PAIA manual

Last updated 13 October 2026

This manual is published by Crypti (Pty) Ltd (“Crypti”, “we”, “us”), the private body that provides Torque, under section 51 of the Promotion of Access to Information Act 2 of 2000 (PAIA) and section 17 of the Protection of Personal Information Act 4 of 2013 (POPIA).

It tells you what records we hold, which of them you can have without asking, how to request the others, what it costs, and how we process personal information.

1. Purpose of this manual

PAIA gives everyone the right to request access to records held by a private body when the record is required to exercise or protect a right. This manual helps you to:

see which categories of records we hold, and which are available without a formal request;
make a request for access to a record, and know what information the request needs;
know the fees, time limits and grounds on which a request may be refused;
know how we process personal information, who receives it, whether it leaves South Africa, and how we protect it;
know how to complain to the Information Regulator if you are unhappy with our response.

2. Contact details

Private body: Crypti (Pty) Ltd
Registration number: 2023/626567/07
Head of the private body and Information Officer: Chad Michael Blanchard
Deputy Information Officer: none appointed; requests go to the Information Officer
Street and postal address: 281 Chopin Avenue, Centurion, 0157, South Africa
Telephone: +27 83 408 1999
Email: [email protected]
Website: torque.crypti.co.za

Send requests for access, and any questions about this manual, to the Information Officer at the email or address above.

3. Guide to PAIA from the Information Regulator

Section 10 of PAIA requires the Information Regulator to publish a guide on how to use PAIA and POPIA to exercise your rights. The guide is available in every official language from the Information Regulator’s website, inforegulator.org.za, and from the Regulator’s offices. You may also inspect or ask for a copy of it from our Information Officer during office hours.

Information Regulator: Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191; telephone 010 023 5200 or toll-free 0800 017 160; [email protected]; inforegulator.org.za.

4. Records available without a request

The following records are published and available to anyone without a request under PAIA (section 52):

the information on our website, including the product description, the questions and answers, and announcements;
our privacy policy, terms of service and this manual, at torque.crypti.co.za;
information about Torque that we have published in marketing material or press releases.

No notice under section 52(2) has been published in the Government Gazette. The list above is published voluntarily.

5. Records held under other legislation

We keep records as required by the following laws, where they apply to us. Some of them are available to the persons those laws name:

Companies Act 71 of 2008
Income Tax Act 58 of 1962, Value-Added Tax Act 89 of 1991 and Tax Administration Act 28 of 2011
Basic Conditions of Employment Act 75 of 1997, Labour Relations Act 66 of 1995, Employment Equity Act 55 of 1998, Unemployment Insurance Act 63 of 2001, Unemployment Insurance Contributions Act 4 of 2002, Skills Development Levies Act 9 of 1999 and Compensation for Occupational Injuries and Diseases Act 130 of 1993
Consumer Protection Act 68 of 2008
Electronic Communications and Transactions Act 25 of 2002
Protection of Personal Information Act 4 of 2013
Promotion of Access to Information Act 2 of 2000
Copyright Act 98 of 1978

6. Subjects and categories of records we hold

A record listed here is not automatically available: access is subject to the grounds for refusal in section 10.

Company and statutory

memorandum of incorporation, registration documents and CIPC filings
securities register, and records of directors and shareholders
resolutions and minutes

Financial and tax

annual financial statements, accounting records and management accounts
bank statements, invoices and payment records
tax returns, assessments and correspondence with the South African Revenue Service

People

employment and contractor agreements
payroll, leave and tax records
records required by labour legislation

Customers and the Torque service

waitlist entries and consent records
account records: email address, display name, sign-in records, preferences and product-update consent
organisation records: names, members, roles, invitations, verified domains, settings and audit events
Git host connection records: repository and branch metadata, and encrypted access tokens
customer content stored in a customer’s organisation, which belongs to that customer
support correspondence

Suppliers and agreements

agreements with suppliers and operators (hosting, email delivery, error monitoring, analytics, CRM)
correspondence with suppliers

Information technology and security

system architecture and security documentation
server logs, error reports and backups
incident records

Intellectual property and marketing

source code, designs and trade marks of Torque and Crypti
marketing material and website analytics (collected only with consent)

7. How we process personal information

Our privacy policy at torque.crypti.co.za/privacy describes this in full. In summary:

Purposes

providing the Torque service to account holders and their organisations;
managing the waitlist and, with consent, sending product updates;
security, abuse prevention, audit trails and debugging;
measuring use of the website, with consent;
running the company: accounting, tax, employment and supplier management;
meeting legal obligations.

Data subjects and categories of personal information

Website visitors: truncated network addresses, browser identifiers and page interactions (analytics only with consent).
Waitlist members: email address, and optionally name, company, role and team size; consent records; campaign parameters.
Account holders and organisation members: email address, display name, avatar, password hash or sign-in provider identifier, session records, roles and audit events.
Git host users: user names and identifiers attached to connections, repositories and commits.
Customers’ own data subjects: whatever personal information a customer places in its organisation, which we process on that customer’s instructions.
Employees, contractors, directors and shareholders: identity, contact, employment, tax and banking details.
Suppliers: contact persons’ names, email addresses and telephone numbers, and banking details.

Recipients

Operators who process on our behalf: Hetzner Online GmbH (hosting and backups), Cloudflare, Inc. (DNS, network protection and file storage), Twilio Inc. (SendGrid email delivery), Functional Software, Inc. (Sentry error monitoring), Google LLC (sign-in and analytics), Loops, Inc. (CRM and email).
GitHub, Inc. and GitLab Inc., when a customer connects them.
Our professional advisers, auditors and banks, where needed.
Regulators, courts and law enforcement, where the law requires it.

Transfers across borders

Our servers, databases and backups are hosted in the European Union. Several operators above process data in the United States of America. We transfer personal information outside South Africa only as POPIA section 72 allows.

Security measures

A separate database for each organisation; envelope encryption of secrets with a master key held outside the database; password hashing; TLS on every connection; encrypted backups; access to production limited to the people who operate it, with administrative actions logged; and a breach response that meets POPIA section 22.

8. How to request access

Complete Form 2 (Request for access to record) of the PAIA Regulations, 2021. It is available from the Information Regulator’s website or from our Information Officer.
Send it to the Information Officer by email to [email protected], or by post or hand to 281 Chopin Avenue, Centurion, 0157, South Africa.
Describe the record in enough detail for us to identify it, say in which form you want access, and give an email address, postal address or fax number for our reply.
Identify the right you want to exercise or protect, and explain why the record is required for that right (PAIA section 53(2)(d)).
If you are asking on behalf of someone else, include proof of the capacity in which you make the request.
If you have a disability that prevents you from reading or completing the form, you may make the request orally and the Information Officer will help you complete it.

To ask for your own personal information, or for its correction or deletion, you may also follow the steps in our privacy policy. Requests for your own personal information do not attract the request fee.

9. Fees

These are the fees for private bodies in Annexure B of the PAIA Regulations, 2021, as published by the Information Regulator. We charge no more than these amounts and waive them where we reasonably can.

Request fee, payable before we process the request (not payable by a personal requester): R140.00
Photocopy or printed copy, per A4 page or part of a page: R2.00
Copy in computer-readable form, on a flash drive or compact disc you provide: R40.00; on a compact disc we provide: R60.00
Transcription of an audio record, per A4 page: R24.00
Copy of an audio record, on a flash drive or compact disc you provide: R40.00; on a compact disc we provide: R60.00
Transcription or copy of visual images: the quoted cost of the service provider
Search for and preparation of the record, for each hour or part of an hour after the first hour: R145.00, to a maximum of R435.00
Deposit, where the search will take more than six hours: one third of the access fee
Postage, email or other electronic transfer: the actual cost, if any

If your request is refused, any deposit is repaid. Records sent by email in the form we already hold them usually cost nothing beyond the request fee.

10. Our decision and grounds for refusal

We decide on a request within 30 days of receiving it with any required fee, and tell you of the decision in the form you asked for. We may extend the period once, by up to 30 days, for the reasons in section 57 of PAIA, and will tell you why. If we do not decide within the time allowed, the request is regarded as refused (section 58).

If a record concerns a third party, we notify that party within 21 days and give them 21 days to respond before we decide (sections 71 to 73).

We may refuse access only on the grounds in Chapter 4 of Part 3 of PAIA, including where disclosure would:

unreasonably disclose personal information about a third party who is a natural person (section 63);
disclose a third party’s trade secrets or confidential commercial information (sections 64 and 65);
endanger the life or safety of a person, or the security of property or systems (section 66);
disclose records privileged from production in legal proceedings (section 67);
disclose our own trade secrets, confidential commercial information, or information that would harm our competitive position (section 68);
disclose research information that would expose the researcher or the research to serious disadvantage (section 69).

We must nevertheless grant access where disclosure would reveal a substantial contravention of the law or an imminent and serious public safety or environmental risk, and the public interest clearly outweighs the harm (section 70). If we cannot find a record or it does not exist, we will tell you by affidavit or affirmation (section 55).

11. If you are unhappy with our decision

We are a private body, so there is no internal appeal. Within 180 days of our decision you may:

complain to the Information Regulator using its PAIA complaint form (Form 5), sent to [email protected] (section 77A); or
apply to a court with jurisdiction for appropriate relief (section 78).

12. Availability and updates

This manual is published at torque.crypti.co.za/paia-manual, and a copy is available for inspection at 281 Chopin Avenue, Centurion, 0157, South Africa during office hours, free of charge. A printed copy costs R2.00 per page. We will give the Information Regulator a copy on request.

We review this manual at least once a year and whenever our records or processing change, and update the “Last updated” date when we do.