Epic Saaz (Pvt) Ltd

PAIA Manual

Prepared in terms of section 51 of the Promotion of Access to Information Act 2 of 2000 (as amended).

Date of compilation: 16 June 2026
Date of last revision: 16 June 2026

1. List of acronyms and abbreviations

2. Purpose of this PAIA manual

This PAIA manual is useful for members of the public to:

• check the categories of records held by Epic Saaz (Pvt) Ltd which are available without a formal PAIA request;

• understand how to make a request for access to a record of Epic Saaz, by reference to the subjects on which Epic Saaz holds records and the categories of records held on each subject;

• know the description of the records of Epic Saaz which are available in accordance with other South African legislation;

• access the contact details of the Information Officer who will assist the public with the records they intend to access;

• know the description of the Regulator’s guide on how to use PAIA and how to obtain access to it;

• know that Epic Saaz processes personal information, the purpose of that processing, and the description of the categories of data subjects and the categories of information relating to them;

• know the recipients or categories of recipients to whom personal information may be supplied;

• know that Epic Saaz transfers and processes personal information outside the Republic, and the country or recipients to whom that information is supplied; and

• know whether Epic Saaz has appropriate security measures to ensure the confidentiality, integrity and availability of personal information that is processed.

3. Key contact details for access to information of Epic Saaz (Pvt) Ltd

3.1 Information Officer (designated under POPIA section 56 read with PAIA section 17)

3.2 Deputy Information Officer

No Deputy Information Officer is currently designated. The Information Officer named in 3.1 acts as the single point of contact for all PAIA requests. A Deputy Information Officer will be designated under PAIA section 17(1) and POPIA section 56 once the organisation grows to a size where it is reasonably necessary.

3.3 Access to information general contacts

3.4 Head office

4. Guide on how to use PAIA and how to obtain access to the guide

4.1 The Regulator has, in terms of section 10(1) of PAIA, as amended, updated and made available the revised Guide on how to use PAIA (“the Guide”), in an easily comprehensible form, as may reasonably be required by a person who wishes to exercise any right contemplated in PAIA and POPIA.

4.2 The Guide is available in each of the official languages of the Republic and in braille.

4.3 The Guide contains the description of:

• the objects of PAIA and POPIA;

• the postal and street address, phone and electronic-mail address of the Information Officer of every public body and every Deputy Information Officer of every public and private body designated under PAIA section 17(1) and POPIA section 56;

• the manner and form of a request for access to a record of a public body (section 11) and a private body (section 50);

• the assistance available from the Information Officer of a public body in terms of PAIA and POPIA;

• the assistance available from the Regulator in terms of PAIA and POPIA;

• all remedies in law available regarding an act or failure to act in respect of a right or duty conferred or imposed by PAIA and POPIA, including the manner of lodging an internal appeal, a complaint to the Regulator, and an application with a court;

• the provisions of PAIA sections 14 and 51 requiring a public body and private body, respectively, to compile a manual, and how to obtain access to a manual;

• the provisions of PAIA sections 15 and 52 providing for the voluntary disclosure of categories of records by a public body and private body, respectively;

• the notices issued in terms of PAIA sections 22 and 54 regarding fees to be paid in relation to requests for access; and

• the regulations made in terms of PAIA section 92.

4.4 Members of the public can inspect or make copies of the Guide from the offices of public bodies, private bodies including Epic Saaz (Pvt) Ltd, and the office of the Regulator, during normal working hours.

4.5 The Guide can also be obtained:

• upon request to the Information Officer named in section 3.1 above;

• from the Regulator’s website at inforegulator.org.za; and

• direct link: https://inforegulator.org.za/wp-content/uploads/2020/07/PAIA-Guide-English_20210905.pdf.

4.6 A copy of the Guide is available, on request, in English and any other of the official languages of the Republic for which a translation has been published by the Regulator.

5. Categories of records of Epic Saaz (Pvt) Ltd which are available without a person having to request access

The following records are published voluntarily on Epic Saaz’s website and are available without a formal PAIA request:

All records above are accessible at https://www.epicsaaz.ai. To request a copy on request, email the Information Officer (section 3.1).

6. Description of the records of Epic Saaz (Pvt) Ltd which are available in accordance with any other legislation

Epic Saaz creates and holds records in accordance with the following South African legislation. These records are subject to the relevant statutory access regime and are released only where required by law or in response to a lawful subpoena, court order, or regulatory request.

7. Description of the subjects on which Epic Saaz (Pvt) Ltd holds records and categories of records held on each subject

8. Processing of personal information

8.1 Purpose of processing personal information

Epic Saaz processes personal information for the following purposes:

• to provide the Epic Saaz automation platform and the application to subscribed customers;

• to authenticate users and manage tenant workspaces;

• to send transactional emails (account verification, password reset, billing receipts, approval-flow notifications);

• to process subscription payments and reconcile invoices via Stripe;

• to enable customer-authorised automations that integrate with third-party platforms (Google Workspace, Meta, TikTok, LinkedIn, etc.) using OAuth tokens the user has explicitly granted;

• to provide customer support upon user request;

• to comply with statutory record-keeping, tax, and corporate-governance obligations;

• to detect, investigate, and prevent fraud, abuse, and security incidents;

• (only with the data subject’s express consent) to send marketing communications about Epic Saaz products and services.

Epic Saaz does not use personal information for advertising, profiling, audience-building, or sale to third parties, and does not train artificial-intelligence or machine-learning models on personal information received through third-party OAuth integrations. For the full Limited Use disclosure for Google Workspace API data, see Privacy Policy section 3.4.

8.2 Description of the categories of data subjects and of the information relating thereto

8.3 The recipients or categories of recipients to whom the personal information may be supplied

All sub-processors are bound by a Data Processing Agreement (DPA) and contractually prohibited from using personal information for any purpose other than to provide the contracted service to Epic Saaz. Sub-processors do not receive third-party OAuth tokens granted by customers (Google Workspace tokens, Meta tokens, etc.) - those tokens are used exclusively by Epic Saaz infrastructure to execute the automations customers configure.

8.4 Planned trans-border flows of personal information

Epic Saaz transfers and processes personal information outside the Republic of South Africa as follows:

For more detail see Privacy Policy section 10.

8.5 General description of information security measures

Epic Saaz implements the following technical and organisational security measures to ensure the confidentiality, integrity and availability of personal information under its care:

• Encryption at rest - OAuth access and refresh tokens, user API keys, and other sensitive secrets are encrypted at rest using AES-256-GCM with a per-value 12-byte initialisation vector generated via cryptographically secure randomness. The encryption key is held in environment configuration with strict file-system access controls and is never written to the database.

• Encryption in transit - TLS 1.2 or higher on all production endpoints; HSTS (HTTP Strict Transport Security) is enforced; unencrypted HTTP connections are refused.

• Tenant isolation - database-level Row-Level Security (RLS) policies enforce that data belonging to one customer tenant is never accessible to another tenant, even at the row level via direct SQL queries.

• Access control - access to production systems is restricted to a small named group of engineering and operational personnel; least-privilege principles apply; multi-factor authentication is required; an immutable audit trail logs every access.

• Credential lifecycle - OAuth tokens are refreshed only while an automation that uses them is active. On disconnect or account deletion, encrypted tokens are irreversibly destroyed within minutes and cannot be recovered.

• Backup and recovery - encrypted off-site backups are taken on a documented schedule and are tested for recoverability.

• Vulnerability management - dependency vulnerability scanning runs on each build; security advisories from upstream maintainers are monitored.

• Incident response — security incidents are investigated within 24 hours of detection; affected data subjects and the Regulator are notified in accordance with POPIA section 22 (see Privacy Policy section 6.5).

• Anti-virus / anti-malware - endpoint protection and content scanning on uploaded files.

• Sub-processor due diligence - all sub-processors are bound by a Data Processing Agreement requiring equivalent security commitments.

9. Availability of this manual

A copy of this PAIA manual is available:

• on Epic Saaz’s website at https://www.epicsaaz.ai/legal/paia-manual;

• at the head office of Epic Saaz (Pvt) Ltd at the address listed in section 3.4 above, for public inspection during normal business hours;

• to any person upon request to the Information Officer (section 3.1), subject to payment of a reasonable prescribed fee per A4-size photocopy as contemplated in annexure B of the PAIA Regulations; and

• to the Information Regulator upon request.

How to request access to a record: a request for access to a record of Epic Saaz must be made on Form C (Form 2 of the PAIA Regulations), addressed to the Information Officer named in section 3.1 above, by email to privacy@epicsaaz.ai with the subject line “PAIA Request”. The Information Officer will respond within 30 calendar days of receipt as required by PAIA section 56. The prescribed request fee and access fee (if any) apply per annexure B of the PAIA Regulations.

Remedies: a requester who is dissatisfied with a decision of the Information Officer may lodge a complaint with the Information Regulator at inforegulator.org.za or apply to the appropriate court for relief.

10. Updating of this manual

The Information Officer of Epic Saaz (Pvt) Ltd will update this manual on a regular basis to reflect changes in the categories of records held by Epic Saaz, changes in legislation, and any change in the Information Officer or registered address. The date of the most recent revision appears at the top of this manual.

Issued by

George Senzere
Founder and Chief Architect, Epic Saaz (Pvt) Ltd
Information Officer (POPIA s.55)

This manual was last updated on the date shown at the top. Material changes will be communicated via the “Date of last revision” field above and (for material changes) via email to active account contacts.