Prepared in terms of section 51 of the Promotion of Access to Information Act 2 of 2000 (PAIA), as amended, and the Protection of Personal Information Act 4 of 2013 (POPIA). Date of compilation: 12 October 2026. Date of last revision: 12 October 2026.
1. Definitions
- PAIA: Promotion of Access to Information Act 2 of 2000, as amended
- POPIA: Protection of Personal Information Act 4 of 2013
- Regulator: Information Regulator
- Tsamaya, we, us: Tsamaya (Pty) Ltd
2. Purpose of this manual
This manual helps anyone who wants information from Tsamaya to:
- see which categories of records we hold that are available without a formal request;
- understand how to request access to a record we hold, and what it costs;
- know which records we keep because other laws require them;
- contact our Information Officer;
- find the Regulator's Guide on how to use PAIA;
- know why and how we process personal information, about whom, who receives it, whether it leaves South Africa, and how we protect it;
- know what to do if a request is refused.
3. Contact details
Information Officer and head of the body: Kyle Kimble, Director
Telephone: 073 285 5752
Email: info@tsamayaapp.co.za
Postal and physical address: 10 Audocia Place, Hurlingham Manor, Sandton, 2196, South Africa
Website: https://tsamayaapp.co.za
Company registration number: 2023/990736/07
No Deputy Information Officer has been appointed. Requests under PAIA and POPIA go to the Information Officer at the email address above.
4. The Regulator's Guide on how to use PAIA
The Regulator has published a revised Guide on how to use PAIA (the Guide), in an easily understood form, for anyone who wishes to exercise a right under PAIA or POPIA. It is available in each of the official languages and in braille.
The Guide describes, among other things, the objects of PAIA and POPIA, how to request access to a record of a public or private body, the help available from the Regulator and from Information Officers, the fees, and the remedies available when a request is refused.
You can get the Guide from the Regulator's website (https://inforegulator.org.za), from the Regulator's office, or by asking our Information Officer for a copy by email.
5. Records available without a request
The following are freely available on our website, with no request needed:
- our Privacy Policy, Terms of Use and this manual;
- the app's release notes (What's New);
- information about the app, its coverage areas, frequently asked questions and how to contact us.
6. Records kept in terms of other legislation
We keep records as required by the following laws, where they apply to us. A record kept under one of them is available to the persons, and in the manner, that law allows:
- Companies Act 71 of 2008
- Income Tax Act 58 of 1962
- Tax Administration Act 28 of 2011
- Value-Added Tax Act 89 of 1991
- Consumer Protection Act 68 of 2008
- Electronic Communications and Transactions Act 25 of 2002
- Protection of Personal Information Act 4 of 2013
- Promotion of Access to Information Act 2 of 2000
- Trade Marks Act 194 of 1993
- Copyright Act 98 of 1978
7. Subjects on which we hold records
| Subject | Categories of records |
|---|---|
| Company | Memorandum of incorporation, CIPC registration and annual returns, the register of directors and of shareholders |
| Finance and tax | Accounting records, bank statements, invoices, tax returns and correspondence with SARS, app store payout reports, records of subscriptions sold |
| The app and its service | Source code and technical documentation, the risk data (risk areas, roads, hotspots, road closures) and its sources, records of our reviewers' decisions on it, app store listings and declarations |
| App users | The personal information described in our Privacy Policy, kept for the periods it states: reports and feedback, usage events and installation records, crash reports, notification registrations, live trips while they are shared, Premium subscription status |
| Service providers and suppliers | Agreements and their terms, including data processing terms, invoices and correspondence |
| Intellectual property | Trade mark applications and registrations, brand assets, licences |
| Correspondence | Correspondence with app users, suppliers, funders, advisers and authorities |
8. Processing of personal information
8.1 Purposes
We process personal information to provide the Tsamaya navigation service; to review drivers' reports and keep the risk data accurate; to send the notifications a driver has chosen; to sell and manage Tsamaya Premium; to find and fix faults and understand how the app is used; to manage the company, its suppliers and its finances; and to comply with the law.
8.2 Categories of data subjects and their personal information
| Data subjects | Personal information |
|---|---|
| App users (drivers) | A random installation identifier; location while the app is in use (processed on the phone, sent to the services that answer a request, and stored only in reports and shared trips); reports, notes and an optional email address; usage events; crash reports; a notification token, metro and fuel preference; a random subscription identifier and subscription status; network addresses in routine request logs (stored only as a keyed hash with police and roadblock notices) |
| People who follow a shared trip or visit our website | Network address and browser details received by our hosting and map providers; aggregate visit statistics (no cookies); the installation identifier of a person who opens a trip link in the app |
| Reviewers and administrators | Name, email address and account credentials |
| Suppliers, service providers, funders and other contacts | Names, contact details, banking details, agreements and correspondence |
| The director and shareholder | The identity, contact and financial information the law requires us to keep |
An emergency contact a driver chooses in the app stays on the driver's phone; we never receive it.
8.3 Recipients
- Our service providers (operators), each bound by data processing terms, as listed in section 5 of our Privacy Policy: Supabase, Mapbox, Google, HERE, Apple, RevenueCat, Sentry, Anthropic, Expo, Resend, Cloudflare and GitHub.
- Our professional advisers, such as an accountant or attorney, under a duty of confidentiality.
- SARS, CIPC, the Regulator, courts and other authorities, where the law requires it.
8.4 Planned transborder flows
Our service providers process personal information outside South Africa: in the United Kingdom, the European Union and the United States. We transfer it only as POPIA section 72 allows: the recipient is bound by law or by binding data processing terms that give protection substantially similar to POPIA, and the transfer is necessary to provide the service the person asked for. Section 5a of our Privacy Policy gives the details.
8.5 Security measures
- Encryption in transit (HTTPS/TLS) on every network call.
- Row-level security on our database; reports can be added by the app but not read back with its public key, and only authorised reviewers can read them.
- Data minimisation: saved places, trip history and the logbook stay on the driver's phone; network addresses with police notices are stored only as a keyed hash.
- A retention schedule enforced by automatic daily deletion jobs.
- Data processing terms with every service provider.
- A security compromise is reported to the Regulator, through its eServices portal, and to the people affected, as POPIA section 22 requires.
9. How to request access to a record
9.1 The request
Complete Form 2 (Request for Access to Record) prescribed by the PAIA Regulations, 2021, available on the Regulator's website, and email it to our Information Officer at info@tsamayaapp.co.za. Give enough detail for us to identify the record and you, say in which form you want access, and identify the right you want to exercise or protect and explain why the record is needed for it (PAIA section 53). If you ask on behalf of someone else, include proof of your authority to do so.
9.2 Your own personal information
If you want to know what personal information we hold about you, or to have it corrected or deleted, you may email us (POPIA sections 23 and 24). Tsamaya has no accounts, so include the Installation ID from the app (Settings › Help & About), or tell us what you sent and roughly when. We do not charge for confirming what we hold about you or for an electronic copy of it.
9.3 Fees
The fees are those in Annexure B of the PAIA Regulations, 2021:
- a request fee of R140.00, which a personal requester (someone asking for their own personal information) does not pay;
- R2.00 for each printed A4 page;
- R40.00 for a copy on a flash drive you provide;
- R145.00 for each hour, after the first, needed to search for and prepare a record, up to R435.00;
- a deposit of one third of the access fee when the search will take more than six hours;
- postage at actual cost.
Most of our records can be sent by email, and we will tell you before any fee is due.
9.4 Time to decide
We decide on a request within 30 days of receiving it in full. We may extend that once, by up to 30 days, in the circumstances PAIA allows, and we will tell you why.
9.5 Grounds for refusal
We may or must refuse access on the grounds in Chapter 4 of Part 3 of PAIA, including to protect: the privacy of a third person; a third party's commercial information or confidential information; the safety of individuals and property; records privileged from production in legal proceedings; our own commercial information; and research information.
9.6 If your request is refused
Tsamaya has no internal appeal. You may complain to the Information Regulator within 180 days of our decision (PAIA sections 77A and 77B), or apply to a court (PAIA section 78).
Information Regulator: Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191. Complaints about access to information: PAIAComplaints@inforegulator.org.za. Complaints about personal information: POPIAComplaints@inforegulator.org.za. Website: https://inforegulator.org.za.
10. Availability of this manual
This manual is published at https://tsamayaapp.co.za/paia.html. You may also ask the Information Officer for a copy by email at no charge, or a printed copy at R2.00 a page.
11. Updating this manual
We review this manual at least once a year and whenever our details or our processing change.
Issued by Kyle Kimble, Information Officer and Director, Tsamaya (Pty) Ltd.