PAIA manual

Last updated: 10 August 2026

1. Purpose of this manual

The Promotion of Access to Information Act 2 of 2000 (PAIA) gives effect to the right of access to information in section 32 of the Constitution. It allows any person to request access to a record held by a private body where that record is required for the exercise or protection of any right.

Section 51 of PAIA requires a private body to compile and publish a manual describing the body, the records it holds and how a request for access is made. This document is that manual for Big Sky Investments. The exemption that previously relieved small private bodies of this obligation lapsed on 31 December 2021, so the requirement applies to us in full.

The manual is written for anyone who wants to know what records we keep and how to ask for them: clients and former clients, people who have contacted us through this website, suppliers, and members of the public. It is published free of charge and no permission is needed to read, copy or circulate it.

This manual deals with access to records. How we handle personal information more generally is set out in our Privacy Policy, and the terms on which we provide services are in our Terms of Service.

2. Details of the private body

There is no public telephone line. We do not operate a switchboard, and we would rather say so than publish a number that rings nowhere. All contact with the business, including every request made under PAIA, is by email to info@bigskyfinancials.trade or by post or delivery to the physical address above. We acknowledge correspondence within one business day during business hours.

3. The head of the private body / Information Officer

Under PAIA the head of a private body is responsible for dealing with requests for access, and under section 55 of the Protection of Personal Information Act, 2013 (POPIA) that person also acts as the Information Officer. We publish the role rather than an individual’s name, so that the address stays correct if the person holding the role changes.

The Information Officer is contactable at the address above. Requests under PAIA, and requests relating to personal information under POPIA, are received and dealt with at that address, and the duties set out in this manual are performed in full.

4. The PAIA Guide

Section 10 of PAIA requires the Information Regulator to compile a guide, in an easily comprehensible form, explaining how to use the Act to exercise a right. The Guide sets out the procedure for lodging a request, the fees, the remedies available and the contact details of every public and private body that has to be approached.

The Guide is available from the Information Regulator in each of the official languages, on request and on the Regulator’s website. Requests for the Guide are directed to the Regulator, not to us.

5. Categories of records held

We are a small marketing agency, and the list below is an honest description of what we actually keep rather than a generic inventory. A record appearing in this list does not mean it will be released: access is decided against the grounds in section 10 of this manual.

Client engagement records

Service agreements and statements of work, scoping documents and briefs, proposals, correspondence with client contacts, meeting notes, and the account access arrangements agreed with each client. Retained for the duration of the engagement plus 90 days, except where a longer period is required by law.

A client may obtain its own engagement records without a formal PAIA request. A request from anyone else for these records follows the section 53 procedure and will usually engage the protection of a third party’s commercial or confidential information.

Financial records

Invoices, statements, remittance and payment records, and the supporting books of account. Invoices and their supporting records are retained for 5 years, as required by South African tax law. A client may obtain copies of its own invoices and statements on request; the wider financial records of the business are available only through the formal procedure.

Marketing and campaign records

Campaign plans and structures, keyword and audience documentation, performance reports, measurement and conversion tracking configurations, change logs, and creative assets including copy and artwork. These are held per client account and are treated as that client’s confidential information. Retained for the duration of the engagement plus 90 days.

Website records

Enquiry-form submissions and the correspondence that follows them, retained for 24 months from our last contact with you. Web server and application logs, which include IP addresses and request metadata, retained for 90 days. Where a client authorises our software to access an advertising account, the resulting access and refresh tokens are retained for 7 days after the authorisation ends or is revoked.

A person who submitted an enquiry may ask for a copy of their own submission and our replies without a formal PAIA request. Server logs are available only through the formal procedure, because a single log file contains the records of many unrelated people.

Internal administrative records

Internal policies and procedures, supplier and service-provider contracts, insurance records, tax and statutory filings, and internal working documents. These are held for the administration of the business and are available only through the formal procedure.

6. Records available without a formal request

The following are available on request, at no charge, without following the section 53 procedure. Ask by email at info@bigskyfinancials.trade.

• This PAIA manual.
• Our Privacy Policy, Terms of Service and third-party advertising policy.
• Our company and legal information and the description of the services we provide.
• A client’s own engagement records: its service agreement, its invoices and statements, and the campaign plans and performance reports for its own accounts.
• A copy of an enquiry a person submitted through this website, and our replies to it.

We may ask for enough information to satisfy ourselves that the person asking is the client or the person concerned, before we release anything. Where a request that arrives informally turns out to affect someone else’s information, we will say so and direct the requester to the formal procedure.

7. How to request access

A request for access to a record that is not listed in section 6 above is made under section 53 of PAIA, on the prescribed form.

1. Use Form 2 — the “Request for Access to Record of Private Body” prescribed by the PAIA Regulations. The form is available from the Information Regulator, and we will email a copy on request.
2. Send it to the The Information Officer by email to info@bigskyfinancials.trade, or by post or delivery to 121 Beyers Naudé Drive, Roosevelt Park, Johannesburg, 2195, South Africa.
3. Identify the record with enough detail for us to find it. A description of the subject matter, the period it covers and, where known, who was involved is usually enough. If we cannot identify the record from the description, we will say so and give you a reasonable opportunity to provide more detail.
4. Identify yourself and give an address in the Republic to which our decision must be sent. Include a telephone number or email address if you want to be contacted about the request.
5. State the form of access required — for example an electronic copy, a printed copy, or inspection of the record — and the language you prefer, if the record exists in more than one.
6. Attach proof of identity. A copy of an identity document, passport or other acceptable identification must accompany the form.
7. If you are acting for someone else, attach proof of the capacity in which you are making the request, to our reasonable satisfaction — for example a power of attorney, a letter of authority, or the resolution of a juristic person.
8. State the right you are exercising or protecting and explain why the record is required for that purpose. PAIA requires this of a request to a private body, and a request that does not address it cannot be granted.

We will acknowledge receipt within one business day. An incomplete form does not start the clock in section 9 below; where a form is incomplete we will tell you what is missing rather than simply refuse it.

8. Fees

The fees payable under PAIA are those prescribed by regulation from time to time. We do not set them and we do not add to them. Because the prescribed amounts are changed by publication in the Government Gazette, no rand figures are quoted here; we will confirm the applicable amounts in writing before any work is done on a request.

• Request fee. A requester other than a personal requester must pay the prescribed request fee before the request is processed. A personal requester — a person asking for a record that contains their own personal information — is not required to pay a request fee.
• Access fee. Where access is granted, an access fee is payable for the reproduction of the record, for the time reasonably required to search for and prepare it, and for postage or delivery where applicable, at the prescribed rates.
• Deposit. Where we estimate that searching for and preparing the record will take more than six hours, a deposit is payable before we begin. The deposit is set at the prescribed proportion of the access fee and is set off against the final amount.
• Refunds. If a request is ultimately refused, any deposit paid is refunded.

We will send a written notice stating the amount required, how it was calculated and how to pay it. The period for our decision is suspended while payment is outstanding.

9. Decision and timeframes

We must decide a request as soon as reasonably possible, and in any event within 30 days of receiving a complete request together with any fee that is payable. You will be notified of the decision in writing.

That period may be extended once, by a further period of not more than 30 days, in the circumstances PAIA allows — for example where the request is for a large number of records, or where the records are not held at the office where the request was received, or where consultation with a third party or another body cannot reasonably be completed in time. Where we extend, we will notify you in writing before the original 30 days expire, giving the length of the extension, the reasons for it, and a statement that you may lodge a complaint with the Information Regulator or apply to a court against the extension.

If a request is refused, in whole or in part, the notice will state the reasons for the refusal, refer to the provision of PAIA relied on, and set out the remedies available to you. Where we fail to give a decision within the applicable period, the request is regarded as having been refused.

10. Grounds for refusal

Chapter 4 of Part 3 of PAIA sets out the grounds on which access to a record of a private body must or may be refused. In summary, we must or may refuse access where the record contains:

• Personal information of a third party who is a natural person, the disclosure of which would involve an unreasonable disclosure of personal information about that person. This protection is mandatory, subject to the exceptions in PAIA (including where the person has consented).
• Commercial information of a third party, such as trade secrets, financial, commercial, scientific or technical information the disclosure of which would be likely to cause harm to that party’s commercial or financial interests, or information supplied in confidence the disclosure of which could put that party at a disadvantage in contractual or other negotiations, or prejudice it in commercial competition.
• Confidential information, where disclosure would constitute an actionable breach of a duty of confidence owed to a third party under an agreement.
• Information affecting the safety of individuals or the protection of property, including records the disclosure of which could reasonably be expected to endanger a person, or prejudice the security of a building, a computer or communication system, or a means of transport.
• Legally privileged records, unless the privilege has been waived.
• Information about our own commercial activities, including our trade secrets, financial, commercial, scientific or technical information the disclosure of which would be likely to cause harm to our commercial or financial interests, information the disclosure of which could put us at a disadvantage in negotiations or prejudice us in commercial competition, and a computer program owned by us.
• Research information, of a third party or of ourselves, where disclosure would be likely to expose the researcher, the subject matter or the person carrying out the research to serious disadvantage.

We must also refuse a request that is manifestly frivolous or vexatious, or where the work involved in processing it would substantially and unreasonably divert our resources.

Where a record contains information that must be refused together with information that may be released, we will grant access to the part that can be separated out and refuse the rest, explaining which is which. PAIA also provides for disclosure in the public interest: a refusal on certain of the grounds above must be overridden where disclosure would reveal a substantial contravention of the law or an imminent and serious public safety or environmental risk, and the public interest in disclosure clearly outweighs the harm.

Where a record we hold contains information about a third party, PAIA requires us to take reasonable steps to inform that party and to give them an opportunity to make representations before we decide. That consultation is one of the circumstances in which the period for our decision may be extended.

11. Remedies

There is no internal appeal against a decision of a private body. A requester who is dissatisfied with our decision — including a refusal, a deemed refusal, the fee charged, the form of access given, or an extension of time — may either lodge a complaint with the Information Regulator or apply to a court with jurisdiction.

A complaint to the Regulator is lodged on Form 5, the prescribed complaint form, and is sent to the Regulator at the address below. The Regulator will not accept a complaint lodged more than three years after the incident complained of. A third party whose information is affected by a decision to grant access has the same remedies.

Nothing in this manual limits any other remedy available in law, and a requester may apply to court whether or not a complaint has been lodged with the Regulator.

12. Processing of personal information under POPIA

Big Sky Investments processes personal information as a responsible party in respect of its own business, and as an operator on behalf of client advertisers in respect of the advertising accounts we manage for them. The full account is in our Privacy Policy; the particulars required in a PAIA manual are summarised here.

Purposes of processing

Responding to enquiries; entering into and performing service agreements; planning, building, managing and reporting on advertising campaigns for clients; measurement and conversion tracking; invoicing and the keeping of books of account; securing and maintaining this website; and complying with legal obligations.

Categories of data subjects and of personal information

• People who contact us — name, email address, the organisation they represent, and the content of their message and our correspondence.
• Client representatives — name, role, business contact details, and correspondence and meeting records relating to the engagement.
• Suppliers and service providers — business contact details and contract and payment records.
• Visitors to this website — IP address, request metadata and other technical information recorded in server logs.
• Data subjects of our clients — where a client instructs us to process information relating to its own customers or prospects for measurement or audience purposes, we do so as an operator, only on that client’s documented instruction and under written agreement as required by sections 20 and 21 of POPIA. We do not decide the purpose of that processing and we do not use it for our own purposes.

We do not knowingly process the personal information of children, and we do not process special personal information as defined in POPIA in the ordinary course of our work.

Recipients

Personal information may be made available to the following categories of recipient, and to no others:

1. Google LLC and/or Google Ireland Limited — operating the Google Ads platform and the Google Ads API.
2. Our website hosting provider — hosting this site and its server logs.
3. Our email provider — carrying our mail, including enquiries sent through this site.
4. Other advertising, measurement and analytics platforms on which a client’s campaigns run, where the client has instructed us to operate them.
5. Our accountants and professional advisers — where necessary for bookkeeping, audit or legal advice, under professional confidentiality obligations.
6. Any authority to which disclosure is required by law, or where disclosure is necessary to establish, exercise or defend a legal claim.

We do not transfer or disclose your information to third parties for purposes other than those described in this manual and in our Privacy Policy. We do not sell personal information and we do not share it for anyone else’s marketing.

Some of these recipients process information outside the Republic. Where personal information is transferred across a border, we do so on the bases permitted by section 72 of POPIA, including where the transfer is necessary for the performance of a contract with the data subject or is subject to binding obligations providing an adequate level of protection.

Security measures

We apply the safeguards required by section 19 of POPIA, appropriate to the size of the business and the sensitivity of what we hold. The measures we assert are these, and we claim no others:

• Access to the systems holding Google user data requires individual named accounts with multi-factor authentication.
• OAuth refresh tokens and client secrets are encrypted at rest and stored separately from application data.
• Data in transit is protected by TLS meeting the Google Ads API requirement of at least 128-bit encryption.
• Access is granted on a least-privilege basis to the team assigned to that client, and removed when the assignment ends.
• Access to client accounts, and changes made through the API, are logged.

Where section 22 of POPIA requires it, we notify the Information Regulator and the affected data subjects of a compromise of personal information.

A data subject may ask what personal information we hold about them, ask us to correct or delete it, and object to processing, by writing to info@bigskyfinancials.trade. The procedure and the prescribed forms are described in our Privacy Policy.

13. Availability of this manual

This manual is published on our website at bigskyfinancials.trade/paia-manual, where it can be read, printed and downloaded at any time.

A copy will also be sent by email, free of charge, to anyone who asks for one at info@bigskyfinancials.trade, and may be inspected during business hours (Monday to Friday, 08:00–17:00 SAST) at 121 Beyers Naudé Drive, Roosevelt Park, Johannesburg, 2195, South Africa. No fee is charged for the manual itself.

Section 51(3) of PAIA requires the manual to be made available in the prescribed manner, which includes publication on the body’s website, availability at its head office for public inspection, and provision to the Information Regulator on request. We make the manual available at the website address and the physical address given above, and will furnish a copy to the Regulator on request.

14. Updates

This manual is reviewed whenever our records, our contact details or the applicable regulations change, and in any event periodically as required by section 51(2) of PAIA. Any update is published on this page and the date below is changed. Where a material change is made, the previous version is available on request.

Last updated: 10 August 2026 · Questions about this manual: info@bigskyfinancials.trade · Contact us