PAIA manual

Private body

AINEXIM (Pty) Ltd, which runs Ubonile

Registration number

[CIPC registration number]

Head of the body

[Name of the head of the private body]

Information Officer

[Information Officer name]

Email

[Information Officer email]

Street and postal address

[Registered address]

Telephone

[Telephone number]

We are required to register our Information Officer with the Information Regulator and to publish this manual (POPIA section 55 and PAIA section 51). [Registration date and reference, to be added]

The Information Regulator publishes a guide on how to use PAIA. You can find it, and the request forms, on the Regulator's website, inforegulator.org.za.

We hold these kinds of records. Holding a record does not mean you can see it. See "Records we will usually refuse" below.

Requests

The public question: incident type, place, date and time, what to look for, status and review history. The private account and exact pin, encrypted. The case link: station, case number, officer. Moderation notes and the checks the system ran.

Answers and evidence

Footage, photos, audio and written accounts, encrypted, with their fingerprints, processing results, officer questions and replies, and relevance marks. Identity details, encrypted, for the contributors who gave them.

The custody log

An append-only record of actions on each case, and the daily fingerprint of all of them. It holds hashes and event types and no personal information.

Accounts

Name, phone or email, language and notification settings. Followed areas, registered cameras, check requests and answers, inbox messages and push addresses.

Officers and verification

Applications, the steps taken to verify each officer, grants of access to cases, sign-in and session records, and records of what each officer viewed.

Partners

Applications, verification decisions, contact details, join codes and reach counts.

Reports and decisions

Reports from the public about requests and alerts, takedown decisions, break-glass requests and decisions, and rights requests with our answers.

Alerts

Proposals, the sources cited, the second approval, corrections and retractions.

The company

Company and governance records, contracts, policies, and employee and supplier records. [Further categories, to be completed by the Information Officer]

You do not need to make a formal request for these.

• The public pages of this website, including live requests and alerts while they are live.
• The transparency page: our figures, how long we keep data, and the daily fingerprint of the custody log.
• Our privacy page, terms of use, community rules and this manual.
• The records of your own account, which you can download from Settings in My Ubonile.

PAIA lists the grounds on which a private body must or may refuse access. The grounds that matter most for Ubonile are protecting another person's privacy, protecting the safety of a person, protecting information given to us in confidence, and protecting records that relate to a criminal investigation or to legal proceedings.

For that reason we will usually refuse a request for evidence, for the identity of a contributor, for the location of a camera, and for the private account of someone else's request. Where we hold records about you, you have a separate right of access under POPIA, which is explained on the privacy page. [Grounds to be confirmed by the attorney]

1. Fill in the request form that the Information Regulator publishes for private bodies.
2. Say which record you want, as clearly as you can, and which right you want to use it for.
3. Give us an email address or postal address to reply to, and tell us how you would like to receive the record.
4. If you ask for a record about someone else, tell us in what capacity you ask and give us proof of it.
5. Send it to our Information Officer at the email or address above.

PAIA lets a private body charge a request fee and an access fee. The amounts are set by regulation. We will tell you what applies before we charge anything. [Fee position to be confirmed by the attorney]

We will answer within 30 days of receiving a request that is complete. PAIA allows an extension in some cases. If we need one, we will tell you before the 30 days are up and say why. If we refuse, we will give you the reason in writing.

This is the short form. The full account is on the privacy page.

Purposes

Letting people ask about, and answer, requests for evidence of a crime. Passing answers to the verified investigating officer on the case. Verifying officers and partners. Keeping a custody record. Reviewing requests and alerts. Sending the notices people ask for. Running and securing the service.

People we hold information about

People who ask for help, people who answer, camera owners, area followers, investigating officers, partners and staff.

Kinds of information

Contact details, names, case numbers, locations, accounts of events, recordings, and information about alleged criminal behaviour.

Who receives it

The verified investigating officer on the case, our service providers, and a court, the police or the Regulator where the law requires.

Outside South Africa

Evidence stays in South Africa. Message and push delivery, and map tiles, may involve providers elsewhere. See the privacy page.

Security

Application-level encryption, access limited by role and by case, two-person approval for any staff access to evidence, a tamper-evident log, and hardened servers.

If we refuse a request, or you are unhappy with how we handled it, you can complain to the Information Regulator, or apply to a court. We will explain how in our reply.