PAIA manual

ShopOn Online (Pty) Ltd — prepared in terms of section 51 of the Promotion of Access to Information Act 2 of 2000 ("PAIA"). Last updated: 26 October 2026.

1. About this manual

This manual explains which records ShopOn Online (Pty) Ltd ("ShopOn") holds, how to ask for access to them, and how ShopOn processes personal information. It is available on this website and, on request, at our business address.

2. Our details

Name: ShopOn Online (Pty) Ltd
Registration number: 2013/217040/07
Business contact address: 18 West Road South, Morningside, 2196, South Africa (we have no separate postal address)
Telephone: 072 402 9614
E-mail: info@shopon.co.za
Website: shopon.co.za

Information Officer: John Peter Criticos, john@shopon.co.za, 072 402 9614, at the business contact address above. No Deputy Information Officer has been appointed.

3. The Information Regulator's guide

The Information Regulator publishes a guide on how to use PAIA and the Protection of Personal Information Act ("POPIA"), in the official languages. It is available on the Regulator's website, inforegulator.org.za, which also gives the Regulator's current contact details.

4. Records available without a request

The following are available on our website without a PAIA request: our Privacy Policy, our Terms and Conditions, our data deletion instructions, this manual, and the information on our product and pricing pages.

5. Records kept in terms of other legislation

Where applicable, ShopOn keeps records in terms of legislation including the Companies Act 71 of 2008, the Income Tax Act 58 of 1962, the Value-Added Tax Act 89 of 1991, the Tax Administration Act 28 of 2011, the Basic Conditions of Employment Act 75 of 1997, the Labour Relations Act 66 of 1995, the Electronic Communications and Transactions Act 25 of 2002, the Consumer Protection Act 68 of 2008 and the Protection of Personal Information Act 4 of 2013.

6. The records we hold

(a) Company records: incorporation documents, statutory registers, minutes and resolutions.
(b) Financial and tax records: accounting records, invoices, payment records, bank statements, tax returns.
(c) Client (merchant) records: account and contact details, subscriptions and services, invoices and payments, support correspondence, domain registrations, and the content of the online shops our clients build (products, pages, images, settings).
(d) Shoppers' records held for our clients: orders and customer details in our clients' shops, which we process on our clients' behalf.
(e) Website and platform records: server and security logs, the records described in our Privacy Policy (including cookies and the Facebook and Instagram connections), and privacy requests.
(f) Supplier and service-provider records: agreements, correspondence and invoices.
(g) Employee and contractor records, where applicable.

7. How we process personal information

Purposes: to provide, bill and support our online-shop platform and related services (including domains, e-mail and payment integrations); to run the online shops our clients build, on their behalf; to keep the platform secure; to meet our legal obligations; and, where you allow it, to measure and improve our website and advertising (see the cookie section of our Privacy Policy).

Who the information is about, and what it is: clients (names, contact details, billing and account information, support correspondence); shoppers in our clients' shops (names, contact and delivery details, orders — processed for our clients); website visitors (technical and, with consent, analytics and advertising information); people who send us privacy requests; suppliers; and employees or contractors, where applicable.

Who receives it: our clients (for their own shops' information); service providers who help us run the platform — e-mail delivery (SendGrid, and Amazon Web Services where used), website delivery and domain services (Cloudflare), payment providers (PayFast, and Netcash for some older shops), the .co.za domain registry (ZA Central Registry) for domain registrations, live chat (Tawk.to, when used), Google (analytics, advertising and reCAPTCHA on our website, as described in our Privacy Policy, and the web fonts that the shop editor and our clients' shops use) and Meta (the optional Facebook and Instagram connections and, with consent, the Meta Pixel); and authorities where the law requires it. We do not sell personal information.

Transfers outside South Africa: some of these providers process information outside South Africa (for example in the United States or the European Union). We use providers that are bound to protect it under their terms and applicable law.

Security: access to personal information is limited to the people and systems that need it; connections are encrypted (HTTPS); the access tokens for the Facebook and Instagram connections are stored encrypted; and we keep backups so information is not lost.

8. How to request access to a record

(a) Use the prescribed request form, Form 2 (Request for Access to Record), and send it to our Information Officer at the contact details in section 2. The Information Regulator's PAIA Guide explains how. In the form:

   (i) give enough detail to identify the record and yourself;
   (ii) identify the right you want to exercise or protect, and explain why you need the record to exercise or protect that right (for the PAIA request described here);
   (iii) say how you want to receive the record; and
   (iv) if you ask on someone else's behalf, show your authority.

(b) Fees: a request fee and an access fee may be payable, as prescribed by the PAIA regulations. We will tell you the amount before we proceed. A person asking for their own personal information does not pay the request fee.

(c) We decide within 30 days of receiving the request. We may extend this once by up to 30 days, and will tell you why.

(d) We may refuse access on the grounds PAIA sets out (for example to protect another person's personal information, commercial or confidential information, or the safety of people or property). If we refuse, we give reasons.

(e) If you are not satisfied with our decision, you may complain to the Information Regulator within 180 days, or apply to a court.

Your own personal information (POPIA) is a separate, simpler route. To ask whether we hold personal information about you, or to see it, contact the Information Officer; you do not need to explain why you want it. To ask for your own personal information to be corrected or deleted, or to object to its use, contact the Information Officer, or see our data deletion page. We first confirm that the request comes from you.

9. Availability and updates

This manual is published on our website and is available at our business address. We update it when our details or practices change.