PAIA Manual

Manual prepared in terms of Section 51 of the Promotion of Access to Information Act, 2 of 2000

Last Updated: 8 March 2026 · Version 1.0

1. Particulars of the Private Body

Item	Detail
Name of Private Body	Lambie AI (Pty) Ltd
Type of Entity	Private Company incorporated under the Companies Act, 71 of 2008
Registered Address	0c Robert Bruce Rd, Beverley AH, Sandton, Johannesburg, South Africa
Postal Address	As above
Telephone	+27 79 418 9828
Email	info@lambie-ai.com
Website	www.lambie-ai.com

2. Information Officer and Deputy Information Officer

In terms of section 17 of POPIA, the head of the private body is automatically the Information Officer. Deputy Information Officers have been designated where applicable to assist with PAIA and POPIA requests.

Role	Name	Contact
Information Officer	Mischa Lambie (Director)	info@lambie-ai.com
Deputy Information Officer	Luca Lambie (Director)	info@lambie-ai.com

3. Guide on How to Use PAIA

The Information Regulator (South Africa) has, in terms of section 10(1) of PAIA, updated and made available a Guide on how to use PAIA. The Guide is available in each of the official languages and in Braille on request. The Guide contains the information that a person may require to exercise their rights under PAIA and POPIA, and may be obtained from:

4. Records Automatically Available Without Request

The following categories of records are available on our website or on request without the need to follow the formal PAIA procedure:

• Privacy Policy
• Cookie Policy
• Terms and Conditions / Terms of Use
• Marketing brochures, case studies and product information
• This PAIA Manual

5. Categories of Records Held by Lambie AI (Pty) Ltd

5.1 Records held in terms of other legislation

• Companies Act, 71 of 2008
• Income Tax Act, 58 of 1962
• Value-Added Tax Act, 89 of 1991
• Tax Administration Act, 28 of 2011
• Labour Relations Act, 66 of 1995
• Basic Conditions of Employment Act, 75 of 1997
• Skills Development Act, 97 of 1998 and Skills Development Levies Act, 9 of 1999
• Unemployment Insurance Act, 63 of 2001 and Unemployment Insurance Contributions Act, 4 of 2002
• Compensation for Occupational Injuries and Diseases Act, 130 of 1993
• Occupational Health and Safety Act, 85 of 1993
• Employment Equity Act, 55 of 1998 (where applicable)
• Broad-Based Black Economic Empowerment Act, 53 of 2003
• Protection of Personal Information Act, 4 of 2013 (POPIA)
• Promotion of Access to Information Act, 2 of 2000 (PAIA)
• Electronic Communications and Transactions Act, 25 of 2002
• Financial Intelligence Centre Act, 38 of 2001 (where applicable)
• Consumer Protection Act, 68 of 2008 (where applicable)

5.2 Subject categories and types of records held

Subject Category	Types of Records
Company Records	Memorandum of Incorporation, share register, statutory registers, minutes of meetings, director resolutions
Financial Records	Annual financial statements, management accounts, invoices, receipts, bank statements, tax returns, VAT records, payroll
Human Resources	Employment contracts, performance reviews, payroll, leave records, training records, employee personal data
Client Records	Master Services Agreements, Statements of Work, Data Processing Addenda, NDAs, project files, correspondence, AI agent configurations, prompts, conversation logs (where retained)
Supplier and Sub-Processor Records	Vendor agreements, sub-processor data processing agreements, sub-processor security attestations, purchase orders
Marketing and Sales	Leads database, CRM records, marketing campaign data, website analytics, advertising attribution
Technical and Operational	Source code, infrastructure configuration, security logs, incident reports, backup records, change logs
Legal and Compliance	Contracts, legal opinions, regulatory correspondence, IP registrations, insurance policies

6. Categories of Personal Information Processed

In compliance with section 51(1)(c) of PAIA and section 17 of POPIA, the following categories of Personal Information are processed:

• Identity and contact details of Clients, prospective Clients, employees, directors, contractors, and suppliers.
• Financial and billing information (excluding full card numbers, which are tokenised by PCI DSS compliant payment processors).
• Records of communications, including email, WhatsApp, voice calls (where recorded with notice), and support tickets.
• Business information provided by Clients for the configuration of AI agents and custom software.
• End-user data collected by AI agents deployed on behalf of Clients (processed as Operator on the Client's behalf).
• Website analytics data, device data, IP address, cookie identifiers.

7. Purpose of Processing

• To provide, maintain, and improve the Services.
• To perform contracts and comply with legal, regulatory, and tax obligations.
• To manage employees, contractors, suppliers, and Client relationships.
• For direct marketing to existing Clients (subject to opt-out) and to prospective Clients on the basis of consent or legitimate interest as permitted by POPIA, the CPA, and ECTA.
• To prevent and detect fraud, abuse, and security incidents.

8. Recipients or Categories of Recipients

Personal Information may be shared with:

• Authorised employees, directors, and contractors of Lambie AI (Pty) Ltd.
• Sub-processors listed in our Privacy Policy.
• Professional advisers (auditors, accountants, lawyers, insurers).
• Banks and payment processors.
• Regulatory authorities, courts, and law enforcement where lawfully required.
• Prospective purchasers in the context of a corporate transaction, subject to appropriate confidentiality undertakings.

9. Cross-Border Transfers

Personal Information may be transferred outside the Republic of South Africa in accordance with section 72 of POPIA. We rely on lawful transfer mechanisms including binding contractual safeguards, Standard Contractual Clauses, Data Subject consent, and necessity for the performance or conclusion of a contract. Details are set out in our Privacy Policy.

10. Security Safeguards

Lambie AI (Pty) Ltd takes appropriate, reasonable technical and organisational measures to prevent loss of, damage to, or unauthorised destruction of Personal Information, and unlawful access to or processing of Personal Information, as required by section 19 of POPIA. These measures include encryption in transit and at rest, role-based access controls, multi-factor authentication, network segmentation, monitoring, logging, and an incident response programme.

11. How to Request Access to Records

11.1 Form of request

A request for access to a record held by Lambie AI (Pty) Ltd must be made on the prescribed Form 2 (Request for Access to Record) published by the Information Regulator. The form is available at inforegulator.org.za.

11.2 Submission

The completed Form 2 must be submitted to the Information Officer at the postal address or email address shown in Section 1 of this Manual.

11.3 Required information

• Sufficient particulars to enable the Information Officer to identify the record(s) requested and the requester.
• The form of access required (inspection, copy, transcription, etc.).
• A postal address or email address in the Republic of South Africa.
• Proof of identity of the requester and, where applicable, the person on whose behalf the request is made.
• If the request is made on behalf of another person, proof of the capacity in which the requester is acting.

11.4 Grounds for refusal

Access to records may be refused on any of the grounds set out in Chapter 4 of Part 3 of PAIA, including the protection of the Personal Information of third parties, commercial information of third parties, confidential information of third parties, safety of individuals and property, records privileged from production in legal proceedings, commercial activities of the private body, and research information of third parties.

12. Fees

The fees payable in respect of PAIA requests are those prescribed by the Minister of Justice and Correctional Services and published in the Government Gazette. The current fee structure is summarised below and is subject to change.

Item	Fee (ZAR)
Request Fee (other than personal requester)	R50.00
Photocopy / printed A4 page	R1.10
Copy in computer-readable form (e.g. flash drive)	R70.00
Transcription of visual or audio record per A4 page	R30.00
Search and preparation, per hour or part thereof (after first 6 hours)	R30.00
Deposit (where preparation is estimated to exceed 6 hours)	One third of access fee
Postage, e-mail or other electronic transfer	At actual cost

The request fee is not payable by a personal requester (a requester seeking access to a record containing the requester's own Personal Information). Access fees may be payable in addition to the request fee. Fees must be paid in advance unless waived under PAIA.

13. Timeframes

The Information Officer will respond to a request within 30 days of receipt of a properly completed request. This period may be extended by a further 30 days in the circumstances contemplated in section 57 of PAIA, in which case the requester will be notified in writing.

14. Remedies and Complaints

A requester who is dissatisfied with a decision of the Information Officer may:

• Lodge an internal appeal where applicable.
• Lodge a complaint with the Information Regulator using the prescribed POPIA Form 5 or PAIA Form 6 available at inforegulator.org.za.
• Apply to a competent court for appropriate relief in terms of section 78 of PAIA.

15. Availability of this Manual

This Manual is available:

• On the Lambie AI website at www.lambie-ai.com/paia_manual.html.
• At the registered office during normal business hours, on prior written request.
• By email on request to info@lambie-ai.com.

16. Updates

This Manual will be reviewed and updated as and when necessary, and at least annually, to reflect changes in the law, the records held, or the contact details of the Information Officer.