PAIA manual

Prepared in terms of section 51 of the Promotion of Access to Information Act 2 of 2000 (PAIA), as amended by the Protection of Personal Information Act 4 of 2013.

1. Purpose of this manual

PAIA gives effect to the constitutional right of access to information. It requires every private body to publish a manual explaining what records it holds and how to ask for them. This is that manual. It is written to be used, not to be filed — if you want a record from us, everything you need is below.

2. Particulars of the private body

Name: Dermal Health Science (Pty) Ltd.
Registration number: 2017/269563/07
VAT number: 4400279230
Physical address: Dermal Health Science (pty) Ltd, Menlyn Square Office Park, 134 Aramist Avenue, Newlands, Pretoria, Gauteng, 0181, South Africa
Postal address: As above
Telephone: +27 (0) 12 004 1791
Website: www.dermalhealth.store

3. Information Officer

Requests under this manual are directed to the Information Officer:

Information Officer
Trinette Eckard
Email: trinette@dermalhealth.co.za
Telephone: +27 (0) 12 004 1791
Postal address: as in paragraph 2 above

Under POPIA, the head of a private body is its Information Officer by default. The appointment of the Information Officer must be registered with the Information Regulator, and an Information Officer may take up their duties only once that registration is in place.

4. The Guide published by the Information Regulator

The Information Regulator has published a guide, in each official language, on how to use PAIA. It explains your rights and how to exercise them, and it is more general than this manual. It is available from:

The Information Regulator (South Africa)
Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191
Telephone 010 023 5200 · Toll free 0800 017 160
enquiries@inforegulator.org.za
inforegulator.org.za

5. Records available without a formal request

We have not published a notice under section 52(2) of PAIA. However, the following are freely available on our websites and do not require a request:

• Product information, full INCI ingredient lists and directions for use
• Our privacy policy, POPIA notice, cookie policy, terms of service, returns policy, delivery policy and medical disclaimer
• This manual
• Company contact and registration details

6. Records held in terms of other legislation

We hold records in terms of, among others: the Companies Act 71 of 2008; the Income Tax Act 58 of 1962; the Value-Added Tax Act 89 of 1991; the Tax Administration Act 28 of 2011; the Basic Conditions of Employment Act 75 of 1997; the Labour Relations Act 66 of 1995; the Employment Equity Act 55 of 1998; the Compensation for Occupational Injuries and Diseases Act 130 of 1993; the Unemployment Insurance Act 63 of 2001; the Consumer Protection Act 68 of 2008; the Electronic Communications and Transactions Act 25 of 2002; the Foodstuffs, Cosmetics and Disinfectants Act 54 of 1972; and the Protection of Personal Information Act 4 of 2013.

Access to a record under one of those Acts is not automatic access under PAIA, and vice versa.

7. Subjects and categories of records we hold

Subject	Categories of record
Company records	Founding documents, share register, minutes, resolutions, statutory registers
Financial records	Annual financial statements, ledgers, invoices, bank records, tax returns and assessments
Customer records	Orders, invoices, delivery records, returns and refunds, correspondence
Skin assessment records	Dermal Diagnosis answers, resulting skin profiles and recommended regimens
Product safety records	Adverse reaction reports and their outcomes, batch records
Product and formulation records	Formulations, specifications, ingredient documentation, stability and testing data, supplier records
Practitioner and stockist records	Applications, agreements, account records, training records
Employee records	Contracts, payroll, leave, disciplinary and performance records, statutory returns
Marketing records	Subscriber lists and preferences, campaign records, published reviews
Information technology records	System documentation, access logs, security records, supplier agreements

Listing a category here does not mean every record in it will be released. Paragraph 10 sets out the grounds on which access must or may be refused.

8. How to request a record

1. Complete Form 2 of the PAIA Regulations — the prescribed form for a request to a private body. It is available from the Information Regulator's website, and we will send it to you on request.
2. Give enough detail to identify the record, and to identify the right you are seeking to exercise or protect, and explain why the record is required to exercise or protect it. This is a requirement of section 53(2)(d), and a request that does not address it will usually be refused.
3. Tell us how you want to receive the record and whether you need it in a particular language.
4. If you are asking on someone else's behalf, attach proof of your authority.
5. Send the form to the Information Officer at the address in paragraph 3.

We will respond within 30 days. That period may be extended by up to a further 30 days where the request is for a large number of records or requires a search through records held elsewhere; if we extend it, we will tell you why and you may complain about the extension.

If your request is for personal information about yourself, you are a personal requester, which the Regulations treat differently on fees — we will confirm what, if anything, is payable. You may also find it simpler to email us as described in our POPIA notice.

9. Fees

PAIA provides for two fees: a request fee, payable before a request is processed, and an access fee, covering the cost of searching for, reproducing and preparing the record. The PAIA Regulations determine who pays which fee and how much.

The PAIA Regulations, not us, set the amounts, and they are amended from time to time. The schedule current at any date is published by the Information Regulator at inforegulator.org.za. We will tell you in writing exactly what is payable on your request before any work is done, so you are never billed for something you did not agree to.

Where a request requires a long search, we may ask for a deposit before starting. A deposit may not exceed one third of the access fee that would be payable if the request were granted, and it is refunded in full if we refuse access.

10. Grounds for refusing access

PAIA obliges or permits us to refuse access in defined circumstances. The main ones are:

• Someone else's privacy — mandatory protection of the personal information of a third party who is a natural person (section 63).
• Commercial information of a third party — trade secrets, financial, commercial, scientific or technical information that would harm them, or information supplied in confidence (section 64).
• Confidentiality — where release would breach a duty of confidence owed to a third party (section 65).
• Safety of people and property — where release could endanger a person or the security of property or a system (section 66).
• Legal privilege — records privileged from production in legal proceedings (section 67).
• Our own commercial information — including our formulations, testing data and research (section 68).
• Research information — ours or a third party's, where release would expose the researcher or the subject to serious disadvantage (section 69).
• Frivolous or vexatious requests, or requests involving an unreasonable diversion of resources (section 45).

Access must still be given, despite most of these grounds, where disclosure would reveal a substantial contravention of the law or an imminent and serious public safety or environmental risk, and the public interest in disclosure clearly outweighs the harm — the public interest override in section 70.

If we refuse, we will tell you in writing which ground we relied on and how to take it further.

11. If we refuse, or do not respond

There is no internal appeal against the decision of a private body. You may:

• lodge a complaint with the Information Regulator, using the Regulator's complaint form, at PAIAComplaints@inforegulator.org.za; or
• apply to a court with jurisdiction, in terms of section 78 of PAIA.

12. Personal information

How we collect, use, share and protect personal information — including the health information in a Dermal Diagnosis assessment — is set out in our POPIA notice and our privacy policy. You can exercise your POPIA rights to correction and deletion through that notice, not through this manual.

13. Availability of this manual

This manual is available free of charge:

• on our websites, at this page;
• at our registered address, on request, during business hours;
• by email, on request to the Information Officer.

14. Updating

We review this manual at least annually and whenever our records or contact details change materially. The date at the top of this page reflects the current version.