PAIA manual
1. Purpose of this manual
PAIA gives everyone the right to request access to records held by a private body when the record is needed to exercise or protect a right, subject to the grounds of refusal in PAIA. This manual tells you what records Luciatech (Pty) Ltd, trading as Prysly ("Prysly"), holds and how to ask for them. It also describes how Prysly processes personal information, as section 51(1)(c) requires.
Prysly runs a free browser extension that shows the price history of products on 35 South African store websites and cheaper prices at the other stores, and the website prysly.com. Prysly has no user accounts and does not collect names or contact details of the shoppers who use it.
2. Our details
| Name of private body | Luciatech (Pty) Ltd, trading as Prysly |
|---|---|
| Registration number | 2019/548229/07 |
| Head of the private body and Information Officer | The Information Officer, Luciatech (Pty) Ltd |
| Physical address | Sandton, Johannesburg, South Africa |
| Postal address | Same as the physical address |
| privacy@prysly.co.za | |
| Website | prysly.com |
No Deputy Information Officer has been appointed. If one is appointed, their details will be added here.
3. The Information Regulator's guide
The Information Regulator has published a guide on how to use PAIA and POPIA (section 10 of PAIA). It is available in all official languages from the Information Regulator (you can ask for a copy with PAIA Form 1):
- Website: inforegulator.org.za
- General enquiries: enquiries@inforegulator.org.za
- PAIA complaints: PAIAComplaints@inforegulator.org.za
- Address: Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191
Please check the Regulator's website for its current contact details. A copy of the guide can also be inspected at our address during business hours, on request.
4. Records available without a request
Section 51(1)(b)(ii): Prysly has not published a notice under section 52(2) of PAIA. The following records are nevertheless freely available on our website, without a PAIA request:
- Privacy policy, terms of use, affiliate disclosure, cookies and storage and this manual;
- information about the extension and the supported stores on the home page.
5. Records kept under other laws
Where they apply to Prysly, we keep records as required by, among others:
- Companies Act 71 of 2008;
- Income Tax Act 58 of 1962, Value-Added Tax Act 89 of 1991 and Tax Administration Act 28 of 2011;
- Electronic Communications and Transactions Act 25 of 2002;
- Consumer Protection Act 68 of 2008;
- Protection of Personal Information Act 4 of 2013 and Promotion of Access to Information Act 2 of 2000;
- Basic Conditions of Employment Act 75 of 1997 and related labour laws, if Prysly has employees.
6. Subjects and categories of records
| Subject | Categories of records |
|---|---|
| Company | Incorporation documents, memorandum of incorporation, registers of directors, minutes and resolutions |
| Finance and tax | Accounting records, bank statements, invoices, tax returns, affiliate commission statements and payments |
| Agreements | Affiliate programme agreements with stores and affiliate networks; agreements with service providers (hosting, database, AI, email) |
| Price data | Products and store listings (title, barcode, model, brand, page address, latest price, stock status); price history; unconfirmed unusual prices; new-listing confirmations; stock reports (out of stock and back in stock); store configurations |
| Service logs | Click logs for store links (listing, store, time, whether it was an affiliate link, whether it was a repeat click); hourly store health counts |
| Customer data (minimal) | Daily one-way IP codes stored with prices sent by the extension, unconfirmed prices, new-listing confirmations, stock reports and store health counts. No names, accounts, email addresses or IP addresses of shoppers are kept |
| Correspondence | Emails from members of the public, including POPIA and PAIA requests and complaints |
| Intellectual property and technology | Source code of the extension, server and website; brand assets; security and operational documentation |
| Personnel (if any) | Employment contracts, payroll and tax records of employees and contractors |
Listing a category does not mean every record in it will be made available: access is subject to PAIA's grounds of refusal.
7. Processing of personal information
7.1 Purposes
- Working out price histories, verdicts and cheaper offers, and keeping them accurate (confirmation of unusual prices and new listings by different shoppers);
- preventing abuse of the service (rate limits) and detecting stores whose pages can no longer be read;
- counting clicks on store links, including reconciling affiliate commissions;
- answering questions and requests from members of the public;
- managing suppliers, affiliate programmes, finances and legal obligations.
7.2 Categories of data subjects and their personal information
| Data subjects | Personal information |
|---|---|
| Shoppers using the extension | Daily one-way codes derived from IP addresses (see the privacy policy). No names, contact details, accounts or IP addresses |
| Members of the public who contact us | Email address, name if given, and the content of the message |
| Suppliers, affiliate networks and stores (their representatives) | Names, business contact details, contract and banking details |
| Directors, employees and contractors (if any) | Identity, contact, employment, payroll and tax details |
7.3 Recipients
- Service providers acting as operators: Railway (server hosting), MongoDB Atlas (database), Resend (service alert emails to Prysly's own team, with no shopper information), our website host and email provider;
- Anthropic, PBC or OpenAI, L.L.C., one at a time (AI product matching, page reading and coupon terms), receives public product information and owner-written coupon descriptions only, never personal information;
- affiliate networks and stores receive a click reference number for commission reconciliation, which does not identify a person;
- professional advisers, auditors, banks, the South African Revenue Service and other authorities, where needed or required by law.
7.4 Planned transborder flows
The Prysly server and database are hosted in the European Union and may be processed outside South Africa by our operators. Transfers take place only as section 72 of POPIA allows, for example to recipients bound by agreements or rules that give protection substantially similar to POPIA. Requests to Anthropic, PBC or OpenAI, L.L.C. (AI product matching, page reading and coupon terms) are processed in the United States under its API terms and contain no personal information.
7.5 Security measures
- Encrypted connections (HTTPS) between the extension and the Prysly server;
- the Prysly service doesn't store or log IP addresses, only one-way daily codes made with a secret key (the hosting provider may keep standard request logs);
- rate limits on the service, and automatic deletion of time-limited records;
- access to hosting and database accounts limited to the people who run Prysly;
- breach notification to the Information Regulator and affected people as section 22 of POPIA requires.
8. How to request access
- Complete Form 2 (Request for access to record, regulation 7 of the PAIA Regulations), available from the Information Regulator's website or from us on request.
- Send it to the Information Officer by email to privacy@prysly.co.za or by post or hand to Sandton, Johannesburg, South Africa.
- Describe the record you want in enough detail for us to find it, say how you want access (for example a copy by email), and state the right you want to exercise or protect and why the record is needed for it (section 53).
- If you ask on behalf of someone else, include proof of your authority. We may ask for proof of identity.
- If you cannot read or write, or have a disability, you may make the request orally and we will help you complete the form.
We will decide on your request within 30 days of receiving it, and may extend that once by up to 30 more days in the circumstances section 57 allows, telling you why. If we do not answer in time, the request is regarded as refused (section 58).
To ask for your own personal information under POPIA (rather than a record under PAIA), you can simply email us; see "Your rights" in the privacy policy.
9. Fees
Fees are those prescribed under the PAIA Regulations, as published by the Information Regulator in its PAIA fees structure (private body fees), as amended from time to time. In summary:
- a request fee is payable before we process a request, except by a personal requester asking for their own personal information (PAIA section 54(1));
- an access fee covers searching for, preparing and copying the records, and if the search and preparation will take more than 6 hours, we may ask for a deposit of one third of the access fee;
- we will tell you the amount and how to pay before any fee is due. You may apply to the Information Regulator or a court about a fee or deposit.
10. Refusal and remedies
We may refuse access only on the grounds in Part 3, Chapter 4 of PAIA, for example to protect the privacy of a third party, commercial information of a third party or of Prysly, confidential information, the safety of people or property, or records privileged from production in legal proceedings. If we refuse, we will give reasons. There is no internal appeal against a private body's decision. If you are unhappy with a decision, you may complain to the Information Regulator within 180 days of our decision, or of the 30-day deadline passing without one (sections 77A and 77B, using PAIA Form 5). You must use this complaint procedure before applying to court (section 78).
11. Availability of this manual
This manual is available on our website at prysly.com/legal/paia-manual.html, for inspection at our address during business hours, free of charge, and to the Information Regulator on request. A copy can be emailed to you on request; the prescribed fee for a copy may apply. We review it at least once a year and whenever our processing changes.