PAIA manual · updated 30 October 2026

Access to our records

This is the manual of Unmapped Labs under section 51 of the Promotion of Access to Information Act, 2000 (PAIA). It describes the records we hold and how you can ask for access to them, and it sets out how we process personal information, as the Protection of Personal Information Act, 2013 (POPIA) requires.

1. Who we are, and who to ask

Unmapped Labs is a sole proprietorship, which builds South African datasets from official and public sources and provides them through an online portal and an API. As a private body owned by one person, the head of the body and its Information Officer is the owner of Unmapped Labs.

• Street address: Cape Town, South Africa
• Postal address: as for the street address
• Email for PAIA and privacy requests: privacy@unmappedlabs.com
• Website: unmapped.co.za

2. The Information Regulator’s guide

The Information Regulator publishes a guide on how to use PAIA and POPIA to get access to records (section 10 of PAIA). It is available in each official language on inforegulator.org.za and from the Regulator: Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191; enquiries@inforegulator.org.za; 010 023 5200.

3. Records available without a request

These are on our website for anyone to read, without a PAIA request: the dataset catalogue (unmapped.co.za/datasets), our privacy notice, our terms of use and this manual. We have not published a notice under section 52 of PAIA.

4. Records kept under other laws

We keep records as these laws require, where they apply to us: the Income Tax Act, 1962; the Tax Administration Act, 2011; the Value-Added Tax Act, 1991; the Electronic Communications and Transactions Act, 2002; the Protection of Personal Information Act, 2013; and the Promotion of Access to Information Act, 2000.

5. The records we hold

• Business and financial: accounting records, invoices, bank statements, tax records and returns.
• Customers and accounts: account details, terms acceptances, dataset choices, API key records, usage counts and correspondence.
• Prospects: early-access sign-ups, dataset requests and “I need this” submissions from our website.
• Suppliers and service providers: agreements and correspondence, including with our hosting and email providers.
• Datasets: our datasets and their release history, the source documents they were built from, our checks and our internal register of datasets.
• Security and operations: service logs and records of administrative actions.

Listing a category here doesn’t mean a request for those records will be granted: PAIA sets out grounds on which access may or must be refused (chapter 4 of part 3), such as protecting the privacy of others or commercial information.

6. How we process personal information

Why we process it

To run accounts and the service our customers ask for; to apply the limits and terms that protect our data; to reply to people who contact us and invite them when accounts open; to decide which datasets to build; to send news to those who asked for it; to keep the service secure; to build datasets from public records; and to meet our legal duties.

Whose, and what

• Customers and their users: name where given, work email, password hash, sign-in and session records, dataset choices, API key records, usage counts and terms acceptances.
• Prospects and people who contact us: name, work email, company, role, what they need and their choices about updates.
• Suppliers: contact names, emails and the details in our agreements.
• People named in public sources: names and the public, professional details that registers, gazettes, court records and company disclosures publish, such as a registration number, licence or role. Our privacy notice sets out what we leave out.

Who receives it

Our service providers Cloudflare (hosting, databases, email sending and bot checks) and Microsoft (email). Our customers receive the datasets, including the public personal information described above. Authorities, where the law requires it.

Sending it outside South Africa

Cloudflare and Microsoft may store or process personal information outside South Africa, under agreements that give it protection comparable to POPIA’s (section 72).

How we keep it secure

Encryption in transit; passwords, codes, session tokens and API keys stored only as one-way hashes; sign-in with a password and an emailed code; access to account data limited to the owner; rate limits and bot checks; and automatic deletion when information is no longer needed, as the privacy notice sets out.

7. How to ask for a record

1. Use the request form (Form 2) prescribed by the PAIA Regulations, 2021, available on the Information Regulator’s website, and send it to privacy@unmappedlabs.com or to the address above.
2. Describe the records clearly enough for us to find them, say in what form you want access, and explain which right you want to exercise or protect and why the record is needed for it (section 53 of PAIA). If you ask on someone else’s behalf, include proof that you may.
3. We may charge the request fee and access fees prescribed in the PAIA Regulations. If a fee applies, we’ll tell you before we go on. You don’t pay a request fee to ask for your own personal information.
4. We’ll give you our decision within 30 days of receiving a complete request, or tell you within that time if we need up to 30 days more, as PAIA allows (sections 56 and 57).

If you’re unhappy with our decision, you may complain to the Information Regulator within 180 days (PAIAComplaints@inforegulator.org.za) or apply to court (section 78).

8. Where to find this manual

On our website at unmapped.co.za/paia, and on request by email at no charge. We update it when what it describes changes.