• enough detail for us to identify the record or records you want;
• the form of access you want (for example, a copy by email, or inspection);
• your contact details;
• the right you are trying to exercise or protect, and why you need the record for it (section 53(2)(d) of PAIA);
• proof of identity; and
• if you are asking on behalf of someone else, proof of your authority to do so.

8.4 If you need help to complete the form, ask the Information Officer.

8.5 Personal information about you. If you want to know what personal information Underwing holds about you, you may simply email privacy@underwing.co.za. See also section 11.

8.6 Timing. We'll decide on your request within 30 days of receiving it. We may extend this once, by up to 30 more days, in the circumstances PAIA allows (for example, where the request is for a large number of records, or we need to consult others). We'll tell you in writing before the first 30 days end if we need more time, and why. If we don't decide within the time allowed, the request is regarded as refused.

8.7 Third parties. If the record contains information about a third party, PAIA may require us to tell them and give them a chance to make representations before we decide.

8.8 Our decision. We'll tell you in writing whether access is granted. If it is refused, we'll give reasons with reference to the relevant sections of PAIA, and tell you how to complain or apply to court.

9. Fees

9.1 Fees are as prescribed in the PAIA Regulations. They may include:

• a request fee, payable before we process a request (except for a request for your own personal information);
• an access fee, for searching for and preparing the record, and for copies; and
• a deposit, where the search and preparation is expected to take longer than the time the regulations allow without one.

9.2 We'll tell you in writing what fees apply before doing the work. Some requesters are exempt from paying fees under the regulations.

9.3 We'll give you access once any fees due have been paid.

10. Grounds for refusal

PAIA requires or allows a private body to refuse access in certain cases. We may refuse access where it is needed to:

• protect the privacy of a third party who is a natural person, including a deceased person (section 63);
• protect the commercial information of a third party, such as trade secrets or information whose disclosure could harm their commercial or financial interests (section 64);
• protect confidential information of a third party, where disclosure would breach a duty of confidence (section 65);
• protect the safety of people and the security of property (section 66);
• protect records that are privileged from production in legal proceedings (section 67);
• protect Underwing's own commercial information, such as trade secrets, information whose disclosure could harm our commercial or financial interests, or information that could put us at a disadvantage in negotiations or competition (section 68);
• protect research information of a third party or of Underwing (section 69).

Security information. Records about Underwing's security controls, such as penetration test reports, will usually fall within sections 66 and 68, because disclosing them could help an attacker. Clients can get summaries under their agreement.

Public interest override. Even where a ground for refusal applies, PAIA section 70 requires us to grant access if disclosure would reveal evidence of a substantial contravention of the law, or an imminent and serious public safety or environmental risk, and the public interest in disclosure clearly outweighs the harm.

11. Remedies

11.1 Underwing is a private body, so there is no internal appeal.

11.2 If you are unhappy with our decision (including a refusal, the fees, an extension or the form of access), you may:

• complain to the Information Regulator within 180 days of the decision (PAIA sections 77A and 77B); or
• apply to court for appropriate relief (PAIA section 78).

12. How we process personal information (POPIA)

12.1 Purposes

Underwing processes personal information to:

• deliver its training programme and free Team Spot Check, on behalf of its clients (as operator);
• run manager accounts, bill clients and keep tax records (as responsible party);
• keep the Service and its users secure, including audit logs and bot protection;
• reply to enquiries, reservations and quote requests;
• send marketing emails to people who have consented, and to existing customers about similar services;
• produce anonymised benchmarks across clients;
• run the optional Voice Test, with explicit written consent;
• employ and pay staff and contractors, and meet legal obligations.

12.2 Categories of data subjects and their information

Data subjects	Personal information
Learners (clients' people)	First name, surname, work email, optional department, lesson completion, quiz results stored as scores per field mark, certificates, email delivery events
Team Spot Check participants	First name, surname, work email, optional department, results by field mark
Client managers and billing contacts	Name, work email, organisation, role, sign-in credentials (passkey public key or authenticator enrolment, not passwords), billing contact details, audit log entries
Clients (organisations)	Organisation name, registration and VAT numbers, address, subscription and billing records
Website visitors and enquirers	Name, work email, organisation, team size, message; technical information such as IP address and browser type
Voice Test participants	Name, voice recording and voice clone (special personal information: biometric), consent records. Recordings and clones are deleted the same day.
Suppliers and processors	Contact names, email addresses, telephone numbers, banking and tax details, contracts
Staff and contractors	Identity and contact details, banking details, tax and UIF details, employment records, training records
Actors and contributors	Contact details, contracts, consents and releases, payment details

12.3 Recipients

Personal information may be shared with:

• clients' authorised managers (learners' and Spot Check participants' results only);
• Underwing's processors: Amazon Web Services (database and backups), Vercel (hosting), Resend (email delivery), Paystack (payments) and Cloudflare (bot protection and video streaming);
• professional advisers, auditors and insurers, under confidentiality;
• SARS and other authorities, where the law requires it.

Underwing doesn't sell personal information.

12.4 Cross-border transfers

Personal information is stored in South Africa, in Amazon Web Services' Cape Town region (af-south-1). Some processors (Vercel's edge network, Resend for email delivery, Cloudflare and Paystack) process limited information outside South Africa. These transfers are covered by data processing agreements with standard contractual clauses, as POPIA section 72 allows. Special personal information isn't transferred outside South Africa unless the law allows it, including any prior authorisation the Regulator requires.

12.5 Security measures

Underwing protects personal information with:

• no passwords: email links plus a mandatory passkey for managers, short-lived single-purpose links for learners, and hardware keys for staff;
• collecting the minimum and deleting it on schedule;
• separation between clients enforced in the application and again in the database, with automated tests on every build;
• encryption in transit and at rest, including backups;
• card details handled only by Paystack;
• security headers, input validation, rate limits and bot checks, and logs that contain no personal information;
• an append-only audit log of sign-ins, exports, views of individual results, billing changes and staff actions;
• tested backups, an incident response plan, quarterly access reviews and an independent penetration test.

More detail is in our privacy policy and data processing agreement.

13. Objection, correction and deletion under POPIA

13.1 You can object to the processing of your personal information on Form 1 of the POPIA Regulations, and ask for correction or deletion on Form 2 of the POPIA Regulations. Send these to privacy@underwing.co.za. We'll provide the forms on request, and an email is enough to start.

13.2 Where Underwing processes your information as an operator for a client, we'll pass your request to that client, as the responsible party, and tell you we have done so.

13.3 You may complain to the Information Regulator at any time (see section 4.4).

14. Availability of this manual

14.1 This manual is available on our website at underwing.co.za/legal/paia, and for inspection at our office during business hours.

14.2 You can ask for a copy by email at no charge. A fee as prescribed may apply to printed copies.

15. Updates

We review this manual at least once a year and whenever our records or processing change materially. The date at the top shows when it was last updated.

Issued by: P.J. Mbedzi, Information Officer, Under Bridges Entity (Pty) Ltd, trading as Underwing. Date: 8 October 2026