Access to information.What we hold, and how to ask for it.

Registered name: Zelpano (Pty) Ltd.

Company registration number: 2026/675811/07.

Type: private company, registered with CIPC on 28 August 2026.

Holding company: none recorded. Zelpano (Pty) Ltd was incorporated with one incorporator and one director, and no holding company appears on its founding documents.

Registered and postal address: 13 Oliver Road, Monument Heights, Kimberley, 8301.

Website: https://zelpano.com.

Information Officer: Liyema Swartbooi (Director), registered with the Information Regulator on 7 September 2026 under registration number 2026-066104, appointed 24 August 2026.

Information Officer email — support@zelpano.com.

Deputy Information Officers: none currently designated.

The Information Regulator has, in terms of section 10 of PAIA, published a Guide on how to exercise rights under PAIA and POPIA. The Guide is available from the Regulator at the contacts below.

Information Regulator (South Africa): JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001. Telephone 010 023 5200.

PAIA complaints: PAIAComplaints@inforegulator.org.za. POPIA complaints: POPIAComplaints@inforegulator.org.za. General enquiries: enquiries@inforegulator.org.za.

Website: https://inforegulator.org.za. eServices portal: https://eservices.inforegulator.org.za.

The following are available on the website without a PAIA request: marketing and product information, the workflow catalogue and pricing; the Privacy Policy and the Terms of Service; and this manual.

An account holder can also access, at any time through their own account and without a PAIA request, the personal information in their own profile and their own submissions.

Records are held in electronic form in the database and file storage underpinning the platform, and, where applicable, in generated PDF documents.

Company and business records: company registration, tax, statutory and governance records; financial, banking, accounting and subscription records; contracts with customers, suppliers and operators; insurance, correspondence and internal policies.

Platform account records, where the data subjects are account holders: name, email, phone, South African ID number where provided, address and avatar; authentication metadata, role, consent records including the terms version and timestamp, and organisation membership; support tickets, issue reports, workflow ratings and free-text feedback.

Workflow submission records, where the data subjects are a customer organisation's employees, job candidates, students and other third parties, and where Zelpano acts as Operator: HR and employment-lifecycle records including onboarding dossiers, employment contracts, offer letters, probation reviews, appraisals, leave requests, training enrolments, checklists, exit interviews and 360° feedback; finance and claims records including subsistence, travel, official-duty, overtime and reimbursive claims, with banking details, salary and tax or UIF numbers; recruitment records including CVs, applications and questionnaires; background-check records; operations records including shift rosters with PSIRA grades, registers and logs with occurrence data, photographs and geolocation; and education records for work-integrated-learning placements.

These records include Special Personal Information within the meaning of section 26 of POPIA: health information, race or ethnicity for Employment Equity purposes, criminal and credit-check information, and signatures: all processed on behalf of, and under the authority of, the relevant customer organisation.

Records held with operators: personal information is processed with authentication (Clerk), database, file storage and application backend (Convex), transactional email (Resend), SMS and WhatsApp notifications (Twilio), subscription billing (Polar) and hosting (Vercel), each under a written processing arrangement.

Records are also kept as required by, among others, the Companies Act 71 of 2008, the Income Tax Act and related tax legislation, the Basic Conditions of Employment Act, the Labour Relations Act, the Employment Equity Act, the Skills Development Act and POPIA itself.

Purposes of processing: providing the workflow platform; account management; processing and delivering form submissions on behalf of customer organisations; billing; support; security; and legal compliance.

Categories of data subjects: platform account holders; customer organisations' employees; job candidates; students; security personnel; and business contacts.

Categories of personal information: identity and contact details, South African ID or passport numbers, banking and tax details, employment and salary information, qualifications, and the Special Personal Information described in section 5.

Cross-border transfers. Zelpano uses six operators: Clerk, Convex, Resend, Twilio, Polar and Vercel. Personal information is processed by all six outside the Republic of South Africa, and no operator offers a South African region. Vercel serves this platform's functions from US East (Northern Virginia); Convex offers only US East and EU West (Ireland); Clerk does not offer region selection and hosts on United States infrastructure; Resend stores message content, delivery logs and account records in the United States regardless of the sending region; Twilio offers United States, Ireland and Australia regions only, and this platform uses the United States default; Polar's published sub-processor list is entirely United States and United Kingdom. These transfers are accordingly made in terms of section 72 of POPIA, on the bases set out in the Privacy Policy and in Zelpano's operator agreements.

Retention: personal information is retained only as long as necessary for the purpose or as required by law. The retention window is set by the organisation's subscription plan: 30 days on the entry plan, one year, five years, or a contractually agreed period on Enterprise. These windows govern register entries; other record types are retained for as long as the responsible party's own purpose requires, and are deleted on that party's instruction. The applicable window for an organisation is stated in its operator agreement. Retention is presently applied by policy and on request rather than by an automated purge.

Complete the prescribed Form 2, Request for Access to Record of Private Body, available from the Information Regulator's website or on request from the Information Officer.

Submit it to the Information Officer at the contact details in section 2.

Provide sufficient particulars to identify the record and yourself, the form of access required, and the right you seek to exercise together with why the record is required to exercise it.

Pay the prescribed request fee and any access fee, as set out in section 10.

The Information Officer will respond within 30 days, extendable in terms of section 57 of PAIA, notifying you of the decision and of any fees due.

A requester seeking access to their own personal information may instead use the POPIA route under section 23 of POPIA, and the Information Officer will treat such a request accordingly. A request can also be submitted online at zelpano.com/data-request.

Access may be refused on the grounds set out in Chapter 4 of PAIA, including the mandatory protection of the privacy of a third party (section 63), commercial information of a third party (section 64), confidential information (section 65), the safety of individuals and protection of property (section 66), legal privilege (section 67), and the commercial information of the company (section 68).

Where a ground of refusal applies to part only of a record, access to the remainder of that record will be given.

The fees payable are those prescribed in the PAIA Regulations. The Information Officer will notify a requester of the fees due before providing access.

The amounts in force, as published by the Information Regulator, are: a request fee of R140.00; R2.00 per page or part page for a black-and-white photocopy or printed copy; R40.00 for a copy in computer-readable form on a flash drive or on a CD supplied by the requester; R24.00 per A4 page for a transcription of audio; and a search-and-preparation fee of R145.00 per hour excluding the first hour, capped at R435.00.

Where the search is estimated to exceed six hours, a deposit of one third of the estimated fee is payable before the request is processed. Postage, email or electronic transfer is charged at actual cost. VAT is added where the company is a registered vendor.

The prescribed schedule is amended by notice from time to time. Where an amount here differs from the notice in force, the notice prevails, and the Information Officer will confirm the amount payable before access is given.

Internally, raise the matter with the Information Officer at the contact details in section 2.

A requester may lodge a complaint with the Information Regulator under PAIA or POPIA, using the contacts in section 3 or the eServices portal.

A requester may apply to court in terms of section 78 of PAIA after exhausting the internal and Regulator remedies.

This manual is available on this website at zelpano.com/paia and is linked from the Privacy Policy; at the company's principal place of business for inspection during business hours; from the Information Officer on request; and to the Information Regulator.

It is reviewed and updated as required. Effective 7 September 2026.