Skip to content
Set up a plan
Menu

PAIA manual

Updated 22/09/2026

1. About this manual

This manual is published under section 51 of the Promotion of Access to Information Act 2 of 2000 (PAIA), as amended by the Protection of Personal Information Act 4 of 2013 (POPIA). It explains which records we hold, how to ask for access to them, and how we process personal information.

A copy of this manual is available free of charge on this page and, on request, by email from the Information Officer.

2. Details of the private body

Atomara is a web service for checking PDF documents for signs of editing. It is operated by ФОП Гайдучик Борис Іванович (Borys Gayduchyk), a sole proprietor registered in Ukraine and based in Kyiv, Ukraine. The operator has no office or branch in South Africa.

As the business is a sole proprietorship, the head of the private body is the proprietor himself.

3. Information Officer

Send every request under PAIA and every question about personal information to the Information Officer. Email is the quickest route; a postal address for correspondence is provided on request.

4. The Information Regulator's guide

The Information Regulator has published a guide, in each official language, on how to use PAIA and POPIA to exercise your rights. It is available on the Information Regulator's website, and you can ask the Regulator directly for a copy.

5. Records available without a request

We have not published a notice under section 52 of PAIA. The following is available on our website to anyone, without a formal request:

6. Records kept in terms of legislation

We keep records that the law requires us to keep, including accounting and tax records required by the law of Ukraine, where the business is registered, and the records of processing that POPIA and other data-protection laws require.

7. Categories of records we hold

Holding a category of record does not mean that every record in it will be released: access is subject to the grounds for refusal in part 10 below.

  • Business records: registration documents of the sole proprietorship, accounting and tax records
  • Customer records: account details, correspondence, and the checks customers have run
  • Uploaded documents and their check reports — documents are deleted within 30 days of upload
  • Request (lead) records from the South Africa section — kept for 12 months, then deleted or anonymised
  • Service-provider records: agreements and correspondence with the providers who host and deliver the service
  • Website and security records: technical logs used to run and protect the service

8. How to request access to a record

Use Form 2 (Request for Access to Record) prescribed by the Regulations relating to the Promotion of Access to Information, 2021. The form is available on the Information Regulator's website. Email the completed form to the Information Officer.

Give enough detail for us to identify the record and you, say in which form you want access (for example an electronic copy), and, if you ask on behalf of someone else, show in what capacity you act. You must identify the right you want to exercise or protect and explain why the record is needed for it.

We will decide on your request within 30 days of receiving it. We may extend that period once, by up to 30 more days, where section 57 of PAIA allows it, and we will tell you if we do.

9. Fees

Fees are those prescribed for private bodies in the PAIA Regulations, 2021. A requester who is not asking for their own personal information pays a request fee (R140 at the date of this manual) before the request is processed. An access fee for reproducing, searching for and preparing the record may also be payable; where the search and preparation take more than six hours, a deposit of up to one third of the access fee may be asked for first.

There is no request fee when you ask for personal information about yourself. We will tell you the fees that apply before any work that attracts them begins.

10. Grounds for refusal

We may refuse access, in whole or in part, only on the grounds set out in Part 3, Chapter 4 of PAIA, including where access would:

  • unreasonably disclose personal information about another person
  • disclose a third party's trade secrets or confidential commercial information
  • breach a duty of confidence owed to a third party
  • endanger a person's life or safety, or the security of property or systems
  • disclose records that are privileged from production in legal proceedings
  • disclose our own trade secrets or commercial information whose release would harm our commercial position

11. If your request is refused

A private body has no internal appeal procedure. If you are not satisfied with our decision, you may lodge a complaint with the Information Regulator within 180 days of the decision, or apply to court, as sections 77A and 78 of PAIA provide.

12. Processing of personal information

Purpose: we process personal information to provide the document-check service, to answer requests for access, pricing and trials, to run customer accounts, to keep the service secure and free of abuse, and to meet our legal obligations.

Transfers across borders: the operator is in Ukraine and our servers are outside South Africa, so personal information is processed outside South Africa. Some service providers (email delivery, website delivery and security, and analytics where the visitor allows it) may process it in other countries, including the European Union and the United States. Transfers take place as section 72 of POPIA allows, as described in our privacy policy.

Security: information is sent over HTTPS and stored on access-controlled infrastructure that is never exposed at a public address; access is limited to the operator; uploaded documents are deleted within 30 days and request data after 12 months; forms are protected against automated abuse.

13. Data subjects and the information we hold about them

  • People who ask for access, pricing or a trial: name, contact details, company, organisation type, plan and volume of interest, message, consent record, how they reached us, country and browser language
  • Customers: name, email address, account and usage details, and the documents they upload with the resulting reports
  • People named in uploaded documents: whatever personal information the document contains, kept for no more than 30 days
  • Website visitors: technical data such as IP address and browser, and analytics data only where the visitor allows it
  • Service providers: contact and contract details

14. Recipients of personal information

  • The operator
  • Service providers acting on our instructions: hosting, email delivery, website delivery and security, the spreadsheet or CRM service used to track requests, and analytics where the visitor allows it
  • Public authorities, where the law requires it

15. Updates to this manual

We review this manual when the way we handle records changes and publish every update on this page with a new date.