PAIA Manual

This manual is published for MRM Support ("we", "us"), a private body as defined in PAIA. It explains how to request access to records we hold and describes how we process personal information. It is available on this website, at our offices, and from the Information Regulator on request.

Information Officer: Laura M Stucky (Information Regulator registration 18193/2021-2022/IRRTT)
Email: hello@mrmsupport.co.za (attention: Information Officer)
Phone: +27 11 476 3932

The Information Regulator publishes a Guide on how to use PAIA, in all official languages, with everything a person needs to exercise their rights under PAIA and POPIA. Obtain it from the Regulator: inforegulator.org.za, enquiries@inforegulator.org.za, 010 023 5200, or Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg.

• Content published on this website, including service and case study material
• Our Privacy Policy and this PAIA Manual

Subject to the grounds of refusal in PAIA, we hold records in these categories:

• Statutory and corporate records
• Financial and tax records
• Human resources records
• Operational and client records (agreements, research and fieldwork records, correspondence)
• Personal information records (described in section 8)

Records may also be held under other legislation, including the Companies Act 71 of 2008, the Income Tax Act 58 of 1962, the Value-Added Tax Act 89 of 1991, the Basic Conditions of Employment Act 75 of 1997, the Labour Relations Act 66 of 1995, the Unemployment Insurance Act 63 of 2001, and the Compensation for Occupational Injuries and Diseases Act 130 of 1993.

• Complete the prescribed request form (Form 2 of the PAIA Regulations, 2021), available from the Information Regulator's website, and send it to the Information Officer at the contact details above.
• Identify the record and the right you seek to exercise or protect, and provide proof of identity.
• The prescribed request and access fees apply, unless you request your own personal information.
• We respond within 30 days as required by PAIA.
• If a request is refused, you may lodge a complaint with the Information Regulator or apply to court.

You may ask whether we hold personal information about you, request access to it, and request correction or deletion of information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or unlawfully obtained (sections 23–24 of POPIA), using Form 2 of the POPIA Regulations or a substantially similar form. We verify a requester's identity before acting. Where we process personal information as an operator for a client, we refer the request to the client and assist in resolving it.

• Purposes: customer and employee experience research, close-the-loop programmes, call centre and support services on behalf of business clients; responding to enquiries; employment administration.
• Categories of data subjects and personal information: survey and research participants and our clients' customers (contact details, interaction records, survey responses); website visitors (name, email, company); employees and applicants (HR records).
• Recipients: service providers processing on our behalf under data processing terms (cloud hosting, email and productivity providers); reports to the client responsible for the research programme.
• Cross-border transfers: processing occurs primarily in South Africa; any transfer abroad meets the conditions of section 72 of POPIA.
• Security measures: encryption in transit and at rest, role-based least-privilege access, managed and encrypted devices, audit logging, and a documented security incident response plan.

This manual is available on this website and at our offices, and is reviewed at least annually and updated whenever material changes occur.