PAIA manual | LitreIQ

DRAFT - [REVIEW NEEDED BY attorney] before relying on it. Last updated 30 October 2026.

1. About this manual

This manual explains which records Blue Oceans Approach (Pty) Ltd holds, how you can ask for access to them, and how we process personal information. It is available on this website and, on request, by e-mail at no charge. [VERIFY: also keep a copy at the registered office as required]

2. Company details

Name	Blue Oceans Approach (Pty) Ltd
Registration number	2019/629537/07
Trading as / product	LitreIQ
Head of the private body	[REVIEW NEEDED BY attorney: name of the director acting as head]
Information officer	[REVIEW NEEDED BY attorney: name the information officer and confirm registration with the Information Regulator]
Deputy information officer	[REVIEW NEEDED BY attorney: name, if appointed]
E-mail	privacy@litreiq.com
Postal and street address	[REVIEW NEEDED BY attorney: registered address as recorded at CIPC; PAIA s51(1)(a) requires it]
Telephone	[REVIEW NEEDED BY attorney: company telephone number]
Website	https://www.litreiq.com

3. Guide from the Information Regulator

The Information Regulator has published a guide on how to use PAIA and POPIA to exercise your rights (section 10 of PAIA). It is available in the official languages on the Regulator's website at https://inforegulator.org.za, or from the Regulator:

PAIA complaints: PAIAComplaints@inforegulator.org.za
General enquiries: enquiries@inforegulator.org.za
Telephone: 010 023 5200
Address: Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191

4. Records available without a request

The following are available without a formal PAIA request: the content of this website, including product information, pricing, our privacy notice, terms of use and security page. No notice under section 52(2) has been published. [REVIEW NEEDED BY attorney]

5. Records held in terms of other legislation

We keep records as required by, among others, the Companies Act 71 of 2008, the Income Tax Act 58 of 1962, the Value-Added Tax Act 89 of 1991 (once registered), the Tax Administration Act 28 of 2011, the Basic Conditions of Employment Act 75 of 1997, the Labour Relations Act 66 of 1995, the Employment Equity Act 55 of 1998, the Unemployment Insurance Act 63 of 2001, the Skills Development Levies Act 9 of 1999, the Electronic Communications and Transactions Act 25 of 2002, the Consumer Protection Act 68 of 2008 and POPIA. [REVIEW NEEDED BY attorney: confirm list]

6. Categories of records we hold

Subject	Examples of records
Company and statutory	Memorandum of incorporation, CIPC records, share register, minutes and resolutions
Finance and tax	Financial statements, accounting records, invoices, tax returns and assessments
People	Employment contracts, payroll records, leave and disciplinary records, contractor agreements
Clients	Subscription and operator agreements, trial records, correspondence, invoices, support tickets
Client business data	Data that clients process through LitreIQ. We hold this as an operator on behalf of each client. Requests for it should be made to the client concerned, as the responsible party.
Marketing and leads	Enquiries from website forms, consent and opt-out records
Suppliers and partners	Supplier and partner agreements, correspondence, invoices
Information technology	System documentation, security policies, audit logs, incident records
Intellectual property	Software source code, product designs, trade mark applications

Listing a category does not mean every record in it will be released. Access may be refused on the grounds set out in Chapter 4 of Part 3 of PAIA, for example to protect the privacy of third parties, commercial information, confidential information or the safety of individuals.

7. How to request access

Complete the prescribed request form (Form 2 under the PAIA Regulations, 2021), available on the Information Regulator's website. [VERIFY current form number]
Send it to the information officer at privacy@litreiq.com.
Give enough detail for us to identify the record and you, state the form of access you want, and identify the right you are exercising or protecting and why the record is needed for it (section 53 of PAIA).
If you ask on behalf of someone else, include proof of your authority.
Pay the request fee (see below), where it applies.

We will decide on your request within 30 days of receiving it, and tell you the outcome. That period may be extended once by up to 30 days in the circumstances set out in section 57 of PAIA. If we refuse access, we will give reasons and tell you how to challenge the decision.

8. Fees

The fees are set by the PAIA Regulations, 2021. In summary [VERIFY all amounts against the current regulations before publishing]:

A request fee, payable by requesters other than personal requesters (a person asking for their own personal information does not pay the request fee). [VERIFY amount]
An access fee for reproducing the record (for example per printed page or per electronic copy) and, where the search and preparation take longer than the prescribed time, a search fee per hour. [VERIFY amounts]
Where a deposit is allowed by the regulations, we will tell you the amount in writing before we start. [VERIFY]

You may apply to be exempted from fees in the circumstances the regulations allow.

9. Processing of personal information (POPIA)

9.1 Purposes

To provide the LitreIQ service to clients, as their operator.
To respond to enquiries, run trials, demos and Profit Protection checks.
To manage our employees, contractors, suppliers and partners.
To meet our legal, tax and accounting obligations.
To keep our systems secure and prevent fraud.
To send marketing to people who opted in.

9.2 Categories of data subjects and information

Data subjects	Personal information
Website visitors and leads	Name, business, role, cellphone, e-mail, number of sites, systems used, messages, consent records, technical logs
Client contacts and users	Name, role, contact details, login and activity records
Clients' staff and customers (processed as operator)	As instructed by each client, which may include shift and transaction records, masked card digits and, where a client chooses, payroll, health (such as medicals) or biometric (such as clocking) information, flagged as special personal information
Employees and contractors	Identity, contact, banking, tax, employment and payroll information
Suppliers and partners	Contact persons, company and banking details

9.3 Recipients

Our staff who need the information, our operators (hosting, security and e-mail providers) under written agreements, the vendors of systems a client chooses to connect (as sub-operators), professional advisers, and regulators or authorities where the law requires. We do not sell personal information.

9.4 Transfers across borders

Client data, connection details and logs are stored in South Africa (Amazon Web Services, Cape Town region). Where a client connects a system run by a vendor outside South Africa, that vendor receives only what its own service needs, and only on the client's instruction. Any transfer is made only as allowed by section 72 of POPIA. [REVIEW NEEDED BY attorney]

9.5 Security measures

Encryption in transit and at rest, separate encryption keys per client for connection secrets, separation of each client's data, role-based access, audit logs, read-only connections by default, and an incident response procedure that includes notifying clients without undue delay. More detail is on our security page.

10. Requests about your own personal information

You may ask us to confirm, correct or delete your personal information, or object to its processing, under sections 23 to 25 of POPIA. Use the forms prescribed by the POPIA Regulations, 2018 where they apply (for example the forms for objections and for requests for correction or deletion), or e-mail us. [VERIFY form numbers]

11. Availability and updates

This manual is reviewed at least once a year and whenever our records or processing change.