PAIA Manual

1. Introduction

This manual is published in terms of section 51 of the Promotion of Access to Information Act 2 of 2000 (PAIA). PAIA gives effect to the constitutional right of access to any information held by the state and any information held by another person that is required for the exercise or protection of any right.

This manual describes the records held by Trolley Trekka, the procedure for requesting access to those records, and the grounds on which access may be refused.

This manual must be read together with our Privacy Policy and Terms of Service.

2. Details of the Responsible Party

The Information Officer has been registered with the South African Information Regulator in terms of section 55 of POPIA (registration confirmed April 2026).

3. South African Information Regulator

The Information Regulator is the supervisory authority for both PAIA and POPIA in South Africa. Complaints, enquiries, and breach notifications may be directed to:

4. Guide on How to Use PAIA

The Information Regulator has published a guide on how to use PAIA, available at www.inforegulator.org.za. The guide is available in all official languages.

PAIA requests may be made for records held by Trolley Trekka that are required for the exercise or protection of a right. You do not need to state a reason for requesting access to records about yourself.

5. Records Available Without a Formal Request

The following records are publicly available and do not require a formal PAIA request:

• This PAIA Manual — trolley-trekka.co.za/legal/paia-manual
• Privacy Policy — trolley-trekka.co.za/privacy
• Terms of Service — trolley-trekka.co.za/terms
• Your own personal data (self-service export) — logged-in users may download a full JSON export of their personal data via Account Settings → Download My Data, at no cost and without a formal PAIA request.
• Refund and cancellation policy — trolley-trekka.co.za/refund

6. Categories of Records Held

Trolley Trekka holds the following categories of records. Access to records about you may be requested using the procedure in section 7. Access to records about other persons is subject to the grounds for refusal in section 9.

6.1 User Account Records

• Email address, display name, and account creation date
• Date and time of consent to the Privacy Policy
• Profile photograph (if uploaded)
• Subscription tier and status
• Marketing opt-in status

6.2 Receipt and Purchase Records

• Receipt images uploaded by the user (photographs or scans)
• Store name, purchase date, and currency
• Itemised product names, quantities, and prices extracted by AI
• Total purchase amounts
• Raw text extracted from receipt images

6.3 Nutrition and Dietary Records

• Food group and subgroup classifications of purchased items
• Plate Scores (dietary balance scores derived from purchase history)
• AI-generated dietary recommendations
• User corrections to item classifications

6.4 Household Records

• Household name and membership list (members accepted the sharing arrangement on joining)
• Roles within the household (owner / member)

6.5 Payment and Billing Records

• Subscription plan, billing interval, and status
• Payment event records (event type, reference, date, amount) — retained for 5 years
• No card numbers or banking details are stored; these are held by Paystack

6.6 Technical and Usage Records

• Monthly receipt scan count (used for subscription limit enforcement)
• AI processing logs: model used, token counts, estimated cost per call (anonymised on account deletion)

6.7 Business Records

• Data Processing Agreements with sub-processors (Supabase, OpenAI)
• Information Officer registration certificate
• Internal compliance records and incident logs
• Correspondence relating to PAIA requests or data subject rights

7. Procedure for Requesting Access to Records

7.1 Self-Service (Recommended)

If you are requesting your own personal data, please use the self-service export feature in Account Settings → Download My Data before submitting a formal PAIA request. This is faster and free of charge.

7.2 Formal PAIA Request

To make a formal PAIA request:

1. Complete the prescribed Form C (available from the Information Regulator at www.inforegulator.org.za).
2. Submit the completed form to our Information Officer by email at privacy@trolley-trekka.co.za.
3. Include sufficient detail to identify the records you are requesting and the right you are seeking to exercise or protect.
4. Pay the prescribed request fee (see section 8) where applicable.

We will respond within 30 days of receiving a valid request. This period may be extended by a further 30 days in exceptional circumstances, with written notice to you.

7.3 Third-Party Records

If a request relates to records about a third party (e.g., another user), we will notify that party and give them an opportunity to respond before a decision is made.

8. Fees

Fees are determined by the regulations published under PAIA. Current prescribed fees are available from the Information Regulator. The following general principles apply:

• Request fee: A prescribed fee is payable before a request is processed (except for requests for the requester's own personal information, which are free).
• Access fee: Where records are provided, an access fee may be charged to cover the cost of reproduction (e.g., electronic copies sent by email are generally at minimal cost).
• No fee for self-service export: Requests for your own personal data via Account Settings → Download My Data are always free.
• Indigent requesters: We may waive fees where the requester demonstrates financial hardship.

Please contact us at privacy@trolley-trekka.co.za for the current prescribed fee schedule before submitting a formal request.

9. Grounds for Refusal

Access to records may be refused on the grounds set out in sections 62–69 of PAIA. The main grounds applicable to Trolley Trekka are:

• Protection of third-party privacy (s63): Records containing the personal information of another user will not be disclosed without that person's consent or a compelling public interest.
• Commercial confidentiality (s64): Proprietary business information, including AI model configurations, system architecture, and internal cost data, may be withheld.
• Research records (s65): Internal research or analysis that has not been completed or published may be withheld where disclosure would be harmful.
• Mandatory protection of third-party personal information (s63): We are required to refuse a request where disclosure would involve the unreasonable disclosure of personal information about a third party.

Where a request is refused (in whole or in part), we will provide written reasons for the refusal and inform you of your right to internal appeal and to complain to the Information Regulator.

10. Internal Appeal and External Remedies

If your request is refused or you are dissatisfied with our decision, you may:

1. Internal appeal: Request that the Information Officer reconsider the decision by emailing privacy@trolley-trekka.co.za within 60 days of the decision.
2. Complaint to the Information Regulator: Lodge a complaint with the Information Regulator at eservices.inforegulator.org.za.
3. Court application: Apply to a court for relief in terms of section 78 of PAIA.

11. Availability of This Manual

This manual is available:

• Online at trolley-trekka.co.za/legal/paia-manual
• By email request to privacy@trolley-trekka.co.za (a copy will be provided in PDF or electronic format at no charge)
• By request to the Information Regulator — a copy can be provided on request to eservices.inforegulator.org.za

This manual will be updated as required and whenever significant changes occur to our information holdings or the applicable legislation.