PAIA manual

1. Acronyms and abbreviations

• "MFH", "the company", "we": MFH Technologies (Pty) Ltd
• "DalaDish": the DalaDish meal-planning app and the website daladish.co.za, products of MFH
• "Guide": the Regulator's Guide on how to use PAIA, made under section 10 of PAIA
• "IO": Information Officer
• "DIO": Deputy Information Officer
• "Minister": the Minister of Justice and Constitutional Development
• "PAIA": the Promotion of Access to Information Act 2 of 2000, as amended
• "POPIA": the Protection of Personal Information Act 4 of 2013
• "Regulator": the Information Regulator (South Africa)
• "Republic": the Republic of South Africa

2. Purpose of this manual

This manual helps members of the public to:

1. check the categories of records we hold that are available without a formal PAIA request;
2. understand how to request access to a record, from a description of the subjects on which we hold records and the categories of records held on each subject;
3. know which of our records are available under other laws;
4. find the contact details of the Information Officer, who will help with requests;
5. know about the Regulator's Guide on how to use PAIA, and how to get it;
6. know whether we process personal information, why, and the categories of data subjects and of personal information concerned;
7. know the recipients, or categories of recipients, to whom we may supply personal information;
8. know whether we transfer or process personal information outside the Republic, and to whom; and
9. know whether we have appropriate security measures to protect the confidentiality, integrity and availability of the personal information we process.

3. Key contact details

3.1 Information Officer

3.2 Deputy Information Officer

No Deputy Information Officer has been designated. The Information Officer deals with all requests.

3.3 General contact for access to information

Email: privacy@daladish.co.za

3.4 Head office

4. The Guide on how to use PAIA

1. The Regulator has, under section 10(1) of PAIA, updated and made available the revised Guide on how to use PAIA, in an easily understood form, for anyone who wishes to exercise a right under PAIA or POPIA.
2. The Guide is available in each of the official languages and in braille.
3. The Guide describes:
   • the objects of PAIA and POPIA;
   • the postal and street address, phone and fax number and, if available, email address of the Information Officer of every public body, and of every Deputy Information Officer of every public and private body designated under section 17(1) of PAIA and section 56 of POPIA;
   • the manner and form of a request for access to a record of a public body (section 11) and of a private body (section 50);
   • the help available from the Information Officer of a public body under PAIA and POPIA;
   • the help available from the Regulator under PAIA and POPIA;
   • all remedies in law for an act or a failure to act in respect of a right or duty under PAIA and POPIA, including how to lodge an internal appeal, a complaint to the Regulator, and an application to court against a decision of the information officer of a public body, a decision on internal appeal, a decision of the Regulator or a decision of the head of a private body;
   • the provisions of sections 14 and 51 requiring public and private bodies to compile a manual, and how to obtain access to a manual;
   • the provisions of sections 15 and 52 on the voluntary disclosure of categories of records by public and private bodies;
   • the notices issued under sections 22 and 54 on the fees payable for requests for access; and
   • the regulations made under section 92.
4. Members of the public may inspect or make copies of the Guide at the offices of public and private bodies, including our office and the Regulator's, during normal working hours.
5. The Guide can also be obtained:
   • on request to our Information Officer; and
   • from the Regulator's website: inforegulator.org.za/paia.
6. We keep a copy of the Guide in English and in Afrikaans for public inspection at our office, by appointment, during normal office hours.

5. Records available without a request

These records are available without a PAIA request (section 52). Most are on our website, and we email copies on request.

6. Records kept under other laws

We keep records under these laws, where they apply to us. A record listed here is not automatically available: a request may still be needed, and the grounds for refusal in PAIA still apply.

7. Subjects and categories of records

8. Processing of personal information

Our Privacy Policy gives users of DalaDish the full detail. This section summarises it, as section 51 of PAIA requires.

8.1 Purpose of processing

• To provide DalaDish: accounts, households, meal plans, shopping lists, recipes and food photos.
• To keep DalaDish and our systems secure.
• To record and respect consents and privacy choices.
• To communicate with users, answer support and privacy requests and, only with their consent, send news about DalaDish.
• To improve DalaDish from feedback.
• To run the company: accounting, tax, contracts and complying with the law.
• To deal with suppliers, partners and investors.

8.2 Categories of data subjects and their personal information

8.3 Recipients of personal information

We do not sell personal information, and we do not share it with advertisers, data brokers or retailers.

8.4 Planned transborder flows of personal information

• Germany (European Union). Supabase stores all app user and household information in Frankfurt, including special personal information and children's information, with backups in the same region.
• Ireland (European Union). Resend sends sign-in emails from Ireland: the email address and the email itself.
• United States. Resend keeps its record of each email sent (address, time and delivery status). GitHub and Google receive website visitors' IP addresses and browser details. Expo builds the app, hosts the test install file and, later, will deliver notifications.
• Other countries. Supabase's support staff may reach our project from other countries when we ask for help, under the European Commission's standard contractual clauses, and stored photos may be served through a worldwide content delivery network.

We rely on section 72(1)(a) of POPIA (the recipient is subject to a law or binding agreement that gives an adequate level of protection), section 72(1)(b) (the data subject's consent, given in the app) and, for sign-in emails, section 72(1)(c) (the transfer is necessary to perform our agreement with the user). Special personal information and children's information are stored only in the European Union, which provides an adequate level of protection.

8.5 Security measures

• Row Level Security on every database table, so each person can reach only their own information and that of their household.
• Encryption in transit and at rest.
• Sign-in with one-time codes, with no passwords; sign-in tokens kept in the iPhone Keychain or Android Keystore.
• Family codes stored only as a hash, with limits on tries and owner approval for every new member.
• Private photo storage with links that expire, and location data removed from photos on the phone.
• Administrative access limited to the people who run DalaDish.
• Operators chosen for their security commitments, and bound to process personal information only on our instructions.
• Security compromises reported to the Regulator and to affected people as section 22 of POPIA requires.

9. How to request access to a record

1. Under section 50 of PAIA, you must be given access to a record of a private body if you need it to exercise or protect a right, you follow the procedure PAIA sets, and no ground for refusal applies.
2. Complete Form 2, Request for access to record (regulation 7), and send it to our Information Officer by email to privacy@daladish.co.za, or by post or hand delivery to the address in section 3.
3. Give enough detail for us to identify the record and you, say in which form you want access, say how you want to be told of our decision, and say which right you want to exercise or protect and why you need the record for it.
4. If you request on behalf of someone else, include proof of the capacity in which you make the request.
5. If you only want your own personal information from DalaDish, you do not need the form: email privacy@daladish.co.za or use the app, as our Privacy Policy explains.
6. We decide within 30 days of receiving a complete request. We may extend this once, by up to 30 more days, if PAIA allows it, and we will tell you why. If we do not answer in time, the request is treated as refused.
7. We tell you our decision, and any fees payable, on Form 3 (Outcome of request and of fees payable).

10. Fees

These are the fees for private bodies set by the PAIA regulations, as published by the Regulator. We tell you in writing before we charge anything. If you only want your own personal information from DalaDish, ask us by email under POPIA instead: we do not charge for that, and confirming whether we hold information about you is always free.

11. Grounds for refusal, and remedies

We may, and in some cases must, refuse access on the grounds in Chapter 4 of Part 3 of PAIA, including to protect:

• the privacy of another person (section 63);
• another party's commercial information (section 64);
• confidential information of another party (section 65);
• the safety of people and property (section 66);
• records privileged from production in legal proceedings (section 67);
• our own commercial information, such as trade secrets and information that would harm us in negotiations or competition (section 68); and
• research information (section 69).

We must still grant access where section 70 requires disclosure in the public interest. If we refuse, we give our reasons.

A private body has no internal appeal. If you are unhappy with our decision, our fees or an extension, you may complain to the Regulator, or apply to a court, within 180 days of the decision.

12. Objecting to, correcting or deleting personal information

Under POPIA you may object to the processing of your personal information, and ask us to correct or delete it. You can do most of this in the DalaDish app, or by email to privacy@daladish.co.za. You may also use the Regulator's forms: Form 1, Objection to the processing of personal information, and Form 2, Request for correction or deletion of personal information. POPIA complaints go to POPIAComplaints@inforegulator.org.za.

13. Availability of this manual

1. A copy of this manual is available:
   • on our website, at daladish.co.za/paia;
   • at our head office, for public inspection during normal business hours, by appointment;
   • to any person on request, by email free of charge, or as a printed copy at the prescribed fee of R2.00 per A4 page; and
   • to the Information Regulator on request.

14. Updating this manual

The head of MFH Technologies (Pty) Ltd will review this manual at least once a year, and update it whenever our records or our processing of personal information change in a way that matters. The dates at the top show the latest version.

Issued by SJ Pieterse, director and Information Officer, MFH Technologies (Pty) Ltd, on 22 October 2026.