PAIA manual

The Promotion of Access to Information Act (PAIA) gives everyone the right to request records held by a private body where the record is needed to exercise or protect a right. This manual explains what records [registered name of IDK Solutions: to be supplied], the operator of Noques, holds and how to ask for them. It is published under section 51 of PAIA and also serves the purposes of the Protection of Personal Information Act (POPIA).

Head of the private body

[name of the owner or managing director: to be supplied]

Information officer

[registered information officer: to be supplied]

Postal and physical address

[physical address: to be supplied]

Telephone

+27 71 624 9157

Email

support@noques.com

Website

noques.com

The Information Regulator publishes a guide on how to use PAIA and POPIA to request information, in each official language. It is available at inforegulator.org.za and from the Regulator at Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191, or enquiries@inforegulator.org.za. We will send you a copy on request.

Everything published on noques.com, including our legal documents, pricing and guides, is available to anyone without a request. So is a vendor’s public storefront in the Noques app.

We keep records as required by, among others:

• the Companies Act 71 of 2008
• the Tax Administration Act 28 of 2011, the Income Tax Act 58 of 1962 and the Value-Added Tax Act 89 of 1991
• the Consumer Protection Act 68 of 2008
• the Electronic Communications and Transactions Act 25 of 2002
• the Protection of Personal Information Act 4 of 2013
• the Financial Intelligence Centre Act 38 of 2001

• Company records: registration documents, ownership records, agreements with service providers.
• Financial and tax records: the ledger, bank records, commission and payout records, tax returns.
• Customer records: accounts, orders, payments, refunds, cashback, tickets, reviews and support messages.
• Vendor records: applications, storefront details, listings, commission terms, wallet and payout records, banking details, charity registration documents.
• Market records: market details, stall applications and fees, gate helper applications.
• Technical records: security logs, access records and system configuration.

Purpose

To run the marketplace: accounts, orders, payments, payouts, refunds, tickets, support, safety and fraud prevention, and meeting legal obligations. The privacy policy sets this out in full.

Whose information, and what

• Customers: name, email, optional phone and photo, orders, payment references, cashback, tickets, reviews, messages, search activity.
• Vendors (people and businesses): business and contact details, trading addresses, listings, banking details, commission and payout records, charity documents.
• Market organisers and gate helpers: name, contact details, market and stall records.
• Visitors: contact-form messages and technical logs.

Who receives it

Vendors and organisers for the orders and tickets they fulfil; our service providers Google (Firebase), Yoco, Algolia, Resend and CARTO; and regulators, courts or law enforcement where the law requires.

Transfers outside South Africa

Our backend is hosted in Belgium, and some service providers process information in other countries including the United States, under terms giving protection comparable to POPIA.

Security

Access controlled by database rules and server-side role checks, encryption in transit and at rest, no storage of card details, and a breach response that notifies the Information Regulator and affected people.

1. Complete the request form prescribed under PAIA (Form 2), available from the Information Regulator’s website, or ask us for a copy.
2. Send it to the information officer by email or to the address in section 2. Say which record you want, the right you want to exercise or protect, and how you want to receive it.
3. If a fee applies under the PAIA regulations, we will tell you before doing any work. There is no fee to ask for your own personal information.
4. We will decide within 30 days and tell you in writing. We may extend that once, by up to 30 days, where the Act allows, and will tell you why.

A request may be refused only on the grounds in Chapter 4 of Part 3 of PAIA, for example to protect another person’s privacy, commercial information of a third party, or legally privileged records. If you are refused, you may complain to the Information Regulator or apply to court.

On this page, at the address in section 2, and from the Information Regulator on request. It is updated whenever the information in it changes.