Legal
PAIA manual
Prepared in terms of section 51 of the Promotion of Access to Information Act 2 of 2000 (as amended).
ProSynth is a sole proprietorship owned by Shane Aucamp. Shane Aucamp is also the head of ProSynth for the purposes of PAIA.
- Date of compilation: 16 October 2026
- Date of revision: 16 October 2026
1. List of acronyms and abbreviations
| Acronym | Meaning |
|---|---|
| CEO | Chief Executive Officer |
| DIO | Deputy Information Officer |
| IO | Information Officer |
| PAIA | Promotion of Access to Information Act No. 2 of 2000 (as amended) |
| POPIA | Protection of Personal Information Act No. 4 of 2013 |
| Regulator | Information Regulator (South Africa) |
| Republic | Republic of South Africa |
| the Act | Promotion of Access to Information Act |
2. Purpose of the PAIA manual
This PAIA manual is useful for the public to:
- 2.1 check the categories of records held by ProSynth which are available without a person having to submit a formal PAIA request;
- 2.2 have a sufficient understanding of how to make a request for access to a record of ProSynth, by providing a description of the subjects on which ProSynth holds records and the categories of records held on each subject;
- 2.3 know the description of the records of ProSynth which are available in accordance with any other legislation;
- 2.4 access all the relevant contact details of the Information Officer and Deputy Information Officer who will assist the public with the records they intend to access;
- 2.5 know the description of the guide on how to use PAIA, as updated by the Regulator, and how to obtain access to it;
- 2.6 know if ProSynth will process personal information, the purpose of processing of personal information and the description of the categories of data subjects and of the information or categories of information relating thereto;
- 2.7 know the description of the categories of data subjects and of the information or categories of information relating thereto;
- 2.8 know the recipients or categories of recipients to whom the personal information may be supplied;
- 2.9 know if ProSynth has planned to transfer or process personal information outside the Republic of South Africa and the recipients or categories of recipients to whom the personal information may be supplied; and
- 2.10 know whether ProSynth has appropriate security measures to ensure the confidentiality, integrity and availability of the personal information which is to be processed.
3. Key contact details for access to information of ProSynth
Information Officer registration no. 2026-068901 (Information Regulator, South Africa, 11 October 2026).
ProSynth’s Information Officer is registered with South Africa’s Information Regulator. This is registration only, not independent compliance certification.
3.1 Information Officer
- Name: Shane Aucamp
- Designation: Owner / Information Officer
- Tel: 082 819 4015
- Email: shane@prosynthsystem.com
- Fax number: N/A
3.2 Deputy Information Officer
Designated under PAIA section 17(1) and POPIA section 56.
- Name: Martin Aucamp
- Contact: through the Information Officer's details above
3.3 Access to information general contacts
- National or head office postal address: 7 Fernwood Crescent, Vergelegen, Somerset West, 7130
- Physical address: 7 Fernwood Crescent, Vergelegen, Somerset West, 7130
- Telephone: 082 819 4015
- Email: shane@prosynthsystem.com
- Website: prosynthsystem.com
4. Guide on how to use PAIA and how to obtain access to the guide
The Regulator publishes a Guide on how to use PAIA, which you can download from its website. To ask for a record of ProSynth, fill in Form 2 and send it to us; section 4.5 explains how.
The Regulator has, in terms of section 10(1) of PAIA, as amended, updated and made available the revised Guide on how to use PAIA ("Guide"), in an easily comprehensible form and manner, as may reasonably be required by a person who wishes to exercise any right contemplated in PAIA and POPIA. The Guide is available in each of the official languages and in braille.
- 4.1 The Guide contains a description of:
- 4.1.1 the objects of PAIA and POPIA;
- 4.1.2 the postal and street address, phone and fax number and, if available, electronic mail address of the Information Officer of every public body, and every Deputy Information Officer of every public and private body designated in terms of section 17(1) of PAIA and section 56 of POPIA;
- 4.1.3 the manner and form of a request for access to a record of a public body contemplated in section 11, and access to a record of a private body contemplated in section 50;
- 4.1.4 the assistance available from the IO of a public body in terms of PAIA and POPIA;
- 4.1.5 the assistance available from the Regulator in terms of PAIA and POPIA;
- 4.1.6 all remedies in law available regarding an act or failure to act in respect of a right or duty conferred or imposed by PAIA and POPIA, including the manner of lodging an internal appeal, a complaint to the Regulator, and an application with a court;
- 4.1.7 the provisions of sections 14 and 51 requiring a public body and private body, respectively, to compile a manual;
- 4.1.8 the provisions of sections 15 and 52 providing for the voluntary disclosure of categories of records;
- 4.1.9 the notices issued in terms of sections 22 and 54 regarding fees; and
- 4.1.10 the regulations made in terms of section 92.
4.2 Members of the public can inspect or make copies of the Guide from the offices of the public and private bodies, including the office of the Regulator, during normal working hours. To inspect it at ProSynth, arrange a time through the contact details in section 3.
4.3 The Guide can also be obtained:
- 4.3.1 upon request to the Information Officer;
- 4.3.2 from the website of the Regulator: PAIA Guide, English, and the other guides and forms at inforegulator.org.za/paia.
4.4 The Guide can be read and downloaded from the Regulator's website, at the address in 4.3.2.
4.5 How to request access to a record of ProSynth
4.5.1 Complete the Regulator's Form 2, Request for Access to Record, and send it to the head of ProSynth by email or post at the addresses in section 3.
4.5.2 In your request, give your name and contact details, enough detail for us to identify the record, and the form of access you want (inspection, copy or electronic). If you make the request for someone else, send proof that you may do so. For a record of a private body, say which right you want to exercise or protect, and why you need the record for that.
4.5.3 A request fee may be payable before we process your request, and an access fee if your request is granted. The fees are set in Annexure B of the Regulations.
4.5.4 We decide your request within 30 days of receiving it and tell you the outcome in writing.
4.5.5 If we refuse your request, or do not respond, you may complain to the Regulator on Form 5, Complaint Form, sent to PAIAComplaints@inforegulator.org.za, or apply to a court. A complaint to the Regulator must be lodged within 180 days of the refusal, or of the end of the 30 days if we did not respond.
4.5.6 Regulator contact: enquiries@inforegulator.org.za, toll free 0800 017 160, 54 Maxwell Drive, Woodmead, Johannesburg, 2191.
5. Categories of records of ProSynth which are available without a person having to request access
| Category of records | Types of the record | Available on website | Available upon request |
|---|---|---|---|
| Company and contact information | PAIA manual, privacy notice, contact details | Yes (prosynthsystem.com) | Yes |
| Marketing and public material | Descriptions of our services on the home page | Yes (prosynthsystem.com) | Yes |
6. Description of the records of ProSynth which are available in accordance with any other legislation
| Category of records | Applicable legislation | How long we keep them |
|---|---|---|
| Tax records | Tax Administration Act 28 of 2011 (section 29) | 5 years from the date the return is submitted |
As a sole proprietorship, ProSynth holds fewer statutory records than a registered company.
7. Description of the subjects on which the body holds records and categories of records held on each subject by ProSynth
| Subjects on which the body holds records | Categories of records |
|---|---|
| Business operations | Business plans, strategy documents, internal processes and agreements |
| Finance | Invoices, receipts, bank statements, financial records |
| Clients and prospects | Lead list, outreach records, booking details, meeting notes and transcripts, proposals, engagement agreements |
| Human resources | Not applicable: no employees at this time |
| IT and security | Tool and provider documentation, information security measures, breach records |
| Marketing and communications | Website content, social media content, brand assets, privacy notice |
8. Processing of personal information
8.1 Purpose of processing personal information
ProSynth processes personal information for the following purposes:
- To identify and contact prospective clients regarding our services (lead generation and outreach)
- To take bookings for calls through our website and to answer enquiries
- To run and secure our website
- To conduct and document discovery meetings and diagnostic interviews
- To deliver operations diagnostics and builds to clients under contract
- To manage client relationships and engagement records
- To comply with legal obligations under South African law
8.2 Description of the categories of data subjects and of the information or categories of information relating thereto
| Categories of data subjects | Personal information that may be processed |
|---|---|
| Prospective clients (leads) | Name, work email address, work phone number, job title, employer name, LinkedIn profile URL, outreach communication history |
| Clients | Name, work email address, work phone number, job title, employer name, meeting notes, diagnostic notes, contract information, payment information |
| Client staff (diagnostic interviewees) | Name, job title, department, responses and views expressed during diagnostic interviews |
| Service providers and suppliers | Name, contact details, registration and VAT numbers, banking details |
| People who book a call or contact us | Name, email address, time zone, phone number if given, answers on the booking form, the content of emails and calls |
| Website visitors | IP address, browser and device type, page requested and time. Our website has no forms, no cookies and no analytics. |
8.3 The recipients or categories of recipients to whom the personal information may be supplied
| Category of personal information | Recipients or categories of recipients to whom the personal information may be supplied |
|---|---|
| Client identity and payment details | Banking institution, accounting firm (as required) |
| Client diagnostic data | Only with client instruction; otherwise not disseminated |
| Lead and client records | For our own use; not sold or shared with third parties for their own marketing |
| Personal information processed by service providers that host or process information for us | OpenAI, OpenRouter, Google NotebookLM, Pinecone, Granola, Fathom: these providers handle information for us. See 8.4. |
| Emails you send us and we send you | Our email provider, Google (Gmail and Google Workspace): carries the messages for us. See 8.4. |
| Booking details | Cal.com: takes bookings for us and acts as our operator. See 8.4. |
| Website visitor request details | Our website host, Netlify: acts as our operator. See 8.4. |
8.4 Planned transborder flows of personal information
Researching prospective clients. When we research a prospective client who has not yet agreed to hear from us, our AI assistant (OpenAI, through our ChatGPT plan, and models reached through OpenRouter) may process their public business contact details: name, job title, employer, work email and LinkedIn profile. We have no data processing agreement with OpenAI for this, and the research that goes through OpenAI rests on none of the section 72 grounds listed below the table. For research that goes through OpenRouter, its data processing agreement forms part of its Terms of Service (see its row in the table). We use only public business details, never private or sensitive information. We do not put the personal information of people in the United Kingdom into our ChatGPT plan. Anyone can ask us to delete their details, or object to our processing, at any time through the contact details in section 3.
ProSynth uses the following service providers that host or process information for us, and that process or store personal information outside the Republic of South Africa:
| Provider | Country | Categories of personal information | Safeguard |
|---|---|---|---|
| Google (Gmail and Google Workspace) | United States and other countries where Google operates | The emails you send us and we send you, with their attachments, and our Google Meet calls | Google's Cloud Data Processing Addendum, which forms part of its Google Workspace agreement. Google may process data in any country where it or its subprocessors have facilities. We accepted Google's Cloud Data Processing Addendum for our Workspace on 15 October 2026. |
| OpenAI (ChatGPT, our individual plan; also the AI assistant that helps us with notes, drafts and follow-up) | United States | Lead list data, meeting transcripts, business notes (via our own account) | We have no data processing agreement with OpenAI. We have switched off OpenAI's use of our content to train its models. For clients and people on our calls, the ground is their consent (section 72(1)(b) of POPIA). For prospective clients, see "Researching prospective clients" above. We do not put the personal information of people in the United Kingdom into our individual ChatGPT plan, because we have no data processing agreement with OpenAI for it and so no UK transfer safeguard. |
| OpenRouter (request routing; we reach it through the same AI assistant for some tasks) | United States | Lead list data, meeting transcripts, business notes | OpenRouter's data processing agreement forms part of its Terms of Service. Under it OpenRouter acts as our processor, and for transfers from the United Kingdom it applies the UK Addendum to the standard contractual clauses. OpenRouter's privacy policy says it does not use inputs or outputs for model training. It passes each request to the model provider we select, and that provider's own terms apply. |
| Google NotebookLM | United States and other countries where Google operates | Meeting transcripts, research notes, business documents | Through a Google Workspace work account, Google's Cloud Terms of Service apply, and Google says uploads and queries are not used to train its models. |
| Pinecone (storage for search over our own records) | United States | Session summaries and business knowledge, stored for search | Pinecone's Master Subscription Agreement, which governs our account (a free plan), incorporates its Data Processing Addendum for customer data containing personal information (section 8.1). Under that addendum Pinecone acts as our processor. Pinecone may process data wherever it or its subprocessors operate. |
| Granola (meeting notes and transcription) | United States. The company is based in the United States and the United Kingdom, and its servers are on Amazon Web Services, located primarily in the United States. | Meeting audio, transcribed and not stored, and the transcripts and notes | Granola's privacy policy says personal data is encrypted at rest and in transit, and that it does not allow third parties such as OpenAI or Anthropic to use personal data to train their models. It may also process data in other regions where it has facilities or service providers. For transfers it relies on legal mechanisms such as standard contractual clauses, and points to its Data Processing Addendum for detail. That addendum, under which Granola acts as our processor, applies to customers using its services under its terms, and its text sets no paid-plan condition. We have switched off Granola's use of our data to improve its models. |
| Fathom (call recording and transcription, only when we record a call with your agreement) | United States. The company, Fathom Video Inc., is in San Francisco and stores all data in the United States. | Call recordings and transcripts, when we record a call with your agreement | Its Data Processing Agreement, which its Terms of Service incorporate by reference where an applicable law requires one. Fathom says it complies with the EU-U.S. Data Privacy Framework, and that for transfers outside the European Economic Area it ensures safeguards such as standard contractual clauses or the Data Privacy Frameworks. |
| Cal.com (booking) | United States | Details you enter when you book a call: name, email address, time zone, and anything else the booking form asks for | Cal.com's Data Processing Agreement, under which it handles booking details for us. Cal.com states that it complies with the EU-U.S. Data Privacy Framework and uses EU standard contractual clauses where appropriate. |
| Netlify (website hosting) | United States | Information sent to or from our website: IP address, browser and device type, page requested, time | Netlify's Data Processing Agreement, which forms part of its Self-Serve Subscription Agreement. Netlify has certified to participate in and comply with the EU-U.S. Data Privacy Framework, and the UK Extension to the EU-U.S. Data Privacy Framework. If that certification is invalid or lapses, the agreement falls back to the EU Standard Contractual Clauses. |
Calls take place on Google Meet, through our Google Workspace account, or on Microsoft Teams when the other party hosts the call on its own account.
A Data Processing Addendum, the EU-U.S. Data Privacy Framework and standard contractual clauses are the arrangements that require a provider to protect personal information when it crosses a border.
Apart from the research on prospective clients described above, we send personal information to a provider abroad under section 72 of POPIA only on one of these grounds:
- A binding agreement that requires the provider to protect the information to a standard substantially similar to POPIA, including when it passes the information on (section 72(1)(a)). We rely on this for Google (Gmail, Google Workspace, Google Meet and NotebookLM, through our Google Workspace account), Cal.com, Netlify, Pinecone and Granola, each under its own data processing agreement or addendum, as the safeguard column shows.
- The consent of the data subject (section 72(1)(b)). If you are a client or you join one of our calls, we ask for your consent at the start of each call, and in our proposals and engagement agreements. We tell you that a note-taking service and our AI assistant, hosted in the United States, help us take notes and follow up. We record a call with Fathom only with your agreement.
- A booking or request the data subject made (section 72(1)(c)), such as taking a booking.
The safeguard column shows which applies to each provider. We do not put personal information about clients or call attendees into any tool that meets none of these.
Data subjects are notified of these transfers in the privacy notice (section 18(1)(g) of POPIA) and may object.
8.5 General description of information security measures
ProSynth implements the following technical and organisational measures.
Technical measures:
- Device-level encryption (FileVault) on the Mac we work on
- A password is required as soon as the Mac locks
Organisational measures:
- A client's own data is stored solely in that client's designated location and is not pooled
- Access to personal information is limited to the owner (Shane Aucamp) and the service providers listed in 8.4
- Breach response: we have a breach notification plan
9. Availability of the manual
- 9.1 A copy of the manual is available:
- 9.1.1 on prosynthsystem.com/paia-manual/;
- 9.1.2 at the head office of ProSynth (7 Fernwood Crescent, Vergelegen, Somerset West, 7130) for public inspection by appointment, arranged through the contact details in section 3;
- 9.1.3 to any person upon request and upon the payment of a reasonable prescribed fee; and
- 9.1.4 to the Information Regulator upon request.
9.2 A fee for a copy of the manual, as contemplated in Annexure B of the Regulations, is payable per each A4-size photocopy made.
10. Updating of the manual
The head of ProSynth will on a regular basis update this manual (PAIA section 51(2)).
Issued by:
Shane Aucamp
Information Officer / Owner