Legal

Manual in terms of section 14 of the Promotion of Access to Information Act 2 of 2000

Published: 14 August 2026

1. Introduction

This manual is published in terms of section 14 of the Promotion of Access to Information Act 2 of 2000 (“PAIA”), as amended. It explains what records Signalword holds, how to request access to them, and how we handle personal information under the Protection of Personal Information Act 4 of 2013 (“POPIA”).

Signalword is a private body. We audit how visible travel and education companies are to AI assistants: whether AI systems can read a company’s website, and whether they recommend that company when a customer asks. We are a very small operation, and this manual is short because there is genuinely little to describe.

2. Contact details

Requests and enquiries under this manual should be addressed to the Information Officer at the email address above.

3. The Information Regulator’s guide

Section 10 of PAIA requires the Information Regulator to publish a guide on how to use the Act. It is available from the Regulator:

Information Regulator (South Africa)
JD House, 27 Stiemens Street, Braamfontein, Johannesburg
PO Box 31533, Braamfontein, Johannesburg, 2017
Telephone: 010 023 5200
Email: enquiries@inforegulator.org.za
Website: inforegulator.org.za

4. Records available without a request

Section 52(1) of PAIA allows a private body to publish a notice listing categories of records that are automatically available without a formal request.

Signalword has not published such a notice. However, the following are freely available on our website without any request or payment:

• Our privacy policy
• This manual
• Our published method — what we measure and what we cannot measure
• Aggregate industry statistics from our audits, which contain no personal information and name no individual company
• A specimen audit report, based on a fictional company

5. Records available in terms of other legislation

Records may be available in terms of, among others:

• Companies Act 71 of 2008
• Income Tax Act 58 of 1962
• Tax Administration Act 28 of 2011
• Value-Added Tax Act 89 of 1991
• Basic Conditions of Employment Act 75 of 1997, if and when we employ anyone
• Protection of Personal Information Act 4 of 2013

Access under those Acts is governed by them and not by this manual.

6. Subjects and categories of records we hold

A note on the audit data, because it is the largest category and the most easily misunderstood. It describes websites, not people. It is gathered by making ordinary web requests of the kind any search engine makes, and by asking AI assistants publicly answerable questions such as “best safari operators for families” and recording which businesses they name. Company names and website addresses are not personal information. We hold no personal information about any audited company’s customers, staff or students.

7. How to request a record

1. Complete the prescribed request form (Form 2 of the PAIA regulations), available from the Information Regulator’s website.
2. Send it to the Information Officer at the email address in section 2.
3. Provide enough detail to identify the record, and to identify you and any right you are exercising. State how you wish to be informed of the decision.
4. If you are requesting on someone else’s behalf, include proof of your authority.
5. If you are requesting a record in order to exercise or protect a right, say which right — PAIA requires a private body to be told this.

Fees. PAIA provides for a request fee and an access fee, prescribed by regulation and published by the Information Regulator. We will tell you what is payable before doing any work, and we will not charge more than the prescribed amount. There is no fee for a request for your own personal information.

Timing. We will decide within 30 days of receiving a complete request, and tell you the outcome and any fee. That period may be extended in the circumstances PAIA allows, and we will tell you if it is, and why.

If we refuse. We will give reasons, in writing, and identify the provision of PAIA we rely on. A private body has no internal appeal procedure. You may complain to the Information Regulator, or apply to court, within the periods PAIA sets.

Grounds we may refuse on are those in Chapter 4 of PAIA, and include the mandatory protection of another person’s privacy, of a third party’s commercial information, and of information given to us in confidence. Notably, an audit report prepared for a client contains that client’s commercial information and we will not release it to anybody else.

8. Processing of personal information

Included as required by PAIA as amended, and consistent with our privacy policy.

Purpose. To reply to enquiries, and to deliver and invoice work for clients. We do not use personal information for anything else.

Categories of data subjects and information.

Recipients. Service providers acting only on our instructions: our website host, our email delivery provider, our email provider, our payment processor, and our anti-spam provider. We do not sell or share personal information for anyone else’s marketing, and we do not send personal information to AI models — the questions we put to AI assistants are about companies and destinations.

Cross-border transfers. Some of those providers are outside South Africa, principally in the European Union and the United States, so personal information may be transferred internationally. Those transfers rely on standard contractual clauses or an equivalent safeguard.

Special personal information and children’s information. We do not process special personal information as defined in section 26 of POPIA, and we do not knowingly process the personal information of children. Some of our clients are language schools and educational travel providers whose own customers are young; we audit their websites and never receive their student records.

Retention. Enquiries are kept for up to 24 months from last contact. Client and financial records are kept for as long as tax and company law requires. Audit measurements are kept while useful for comparison and contain no personal information.

Security. Access to enquiries is limited to the Information Officer. Our email uses multi-factor authentication. Credentials for third-party services are held as environment variables and never appear in the website’s code. We are a very small operation, and the honest implication is worth stating: we hold little, and the best protection for your information is that there is not much of it.

9. Availability of this manual

• On our website at signalword.com/paia
• From the Information Officer on request, by email, at no charge

It is available in English. We will make reasonable arrangements for anyone who cannot read it in English or who has a disability that prevents them from reading it, including reading it to you.

10. Updates

This manual will be updated whenever what we hold or how we handle it changes materially. The publication date at the top shows the current version.