Protoworks Defence (Pty) Ltd
Registration number 2026/524692/07
Prepared under section 51 of the Promotion of Access to Information Act 2 of 2000 (PAIA), following the Information Regulator's template for private bodies.
Version 1.0, 25 September 2026.
1. Abbreviations
| Company, we | Protoworks Defence (Pty) Ltd |
| IO | Information Officer |
| DIO | Deputy Information Officer |
| PAIA | Promotion of Access to Information Act 2 of 2000 |
| POPIA | Protection of Personal Information Act 4 of 2013 |
| Regulator | Information Regulator (South Africa) |
2. Purpose of this manual
This manual tells you:
- what categories of records the Company holds;
- which records you can have without making a request;
- how to ask for any other record, and what it costs;
- how the Company processes personal information; and
- who to contact.
3. Contact details
| Company | Protoworks Defence (Pty) Ltd |
| Registration number | 2026/524692/07 |
| Holding company | Protoworks Group (Pty) Ltd, 2026/556877/07 |
| Head of the Company | Richard Peters, Director |
| Information Officer | Richard Peters |
| Deputy Information Officer | None designated yet |
| Email for requests | privacy@protoworks.dev |
| Physical and postal address | From the Information Officer, on request |
| Website | https://defence.protoworks.dev |
4. The Regulator's guide to PAIA
The Regulator publishes a guide on how to use PAIA (section 10). It explains your rights, how to make a request, the fees, and how to complain. It is available in all eleven official languages:
- on the Regulator's website, https://inforegulator.org.za; and
- by email on request to privacy@protoworks.dev.
5. Records available without a request
You do not need to make a PAIA request for these. They are published on our websites:
- this manual;
- our privacy notice;
- our vulnerability disclosure policy and security.txt contact file; and
- information about our products and services.
The Company has not published a notice under section 52(2) listing other categories of automatically available records.
6. Records kept under other legislation
The Company keeps records required by the following laws, where they apply to it. Some of these records are available to specific people under those laws.
- Companies Act 71 of 2008
- Income Tax Act 58 of 1962
- Value-Added Tax Act 89 of 1991
- Tax Administration Act 28 of 2011
- Basic Conditions of Employment Act 75 of 1997
- Labour Relations Act 66 of 1995
- Employment Equity Act 55 of 1998
- Unemployment Insurance Act 63 of 2001
- Skills Development Levies Act 9 of 1999
- Compensation for Occupational Injuries and Diseases Act 130 of 1993
- Electronic Communications and Transactions Act 25 of 2002
- Protection of Personal Information Act 4 of 2013
- Promotion of Access to Information Act 2 of 2000
7. Subjects and categories of records
| Subject | Categories of records |
|---|---|
| Company administration | Memorandum of Incorporation, registration certificate, securities register, register of directors, beneficial ownership register, minutes and resolutions |
| Finance | Annual financial statements, accounting records, bank records, invoices, budgets |
| Tax | Income tax, VAT and PAYE records and correspondence with SARS |
| People | Employment and contractor agreements, payroll, leave and disciplinary records |
| Clients | Contracts, correspondence, licence and support records |
| Suppliers and operators | Contracts, data processing terms, invoices, correspondence |
| Products and intellectual property | Source code, designs, technical documentation, trade marks |
| Information security | Access records, request and audit logs, incident register, vulnerability reports |
| Platform data | Information collected from public sources by the Panoptes platform, and the analysis built on it |
Listing a category here does not mean every record in it will be released. PAIA sets out when we must or may refuse (sections 62 to 70), for example to protect another person's privacy, another company's commercial information, the safety of people or property, or legally privileged material. We refuse records that would reveal the platform's suppliers, sources, feeds or methods, because disclosure would prejudice the security of our computer systems (section 66(b)) and reveal our trade secrets and commercial information (section 68).
8. Processing of personal information
8.1 Why we process personal information
- To run our websites and keep them secure.
- To answer people who contact us.
- To enter into and carry out contracts with clients, suppliers and staff.
- To meet our legal, tax and regulatory duties.
- To provide the Panoptes platform, which helps clients detect, investigate and prevent crime, fraud and threats to people and property.
8.2 Whose information and what information
| Category of person | Information |
|---|---|
| Website visitors | IP address, browser type, pages requested, times |
| People who contact us | Name, email address, message content |
| Client and supplier representatives | Name, role, work contact details, correspondence |
| Staff, contractors and directors | Identity and contact details, tax and bank details, employment records |
| People named in public sources processed by the platform | Names and aliases, usernames, email addresses, phone numbers, addresses, company roles, published allegations or records of criminal conduct, and the source of each item |
8.3 Who receives it
- Operators that process information for us under written terms: Google Cloud (hosting and storage in Johannesburg), Google Workspace (email), and, for the platform, providers of hosting, automated text analysis and public web and social media collection. We name the platform's operators by category only (see section 7).
- Platform clients, under written contracts that limit them to lawful use.
- SARS, the CIPC and other public bodies, where a law requires it.
- Our auditors and professional advisers.
8.4 Information sent outside South Africa
Email may be stored in Google data centres outside South Africa, under Google's data processing terms (POPIA section 72(1)(b)). Website hosting, request records and stored source documents are held in South Africa. Some platform operators are outside South Africa; we send information to them only as section 72 allows.
8.5 How we protect it
- Encryption in transit on every connection, and customer-managed encryption keys for sensitive stored data.
- Access limited to named people, through groups, with two-step verification.
- A web application firewall in front of every website.
- Audit logs of access to our cloud systems.
- A published vulnerability disclosure policy and a security contact.
- Notification of security compromises to the Regulator and to affected people, as POPIA section 22 requires.
9. How to request a record
- Complete PAIA Form 2 (Request for access to record), which is in the PAIA Regulations, 2021 and on the Regulator's website. Give enough detail for us to identify the record, say how you want access (a copy, inspection, or electronically), and say how you want to be told our decision.
- If you are asking on behalf of someone else, include proof of your authority.
- Send it to the Information Officer at privacy@protoworks.dev. If you would rather deliver or post it, ask the Information Officer for the address.
- Pay the request fee if one applies (section 10). A personal requester asking for their own personal information pays no request fee.
- We decide within 30 days and tell you in writing. We may extend this once, by up to 30 more days, and will tell you why (sections 56 and 57).
If we refuse, we give reasons. You may then complain to the Regulator within 180 days (section 77A) or apply to court (section 78).
10. Fees
The fees are the ones prescribed in Annexure B of the PAIA Regulations, 2021:
- a request fee, payable when you submit the request, unless you are a personal requester asking for your own information;
- an access fee for reproducing records, and for the time spent searching for and preparing them.
If the search and preparation will take more than six hours, we will ask for a deposit of up to one third of the access fee before we start (section 54(2)). If the request is refused, the deposit is refunded.
11. Availability of this manual
This manual is available:
- on our websites;
- for inspection, by arrangement with the Information Officer; and
- to the Regulator on request.
A printed copy is available on request, at the prescribed reproduction fee.
12. Updates
We review this manual at least once a year and whenever our contact details or processing change. Each update carries a new version number and date.
Issued by Richard Peters, Director and Head of Protoworks Defence (Pty) Ltd, on 25 September 2026.