PAIA and POPIA Manual
AfroQuest Brand Managers (Pty) Ltd, trading as ProductionRun
Prepared under section 51 of the Promotion of Access to Information Act 2 of 2000 (PAIA), as amended by the Protection of Personal Information Act 4 of 2013 (POPIA).
Version 2026-10-v1 · Compiled 18 October 2026
1. Purpose of this manual
This manual explains how to ask AfroQuest Brand Managers (Pty) Ltd for access to records it holds, which records it holds, and how it processes personal information.
2. Contact details
| Private body | AfroQuest Brand Managers (Pty) Ltd (registration number 2026/622999/07), trading as ProductionRun |
| Information Officer | Edgar Dzimiri (appointed 5 August 2026; Information Regulator registration 2026-069311) |
| Postal and street address | 5 Loerie Road, Randpark Ridge, Randburg, 2169, South Africa |
| Phone | +27 79 092 9972 |
| privacy@afroquest.co.za | |
| Website | https://production-run.afroquest.dev/ |
3. Guide to PAIA
The Information Regulator has published a Guide on how to use PAIA, in each official language. It is available from the Information Regulator: https://inforegulator.org.za · Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg · enquiries@inforegulator.org.za.
4. Records available without a formal request
The following are available on our website without a PAIA request: information about our services, the Privacy Policy (https://production-run.afroquest.dev/privacy-policy) and this manual.
5. Records kept under other laws
Depending on the circumstances, we keep records under the following laws, among others:
- Companies Act 71 of 2008
- Tax Administration Act 28 of 2011
- Income Tax Act 58 of 1962
- Value-Added Tax Act 89 of 1991
- Electronic Communications and Transactions Act 25 of 2002
- Consumer Protection Act 68 of 2008
- Protection of Personal Information Act 4 of 2013
- Promotion of Access to Information Act 2 of 2000
6. Records we hold
| Subject | Categories of records |
|---|---|
| Company | Incorporation documents, statutory registers, resolutions, agreements |
| Finance and tax | Accounting records, invoices, payment and refund records, supplier settlement records, tax and VAT records |
| Customers | Accounts, production requests, artwork files, quotes, orders, job messages, delivery details, payment confirmations |
| Suppliers (production partners) | Applications, company and contact details, services and capacity, banking details and bank confirmation letters, price lists, agreements and acceptance records, quotes, jobs, performance records, settlement statements |
| Creatives | Applications, profiles and portfolio images |
| Information technology | System logs, access and audit records |
Access to these records is subject to the grounds for refusal in PAIA.
7. Processing of personal information (POPIA)
Purposes: to provide our production services (quoting, producing, delivering and supporting orders), to take and reconcile payments and pay suppliers, to check artwork and supplier documents, to prevent fraud, and to meet legal obligations.
Data subjects and categories of information:
- Customers: contact details, delivery details, artwork, orders, messages and payment confirmations.
- Suppliers and their representatives: business and contact details, banking details and documents, performance and agreement records.
- Creatives: profile and portfolio.
- Staff and administrators: account and action records.
- Website visitors: technical information.
Recipients:
- Producers assigned to a job, who receive only the information needed to make and deliver it.
- Service providers: Supabase (database, storage and sign-in), Lovable/Cloudflare (hosting), Resend (email), PayFast (payments) and an AI service through Lovable's AI gateway (automated file and document checks).
- Authorities, where the law requires.
Planned transfers outside South Africa: database hosting in the European Union (Ireland); email and AI processing in the United States. We use providers bound by laws or agreements giving protection substantially similar to POPIA (section 72).
Security measures:
- Role-based access control enforced on the server.
- Private file storage with short-lived access links.
- Encrypted connections.
- Re-verification of bank-detail changes before payment.
- Append-only financial and audit records.
- Restricted administrator access.
8. How to request access
- Complete Form 2 (Request for Access to Record) under the PAIA Regulations, available from the Information Regulator's website.
- Send it to the Information Officer at privacy@afroquest.co.za, or deliver it to the address above.
- Give enough detail to identify the record, the form of access you want, and your proof of identity. If you ask on behalf of someone else, include proof of your authority.
- We will respond within 30 days. This can be extended once by up to 30 days in the circumstances PAIA allows.
Fees: a request fee and an access fee may be payable, as prescribed in the PAIA Regulations. Requesters asking for their own personal information do not pay the request fee. We will tell you if a fee applies before you pay.
A data subject may also ask us to correct or delete personal information, using the forms prescribed under the POPIA Regulations, or by contacting the Information Officer.
9. Grounds for refusal
We may refuse access on the grounds in Chapter 4 of Part 3 of PAIA. These include protecting the privacy of third parties, commercial information of third parties (including our suppliers' identities and pricing), confidential information, the safety of individuals and property, privileged records, and our own commercial information.
10. Remedies
If your request is refused, you may lodge a complaint with the Information Regulator within 180 days, or apply to court.
11. Availability of this manual
This manual is available at https://production-run.afroquest.dev/paia-manual and at our address, free of charge. We update it when our information practices change.