PAIA and POPIA Manual

1. About this manual

This manual explains what records Certiva (Pty) Ltd holds, how to ask for access to them, and how Certiva processes personal information. It is available on certiva.co.za and, on request, by email.

2. Contact details

• Name of private body: Certiva (Pty) Ltd
• Registration number: 2026/338141/07
• Head of the private body and Information Officer: Bhavik Daya (director)
• Postal and physical address: Durbanville, Cape Town, 7551. The full street address is held by the Information Regulator and is given to any requester who needs it to deliver a request; ask by email or phone.
• Telephone: 083 406 0222
• Email: hellocertiva@gmail.com
• Website: certiva.co.za

3. Guide by the Information Regulator

The Information Regulator has published a guide on how to use PAIA and POPIA, in all official languages, at inforegulator.org.za. You can contact the Regulator at Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191, at enquiries@inforegulator.org.za or on 010 023 5200.

4. Records available without a request

These are freely available on certiva.co.za: the terms of service, the privacy policy, the cancellation and refund terms, prices and what each pass includes, and the exam information pages.

5. Records kept under other legislation

Where it applies to Certiva, records are kept under the Companies Act 71 of 2008, the Income Tax Act 58 of 1962, the Tax Administration Act 28 of 2011, the Value-Added Tax Act 89 of 1991 (if registered), the Electronic Communications and Transactions Act 25 of 2002, the Consumer Protection Act 68 of 2008, POPIA, and the Health Professions Act 56 of 1974 for CPD records submitted to the HPCSA.

6. Subjects and categories of records

• Company: registration documents, director and shareholder records, minutes.
• Finance and tax: payment records, invoices, bank statements, tax returns.
• Customers: account records, purchases and access, study progress, CPD completions and certificates, CVs and cover letters saved by the user, email choices, support and feedback correspondence.
• Suppliers and service providers: agreements and correspondence with hosting, database, email, payment and analytics providers.
• Content: question banks, course material and website content.

7. Processing of personal information

Purposes

The purposes are set out in section 3 of the privacy policy. They include providing accounts and exam preparation, processing payments, issuing CPD certificates and submitting CPD points to the HPCSA, saving CVs, and sending account emails (marketing emails only with consent).

Data subjects and their information

• Users: name, email, HPCSA number (optional), purchases and access dates, answers and results, CPD completions, CVs and cover letters, email choices and usage data.
• People named in a user's CV: for example referees' names and contact details, which the user adds.
• People who send feedback or join a waitlist: email address and what they send.
• Suppliers: contact and payment details.

Recipients

PayFast (payments); Supabase (database and logins); Netlify (hosting and server functions); Google (email sending and Google Analytics); Meta (advert measurement); the HPCSA (CPD points); SAMA and UCT (to verify CPD completions where required); and authorities where the law requires.

Transborder flows

Supabase (EU, Ireland), Netlify, Google and Meta process information outside South Africa. This happens under section 72 of POPIA, with providers bound by laws or agreements that give comparable protection.

Security measures

Encrypted connections (HTTPS); row-level access rules so each user can read only their own records; server-side checks for payments and access; card details are never held by Certiva (PayFast handles them); access to production systems is limited to the director; and the database host takes daily backups.

8. How to request access

1. Complete Form 2 (Request for Access to Record), prescribed in the PAIA Regulations, 2021. It is available from the Information Regulator's website.
2. Email it to the Information Officer at hellocertiva@gmail.com.
3. Give enough detail to identify the record, and say how you want access, for example a copy by email.
4. If you ask on someone else's behalf, say in what capacity.

Certiva will decide within 30 days. This can be extended once, by up to 30 days, as PAIA allows.

Your own personal information. Signed-in users can download a copy of everything their account holds at any time, free: Account, then Your data, then Download my data. They can also ask for correction or deletion there.

9. Fees

Fees are those prescribed for private bodies in the PAIA Regulations. There is no fee for a requester asking for their own personal information.

10. Grounds for refusal

Certiva may refuse access on the grounds in Chapter 4 of Part 3 of PAIA, including protecting another person's privacy, commercial information of Certiva or a third party, confidential information, and legally privileged records.

11. Remedies

If you are unhappy with a decision, you may lodge a complaint with the Information Regulator (PAIAComplaints@inforegulator.org.za for access decisions, POPIAComplaints@inforegulator.org.za for privacy complaints), or apply to court within 180 days.

12. Availability and updates

This manual is on certiva.co.za and can be emailed on request. It will be updated when anything material changes.