PolyTrack Already have an account? Log in

PAIA Manual

Manual of The Polymath (Pty) Ltd, a private body, prepared under section 51 of the Promotion of Access to Information Act 2 of 2000 (PAIA) and the Protection of Personal Information Act 4 of 2013 (POPIA).

Published on 5 November 2026

1. Introduction

PAIA gives a person the right of access to records held by a private body when the record is needed to exercise or protect a right. This manual says what records The Polymath (Pty) Ltd holds, which of them can be had without a formal request, and how to ask for access to the others. It also sets out, as POPIA requires, how we process personal information.

It works together with our Privacy Notice, which explains in everyday language how we handle personal information in PolyTrack.

2. About The Polymath (Pty) Ltd

PolyTrack is a risk management platform provided by The Polymath (Pty) Ltd, a company based in Pretoria, South Africa (registration number 2026/275612/07). For PolyTrack we act only as a software provider: PolyTrack does not give insurance advice and does not handle premiums or claim payments.

We act in two roles. As a responsible party we decide how to use the information of the people who hold PolyTrack accounts or sign up for one. As an operator we process, on a client's behalf, the information about other people that our clients load into PolyTrack; for that information the client is the responsible party.

3. Who to contact

Requests under this manual go to the Information Officer, who is also the head of the company for the purposes of PAIA.

4. The Information Regulator's guide

The Information Regulator has compiled a guide, in each official language, on how to use PAIA and POPIA. It is available from the Regulator:

5. Records available without a request

These are published, or given to anyone who asks, and need no PAIA request:

6. Records available under other legislation

We keep records as other legislation requires, to the extent it applies to us. Such records are available as that legislation provides. The legislation under which we keep records is:

We have no employees at present. If that changes, the employment and occupational health and safety legislation that then applies will be added to this list.

7. Records we hold

We hold the following categories of records. A record being listed does not mean it will be released: access is decided on a request, as section 13 explains.

CategoryWhat it includes
Company recordsIncorporation and registration documents, resolutions, the records of directors and shareholders, and our registration with the Information Regulator.
Financial and tax recordsAccounting records, invoices and receipts, tax and VAT returns, and records of subscriptions and payments. Card and bank details are never held by us: payments are made on PayFast's own pages.
Customer account recordsAccount and profile details (name, email address, role, job title, telephone numbers and, for brokers and insurers, business details such as an FSP number), sign-in and security records, sign-up records, the plan chosen and the person responsible for the subscription.
AgreementsOur agreements with clients, brokers, insurers and service providers, and the terms they accepted.
Security and audit recordsAn audit log of changes made in PolyTrack and who made them, a log of the emails PolyTrack sends, and records of password reset requests.
Correspondence and supportEmails and messages with clients, users and service providers, and support requests.
Policies and proceduresOur internal policies, including those on information security and privacy.
Software and intellectual propertyThe PolyTrack software, its documentation and design, which are proprietary to The Polymath (Pty) Ltd.

Records we hold as an operator. Our clients load information about other people into PolyTrack: for example their employees, drivers, contractors and people involved in incidents. These records belong to the client, who is the responsible party. A request for them should be made to that client; we will help the client respond.

8. Purposes of processing

We process the personal information of account holders:

We do not sell personal information and do not use it for advertising. As an operator we process clients' information only on the client's instructions.

9. People the information is about

10. Who receives the information

We share information only so that these providers can provide their part of the service:

Used only if a user or client connects them: Google Calendar and Microsoft 365 (adding reminders to the user's own calendar), Microsoft Teams and Slack (posting alerts to a client's own channel) and vehicle tracking providers (reading a client's own tracking data). Within PolyTrack, information is shared with the people entitled to it, as section 8 says.

11. Transfers outside South Africa

Some of our service providers process personal information outside South Africa: Cloudflare (document storage in the European Union), Brevo (emails, France) and Sentry (error monitoring). Cloudflare and Sentry are United States companies and may also process information in the United States. Cloudflare's proxy can handle traffic in any country where Cloudflare operates, including the United States. If a user or organisation connects them, Google Calendar, Microsoft 365, Microsoft Teams and Slack may process information in other countries, including the United States. We tell the user this before they connect them.

We share personal information with these providers only under binding data processing agreements that require them to protect it to a standard substantially similar to POPIA, also when they pass it on to their own sub-processors, as section 72 of POPIA requires. Where we process information as an operator for a client, the client approves these providers in its agreement with us.

12. Security measures

We protect personal information with measures that include the following:

If we become aware of a security compromise affecting personal information, we will notify the Information Regulator and the affected people, or the client concerned where we act as operator, as POPIA requires.

13. How to request access

  1. Complete Form 2, “Request for access to record”, from the PAIA Regulations, 2021, available on the Information Regulator's website.
  2. Say clearly which record you want, and which right you wish to exercise or protect with it. If you ask for someone else, send proof of your authority.
  3. Send it to the Information Officer at the email or addresses in section 3. We may need to confirm your identity first.

The PAIA Regulations set a request fee and, if access is granted, fees for searching for, preparing and copying the records. We will tell you what is payable before we do the work. We will reply within 30 days, which PAIA allows us to extend once by up to 30 days if we tell you why.

Access may be refused on the grounds PAIA sets out, for example to protect another person's privacy or confidential commercial information. If you disagree with our decision you may complain to the Information Regulator (PAIAComplaints@inforegulator.org.za) or apply to court.

To ask for your own personal information, to correct or delete it, or to object to its processing, see the Privacy Notice, or write to the Information Officer.

14. Availability and updates

This manual is available on our website at polytrack.co.za/paia, from the Information Officer at the addresses in section 3 on request, and to the Information Regulator on request. We update it when the records we hold or how we handle personal information change.