Call: +27 (0)64 529 1734           Email: admin@invs.co.za

How Can We Help

PAIA Manual

Invictus Security Services Pty Ltd

Registration Number: 2020/941289/07

Prepared and compiled in accordance with Section 51 of the Promotion of Access to Information Act 2 of 2000 (PAIA), as amended.

Date of Revision: 24 November 2025

Contents

1. List of Acronyms and Abbreviations

2. Purpose of the PAIA Manual

3. Key Contact Details for Access to Information

4. Guide on How to Use PAIA and Obtain Access to the Guide

5. Categories of Records Available Without a Formal Request

6. Records Available in Accordance With Other Legislation

7. Subjects and Categories of Records Held by the Private Body

8.Processing of Personal Information

9. Procedure for Requesting Access to Records

10. Availability of the Manual

11. Updating of the Manual

12. Annexure A: Applicable Fees

Annexure B: Form 2 — Request for Access to Record and Annexure C: Form 3 — Outcome of Request and Fees Payable

1. List of Acronyms and Abbreviations

Data Subject

The person to whom Personal Information relates, as contemplated in Section 1 of POPIA.

Deputy Information Officer

A Deputy Information Officer designated in terms of Section 56 of POPIA.

Information Officer

In the case of a juristic person:

  • The chief executive officer or equivalent officer of the juristic person, or any person duly authorised by that officer; or
  • The person acting in such capacity, or any person duly authorised by such acting person, as contemplated in Section 1 of the Act.

Information Regulator

The Information Regulator established in terms of Section 39 of POPIA.

Manual

This manual compiled by Invictus Security Services Pty Ltd in terms of PAIA and POPIA.

PAIA

The Promotion of Access to Information Act 2 of 2000, including the PAIA Regulations, as amended from time to time.

Personal Information

Information relating to an identified or identifiable living natural person and, where applicable, an identifiable existing juristic person, as contemplated in POPIA.

Personnel

All partners, directors, officers, employees, individual contractors, and other personnel of Invictus Security Services Pty Ltd.

POPIA

The Protection of Personal Information Act 4 of 2013, including the POPIA Regulations, as amended from time to time.

Processing

Any operation, activity, or set of operations, whether or not by automated means, concerning Personal Information as contemplated in POPIA.

Private Body

Any former or existing juristic person, as contemplated in PAIA and POPIA.

For purposes of this Manual, references to the Private Body refer to Invictus Security Services Pty Ltd.

Record

A record as contemplated in PAIA and includes Personal Information.

Requester

In relation to a Private Body:

  • Any person, including a public body or an official thereof, making a request for access to a Record of that Private Body; or
  • A person acting on behalf of such a person, as contemplated in PAIA.

Responsible Party

A public or Private Body, or any other person which, alone or in conjunction with others, determines the purpose of and means for Processing Personal Information, as contemplated in POPIA.

2. Purpose of the PAIA Manual

To promote effective governance of private bodies, it is necessary to ensure that everyone is empowered and educated to understand their rights in terms of PAIA so that they can exercise those rights in relation to public and private bodies.

Wherever reference is made to the Private Body in this Manual, it refers to Invictus Security Services Pty Ltd.

This PAIA Manual is intended to assist members of the public to:

  1. Check the categories of records held by the Private Body that are available without having to submit a formal PAIA request.
  2. Understand how to make a request for access to a record by providing a description of the subjects on which the Private Body holds records and the categories of records held for each subject.
  3. Identify records available in accordance with other legislation.
  4. Access the relevant contact details of the Information Officer and Deputy Information Officers who can assist with requests for records.
  5. Understand the Guide on how to use PAIA, as updated by the Information Regulator, and how to obtain access to it.
  6. Understand whether the Private Body processes Personal Information and the purposes for which it is processed.
  7. Understand the categories of Data Subjects and the categories of Personal Information processed.
  8. Identify the recipients or categories of recipients to whom Personal Information may be supplied.
  9. Understand whether the Private Body plans to transfer or process Personal Information outside the Republic of South Africa and the circumstances in which this may occur.
  10. Understand the security measures implemented to protect the confidentiality, integrity, and availability of Personal Information.

3. Key Contact Details for Access to Information

 

3.1 Information Officer

Name: Matthew Hittinger
Telephone: 064 529 1734
Email: matthew@invictussecurityservices.co.za

3.2 Deputy Information Officer

Name: Christine Hittinger
Telephone: 064 529 1734
Email: payroll@invictussecurityservices.co.za

3.3 Deputy Information Officer

Name: Gavin Walker
Telephone: 064 529 1734
Email: hr@invictussecurityservices.co.za

3.4 General Access to Information Contact

Email: payroll@invictussecurityservices.co.za

3.5 Head Office

Physical Address:
90 Jean Avenue
Doringkloof
Centurion
0157

Postal Address:
90 Jean Avenue
Doringkloof
Centurion
0157

Telephone: 064 529 1734
Email: payroll@invictussecurityservices.co.za
Website: www.invictussecurityservices.co.za

4. Guide on How to Use PAIA and Obtain Access to the Guide

The Information Regulator has, in terms of Section 10(1) of PAIA, as amended, updated and made available a revised Guide on How to Use PAIA.

The Guide is intended to be provided in an easily comprehensible form and manner for persons who wish to exercise any right contemplated in PAIA and POPIA.

The Guide is available in each of South Africa’s official languages and in braille.

4.1 What the Guide Contains

The Guide includes information concerning:

  • The objectives of PAIA and POPIA.
  • The postal and street addresses, telephone numbers, fax numbers, and available email addresses of Information Officers of public bodies.
  • Details of Deputy Information Officers of public and private bodies designated in terms of PAIA and POPIA.
  • The manner and form of requesting access to a record of a public body.
  • The manner and form of requesting access to a record of a private body.
  • Assistance available from Information Officers in terms of PAIA and POPIA.
  • Assistance available from the Information Regulator.
  • Remedies available in law in relation to acts or failures to act concerning rights or duties imposed by PAIA and POPIA.

These remedies may include:

  • An internal appeal.
  • A complaint to the Information Regulator.
  • An application to a court against an applicable decision.

The Guide also addresses:

  • Requirements for public and private bodies to compile PAIA manuals.
  • How to obtain access to such manuals.
  • Voluntary disclosure of categories of records.
  • Fees payable in connection with access requests.
  • Regulations made in terms of PAIA.

4.2 Access to the Guide

Members of the public may inspect or make copies of the Guide at the offices of relevant public and private bodies, including the office of the Information Regulator, during normal working hours.

The Guide may also be obtained:

  • Upon request to the Information Officer.
  • From the Information Regulator’s website at inforegulator.org.za.

A copy of the Guide is available in English and Afrikaans for public inspection during normal office hours.

5. Categories of Records Available Without a Formal Request

The following records are generally made publicly available and may be accessed through the website or by simple request without having to follow the formal PAIA request procedure.

Category Types of Records Website Upon Request
Corporate Information and Business Profile General company information, corporate profile, areas of service and product information Yes Yes
Publications and Communications Communications, newsletters, and other publications Yes Yes
Marketing Materials Brochures, pamphlets, posters, and other promotional material Yes Yes
Privacy Compliance Records PAIA Manual and Privacy Notices Yes Yes
Terms of the Private Body Terms and conditions Yes —

6. Records Available in Accordance With Other Legislation

The Private Body is required to maintain various records in accordance with South African legislation.

The following list includes, but is not limited to, the principal categories of records and applicable legislation.

6.1 Governance Records

Records may include:

  • Memorandum of Incorporation.
  • Registration documents.
  • Information concerning directors and shareholders.
  • Share registers.
  • Minutes of meetings.
  • Other corporate governance information.

Applicable legislation:

  • Companies Act 71 of 2008.

6.2 Employment-Related Records

Records may include:

  • Personal information and employee details for employment purposes.
  • Employment contracts and conditions of service.
  • Payroll, leave, and remuneration records.
  • Pension and/or provident fund records.
  • Disciplinary, grievance, and other labour-related records.
  • Employment Equity and skills development plans and reports.
  • Health and safety records.
  • Workers’ compensation records.

Applicable legislation includes:

  • Basic Conditions of Employment Act 75 of 1997.
  • Labour Relations Act 66 of 1995.
  • Employment Equity Act 55 of 1998.
  • Occupational Health and Safety Act 85 of 1993.
  • Compensation for Occupational Injuries and Diseases Act 130 of 1993.
  • Immigration Act 13 of 2002.
  • Income Tax Act 58 of 1962.
  • Skills Development Act 97 of 1998.
  • Skills Development Levies Act 9 of 1999.
  • Pension Funds Act 24 of 1956.
  • Unemployment Insurance Act 63 of 2001.

6.3 Financial and Tax Records

Records may include:

  • Financial statements and accounting records.
  • Income Tax records.
  • VAT records.
  • PAYE records.
  • SDL records.
  • UIF records.

Applicable legislation includes:

  • Income Tax Act 58 of 1962.
  • Value Added Tax Act 89 of 1991.

6.4 Privacy-Related Records

Records may include:

  • PAIA Manual.
  • Privacy Notices.
  • Records relating to electronic communications and transactions.

Applicable legislation includes:

  • Promotion of Access to Information Act 2 of 2000.
  • Protection of Personal Information Act 4 of 2013.
  • Electronic Communications and Transactions Act 25 of 2002.

6.5 Other Records

Records may include:

  • Registration and licensing records, including PSIRA certificates.
  • Personnel requirement records.
  • Firearms control certificates and records.
  • Professional conduct records.
  • Client engagement records.
  • B-BBEE status and supplier information.
  • Records of consumer transactions and complaints.
  • Client due diligence and transactional records.

Applicable legislation includes:

  • Private Security Industry Regulation Act 56 of 2001.
  • Code of Conduct for Security Service Providers, 2003.
  • Firearms Control Act 60 of 2000.
  • Improper Conduct Enquiries Regulations, 2003.
  • Broad-Based Black Economic Empowerment Act 53 of 2003.
  • Prevention and Combating of Corrupt Activities Act 12 of 2004.
  • Financial Intelligence Centre Act 38 of 2001.

While every reasonable effort has been made to compile a comprehensive list of applicable legislation, the list may not be exhaustive.

If existing or newly enacted legislation provides for access to records on a basis other than that prescribed by PAIA, this list may be updated accordingly.

A requester who believes that a right of access exists under other legislation should clearly identify the specific legislative provision on which the request is based.

7. Subjects and Categories of Records Held by the Private Body

The following provides examples of the types of records maintained for various business functions.

7.1 Corporate and Company Secretarial Records

Records may include:

  • Memorandum of Incorporation.
  • Company registration documents.
  • Minutes.
  • Resolutions.
  • Share registers.
  • Records concerning trademarks and other intellectual property.
  • Insurance records, including professional indemnity insurance.

7.2 Financial and Accounting Records

Records may include:

  • Annual financial statements.
  • Accounting records.
  • Audit reports.
  • Tax records.
  • Bank statements.
  • Asset registers.
  • Budgets.
  • Invoices.
  • Receipts.
  • Source documents for creditors and debtors.

7.3 Human Resources and Employee Records

Records may include:

  • Personnel files.
  • Employment contracts.
  • Conditions of service.
  • Payroll and remuneration information.
  • Leave records.
  • Employee benefits records.
  • Pension and/or provident fund records.
  • Medical aid information.
  • Performance evaluations.
  • Disciplinary records.
  • Grievance procedures.
  • Employment Equity plans.
  • Skills development reports.
  • Training records.

7.4 Client-Related Records

Records may include:

  • Client engagement letters.
  • Agreements.
  • Client due diligence records.
  • Correspondence with clients and third parties.
  • Files relating to client matters.

7.5 Administration, Operations, and Property

Records may include:

  • Agreements with suppliers and service providers.
  • Lease agreements.
  • Internal and external correspondence.
  • Tender documentation.
  • Security records.

7.6 Information Technology

Records may include:

  • Computer software records.
  • Software licensing agreements.
  • Maintenance agreements.
  • Records regarding computer systems.
  • IT usage policies.

8. Processing of Personal Information

The following sections describe Invictus Security Services Pty Ltd’s practices regarding the processing of Personal Information.

The examples below are not exhaustive.

 

8.1 Purpose of Processing Personal Information

Clients — Prospective, New, and Existing

Personal Information may be processed:

  • To provide services and perform obligations under a service contract.
  • To manage the commercial relationship, including billing and accounting.
  • To perform client due diligence and Know Your Customer procedures where required by law, including FICA requirements.
  • To comply with legal and regulatory obligations.
  • For requested marketing communications.
  • To respond to correspondence.

Employees and Job Applicants

This includes permanent, temporary, and part-time employees.

Personal Information may be processed:

  • To conclude and perform obligations under an employment contract.
  • For recruitment purposes.
  • To administer payroll.
  • To administer benefits and other HR functions.
  • To comply with employment-related legal obligations.
  • To assess credit and criminal history where relevant to employment.

Suppliers, Service Providers, Contractors, and Business Partners

Personal Information may be processed:

  • To perform obligations under service agreements.
  • To manage supplier relationships.
  • To process payments.
  • To manage invoices.
  • To comply with legal and regulatory obligations.

Visitors to Premises

Personal Information may be processed:

  • To monitor access for safety and security purposes.
  • Through CCTV footage.
  • For health and safety purposes.

Website Interaction

Personal Information may be processed:

  • To improve and monitor the performance of digital platforms.
  • To enable the proper functioning of the website.

8.2 Categories of Data Subjects and Personal Information Processed

Clients and Related Parties

Identifying Information

This may include:

  • Entity name and trading name.
  • Individual name and surname.
  • Entity registration number.
  • Individual identity number.

Contact Information

This may include:

  • Email address.
  • Postal address.
  • Physical address.
  • Landline telephone numbers.
  • Mobile telephone numbers.

Transaction Information

This may include:

  • Contact person’s details.
  • Contact person’s designation.
  • VAT numbers.
  • Service delivery addresses.
  • Related transaction information.

Financial Information

This may include:

  • Banking and account details.
  • Financial records.
  • Income information.
  • Evidence of source of funds where required for FICA purposes.

Employees and Job Applicants

Identifying Information

This may include:

  • Full name and surname.
  • Identity number.
  • Passport number.
  • Work visa information.
  • Asylum documentation.
  • Employee number.
  • Date of birth.
  • Gender.

Contact Information

This may include:

  • Landline and mobile telephone numbers.
  • Email address.
  • Physical address.
  • Postal address.

Emergency Contact Information

This may include:

  • Full name and surname of an emergency contact.
  • Relationship to the employee.
  • Contact numbers.

Remuneration Information

This may include:

  • Banking details.
  • Account details.

Human Resources and Employment Information

This may include:

  • Employment contracts.
  • Personnel files.
  • Leave records.
  • Disciplinary records.

Background Information

This may include:

  • Curriculum Vitae.
  • Spoken and written languages.
  • Academic qualifications.
  • Criminal history.
  • Trade information.
  • Work experience.
  • Employment history.
  • Personality type or psychometric test information.

Information Required by Legislation

This may include:

  • Race or ethnicity.
  • Disability information.
  • Employment and skills information.
  • Tax-related information.

Other Information

This may include:

  • Dietary preferences.
  • Religious holidays.
  • Medical aid information.
  • Provident fund information.
  • Pension fund information.

Suppliers, Service Providers, and Business Partners

Identifying Information

This may include:

  • Entity name and trading name.
  • Individual name and surname.
  • Entity registration number.
  • Individual identity number.

Contact Information

This may include:

  • Email address.
  • Postal address.
  • Physical address.
  • Landline and mobile telephone numbers.

Transaction Information

This may include:

  • Contact person’s details.
  • Contact person’s designation.
  • VAT numbers.
  • Information required for invoicing.

Financial Information

This may include:

  • Banking details.
  • Account details.

Visitors to Premises

Information may include:

  • CCTV footage.
  • Other Personal Information required for security and access monitoring.

8.3 Recipients of Personal Information

Certain Personal Information may be provided to third parties where necessary.

Identity Numbers and Names for Criminal Checks

Possible recipients include:

  • South African Police Service.
  • Criminal background verification agencies.

Qualifications for Verification

Possible recipients include:

  • South African Qualifications Authority.
  • Qualification verification agencies.

Credit and Payment History

Possible recipients include:

  • Credit bureaus.
  • Credit verification agencies.

Tax and VAT Information

Information relating to clients, service providers, suppliers, and employees may be supplied to:

  • South African Revenue Service.

Employee Information

For legislative compliance and payroll purposes, information may be supplied to:

  • Department of Employment and Labour.
  • Payroll service providers.

Other Personal Information

Personal Information relating to clients, service providers, suppliers, and employees may also be supplied to:

  • Cloud storage providers.
  • Productivity software providers such as Microsoft 365 and Google Business.
  • Other service providers or third-party suppliers where the relevant transaction or service requires information sharing.

Personal Information may also be shared with other service providers or third-party suppliers where necessary to perform a transaction or render a service.

8.4 Transborder Flow of Personal Information

As a general principle, we do not transfer Personal Information to another country.

However, in certain circumstances, such transfers may be necessary. This may occur, for example:

  • Where suppliers are based outside South Africa.
  • Where a service involves a foreign party.

Such transfers will only take place where:

  • They are necessary for the nature of the transaction; and
  • They comply with POPIA and/or other applicable South African law.

Where Personal Information is transferred outside South Africa, reasonable steps will be taken to ensure that appropriate safeguards are in place.

These may include:

  • Ensuring that the destination country’s laws provide protection similar to POPIA.
  • Confirming that appropriate binding corporate rules are in place.
  • Using legal agreements designed to ensure Personal Information is handled securely.

Cloud-Based Software

Invictus Security Services Pty Ltd uses software services such as Microsoft 365 and Google Business to support its business operations and store Personal Information.

These services may store information on servers located outside South Africa.

The company uses providers that it believes provide appropriate protection for the Personal Information entrusted to them.

8.5 Information Security Measures

Invictus Security Services Pty Ltd has implemented reasonable technical and organisational security measures to protect Personal Information against:

  • Unauthorised access.
  • Unlawful processing.
  • Loss.
  • Destruction.
  • Damage.

These measures are reviewed and updated regularly.

Technical Measures

Network and System Security

Measures may include:

  • Firewalls.
  • Malware protection.
  • Anti-virus protection.
  • Software patching.
  • Data loss prevention technologies.

Data Protection

Measures may include:

  • Encryption of sensitive information.
  • Regular backups.
  • Backup testing to ensure recoverability.

Access Control

Measures may include:

  • Unique user IDs.
  • Strong passwords.
  • Access restrictions based on a need-to-know principle.

Monitoring and Testing

Measures may include:

  • System monitoring.
  • Vulnerability scanning.
  • Penetration testing.
  • Identification and mitigation of security threats.

Organisational Measures

Policies and Procedures

Measures may include:

  • Documented information security policies.
  • Business continuity plans.
  • Risk assessments.

Employee Awareness

Employees may receive regular training relating to:

  • Information security.
  • Privacy practices.

Third-Party Management

Third-party operators and service providers may be required through contractual arrangements to maintain appropriate security safeguards.

Physical Security

Measures may include:

  • Restricting physical access to offices and sensitive areas.
  • Appropriate disposal procedures for assets containing Personal Information.

9. Procedure for Requesting Access to Records

9.1 Submitting a Request

To request access to records held by Invictus Security Services Pty Ltd, a requester must:

  1. Complete Form 2 — Request for Access to Record, contained in Annexure B.
  2. Submit the completed form to the Information Officer.
  3. Pay the applicable request fee and any required deposit, as set out in Annexure A.

The request must contain sufficient information to identify:

  • The requested record.
  • The identity of the requester.
  • The preferred method of access.
  • The right that the requester wishes to exercise or protect.
  • Why the requested information is necessary to exercise or protect that right.

9.2 Requests on Behalf of Another Person

A request made on behalf of another person must be accompanied by appropriate proof of authority.

9.3 Assistance With Completing a Request

Where a requester is unable to complete the form because of illiteracy or disability, the request may be made orally at the offices of Invictus Security Services Pty Ltd.

Assistance will be provided to record the request.

9.4 Fees

After receiving a request, the Information Officer will notify the requester of any applicable fees.

Processing of the request may only proceed once the required payment has been received.

Where access is granted, additional reproduction or preparation fees may apply.

Where access is denied, any applicable deposit paid will be refunded.

9.5 Decision on a Request

The requester will be informed of the outcome within 30 days, using Form 3 — Outcome of Request and Fees Payable.

9.6 Grounds for Refusal

Access may be refused where disclosure would:

  • Unreasonably compromise another person’s privacy.
  • Reveal confidential third-party information.
  • Reveal confidential company information.
  • Disclose trade secrets.
  • Disclose commercially sensitive information.
  • Harm the competitive position of a party.

Access may also be denied in relation to:

  • Legally privileged information.
  • Contractually protected information.
  • Research that may be disadvantaged by disclosure.
  • Frivolous requests.
  • Requests that would place an unreasonable or excessive burden on the Private Body.

10. Availability of the Manual

A copy of this PAIA Manual is available:

  • On the Invictus Security Services Pty Ltd website at www.invictussecurityservices.co.za.
  • At the head office of Invictus Security Services Pty Ltd for public inspection during normal business hours.
  • To any person upon request and payment of a reasonable prescribed fee.
  • To the Information Regulator upon request.

A fee may be payable for copies of the Manual in accordance with the applicable PAIA Regulations and the fees set out in Annexure A.

11. Updating of the Manual

The head of Invictus Security Services Pty Ltd will update this Manual on a regular basis.

Issued by:
Christine Hittinger
Deputy Information Officer

12. Annexure A: Applicable Fees

The following fees apply to requests for records held by Invictus Security Services Pty Ltd.

Item Description Amount
1 Request fee payable by every requester R140.00
2 Photocopy/printed black-and-white copy of an A4-size page R2.00 per page or part thereof
3 Printed copy of an A4-size page R2.00 per page or part thereof
4(i) Copy in computer-readable form on flash drive supplied by requester R40.00
4(ii)(a) Copy on compact disc supplied by requester R40.00
4(ii)(b) Copy on compact disc supplied to requester R60.00
5 Transcription of visual images per A4-size page Outsourced — cost dependent on service provider quotation
6 Copy of visual images Outsourced — cost dependent on service provider quotation
7 Transcription of an audio record per A4-size page R24.00
8(i) Copy of audio recording on flash drive supplied by requester R40.00
8(ii)(a) Copy on compact disc supplied by requester R40.00
8(ii)(b) Copy on compact disc supplied to requester R60.00
9 Search for and preparation of a record for disclosure, excluding the first hour As prescribed
10 Deposit where search exceeds six hours One-third of the applicable amount calculated in accordance with the prescribed items
11 Postage, email, or other electronic transfer Actual expense, if any

13. Annexure B: Form 2 — Request for Access to Record

Annexure B: Form 2 — Request for Access to Record and  and Annexure C: Form 3 — Outcome of Request and Fees Payable

Download Full Pdf