PAIA Manual
How to request access to a record we hold, and how to exercise your rights over your personal information.
Broker AI (Pty) Ltd t/a Broker AI Registration number 2026/318666/07
Manual compiled in terms of section 51 of the Promotion of Access to Information Act 2 of 2000 ("PAIA"), read with the Protection of Personal Information Act 4 of 2013 ("POPIA")
1. Purpose of this manual
PAIA gives effect to the constitutional right of access to information held by the State and by private bodies where that information is required for the exercise or protection of any right. Section 51 requires every private body to compile a manual setting out how a person may request access to its records.
POPIA gives effect to the constitutional right to privacy and amended parts of PAIA. This manual therefore covers both: how to request access to records, and how to exercise your rights over personal information we hold.
Broker AI (Pty) Ltd is a private body as defined in PAIA. This manual is available free of charge on our website, at our principal place of business, and on request.
2. Particulars of the private body
| Registered name | Broker AI (Pty) Ltd |
| Trading name | Broker AI |
| Registration number | 2026/318666/07 |
| Nature of business | Software as a service for the South African insurance broking industry |
| Physical address | 2 Niagara Road, Tygervalley, Cape Town, 7530 |
| Postal address | 2 Niagara Road, Tygervalley, Cape Town, 7530 |
| Telephone | 082 554 2605 |
| Website | https://broker-ai.org |
Head of the private body / Information Officer
| Full name | Dean Geldenhuys |
| Capacity | Director |
| admin@brokerai.co.za | |
| Telephone | 082 554 2605 |
| Registered with the Information Regulator | Yes — registration number 2026-065219, registered 26 August 2026 |
Deputy Information Officer(s): None appointed.
All requests under this manual must be directed to the Information Officer at the details above.
3. The Guide in terms of section 10 of PAIA
The Information Regulator has compiled a guide explaining how to use PAIA. It is available in the official languages from:
The Information Regulator (South Africa) Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg P.O. Box 31533, Braamfontein, Johannesburg, 2017 Email: enquiries@inforegulator.org.za PAIA enquiries: PAIACompliance@inforegulator.org.za Website: https://inforegulator.org.za eServices Portal: https://eservices.inforegulator.org.za
4. Records available without a PAIA request
The following are available on request or on our website without following the formal PAIA procedure:
- This manual
- Our Privacy Notice
- Our Terms of Service
- Our Security information, and our sub-processor list on request
- Product descriptions, feature documentation and published pricing
- Marketing material
Records filed with a public body and available under other legislation (for example CIPC filings) should be requested from that body.
5. Categories of records held
The categories below are listed for transparency. Listing a category does not mean a request for those records will be granted; every request is assessed on its merits under PAIA.
| Category | Examples |
|---|---|
| Company and statutory | Memorandum of Incorporation, CIPC filings, share register, director and shareholder records, board and shareholder resolutions |
| Financial | Management accounts, annual financial statements, invoices, bank records, tax returns and SARS correspondence, VAT records |
| Customer | Account registration data, subscription and billing records, support correspondence, service usage logs |
| Customer-uploaded content | Policy documents, schedules and client information uploaded by customers, and outputs generated from them. See paragraph 5.1. |
| Employee and contractor | Employment contracts, remuneration records, leave and disciplinary records, CVs, statutory returns (UIF, PAYE, SDL, COIDA) |
| Supplier and contract | Supplier agreements, service level agreements, sub-processor and hosting agreements, NDAs |
| Information technology | System architecture, access logs, security policies, incident records, backup records |
| Intellectual property | Source code, prompts, model configuration, trade marks, designs |
| Compliance | This manual, privacy notice, records of processing operations, data subject requests, breach records, operator agreements |
| Marketing | Prospect and contact lists, consent records, opt-out and suppression registers, campaign records |
5.1 Customer-uploaded content — an important limitation
Where a customer uploads a document containing a third party's personal information, that customer is the responsible party for that information and we act as their operator under POPIA. We hold the record but we do not control it.
Where Broker AI holds client information as an operator for a customer, any access request will be assessed under PAIA, POPIA, the applicable confidentiality obligations and the relevant grounds of refusal. Where appropriate, the requester may be referred to the customer acting as the responsible party.
Requests for information contained in a broker's client file should be directed to that brokerage.
6. Processing of personal information (POPIA)
6.1 Purposes of processing
Account administration and authentication; delivery of the Broker AI service; billing and collection; customer support; security, abuse prevention and diagnostics; service improvement using aggregated usage data; direct marketing where lawfully permitted; and compliance with legal and tax obligations.
6.2 Categories of data subjects and their personal information
| Data subject | Personal information |
|---|---|
| Customers and their users | Name, work email, telephone, brokerage name, FSP number, role, hashed credentials, billing details, usage records, correspondence |
| Customers' clients | Information contained in documents uploaded by customers, including names, contact details, asset and risk information, and policy details |
| Employees and contractors | Identity, contact, banking, tax, remuneration and performance information |
| Suppliers | Contact and banking details of representatives |
| Prospects | Business contact details obtained from public sources, and consent or objection status |
6.3 Recipients
Cloud hosting and infrastructure providers; AI model providers used to generate outputs; a text-extraction provider used to read scanned documents; a real-time messaging provider used to stream job progress; a payment processor; a sanctions and PEP screening provider; professional advisers (legal, accounting, audit); and regulators, courts and law enforcement where legally required.
Our complete current sub-processor list, naming each provider, what it receives and where it processes, is available on request from admin@brokerai.co.za.
6.4 Transborder flows
Customer data, uploaded documents and generated outputs are stored within the Republic of South Africa on Amazon Web Services infrastructure in the af-south-1 (Cape Town) region.
Generating an output requires transmitting document content to AI providers outside the Republic — currently Anthropic, OpenAI and Google — under commercial API licences. Reading scanned documents transmits page images to Google Cloud Vision, also outside the Republic. While an output is being generated, progress and generated text are streamed back to the customer's browser through Pusher infrastructure in the European Union. Names submitted for sanctions and PEP screening are transmitted to Dilisense outside the Republic.
Each transfer is made in terms of section 72 of POPIA on the basis that it is necessary for the performance of our contract with the customer, and that each provider is bound by a data processing agreement imposing obligations materially equivalent to the conditions for lawful processing under POPIA. No provider uses the content to train or improve their models.
Storage remains domestic; it is the transient processing required to generate an output, and the live progress stream, that occur offshore.
6.5 Security measures
Measures under section 19 of POPIA include: encryption in transit (TLS 1.2 or higher) and at rest using AWS KMS, with a customer-managed key for the stores holding customer documents; role-based, least-privilege access control; multi-factor authentication available to all users and enforceable organisation-wide by a customer's administrator; rate limiting and throttling on authentication endpoints; a web application firewall in front of the application and API; access logging and monitoring; and continuous database backups with a 35-day point-in-time recovery window.
Our security measures, including the controls we do not currently have, are described in full at /security.
6.6 Record of processing operations
We maintain a record of our processing operations as required by section 17 of POPIA. It is held by the Information Officer.
7. How to request access to a record
Step 1. Complete Form 2 (Request for Access to Record of Private Body), Annexure A to the PAIA Regulations published under Government Notice R.757 of 27 August 2021. The form is available from the Information Regulator's website and on request from our Information Officer.
Step 2. Provide sufficient detail for us to identify the record and to identify you. Give an address in the Republic and state how you wish to receive the record.
Step 3. Identify the right you are seeking to exercise or protect, and explain why the record is required for that purpose. A request that does not do this will be refused.
Step 4. Pay the request fee. See section 8.
Step 5. Submit to the Information Officer at admin@brokerai.co.za or 2 Niagara Road, Tygervalley, Cape Town, 7530.
Our response. We will decide within 30 days of receiving a compliant request, and notify you in writing. The period may be extended by a further 30 days in the circumstances set out in section 57 of PAIA. If we fail to respond within the period, the request is deemed to have been refused. If access is granted, an access fee may be payable before the record is released.
If a third party's interests are affected, we must notify them and give them an opportunity to make representations before deciding.
8. Fees
Two fees may apply: a request fee, payable on submission, and an access fee covering search, reproduction and preparation, payable before release.
The amounts are those prescribed in the PAIA Regulations published in the Government Gazette from time to time, currently Government Notice R.757 of 27 August 2021 as amended. We charge no more than the prescribed amounts. The current schedule is published by the Information Regulator and is available from our Information Officer free of charge on request.
No fee is payable for:
- a request by a personal requester for their own personal information
- an objection to processing (Form 1, POPIA Regulations)
- a request to correct or delete personal information (Form 2, POPIA Regulations)
A deposit may be required where preparation is estimated to exceed six hours.
9. Grounds on which access may be refused
PAIA obliges or permits refusal in the circumstances set out in Chapter 4 of Part 3, including:
| Section | Ground |
|---|---|
| 63 | Unreasonable disclosure of a third party's personal information |
| 64 | Commercial information of a third party — trade secrets, financial or commercial information likely to cause harm, information supplied in confidence |
| 65 | Research information of a third party, or of the body itself |
| 66 | Protection of safety of individuals and of property |
| 67 | Records privileged from production in legal proceedings |
| 68 | Our own commercial activities — trade secrets, research information, computer programs |
| 69 | Research information of a third party or of ours |
| 70 | Mandatory disclosure in the public interest, which overrides certain of the above |
Where part of a record may be refused and part released, we will release the severable part.
10. Remedies if a request is refused
There is no internal appeal against a decision of a private body.
You may:
- Complain to the Information Regulator in terms of section 77A of PAIA, using Form 5, within 180 days of the decision. Send to PAIAComplaints@inforegulator.org.za.
- Apply to court in terms of section 78 of PAIA, within 180 days of the decision.
11. Exercising your POPIA rights
| Right | How |
|---|---|
| Access to your personal information — s 23 | Form 2 (PAIA Regulations), to the Information Officer |
| Correction or deletion — s 24 | Form 2 (POPIA Regulations), to the Information Officer. Free of charge |
| Objection to processing — s 11(3) | Form 1 (POPIA Regulations), to the Information Officer. Free of charge |
| Opt out of direct marketing — s 69 | Reply to any marketing message, or email admin@brokerai.co.za. Free of charge, and we accept objections through any reasonable channel |
| Complain to the Regulator | Form 5, to POPIAComplaints@inforegulator.org.za |
We respond to POPIA requests within 30 days.
12. Availability of this manual
This manual is available:
- on our website at https://broker-ai.org/paia, including as a downloadable PDF
- at our principal place of business during business hours
- from the Information Officer on request, free of charge
- on the Information Regulator's website, where lodged
13. Updating
This manual is reviewed at least annually and whenever our processing operations change materially. The Information Officer is responsible for keeping it current.
Annexure A — Prescribed fees
The fees payable are those prescribed in the PAIA Regulations, Government Notice R.757 of 27 August 2021, as amended from time to time. Because the gazetted amounts are periodically updated, we do not reproduce them here in a form that could fall out of date. The current schedule is published by the Information Regulator at https://inforegulator.org.za and a copy will be supplied free of charge by our Information Officer on request.
Annexure B — Forms
| Form | Purpose | Source |
|---|---|---|
| PAIA Form 2 | Request for access to record of a private body | Annexure A, GN R.757 of 2021 |
| POPIA Form 1 | Objection to the processing of personal information | Annexure A, POPIA Regulations |
| POPIA Form 2 | Request for correction or deletion of personal information | Annexure A, POPIA Regulations |
| PAIA Form 5 | Complaint to the Information Regulator | Information Regulator |