PAIA manual

1. About this manual

This manual is published under section 51 of the Promotion of Access to Information Act 2 of 2000 (PAIA) and the Protection of Personal Information Act 4 of 2013 (POPIA). It explains what records Advisor-Link Digital (Pty) Ltd keeps, how to ask for them, and how we handle personal information. Advisor-Link Digital (Pty) Ltd is a private company, registration number 2026/877844/07, and runs the OneFile Money app and website.

2. Contact details

• Head of the body and Information Officer: Cameron-Dean Shekleton, Director
• Street address: 19 Woodfern Drive, Fernbrook Estate, Inchanga Road, Craigavon, Johannesburg, 2191
• Postal address: same as street address
• Phone: 082 313 4700
• Fax: none
• Email: camshekleton@gmail.com
• Deputy Information Officer: none designated yet

3. The Regulator's PAIA Guide

The Information Regulator has published a Guide on how to use PAIA and POPIA. It explains the rights in these laws, how to make a request, the fees, and how to complain. You can get it free from the Regulator's website (inforegulator.org.za), from the Regulator at JD House, 27 Stiemens Street, Braamfontein, Johannesburg (enquiries@inforegulator.org.za), or ask us and we will send you a copy. Copies in two official languages are kept at our registered office for inspection during normal office hours.

4. Records available without a request

Our notice under section 52 lists these. They are free: the privacy notice and terms (/privacy), how we keep your data safe (/safety), this manual (/paia), plans and prices (/plans), product information, calculators and tax tips on the website, our public CIPC company details, and, for signed-in users, their own records through Download my data.

5. Records available under other laws

We keep records as required by, among others: the Companies Act 71 of 2008; the Income Tax Act 58 of 1962; the Tax Administration Act 28 of 2011; the Value-Added Tax Act 89 of 1991; the Electronic Communications and Transactions Act 25 of 2002; the Consumer Protection Act 68 of 2008; POPIA; and PAIA. Records that these laws make public (for example our CIPC registration) are available from the relevant authority.

6. Subjects and categories of records we hold

• Company records: registration documents, Memorandum of Incorporation, resolutions, securities and beneficial ownership registers, director details.
• Financial and tax records: accounts, bank statements, invoices, tax returns and SARS correspondence.
• Contracts: agreements with service providers, partners and practitioners.
• User records: accounts, consent records, tax profiles, payments, slips and documents users upload, referrals users asked for, support messages, a record of the steps users take in the app (with amounts only as ranges), and spending-trend consent.
• Product records: source code, product designs, website content and analytics.
• Compliance records: this manual, our POPIA compliance pack, request and incident logs.

7. Why we process personal information

To run each user's account; to sort their payments, check their slips and build their budget and tax records; to share records with an accountant or team only when the user sets that up; to put users in touch with a partner only when they ask; to send account and service emails; to keep the service secure and improve it; and to meet our legal and tax duties.

8. People we hold information about, and what we hold

• Users: name, email, cell number, password or passkey details, consent records, SA ID number (encrypted), tax, company and VAT numbers if given, the last 4 digits of cards, bank statement transactions, slips, invoices, logbooks, IRP5s and their answers. Some payments, such as medical expenses or donations, can reveal health or religious information, which we use only for the user's own tax records.
• Accountants, practitioners and team members of business users: name, email, username, practice details.
• People who pre-register or ask a question: email, and what they tell us.
• Website visitors: page views, device type and country, without cookies.
• Users who switch on spending trends: their spending categories, counted only in totals across at least 100 people, never health, medical aid, retirement, donations or insurance.
• Our director, shareholders and suppliers: names, contact, ID, bank and tax details needed for company records.

9. Who we may share personal information with

• The user's own accountant or team, only through links the user creates (business records only).
• A partner, only when the user asks to be contacted.
• Service providers who run the app for us under written terms: Supabase (database and storage), Vercel (hosting), Anthropic (reading slips), Meta (WhatsApp, if switched on), our email provider and payment provider.
• SARS, CIPC, our bank, auditors or attorneys, and law enforcement, where the law requires it.

10. Information sent outside South Africa

Yes. Some of our service providers store or process information outside South Africa, mainly in the United States and Europe. We only use providers bound by written terms that give protection similar to POPIA (section 72), and users are told about this in our privacy notice.

11. How we keep information secure

All traffic uses HTTPS. The database is encrypted at rest, and row-level security means each person can reach only their own records. SA ID numbers are encrypted before they are saved and only the last 4 digits are shown. We store only the last 4 digits of cards and never bank logins. Passwords are hashed and passkeys are supported. Only the Information Officer has administrator access, with two-step sign-in. We keep a written impact assessment, security register and breach response plan, and review them every year.

12. How to request a record

1. Use Form 2 of the PAIA Regulations (Request for access to record), available from the Regulator's website or from us, and send it to the Information Officer at the email or address above.
2. Describe the record clearly, say how you want access (a copy, email or inspection), and, if the record is not about you, say which right you are trying to protect.
3. We may ask you to prove your identity. If you ask for someone else, include their written permission.
4. Fees: access to your own personal information is free. For other records, the request and access fees in the PAIA Regulations may apply, and we will tell you before you pay.
5. We will decide within 30 days, or tell you within that time if we need up to 30 days more. If we refuse, we will give reasons.
6. If you disagree with our decision, you can complain to the Information Regulator within 180 days, or apply to court.

We may refuse access only on the grounds in Chapter 4 of Part 3 of PAIA, for example to protect someone else's privacy, commercial information of a third party, or legally privileged records.

13. Updates and availability

This manual was last updated on 5 November 2026 and is reviewed at least once a year. It is available on our website at /paia, at our registered office during normal office hours, and on the Information Regulator's eServices portal.

Notice of records available without a request (section 52)

• Privacy notice and terms: /privacy
• How we keep your data safe: /safety
• This manual and notice: /paia, our registered office, and the Information Regulator's eServices portal
• Plans and prices: /plans
• Product information, calculators and tax tips on this website
• Our public CIPC company details
• For signed-in users, their own records through Download my data

These are free.