PAIA Manual

PAIA gives everyone the right to ask for records held by a private body, such as a company, when they need them to exercise or protect a right. This manual explains what records FUNXTOURS (Pty) Ltd ("FUNXTOURS") holds, how to ask for them, what it costs, and how FUNXTOURS processes personal information under the Protection of Personal Information Act, 2013 (POPIA).

FUNXTOURS runs funxtours.co.za, an online platform where people find and book attractions, activities, hotels, lodges, B&Bs and guesthouses in South Africa, and where those businesses ("hosts") list and take bookings.

Company

FUNXTOURS (Pty) Ltd

Registration number

2026/689182/07

Head of the company and Information Officer

[Information Officer to be added]

Email

info@funxtours.co.za

Physical and postal address

52 Mlambo section, Phalaborwa, Limpopo, 1392

Website

https://funxtours.co.za

Please send PAIA and POPIA requests to the Information Officer at info@funxtours.co.za, with "PAIA request" in the subject.

The Information Regulator has published a Guide that explains how to use PAIA and POPIA to get access to records. It is available in all official languages from the Information Regulator's website, inforegulator.org.za, and a copy can be inspected at our address during office hours.

These are publicly available on funxtours.co.za, with no need to make a PAIA request:

• Terms of Service, Host Agreement, Privacy Policy, Cancellation & Refund Policy and Pricing
• This PAIA manual and our Security page
• Information about FUNXTOURS on the About page, and published listings and reviews

Where they apply to FUNXTOURS, records are kept as required by laws including:

• Companies Act 71 of 2008
• Income Tax Act 58 of 1962 and Tax Administration Act 28 of 2011
• Value-Added Tax Act 89 of 1991 (once registered for VAT)
• Basic Conditions of Employment Act 75 of 1997, Labour Relations Act 66 of 1995, Unemployment Insurance Act 63 of 2001 and Skills Development Levies Act 9 of 1999 (once FUNXTOURS has employees)
• Consumer Protection Act 68 of 2008
• Electronic Communications and Transactions Act 25 of 2002
• Protection of Personal Information Act 4 of 2013

A record kept under one of these laws may still be refused under PAIA where PAIA allows it.

• Company records: registration documents, memorandum of incorporation, directors, resolutions and statutory records.
• Financial and tax records: accounting records, bank statements, invoices, tax returns and payment records.
• Guest records: account details, bookings, payment references and refunds, reviews, wishlists, FunX Coins history, Build My Trip requests, and booking and support chats (chats are deleted after 7 days).
• Host records: host applications, listings, prices and availability, verification status, and payout details (bank name and the last 4 digits of the account only; full details are held by Paystack).
• Security and technical records: sign-in and activity records (kept for 180 days) and encrypted backups (kept for 90 days).
• Supplier and service provider records: agreements and correspondence with service providers.
• Employee records, once FUNXTOURS employs staff: employment contracts, payroll and leave records.

Why we process personal information

• To create and manage accounts, take bookings and payments, process refunds, and pay hosts
• To plan trips with Build My Trip and answer support chats
• To keep accounts, payments and the platform safe, and to prevent fraud and misuse
• To meet legal, tax and accounting duties

Categories of people and their information

• Guests: name, email, phone number (optional), bookings, payment references, reviews, messages and sign-in records.
• Hosts: the above, plus business details, listing information and payout details.
• People who contact us or plan a trip without an account: name, email and what they tell us.
• Service providers and their contact people: names and business contact details.

Who may receive it

Hosts (for bookings made with them), and service providers who help run FUNXTOURS: Paystack (payments), Supabase (database and photos), Render and Cloudflare (hosting and security), Resend and Zoho (email), Anthropic (AI trip planning and search), Sentry (error reports), GitHub (encrypted backups), and Google or Apple when someone signs in with them. Also authorities where the law requires it. Full details are in our Privacy Policy.

Information sent outside South Africa

Our database and photos are hosted in Frankfurt, Germany (European Union). Some service providers above also process information in other countries, including the United States. We use providers that protect information to a standard comparable to POPIA, as section 72 of POPIA requires.

How we protect it

Encrypted connections, two-step verification on password sign-ins, passwords stored only as Argon2id hashes, account lockout after repeated wrong passwords, a database that only our own systems can reach, encrypted backups, access limited to people who need it, activity records of administrator actions, and regular security reviews. See our Security page.

• Complete Form 2 (Request for Access to Record), prescribed in the PAIA Regulations. It is available on the Information Regulator's website, and we will email it to you on request.
• Send it to the Information Officer at info@funxtours.co.za. Give enough detail for us to identify the record, say how you want access (for example, an electronic copy), and say which right you are trying to exercise or protect.
• If you are asking on behalf of someone else, include proof that you may act for them.
• We will tell you whether the request is granted within 30 days, using Form 3. This can be extended once by up to 30 days where PAIA allows it, and we will tell you if it is.
• People asking for their own personal information can also use their rights under POPIA. Account holders can download their own data straight away from their account page, free of charge.

Fees are those prescribed in the PAIA Regulations, which may change. At the date of this manual they are:

• Request fee: R140 (not payable when asking for your own personal information)
• Printed or photocopied A4 page: R2 per page
• Copy on a flash drive or CD you provide: R40; on a CD we provide: R60
• Transcription of an audio record: R24 per A4 page
• Search and preparation: R145 per hour after the first hour, up to R435 in total
• A deposit of one third of the access fee may be asked for if the search will take more than 6 hours
• Postage or electronic transfer: the actual cost, if any

We may refuse access only on the grounds in Chapter 4 of Part 3 of PAIA, for example to protect another person's privacy, commercial or confidential information, someone's safety, legally privileged records, or research information. If we refuse, we will give our reasons.

If you are not satisfied with our decision, you may complain to the Information Regulator within 180 days, or apply to a court, as PAIA allows.

This manual is available on funxtours.co.za/paia-manual, and a copy can be inspected at our address free of charge. We review it every year and when our records or processing change.