Manual in terms of section 51 of the Promotion of Access to Information Act 2 of 2000
Profit Pigeon (Pty) Ltd
Registration number: 2026/196128/07
Compiled: 31 August 2026
Last reviewed: 31 August 2026
1. Introduction#
This manual is published in terms of section 51 of the Promotion of Access to Information Act 2 of 2000 ("PAIA"), as amended by the Protection of Personal Information Act 4 of 2013 ("POPIA").
PAIA gives effect to the constitutional right of access to information held by the State and to information held by a private body where that information is required for the exercise or protection of any right.
This manual describes the records Profit Pigeon (Pty) Ltd holds, how a request for access may be made, and how the Company processes personal information.
It is available:
- On the Company's website at profitpigeon.com/paia
- At the Company's principal place of business, for inspection during business hours
- On request, against a reasonable fee for reproduction
- To the Information Regulator on request
2. Particulars of the Company#
| Registered name | Profit Pigeon (Pty) Ltd |
|---|---|
| Registration number | 2026/196128/07 |
| Date of incorporation | 6 March 2026 |
| Type | Private company |
| Financial year end | February |
| Registered office | Unit 201 Masons Press, Woodlands Road, Woodstock, Cape Town, Western Cape, 7925 |
| Postal address | Unit 201 Masons Press, Woodlands Road, Woodstock, Cape Town, Western Cape, 7925 |
| Telephone | +27 73 818 4983 |
| developer@profitpigeon.com | |
| Website | profitpigeon.com |
2.1 Head of the private body and Information Officer#
| Name | Theo van Wyk |
|---|---|
| Capacity | Head of the private body and Information Officer |
| Registered with the Information Regulator | Yes |
| Postal address | Unit 201 Masons Press, Woodlands Road, Woodstock, Cape Town, Western Cape, 7925 |
| Telephone | +27 73 818 4983 |
| developer@profitpigeon.com |
No Deputy Information Officer has been designated. The Company is a small private company and the Information Officer performs the functions directly, as contemplated in paragraph 7.5 of the Information Regulator's Guidance Note on Information Officers and Deputy Information Officers.
2.2 Nature of the business#
The Company develops and operates Profit Pigeon, a profit analytics software application for e-commerce merchants using the Shopify platform.
3. The Information Regulator#
Requests, complaints and enquiries relating to PAIA or POPIA may be directed to:
Information Regulator (South Africa)
JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001
PO Box 31533, Braamfontein, Johannesburg, 2017
General enquiries: enquiries@inforegulator.org.za
PAIA complaints: PAIAComplaints@inforegulator.org.za
POPIA complaints: POPIAComplaints@inforegulator.org.za
Website: inforegulator.org.za
4. The section 10 Guide#
The Information Regulator has compiled a guide, in terms of section 10 of PAIA, containing information reasonably required by a person who wishes to exercise a right under the Act.
The guide is available from the Information Regulator at the contact details in section 3, and on the Regulator's website at inforegulator.org.za. It is available in each of the official languages.
5. Records available without a request#
No notice has been published in terms of section 52(2) of PAIA. The following records are nonetheless made available voluntarily, without a formal PAIA request, on the Company's website at profitpigeon.com:
- The Privacy Policy
- The Terms of Service
- The Data Processing Terms, annexed to the Terms of Service
- This manual
- Product and pricing information
6. Records held by the Company#
The Company holds records in the following categories. Listing a category does not mean that access will be granted. Each request is assessed against the grounds for refusal in Chapter 4 of Part 3 of PAIA.
| Category | Examples |
|---|---|
| Company and statutory records | Memorandum of incorporation, CIPC registrations and returns, share register, director records, board minutes and resolutions |
| Financial records | Annual financial statements, management accounts, invoices, bank statements, tax returns and assessments, VAT records |
| Personnel records | Employment contracts, contractor agreements, personnel files, payroll records, confidentiality undertakings |
| Customer records | Merchant account records, subscription and billing records, support correspondence |
| Operational records | Application data, system and access logs, backups, technical documentation, security records |
| Marketing records | Website content, marketing material, campaign records, mailing lists |
| Contract records | Agreements with suppliers, sub-processors, service providers and professional advisers |
| Data protection records | This manual, the record of processing activities, data protection policies, records of security compromises, data subject request records |
| Insurance records | Policies and claims |
6.1 Records held in terms of other legislation#
Records are also held in terms of, among others:
- Companies Act 71 of 2008 (accounting records, seven years)
- Income Tax Act 58 of 1962 and Tax Administration Act 28 of 2011 (tax records, five years)
- Value-Added Tax Act 89 of 1991
- Tax Administration Act 28 of 2011
- Basic Conditions of Employment Act 75 of 1997
- Labour Relations Act 66 of 1995
- Protection of Personal Information Act 4 of 2013
- Electronic Communications and Transactions Act 25 of 2002
- Consumer Protection Act 68 of 2008
7. Processing of personal information#
The following is included in terms of section 51(1)(c) of PAIA, as amended by POPIA.
7.1 Purposes of processing#
Personal information is processed for the following purposes:
- Providing the Profit Pigeon application to merchants, on the instructions of each merchant
- Creating and administering merchant accounts
- Charging subscription fees through Shopify Billing
- Providing support
- Securing the application and detecting and preventing fraud and abuse
- Diagnosing faults and improving the application
- Direct marketing, where consent has been given
- Complying with legal obligations, including tax and company law obligations
- Administering employment and contractor relationships
7.2 Categories of data subjects and the information relating to them#
| Category of data subject | Categories of information |
|---|---|
| Merchants and their authorised users | Name, business email address, shop domain, role, authentication tokens, session and login records, subscription and billing records, support correspondence |
| Customers of merchants | Pseudonymous customer identifiers and order records only. No names, email addresses, telephone numbers or postal addresses are processed. |
| Employees and contractors | Identity and contact details, banking details for remuneration, remuneration records, employment records, tax records |
| Suppliers and service providers | Business contact details, contract records, payment records |
| Website visitors and prospective customers | Contact details submitted through the website, internet protocol address, device and usage data, cookie identifiers |
7.3 Recipients or categories of recipients#
Personal information may be made available to:
- Sub-processors engaged to run the application, as listed in section 9 of the Privacy Policy at profitpigeon.com/privacy
- The Company's auditors, accountants and attorneys
- The South African Revenue Service and other regulators, where required by law
- A court or law enforcement authority, where required by law
- Shopify, in response to a customer data request, customer redaction or shop redaction notification
- An acquirer, in connection with a merger, acquisition or sale of the business
Personal information is not sold and is not disclosed to any third party for that third party's own purposes.
7.4 Planned transborder flows#
The Company's application data is hosted at South Africa (AWS af-south-1, Cape Town). Infrastructure is provided by Vercel Inc. and Cloudflare, Inc., both incorporated in the United States and operating global networks.
Where personal information is transferred outside the Republic to a sub-processor, that transfer is made in terms of section 72(1)(a) of POPIA, on the basis of a binding written agreement that upholds principles for reasonable processing substantially similar to POPIA's conditions and that restricts onward transfer. The current sub-processors and the country in which each operates are published in section 9 of the Privacy Policy at profitpigeon.com/privacy.
7.5 Security measures#
The Company has appropriate, reasonable technical and organisational measures in place to prevent loss of, damage to, or unauthorised destruction of personal information, and unlawful access to or processing of it.
Those measures include encryption of information in transit and at rest, restricted and logged access on a least-privilege basis, multi-factor authentication on administrative accounts, separation of production and non-production environments, encrypted and tested backups, written confidentiality undertakings, and a documented security incident response procedure.
A fuller description is published in Annex A2 of the Terms of Service at profitpigeon.com/terms.
8. How to request access to a record#
8.1 The forms#
Requests must be made on the prescribed form.
| Form | Purpose | Where to obtain it |
|---|---|---|
| Form 02 | Request for access to a record of a private body | inforegulator.org.za, under PAIA forms |
| Form 03 | Outcome of request and of fees payable | inforegulator.org.za, under PAIA forms |
| Form 04 | Internal appeal, public bodies only | inforegulator.org.za, under PAIA forms |
The forms are editable and are updated from time to time. Current versions are linked directly from profitpigeon.com/paia so that the latest version is always used.
8.2 Where to send a request#
Completed forms must be sent to the Information Officer:
Email: developer@profitpigeon.com
Post: The Information Officer, Profit Pigeon (Pty) Ltd, Unit 201 Masons Press, Woodlands Road, Woodstock, Cape Town, Western Cape, 7925
8.3 What the request must contain#
- Sufficient particulars to enable the Information Officer to identify the record and the requester
- The form of access required
- The postal address, email address or fax number of the requester
- Where the request is made on behalf of another person, proof of the capacity in which the requester is making the request
- The right the requester seeks to exercise or protect, and an explanation of why the record is required to exercise or protect that right. A request that does not state this must be refused, because section 50(1)(a) permits access to a record of a private body only where it is required for the exercise or protection of a right.
8.4 How the request is handled#
- The Information Officer decides the request within 30 days of receipt, and notifies the requester in writing.
- Where the record cannot reasonably be found or does not exist, the requester is notified by affidavit or affirmation.
- Where the request affects a third party, that party is notified and given an opportunity to make representations, and the 30-day period is extended accordingly.
- Where the period is extended for any other reason permitted by section 57, the requester is notified in writing with reasons before the original period expires.
8.5 Fees#
Two fees may apply, as prescribed in the PAIA regulations.
- A request fee, payable on submission before the request is processed.
- An access fee, payable before access is given, covering the cost of reproduction, search and preparation, and postage where applicable.
The Information Officer notifies the requester of the access fee payable, using Form 03, before access is given. A requester may lodge a complaint with the Information Regulator against the amount.
Current prescribed amounts are published by the Information Regulator at inforegulator.org.za.
8.6 Grounds for refusal#
Access may or must be refused on the grounds set out in Chapter 4 of Part 3 of PAIA, including:
- Protection of the privacy of a third party who is a natural person (section 63)
- Protection of the commercial information of a third party or of the Company (sections 64 and 68)
- Protection of confidential information of a third party where disclosure would breach a duty of confidence (section 65)
- Protection of the safety of individuals and of property (section 66)
- Protection of records privileged from production in legal proceedings (section 67)
- Protection of research information (section 69)
Where a request is refused, the requester is given written reasons and is informed of the remedies available.
8.7 Remedies#
A private body has no internal appeal procedure. A requester who is dissatisfied with a decision may:
- Lodge a complaint with the Information Regulator under section 77A of PAIA, within 180 days of the decision, using prescribed Form 05 and sending it to PAIAComplaints@inforegulator.org.za, or
- Apply to a court under section 78 of PAIA, within 180 days of the decision.
9. Availability and review#
This manual is available in English, in the formats set out in section 1.
It is reviewed at least annually, as required by section 51(2), and is updated whenever there is a material change to the Company's records, processing or contact details.
Any query about this manual may be directed to the Information Officer at developer@profitpigeon.com.