PAIA Manual

1. Draft status and private body

N4 AUTOWERKS — private company (owner-supplied identity). Business address: Amatole Street, N4 Gateway Industrial Park, Pretoria, 0081, South Africa. General contact: Admin@n4autowerks.com. Website: https://n4autowerks.com.

This manual follows the headings of the Information Regulator’s private-body template. It is a draft, not a completed statutory filing. The responsible company head/Information Officer has not yet been formally confirmed or registered. General enquiries can be sent to the business email; it is not yet represented as a verified designated PAIA officer channel. The registration certificate, statutory contact details, record inventory and officer particulars must be completed before finalisation.

2. Guide and access to the manual

The Information Regulator’s PAIA Guide explains rights, assistance and request procedures. This draft is available on the website with a downloadable draft copy. Confirm availability of the final manual at business premises and any required regulator submission; uploading it alone does not complete PAIA obligations.

3. Records held and publicly available material

Application records include customer/contact records; vehicles and service history; bookings and check-in; jobs, diagnostics, inspections, photographs and documents; quotes and approvals; suppliers, parts requests, orders, receipts and allocations; staff profiles, roles and assignments; messages, notifications and audit/activity records. Invoice values, cost and payment-status fields exist, but this inventory does not assert that every category of statutory financial or employment document has been uploaded.

Published service descriptions, business contact details and these draft policies are accessible without a formal request. Personal workshop records are not automatically available to the public. The final manual must identify actual company, employee and financial records and the laws under which they are held; do not infer unverified registers from software fields.

4. Submitting a formal access request

Use the current official PAIA Form 2. Identify the record, the right to be exercised or protected and why the record is required for that right; specify the preferred form of access and provide contact details. Supply proof of identity and authority if acting for someone else through an agreed safe channel. Contact the business email to arrange delivery to the responsible head/officer while the designated channel is being finalised.

Access is assessed under PAIA section 50 and other applicable provisions, not guaranteed simply because a request is made. We may seek particulars needed to locate the records and evaluate the request.

5. Fees and statutory decision periods

Applicable request, access, reproduction and search/preparation fees, exemptions and any lawful deposit are determined from the current prescribed fee schedule. We will explain applicable fees and payment arrangements before charging; no fee amount or payment facility is invented by this draft.

Under PAIA section 56 the private-body head must decide and notify the requester as soon as reasonably possible and within 30 days after receipt of the request or required particulars. Section 57 permits one extension of not more than 30 days on statutory grounds, with notice of its period and reasons. These are stated as statutory days, not advertised workshop working-day estimates.

6. Decision, refusal and escalation

Notice of refusal must give adequate reasons and the available remedy. Lawful grounds may protect third-party personal information, trade secrets/commercial or confidential information, safety/property, legally privileged material and research information. The statutory public-interest override must also be considered. Where possible, access to separable non-exempt portions should be considered.

A requester may complain to the Information Regulator or seek a court remedy under the applicable PAIA provisions and time limits. Consult the current PAIA Guide and official complaint process for the prescribed procedure; this draft does not create an internal appeal that PAIA does not provide for private bodies.

7. POPIA processing information

Data subjects include customers, authorised customer contacts, staff and suppliers. Categories and purposes include contact and account administration; vehicle/booking and authorised repairs; supplier/parts procurement; quotations and approvals; service history, communication and accountability. Recipients include authorised staff, necessary operational providers, relevant suppliers and legally required recipients.

The application uses account authentication, protected workshop pages, database row-level access policies and private upload buckets. Role-based access distinguishes owners, managers, service advisors (ADMIN), mechanics, parts staff and customers. Customers’ core customer, vehicle and job records use ownership checks; mechanic job access is assignment-restricted. Other staff access follows the existing role permissions. These measures reduce risk but do not guarantee absolute security.

The website and application use Lovable hosting and Lovable Cloud for account authentication, database records and file storage. Google Fonts supplies the website fonts. Google, Apple and Microsoft are available as optional sign-in providers. The Get Directions link opens Google Maps only when selected; there is no embedded map. No app-added advertising pixel or analytics integration was identified. Website error-reporting hooks may send error context to Lovable where those hooks are active; hosting and authentication providers may also process technical connection information under their terms.

These providers may process information outside South Africa. Deployment location, operator agreements, subprocessors and transfer safeguards must be confirmed before finalisation; no South-Africa-only storage claim is made. Any international transfer must meet the applicable requirements of POPIA section 72.

Refer to the Privacy Policy and Retention Policy for rights, retention criteria and incident handling. Finalise the record inventory and safeguards with the responsible officer before adoption.