PAIA Manual
VulaCheck (Pty) Ltd
Version 1.0 · Effective 7 October 2026
1. Introduction
This manual is published by VulaCheck (Pty) Ltd under section 51 of the Promotion of Access to Information Act 2 of 2000 (PAIA). It also covers the processing details required by the Protection of Personal Information Act 4 of 2013 (POPIA).
It explains:
- which records VulaCheck holds;
- how to ask for them;
- what it costs;
- when a request may be refused.
VulaCheck provides lending software to credit providers registered with the National Credit Regulator. VulaCheck is not a lender. Records about a borrower's loan application or loan belong to the lender that the borrower dealt with. VulaCheck processes those records only as that lender's operator. A request for those records should go to the lender, under the lender's own PAIA manual.
2. Company details and Information Officer
Send every request under this manual to the Information Officer.
| Item | Details |
|---|---|
| Company | VulaCheck (Pty) Ltd |
| Registration number | 2026/307850/07 |
| Director | Fidel Okillah (sole director) |
| Physical and postal address | The Circle Business Center, Douglas Crowe Drive, Durban, KwaZulu-Natal, 4420 |
| Website | https://vulacheck.com |
| Information Officer | Fidel Okillah |
| Information Officer email | fidel@vulacheck.com |
| General enquiries | info@vulacheck.com |
3. The Information Regulator's guide
The Information Regulator publishes a guide under section 10 of PAIA. The guide explains how to use PAIA and POPIA. It is available in all official languages on the Regulator's website, or from the Regulator directly.
| Item | Details |
|---|---|
| Address | Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191 |
| Phone | 010 023 5200 |
| Toll free | 0800 017 160 |
| General enquiries | enquiries@inforegulator.org.za |
| PAIA complaints | PAIAComplaints@inforegulator.org.za |
| POPIA complaints | POPIAComplaints@inforegulator.org.za |
| Website | inforegulator.org.za |
A copy of the guide can also be inspected at VulaCheck's office during business hours.
4. Records available without a request
Anyone can read these records on vulacheck.com without making a PAIA request (section 52):
- Terms of Service;
- Platform Privacy Policy;
- Data Processing Agreement;
- this PAIA manual;
- plans and pricing;
- product and feature pages;
- blog articles;
- masterclass and event information.
5. Records kept under other laws
VulaCheck keeps records as required by the laws listed below. Where a law gives a right of access, a request under that law may be quicker than a PAIA request.
- Companies Act 71 of 2008
- Income Tax Act 58 of 1962
- Tax Administration Act 28 of 2011
- Value-Added Tax Act 89 of 1991 (once VulaCheck is VAT-registered)
- Protection of Personal Information Act 4 of 2013
- Electronic Communications and Transactions Act 25 of 2002
- Consumer Protection Act 68 of 2008
- National Credit Act 34 of 2005: VulaCheck keeps lenders' records only as their operator
- Where VulaCheck employs staff: the Basic Conditions of Employment Act 75 of 1997, the Labour Relations Act 66 of 1995, the Employment Equity Act 55 of 1998, the Unemployment Insurance Act 63 of 2001, the Skills Development Levies Act 9 of 1999 and the Compensation for Occupational Injuries and Diseases Act 130 of 1993
This list is not complete.
6. Records VulaCheck holds
The table lists the subjects of the records VulaCheck holds. A record being listed does not mean access will be given; section 9 sets out the grounds for refusal.
| Subject | Records |
|---|---|
| Company | Incorporation documents, the share register, directors' resolutions, statutory returns |
| Finance and tax | Annual financial statements, accounting records, invoices, tax returns, bank records |
| Lender clients | Signup and verification records (NCR certificate, CIPC registration, owner's ID), subscription agreements, billing history, support correspondence |
| Platform and security | System and audit logs, security monitoring records, backups, software and change records |
| Marketing | Website enquiries, masterclass and event bookings, WhatsApp training-list consents, blog content |
| Suppliers | Agreements with service providers and operators, purchase records |
| Staff, where employed | Employment contracts, payroll and tax records, leave records |
| Records processed for lenders | Applicant and borrower records held for a lender as its operator. Request these from the lender, not VulaCheck. |
7. How VulaCheck processes personal information
This section gives the details POPIA requires in a PAIA manual. The Platform Privacy Policy has the full detail.
Purposes of processing
- To create and run lender accounts and provide the platform.
- To verify lenders and prevent fraud and misuse.
- To bill clients and keep financial records.
- To secure, support and improve the platform.
- To send service messages and, with consent, marketing and masterclass reminders.
People whose information is processed, and what
| People | Information |
|---|---|
| Lender clients and their staff | Names, ID numbers, contact details, NCR and CIPC details, user activity |
| Billing contacts | Names, contact details, payment references (no full card details) |
| Website visitors | Device, browser and usage data; cookies |
| Masterclass and event bookers | Name, business, phone or email, consent record |
| Suppliers | Contact and contract details |
| Applicants and borrowers | Processed for lenders as their operator, under the Data Processing Agreement |
Who receives it
| Service provider | Purpose | Where |
|---|---|---|
| Supabase | Database and authentication | European Union (Ireland) |
| Vercel | Application hosting | United States / global edge |
| Amazon Web Services | Encrypted backups and email | South Africa |
| Anthropic | AI-assisted processing (Vula AI) | United States |
| SMSPortal | SMS delivery | South Africa |
| PayStack | Subscription billing | South Africa |
| Sentry | Error and security monitoring | United States |
VulaCheck also discloses information to regulators and authorities where the law requires it.
Cross-border transfers
Some processing takes place in the European Union and the United States. VulaCheck relies on section 72 of POPIA for these transfers: binding agreements that give adequate protection, transfers needed to perform the contract, or consent.
Security
VulaCheck protects personal information with:
- encryption in transit and at rest;
- role-based access;
- audit logging;
- encrypted backups;
- rate limits;
- security monitoring.
These measures are reviewed regularly.
8. How to request a record
To request a record, send Form 2 to the Information Officer at fidel@vulacheck.com. You can get Form 2 from the Information Regulator's website.
- Fill in Form 2.
- Describe the record clearly.
- Say how you want access, for example a copy by email.
- Give the right you want to exercise or protect, and explain why the record is needed for it (section 53).
- Attach a copy of your ID. If you are asking for someone else, attach proof that you may act for them.
- Pay the request fee if one applies (see the table). VulaCheck will send its banking details.
- VulaCheck decides within 30 days. It may extend this once, by up to 30 more days, and will tell you why (sections 56 and 57). If you get no answer in time, the request is treated as refused (section 58).
If you only want to confirm whether VulaCheck holds your personal information, there is no charge (POPIA section 23).
Fees for requests to private bodies (Information Regulator, PAIA fee structure)
| Item | Fee |
|---|---|
| Request fee (not payable for a request for your own personal information) | R140.00 |
| Search and preparation, after the first hour | R145.00 per hour, up to R435.00 |
| Deposit, where the search takes more than 6 hours | One-third of the access fee |
| Copy or printout, A4 | R2.00 per page |
| Copy on a flash drive or CD you provide | R40.00 |
| Copy on a CD VulaCheck provides | R60.00 |
| Transcription of audio, A4 | R24.00 per page |
| Postage | Actual cost |
9. Grounds for refusal and remedies
VulaCheck may refuse access only on the grounds in Chapter 4 of Part 3 of PAIA, which include:
- protecting another person's privacy (section 63);
- protecting commercial information of VulaCheck or a third party, such as source code, security measures and lender clients' business data (section 64);
- breaching a duty of confidence owed to a third party (section 65);
- endangering the safety of individuals or property (section 66);
- legally privileged records (section 67);
- research information, or VulaCheck's commercial and financial information, where disclosure would cause harm (sections 68 and 69).
Where part of a record can be released, VulaCheck will release it and hold back only the protected part.
If your request is refused
VulaCheck has no internal appeal. Within 180 days of the decision, you may:
- complain to the Information Regulator at PAIAComplaints@inforegulator.org.za; or
- apply to a court (sections 77A and 78).
10. Where to find this manual and updates
This manual is published at vulacheck.com/legal/paia-manual. A copy is free from the Information Officer and can be inspected at VulaCheck's office during business hours.
VulaCheck reviews this manual at least once a year, and whenever its details or processing change. Each version shows its version number and effective date.