PAIA Manual

Foundry Digital Studio (Pty) Ltd · Reg 2026/384110/07 · Compiled 31 July 2026

1. Introduction

Foundry Digital Studio (Pty) Ltd ("Foundry"), trading as Foundry Digital AI, designs, builds, hosts and maintains automated business workflows and artificial-intelligence-assisted systems for South African businesses. Foundry is a private body as defined in section 1 of PAIA. This manual is published in terms of section 51 of PAIA and regulation 9 of the PAIA Regulations, 2021. It explains what records Foundry holds, how to request access to them, and how Foundry processes personal information as required by regulation 4(1)(d).

2. Contact details

3. The Regulator's Guide

The Information Regulator has, in terms of section 10(1) of PAIA, published a Guide on how to use PAIA, in each official language. It describes the objects of PAIA, the manner and form of a request for access, and the assistance available from the Regulator. It is available from the Information Regulator (South Africa): JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001; enquiries@inforegulator.org.za; 010 023 5200; inforegulator.org.za.

4. Records available in terms of other legislation

Foundry holds records that are kept in accordance with, and may be available under, the following legislation (where applicable and subject to the conditions in each Act): the Companies Act 71 of 2008; the Income Tax Act 58 of 1962; the Value-Added Tax Act 89 of 1991 (once registered); the Tax Administration Act 28 of 2011; the Electronic Communications and Transactions Act 25 of 2002; the Protection of Personal Information Act 4 of 2013; the Consumer Protection Act 68 of 2008; and, if and when Foundry employs staff, the Basic Conditions of Employment Act 75 of 1997, the Labour Relations Act 66 of 1995, the Employment Equity Act 55 of 1998, the Compensation for Occupational Injuries and Diseases Act 130 of 1993 and the Unemployment Insurance Act 63 of 2001.

5. Records automatically available

• All content published on https://foundrydigitalai.com, including service descriptions, pricing plans and marketing material
• Foundry's privacy policy
• This PAIA manual

6. Subjects and categories of records held

The listing of a category of records does not mean that a request for access will be granted. All requests are evaluated under Part 3 of PAIA, including the grounds for refusal in Chapter 4 of Part 3, such as the protection of the privacy of third parties, commercial information of Foundry and third parties, and legal professional privilege.

7. How to request access

• Complete Form 2 (Request for Access to Record of Private Body) prescribed under the PAIA Regulations, 2021, available from the Information Regulator's website or from Foundry on request.
• Submit the completed form to the Information Officer at the address or email in section 2, with proof of identity, proof of capacity if acting for someone else, and the prescribed request fee (see section 8).
• Identify the record sought and the form of access required. A requester who is not seeking their own personal information must also identify the right they seek to exercise or protect and explain why the record is required for that purpose (section 50(1)(a) of PAIA).
• Foundry will decide the request within 30 days of receipt (extendable once by up to 30 days in the circumstances permitted by section 57) and will notify the requester of the decision, the applicable access fees and, where access is refused, the reasons and the requester's remedies.
• A requester aggrieved by a decision may lodge a complaint with the Information Regulator (Form 5) or apply to a court, as contemplated in sections 78 and 82 of PAIA.

A data subject requesting their own personal information does not pay the request fee and does not need to motivate a right. Only proof of identity is required.

8. Fees

Fees are as prescribed in Annexure B to the PAIA Regulations, 2021, as amended from time to time. As at the date of this manual the prescribed request fee for a record of a private body is R140.00, not payable by a data subject requesting their own personal information. Access fees for reproduction, search and preparation, and postage are payable in accordance with the same Annexure. Foundry will confirm the current prescribed fees on receipt of a request. Where the search and preparation time is likely to exceed the prescribed hours, a deposit may be requested as contemplated in section 54(2) of PAIA.

9. Processing of personal information (POPIA)

Purpose of processing

• Rendering automated-workflow and AI-assisted services to clients, in which case Foundry generally acts as an operator on the client's behalf under a written operator agreement concluded in terms of section 21 of POPIA
• Managing its own client, supplier and prospect relationships, billing and account administration, as responsible party
• Marketing its services, subject to section 69 of POPIA
• Complying with legal and regulatory obligations

Categories of data subjects and personal information

Recipients and cross-border flows

Personal information may be supplied to the third-party service providers that host or process it in the course of rendering the services, including messaging platforms, productivity platforms, database hosting providers, artificial-intelligence providers and infrastructure hosting providers, each under contractual data-protection obligations. In client engagements, the specific recipients are disclosed to the client in the sub-operator schedule to the operator agreement. Some recipients process personal information outside South Africa, including in the United States and the European Union; transfers take place on the bases permitted by section 72 of POPIA, including written agreements imposing obligations substantially similar to POPIA.

Security measures

Foundry implements appropriate, reasonable technical and organisational measures as required by section 19 of POPIA, including segregation of each client's data in dedicated database projects; encrypted per-client credential storage; least-privilege access control with unique credentials and multi-factor authentication; encryption of data in transit and at rest; individual user logins; execution logging with automated failure alerting; version-controlled backups; written confidentiality undertakings for all personnel with access to personal information; and defined retention and deletion procedures.

10. Availability of this manual

This manual is available on this website, at Foundry's principal place of business during business hours, and by email on request to the Information Officer, free of charge. It will be updated whenever material changes occur, as required by section 51(2) of PAIA.

Melissa Mathurai
Director and Information Officer
Foundry Digital Studio (Pty) Ltd