PAIA and POPIA manual
Version 1, published 14 October 2026. Prepared in terms of section 51 of the Promotion of Access to Information Act 2 of 2000 (PAIA), as amended by the Protection of Personal Information Act 4 of 2013 (POPIA).
This manual tells you what records VIBE FINDER (Pty) Ltd holds, how to ask for access to a record, what it costs, and how we process personal information. It is published here, is available at our registered office on request, and is supplied to the Information Regulator on request. Reading it here is free.
1. Who we are
VIBE FINDER (Pty) Ltd, registration number 2026/607975/07, is a private company registered in South Africa on 30 July 2026, trading as VIBE finder. We run the website and app at vibefinder.co.za, where people discover events near them and organisers list and promote their events. We do not sell tickets.
We are a private body for the purposes of PAIA and a responsible party for the purposes of POPIA. We are registered with the Information Regulator under number 2026-065131.
2. Our Information Officer
- Head of the body and Information Officer: Ruan du Toit, director
- Street and postal address: 2 Jasmine Lane, 149 Glenwood Estate, Brackenfell, 7560
- Phone: 069 532 1731
- Email: support@vibefinder.co.za
- Website: vibefinder.co.za
- Fax: not applicable
We are a small company with no office open to the public. Please send requests by email, or phone to arrange a visit.
3. The Information Regulator's guide
The Information Regulator has published a guide, in every official language, on how to use PAIA and POPIA: how to make a request, the fees, the time limits, the grounds on which a request may be refused, and how to complain. You can read it on the Regulator's website or ask the Regulator for a copy.
- The Information Regulator (South Africa)
- Physical address: Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191
- Toll free: 0800 017 160
- Landline: 010 023 5200
- Email: enquiries@inforegulator.org.za
- Helpdesk and complaint forms: through iSupport, the Regulator's online helpdesk, linked from inforegulator.org.za/contact-us
- Website: inforegulator.org.za
4. Records you can get without a request
These records are available to anyone, free, without a PAIA request:
- Everything on this website: our plans and prices, terms of service, privacy policy, cancellations and refunds policy and this manual.
- Everything shown publicly in the VIBE finder app: published events and public organiser profiles.
5. Records available under other laws
Some of our records may be requested under other laws, on the terms those laws set, by the people they give that right to:
| Law | Records |
|---|---|
| Companies Act 71 of 2008 | Our incorporation documents, memorandum of incorporation, registers of directors and shareholders, and annual financial statements |
| Income Tax Act 58 of 1962 and the Tax Administration Act 28 of 2011 | Tax returns and supporting records |
| Value-Added Tax Act 89 of 1991 | Not applicable while we are not a registered VAT vendor |
| Protection of Personal Information Act 4 of 2013 | Your own personal information (see section 12) |
| Electronic Communications and Transactions Act 25 of 2002 | Records of transactions concluded through our website or app |
| Consumer Protection Act 68 of 2008 | Records of what you bought from us, and of complaints |
| Basic Conditions of Employment Act 75 of 1997, Labour Relations Act 66 of 1995, Unemployment Insurance Act 63 of 2001 | Employment records, if and when we employ staff. We have no employees at the date of this manual. |
6. The records we hold
Subjects on which we hold records, and the categories of record under each. Listing a record here does not mean a request for it will be granted; each request is decided under PAIA.
| Subject | Categories of record |
|---|---|
| Company and statutory | Incorporation and CIPC documents, share register, director records, resolutions, Information Regulator registration, licences and agreements |
| Finance and tax | Bank records, orders, payments, refunds, invoices, receipts, tax records, payment-provider statements |
| Customers and accounts | User and organiser account records, consents and agreements to our terms, settings, saved events and RSVPs, support correspondence |
| Event listings | Events and their images, organiser profiles, verification records, promotion requests and approvals, reports from the public, moderation decisions and copies of removed events |
| Operations and security | Technical logs, the record of privileged actions taken by administrators, security records, suppression records of suspended accounts |
| Suppliers and service providers | Contracts, invoices and correspondence with our hosting, payment, email, map and screening providers |
| Marketing and communications | Website and social media content, correspondence with organisers and the public |
7. How we process personal information
This section gives the information section 51(1)(c) of PAIA requires. Our privacy policy describes the same processing in more detail and is the document to read if you use VIBE finder.
Purposes
- To create and secure accounts and provide the VIBE finder service: showing events near a person, saving events and RSVPs, notifications and service emails.
- To let organisers list, verify and promote events, and to show their public profiles.
- To check listings before they go live and to moderate them, acting on reports from the public.
- To sell plans and promoted periods: taking payment, providing what was bought, keeping the financial records the law requires, and handling refunds and disputes.
- To send event-suggestion emails to people who choose to receive them.
- To keep the service secure and working, and to keep a record of the privileged actions our administrators take.
- To meet our legal obligations and to deal with complaints and legal claims.
Categories of data subjects, and the personal information we hold about each
| Who | What |
|---|---|
| People with an account | Email address; a hashed password, or a Google sign-in; confirmation of being 18 or older (no date of birth); default town; saved events and RSVPs; reports sent; consents and their versions; notifications; moderation records if any; a hashed email address and reason category if the account was suspended |
| Organisers | The above, plus organiser name, bio, profile address, website, and the contact email address and phone number they choose to make public; default venue; events and images; verification records; promotion requests |
| Paying customers | What they bought, when, the price and any discount code, the payment method and reference. Card and Capitec Pay details are given to Paystack directly and never reach us |
| People who contact us | Name, contact details and the content of the correspondence |
| Contacts at suppliers and service providers | Business contact details and correspondence |
We do not process special personal information (such as race, religion, health or biometrics), we do not knowingly process information about children (everyone confirms they are 18 or older when they sign up), and we do not make decisions with legal effect about anyone by automated means alone. Listings are checked partly by automated tools, and a person reviews any listing that is held.
Recipients
We share personal information only with the service providers below, each for one purpose, and with courts, regulators and authorities when the law requires. We do not sell personal information. Organisers never receive information about the people who view or save their events; they see counts only.
| Recipient | What they receive | Purpose | Country |
|---|---|---|---|
| Microsoft Azure | Everything we store | Hosting and database | South Africa |
| OpenAI | An event's title, description, venue name and banner image; an organiser's name and bio. No account details | Checking listings before they go live | United States |
| Stadia Maps | IP address and the map area viewed, sent by the browser | Map images | Outside South Africa |
| OpenStreetMap Nominatim | Addresses typed by organisers, sent from our server | Finding places on the map | Outside South Africa |
| Only for people who choose Google sign-in: their Google account email | Sign-in | United States | |
| Paystack | Account email address, amount and payment reference | Taking payments and refunds | Ireland (data storage) |
| Resend | Email address and the email sent | Service emails | United States (data storage) |
| Afrihost | Email sent to us; visits to this website | Email and website hosting | South Africa |
| Google Fonts | IP address, when this website loads its fonts | Website fonts | United States |
Planned transborder flows
Personal information leaves South Africa only to the recipients marked above as outside South Africa, and only to the extent shown. Each transfer is made under section 72 of POPIA: it is necessary to provide the service the person asked for, or the recipient is bound by law or by agreement to protect the information to a comparable standard.
Security measures
We protect personal information with reasonable technical and organisational measures appropriate to a service of our size: encrypted connections; passwords stored only in hashed form; card details never passing through our systems; access to personal information limited to the people who need it, with administrator actions recorded in a record that cannot be edited or deleted; identifiers rather than names in technical logs; hosting with an established provider in South Africa; and prompt action on security updates. If we believe personal information has been accessed or acquired by an unauthorised person, we notify the Information Regulator and the people affected as section 22 of POPIA requires.
8. How to request a record
- Use the prescribed form. Complete Form 2 (Request for access to record of a private body), which is in the PAIA Regulations of 2021 and on the Regulator's website at inforegulator.org.za. If you cannot use the form, write to us with the same information and we will help.
- Send it to the Information Officer at the address or email in section 2.
- Describe the record in enough detail for us to find it, say in what form you want access (a copy, inspection, an electronic file), and give an address or email for our reply.
- Say which right you need the record to exercise or protect, and why the record is needed for it. PAIA gives access to a private body's records only for that purpose.
- Prove your identity, and if you are asking on someone else's behalf, your authority to do so.
- Pay the request fee in section 9. We tell you the amount and how to pay when we acknowledge your request. If we grant access, we may also charge the access fees in section 9 before giving it.
We decide a request within 30 days of receiving it, or within 30 days of receiving the fee, whichever is later. We may extend that once, by up to 30 days, if the request is large or needs a search through many records, and we tell you if we do. If a record concerns a third party, we must first notify them and give them a chance to object, which may extend the time. If we do not answer in time, the request is treated as refused and section 11 applies.
9. Fees
The fees are set by the PAIA Regulations and published by the Information Regulator. The amounts below are those published at the date of this manual; the Regulator's current table is at inforegulator.org.za/paia-fees-structure-2. If the two differ, the Regulator's table applies.
| Item | Fee |
|---|---|
| Request fee, payable by every requester | R140.00 |
| Photocopy or printed copy, per A4 page or part of a page | R2.00 |
| Copy on a flash drive or CD you provide | R40.00 |
| Copy on a CD we provide | R60.00 |
| Transcription of visual images or audio, per A4 page | R24.00 |
| Search for and preparation of the record, per hour or part of an hour, excluding the first hour | R145.00, up to a maximum of R435.00 |
| Postage, email or other transfer | The actual cost, if any |
If the search is expected to take more than six hours, we may ask for a deposit of one third of the access fee before starting. We do not charge a request fee to a person asking for their own personal information.
10. When a request may be refused
PAIA requires us to refuse access in some cases and allows us to refuse in others (sections 62 to 70). The grounds most likely to apply to our records are:
- the record would unreasonably disclose personal information about another person (section 63);
- the record contains trade secrets or commercial information of another person, including an organiser, that could harm them (section 64);
- the record was supplied in confidence and disclosure would breach a duty of confidence (section 65);
- disclosure could endanger someone's life or safety (section 66);
- the record is privileged in legal proceedings (section 67);
- the record contains our own trade secrets or commercial information and disclosure would harm us (section 68);
- the request is frivolous or vexatious, or would substantially and unreasonably divert our resources (section 54).
Where only part of a record is protected, we give access to the rest (section 65 of PAIA as read with section 28). We must give access despite these grounds where the public interest in disclosure clearly outweighs the harm (section 70).
11. If you are unhappy with our decision
A private body has no internal appeal. If we refuse your request, do not answer in time, or you dispute a fee or the form of access, you may lodge a complaint with the Information Regulator within 180 days of our decision, through the Regulator's iSupport helpdesk or on the complaint form on the Regulator's website, using the contact details in section 3. You may also apply to a court under section 78 of PAIA.
12. Your rights over your own personal information
Separately from PAIA, POPIA gives you rights over personal information about you. You may ask us, free of charge, whether we hold personal information about you and for a description of it; ask for a copy (for which the access fees in section 9 may apply); ask us to correct, update or delete information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or unlawfully obtained; object to processing; and withdraw a consent. Use the forms in the POPIA Regulations (Form 1 to object, Form 2 to request correction or deletion), or simply email support@vibefinder.co.za and we will help. We may need to confirm your identity first. You can also see and change most of your information yourself in your account settings, and delete your account there.
13. Availability and updates
This manual is published at vibefinder.co.za/paia.html, free of charge, in English. A copy can be inspected at our registered address by arrangement, obtained from the Information Officer on request, and is supplied to the Information Regulator on request. We review it at least once a year and whenever the way we process personal information changes, and the version and date at the top show when it last changed.