Questions about this page: info@beboaz.co.za
This is the manual of Echo Reach (Pty) Ltd, trading as Be Boaz, under section 51 of the Promotion of Access to Information Act 2 of 2000 (PAIA), as amended. It follows the Information Regulator's PAIA Manual Template for a private body. Version 2026-10-08, approved by the Information Officer on 8 October 2026. It matches Privacy Policy version 2026-10-09.
1. Abbreviations
| Short form | Means |
|---|---|
| Be Boaz, we, us | MeansEcho Reach (Pty) Ltd, trading as Be Boaz |
| CEO | MeansChief Executive Officer |
| Guide | MeansThe Information Regulator's Guide on how to use PAIA (section 10 of PAIA) |
| IO | MeansInformation Officer |
| PAIA | MeansPromotion of Access to Information Act 2 of 2000, as amended |
| POPIA | MeansProtection of Personal Information Act 4 of 2013 |
| Regulations | MeansRegulations relating to the Promotion of Access to Information, 2021 (Government Notice R.757, Government Gazette 45057, 27 August 2021) |
| Regulator | MeansThe Information Regulator of South Africa |
2. This manual says which records we hold and how to ask for them
This manual tells you:
- which records we hold, and which you can have without a formal request;
- which records we keep because another law requires it;
- how to ask for a record, what it costs and how long it takes;
- whom to contact, and where to find the Regulator's Guide;
- what personal information we process, why, who receives it, what leaves South Africa, and how we protect it.
3. Send every request to the Information Officer
3.1 Information Officer
For a private body, the head of the body is the Information Officer. Ours is registered with the Information Regulator (registration made 8 October 2026).
- Name
- Rynard Snyman, CEO
- Phone
- 071 678 4010
- info@beboaz.co.za
- Fax
- none
3.2 Deputy Information Officer
None designated. Send everything to the Information Officer.
3.3 Access to information requests
Email info@beboaz.co.za. Put “PAIA request” or “POPIA request” in the subject line.
3.4 Head office
- Registered name
- Echo Reach (Pty) Ltd, trading as Be Boaz
- Registration number
- 2024/147636/07
- Physical address
- 18 Figaro Crescent, Brackenfell South, 7560, Western Cape
- Postal address
- 18 Figaro Crescent, Brackenfell South, 7560, Western Cape
- Phone
- 071 678 4010
- info@beboaz.co.za
- Website
- https://beboaz.co.za
Be Boaz is a small company run by one person, with no employees. Phone or email before you visit, so that someone is there to help you.
4. The Regulator's Guide explains how to use PAIA
The Regulator has updated and published a Guide on how to use PAIA (section 10 of PAIA; Government Notice 1504, Government Gazette 45492, 16 November 2021). It explains, in plain terms:
- what PAIA and POPIA are for;
- the contact details of every public body's Information Officer, and of every deputy information officer;
- how to ask for a record of a public body (section 11) and of a private body (section 50);
- the help available from Information Officers and from the Regulator;
- every remedy available, including how to complain to the Regulator and how to apply to court;
- the rules on manuals (sections 14 and 51) and on voluntary disclosure (sections 15 and 52);
- the fee notices (sections 22 and 54) and the regulations (section 92).
The Guide is available in all eleven official languages and in braille. You can get it:
- from the Regulator's website: inforegulator.org.za/paia-guidelines;
- from the Regulator's office, Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191, phone 010 023 5200, email enquiries@inforegulator.org.za;
- from us. Ask the Information Officer. We keep a copy in English and in Afrikaans at our head office for inspection during normal business hours (Regulation 3(1)).
We don't charge for a copy of the Guide or for inspecting it (Regulation 3(3)). You can ask for a copy on Form 1 of the Regulations, or simply by email.
5. Some records are free without a request
These are available to anyone, free, without a PAIA request (section 52 of PAIA, Regulation 5).
| Category | Records | On the website | On request |
|---|---|---|---|
| Legal terms | RecordsTerms of Service, Privacy Policy, Refund and Cancellation Policy, current and stating their version | On the websiteYes | On requestYes |
| Company details | RecordsRegistered name, registration number, address, office bearer, contact details (ECTA section 43) | On the websiteYes, in the site footer | On requestYes |
| Pricing | RecordsPlans and prices | On the websiteYes | On requestYes |
| Guides | RecordsPublished guides on B‑BBEE for small businesses | On the websiteYes | On requestYes |
| This manual | RecordsThe current PAIA manual | On the websiteYes | On requestYes |
| PAIA Guide | RecordsThe Regulator's Guide, in English and Afrikaans | On the websiteLink | On requestYes |
A request for a printed copy of any of these costs R2.00 per A4 page, plus postage (Annexure B, items 2 and 11).
6. Other laws require us to keep these records
| Records | Law |
|---|---|
| Memorandum of Incorporation, registration certificate, register of directors, securities register, minutes and resolutions, accounting records, annual financial statements, annual returns | LawCompanies Act 71 of 2008 |
| Tax returns, assessments and the records behind them | LawIncome Tax Act 58 of 1962; Tax Administration Act 28 of 2011 |
| Information Officer registration; records of consent for direct marketing; operator agreements; records of any security compromise | LawProtection of Personal Information Act 4 of 2013 |
| This manual; PAIA requests and our answers; annual PAIA reports to the Regulator | LawPromotion of Access to Information Act 2 of 2000 |
| Company details on the website; records of electronic transactions | LawElectronic Communications and Transactions Act 25 of 2002 |
| Terms, receipts, cancellation and refund records | LawConsumer Protection Act 68 of 2008 |
We have no employees, so we hold no employment records under labour, tax-withholding or skills legislation.
Some of these records are also public at the Companies and Intellectual Property Commission (CIPC).
7. The subjects on which we hold records
A record being listed here doesn't mean you'll get it. Access depends on the request process and the grounds for refusal in section 8.6.
| Subject | Categories of records |
|---|---|
| Company and governance | Categories of recordsMemorandum of Incorporation, CIPC documents, register of directors, securities register, resolutions, Information Officer registration certificate |
| Finance and tax | Categories of recordsBank statements, accounting records, invoices, receipts, the payment ledger (with Paystack references), refunds, commission owed to partners, tax records |
| Customer accounts | Categories of recordsBusiness details, the people on each account, the record of which Terms and Privacy Policy version was accepted, plans, checkouts, receipts, refunds, account closures and deletion logs (counts only, no names), correspondence |
| Customer data we hold for customers | Categories of recordsSupplier records, the company-level details read from B‑BBEE certificates and sworn affidavits, corrections and their audit trail, scorecard figures, supplier spend, supplier contacts and the document requests sent to them. We hold these as the customer's operator under POPIA. The customer decides what happens to them |
| Free Supplier File Check and WhatsApp | Categories of recordsAnonymous counts of checks and their cost; records about WhatsApp numbers that wrote to us without an account |
| Marketing and consent | Categories of recordsThe founding-spot list and its consent records; business contacts we asked for consent, their answers and the do-not-contact list; link source labels; partner-link visit counts; published guides and social posts |
| Partners | Categories of recordsPartner details, the partner agreement version each accepted, commission entries |
| Operators and suppliers | Categories of recordsTerms, data processing agreements and invoices from Anthropic, Render, Neon, Resend, Meta, Paystack and GoDaddy |
| Product and technology | Categories of recordsSource code, system documentation, system logs, AI usage and cost records, security records |
| Compliance | Categories of recordsPast versions of the Privacy Policy and Terms, compliance reviews, PAIA and POPIA requests and answers, any security compromise and how it was handled |
| Correspondence | Categories of recordsEmails, WhatsApp messages and notes of calls |
8. How to ask for a record
8.1 Your own personal information is free: use POPIA, not Form 2
If you want to know what personal information we hold about you, or to correct or delete it, email the Information Officer at info@beboaz.co.za (POPIA sections 23 and 24). We'll ask you to prove who you are before we answer.
Asking for your own personal information costs nothing. Confirming whether we hold it is free under POPIA section 23(1)(a), and we don't charge for a copy, a correction or a deletion either. The PAIA fees in 8.3 don't apply. We answer within 30 days. The Regulator's forms for objecting to processing (Form 1) and for asking for correction or deletion (Form 2) under the POPIA Regulations, 2018 can be used, but an email is enough.
8.2 Other records: the PAIA request
- Fill in Form 2 of the Regulations (“Request for access to record”). It's in the Guide and on the Regulator's PAIA forms page, and we'll email you a copy if you ask.
- Describe the record clearly enough for us to find it.
- Say how you want access (a printed copy, an electronic copy, or inspection) and in which language.
- Say which right you want to exercise or protect, and why you need the record for it. PAIA gives access to a private body's records only when the record is required for the exercise or protection of a right (section 50(1)).
- If you ask on someone else's behalf, include proof of your authority.
- Send it to info@beboaz.co.za, or deliver it to the head office.
If you can't read or write, or have a disability, you can make the request orally. The Information Officer will fill in Form 2 for you and give you a copy (Regulation 7(2)).
8.3 Fees apply only to records other than your own personal information
Asking for your own personal information is free (see 8.1). These fees apply only to a request for other records of the company.
They are the fees for private bodies in Annexure B to the Regulations (Government Notice R.757, 27 August 2021), the current prescribed amounts. We can't charge more; an Information Officer who knowingly charges a fee other than the prescribed one commits an offence (Regulation 16).
| Item | Fee |
|---|---|
| 1. Request fee, for a request for a record other than your own personal information | FeeR140.00 |
| 2. Photocopy or printed black and white copy, per A4 page | FeeR2.00 per page or part of a page |
| 3. Printed copy, per A4 page | FeeR2.00 per page or part of a page |
| 4. Copy in electronic form: on a flash drive you provide | FeeR40.00 |
| 4. Copy in electronic form: on a CD you provide / a CD we provide | FeeR40.00 / R60.00 |
| 5–6. Transcription or copy of visual images | FeeOutsourced, at the service provider's quote |
| 7. Transcription of an audio record, per A4 page | FeeR24.00 |
| 8. Copy of an audio record: on a flash drive you provide | FeeR40.00 |
| 8. Copy of an audio record: on a CD you provide / a CD we provide | FeeR40.00 / R60.00 |
| 9. Search and preparation, for each hour or part of an hour after the first hour | FeeR145.00, to a maximum of R435.00 |
| 10. Deposit, if the search will take more than 6 hours | FeeOne third of the access fee |
| 11. Postage, email or other electronic transfer | FeeActual cost, if any |
How it works:
- We ask for the R140 request fee before we start on the request (section 54(1)).
- If the search and preparation will take more than 6 hours, we ask for a deposit of up to one third of the access fee (Regulation 8(3)).
- If we grant the request, we tell you the access fee on Form 3, and you pay it before we hand over the record. If we refuse, we refund the deposit.
- The Minister can exempt people or categories of people from fees (section 54(8)). Form 2 has space to say why you think you shouldn't pay.
We send payment details with each fee notice.
8.4 We decide within 30 days
- We decide within 30 days of receiving a request that complies with the procedure (section 56(1)).
- We can extend that once, by up to 30 days, if the request is for many records or needs a search that would unreasonably interfere with our work, if consultation is needed that can't reasonably be finished in 30 days, or if you agree in writing (section 57). We'll tell you why, for how long, and that you can complain to the Regulator or go to court about the extension.
- If a record holds information about someone else (a third party), we must tell them and give them a chance to respond before we decide (sections 71 to 73). This can add time; we'll tell you.
- If we don't answer in time, PAIA treats the request as refused (section 58), and you can use the remedies in 8.7.
8.5 Records we hold for our customers belong to them
Supplier files, scorecard figures and supplier contacts belong to the customer whose account holds them. We process them as that customer's operator. If you ask us for one of these records, we'll treat the customer as a third party and ask for their view first. Asking the customer directly is usually quicker.
8.6 Why a request can be refused
PAIA lists the grounds. In summary, we must or may refuse access to a record if giving it would:
- unreasonably disclose personal information about another person (section 63);
- disclose another party's trade secrets, or commercial information that could harm them (section 64);
- breach a duty of confidence we owe someone else (section 65);
- endanger someone's life or safety, or the security of property (section 66);
- disclose a record privileged from production in legal proceedings, such as legal advice (section 67);
- disclose our own trade secrets, or commercial information that could harm us (section 68);
- disclose research information that would expose the researcher or the subject to serious harm (section 69).
We must still disclose a record if it would reveal a serious breach of the law or a serious risk to public safety or the environment, and the public interest clearly outweighs the harm (section 70). PAIA doesn't apply to a record requested for criminal or civil proceedings after those proceedings have started, where another law provides for its production (section 7). If part of a record can be refused, we give you the rest (section 59). Where a record doesn't exist or can't be found, we tell you on affidavit (section 55).
8.7 If you're unhappy with our decision, go to the Regulator
There is no internal appeal against a decision of a private body. You can:
- complain to the Information Regulator on PAIA Form 5, within 180 days of our decision (sections 77A and 77B). Email PAIAComplaints@inforegulator.org.za, or see the Regulator's complaints page; or
- apply to court for relief within 180 days (section 78). The Guide recommends the Regulator first, because it's quicker and cheaper.
You can complain about a refusal, a request fee or deposit, an extension, or the form of access we grant. A complaint about how we process your personal information goes to POPIAComplaints@inforegulator.org.za.
9. How we process personal information (section 51(1)(c))
This part summarises our Privacy Policy (version 2026-10-09). If the two ever differ, the Privacy Policy is the more detailed statement, and we'll correct this manual.
POPIA protects companies as well as people. So the “data subjects” below include businesses.
9.1 Why we process personal information
- To run the service: read documents, keep supplier records, calculate the indicative B‑BBEE scorecard, send sign-in links, reply on WhatsApp, and send account emails.
- To bill for paid plans from 15 November 2026: charge for the plan, send receipts, and check whether a business qualifies for the First-Month Guarantee.
- To act for customers as their operator: keep their supplier files, and email their suppliers for documents when they ask us to.
- To run the free Supplier File Check fairly: limit how many checks one connection runs, and avoid paying twice to read the same file.
- To see which of our links bring people to the site (link source labels and partner-link visit counts, with no IP address and no third-party tracker).
- To market Be Boaz only with consent: the founding-spot list, WhatsApp news and offers, and email to business contacts who said yes. We ask a business contact or a WhatsApp number once, and only once (POPIA section 69).
- To carry out partner agreements and record the commission we owe.
- To keep proof of consent and of what was agreed, and the records the law requires (for example, payment records for 7 years under the Companies Act).
- To measure B‑BBEE compliance. Ownership figures relate to race; we process them only at company level and only for this purpose, which POPIA section 29 allows.
- To answer requests under PAIA and POPIA, and to protect the service and the information in it.
9.2 Whose personal information, and what
| Data subjects | Personal information |
|---|---|
| People who sign up and use an account | Personal informationName, work email, company name; the phone number used to connect WhatsApp, if connected; the record of which Terms and Privacy Policy version they accepted, when, with their name and email, and their agreement to uploads going to Anthropic in the United States; who made each correction and when |
| Customer businesses | Personal informationCompany name; scorecard figures (payroll, ownership, training and development spend, spend with each supplier) as company totals and percentages; plan, billing email, buyer details (company and registration number, or sole proprietor), payments, receipts and Paystack references and codes; the partner who referred them and the link label they arrived with, if any |
| Customers' suppliers (held as operator) | Personal informationCompany-level details read from B‑BBEE certificates and sworn affidavits: name, registration number, B‑BBEE level, ownership percentages, dates, verification agency; a fingerprint of each file. The file itself isn't kept. The name and ID number of the person who signed a sworn affidavit are sent to Anthropic to be read but not stored |
| People at suppliers whom a customer asks us to email (held as operator) | Personal informationWork email; name, if the customer gives it; the supplier, why the document was asked for, any note from the customer, when we sent the request and the one reminder, and the outcome; a scrambled copy of the upload link and, if they opt out, of their address |
| People who use the free Supplier File Check | Personal informationThe uploaded document, read and not kept; IP address, held in memory for about a day; nothing else linked to them |
| People who message Boaz on WhatsApp without an account | Personal informationTheir number, scrambled with a secret key; the number itself, encrypted, only if they say yes to news and offers; when they first and last wrote, how they found us, whether we sent our notice, how many checks they ran today; the consent question, their answer, when, the wording and the message that carried it |
| Founding-spot list subscribers | Personal informationEmail; name and company, if given; the page they signed up on; consent wording version, when they agreed and confirmed; when we last emailed them and how many confirmation links we sent; scrambled unsubscribe links |
| Business contacts we ask for consent | Personal informationName, if known; organisation, role, province, business email; where we got the details and why we may hold them; when we asked, their answer and when; for a yes, the wording agreed and the IP address and browser it came from; scrambled Yes and No links; for the do-not-contact list, the email address and date |
| Partners | Personal informationName, organisation, kind of work, business email; referral code, status, the partner agreement version accepted and when; commission entries (amount, date, receipt number and the referred business's internal ID) |
| People who contact us or make a PAIA or POPIA request | Personal informationName, contact details and what they wrote or said; for a PAIA request, the details on Form 2, which include an identity number; proof of identity for a POPIA request |
Special personal information: B‑BBEE ownership figures relate to race and are processed at company level only (POPIA section 29). An ID number on a sworn affidavit is read by Anthropic and not stored by us.
9.3 Who receives personal information
| Recipient | What they receive and why |
|---|---|
| Anthropic | What they receive and whyUploaded certificates and sworn affidavits, to read them. Under its commercial terms it doesn't train models on this content and deletes it within 30 days, or keeps it for up to 2 years if flagged under its usage policy |
| Render | What they receive and whyHosts the application, and so all information in it |
| Neon | What they receive and whyHosts the database, and so all information in it |
| Resend | What they receive and whySends our emails: sign-in and account emails, founding-spot list emails, consent requests to business contacts, and document requests to suppliers |
| Meta | What they receive and whyCarries WhatsApp messages, only for people who use WhatsApp |
| GoDaddy | What they receive and whyHosts our mailbox, info@beboaz.co.za, so emails and requests sent to us are stored on its servers |
| Paystack South Africa (Pty) Ltd | What they receive and whyFrom 15 November 2026: billing email, company name and plan, to take card payments. Card details go straight to Paystack, never to us |
| Customers | What they receive and whyWhat a supplier uploads through a request link goes into the customer's supplier file |
| Partners | What they receive and whyHow many businesses they referred signed up, and the commission earned. Not which businesses, what they paid or anything in their accounts |
| A buyer of the Be Boaz business | What they receive and whyAccounts and the information in them, if the business is sold. The buyer must keep the Privacy Policy's promises, and we'd email account owners first |
| The Information Regulator, SARS, courts and other authorities | What they receive and whyWhat the law requires us to give them |
We don't sell personal information and don't use advertising trackers.
9.4 Personal information that leaves South Africa
| Recipient | Where | What |
|---|---|---|
| Anthropic | WhereUnited States | WhatUploaded documents, to be read |
| Render | WhereFrankfurt, Germany | WhatThe application and everything it processes |
| Neon | WhereFrankfurt, Germany | WhatThe database |
| Resend | WhereIreland | WhatEmails we send |
| Paystack (stored on Amazon Web Services) | WhereIreland | WhatBilling information, from 15 November 2026 |
| Meta (Meta Platforms Ireland Limited) | WhereUnited States, Ireland, Denmark and Sweden | WhatWhatsApp messages |
| GoDaddy | WhereOutside South Africa; its terms don't name the country | WhatEmails and requests sent to info@beboaz.co.za |
These transfers rest on POPIA section 72(1)(a), because each operator is bound by a data processing agreement that requires safeguards like POPIA's, and section 72(1)(c), because the service can't be delivered without them. The transfer to Anthropic has a third ground: account holders, and suppliers who upload through a request link, agree to it (section 72(1)(b)).
9.5 How we protect it
- Every record belongs to one business account, and the database itself enforces that separation, so one customer's data can't appear in another's account. The application never connects to the database with the owner's rights.
- Sign-in links work once and expire after 15 minutes. We store only a hash of each sign-in, unsubscribe, consent and upload link, never the link itself.
- WhatsApp numbers are stored as a keyed hash; a number we must keep for news and offers is encrypted.
- We don't keep uploaded files. We never see or store full card numbers or security codes; Paystack holds them under the card industry's security standard (PCI DSS).
- Information travels over encrypted connections.
- Every operator is bound by a written data processing agreement with security obligations (POPIA sections 19 to 21).
- Admin screens are open only to the founder's account.
- After an account closes, its data is deleted within 90 days, except records the law or our own proof of consent requires us to keep.
- If personal information is accessed without authorisation, we notify the Regulator and the people affected as soon as reasonably possible (POPIA section 22).
10. This manual is on our website and at our head office
This manual is available:
- on our website at beboaz.co.za/paia/, this page;
- at our head office (section 3.4), for inspection during normal business hours;
- to anyone who asks, by email for free, or printed at R2.00 per A4 page plus postage (Annexure B, items 2 and 11);
- to the Information Regulator on request.
11. We review this manual at least once a year
The head of Be Boaz reviews this manual at least once a year, and updates it whenever the Privacy Policy changes in substance or we add an operator. The version and date at the top change with each update.
Issued by Rynard Snyman, Chief Executive Officer and Information Officer, Echo Reach (Pty) Ltd, trading as Be Boaz, on 8 October 2026.