PAIA Manual

1. List of Acronyms and Abbreviations

2. Purpose of This PAIA Manual

This PAIA Manual is useful for the public to:

1. Check the categories of records held by Responsive Design Agency (Pty) which are available without a person having to submit a formal PAIA request.
2. Have a sufficient understanding of how to make a request for access to a record, by providing a description of the subjects on which we hold records and the categories of records held on each subject.
3. Know the description of the records which are available in accordance with any other legislation.
4. Access the relevant contact details of the Information Officer who will assist the public with the records they intend to access.
5. Know the description of the guide on how to use PAIA, as updated by the Regulator, and how to obtain access to it.
6. Know the purpose of processing of personal information and the description of the categories of data subjects and of the information or categories of information relating thereto.
7. Know the recipients or categories of recipients to whom personal information may be supplied.
8. Know whether we have planned to transfer or process personal information outside the Republic of South Africa and the recipients or categories of recipients to whom such information may be supplied.
9. Know whether we have appropriate security measures to ensure the confidentiality, integrity and availability of personal information which is processed.

3. Key Contact Details

3.1 Information Officer

3.2 Deputy Information Officer

Responsive Design Agency (Pty) has not designated a Deputy Information Officer. All access to information requests are handled directly by the Information Officer at contact@taalrooster.co.za.

3.3 Access to Information — General Contact

3.4 Head Office

4. Guide on How to Use PAIA

The Regulator has, in terms of section 10(1) of PAIA (as amended), updated and made available the revised Guide on how to use PAIA ("Guide"), in an easily comprehensible form and manner, as may reasonably be required by a person who wishes to exercise any right contemplated in PAIA and POPIA.

The Guide is available in each of the official languages and in braille. A copy of this PAIA Manual is available in the following two official languages for public inspection during normal office hours:

• English
• Afrikaans

The Guide can be obtained:

• Upon written request to the Information Officer.
• From the website of the Information Regulator at www.justice.gov.za/inforeg/.

5. Records Available Without a Formal Request

The following categories of records are automatically available to the public without a person having to submit a formal PAIA request. These are accessible on our website.

6. Records Available in Accordance with Other Legislation

The following records are created and maintained in accordance with applicable South African legislation:

7. Subjects on Which Records Are Held and Categories of Records

The following table describes the subjects in respect of which Responsive Design Agency (Pty) holds records and the categories of records held on each subject:

8. Processing of Personal Information

8.1 Purpose of Processing Personal Information

Responsive Design Agency (Pty) processes personal information for the following purposes:

• To create and manage user accounts and authenticate users on the Taal Rooster platform.
• To enable teachers to create classes, assignments, and rubrics, and to grade student video submissions.
• To enable students to submit video responses and receive graded feedback.
• To facilitate peer feedback and peer moderation workflows.
• To manage school administrator accounts and school-level configuration.
• To process subscription payments and manage billing through Paystack.
• To send transactional communications (assignment notifications, grading alerts, parental consent requests, account emails).
• To obtain and record parental or guardian consent for minor data subjects in accordance with POPIA section 35.
• To maintain audit logs for security, compliance, and dispute-resolution purposes.
• To comply with applicable South African law, including POPIA, PAIA, the Consumer Protection Act, and the Electronic Communications and Transactions Act.

8.2 Categories of Data Subjects and Personal Information Processed

8.3 Recipients of Personal Information

Personal information may be shared with the following categories of recipients strictly to the extent necessary for the purposes described in section 8.1:

8.4 Planned Transborder Flows of Personal Information

In accordance with POPIA section 72, Responsive Design Agency (Pty) discloses the following planned transfers of personal information outside the Republic of South Africa:

Where personal information is transferred to a third country, Responsive Design Agency (Pty) takes reasonable steps to ensure that an adequate level of protection applies, consistent with POPIA section 72 and the conditions for lawful processing set out in POPIA Chapter 3.

8.5 Information Security Measures

Responsive Design Agency (Pty) implements the following technical and organisational security measures to ensure the confidentiality, integrity and availability of personal information:

• Encryption in transit: All communications between users and the platform are encrypted using TLS/HTTPS.
• Encryption at rest: Database data is encrypted at rest via Supabase. OAuth access tokens are individually encrypted at the application layer before storage.
• Access controls: Role-based access control (teacher, student, school admin, moderator) limits data access to only what is necessary for each role. Row-level security policies are enforced at the database layer.
• Password security: Passwords are hashed using Supabase Auth's secure hashing. Passwords are checked against the Have I Been Pwned (HIBP) breach database at registration.
• Audit logging: Platform activity is logged for security and compliance purposes. Logs are retained for seven years and do not contain email addresses or IP addresses.
• Minimal data collection: IP addresses are deliberately excluded from application logs. Error reports transmitted to Sentry are stripped of personal identifiers before transmission.
• Video data ownership: Student videos are stored exclusively in the school's own Google Drive or Microsoft OneDrive account, governed by the school's agreement with those providers. RDA does not host video content on its own servers.
• Breach notification: In the event of a data breach, Responsive Design Agency (Pty) will notify affected data subjects and the Information Regulator in accordance with POPIA section 22.

9. Availability of This Manual

A copy of this PAIA Manual is available:

1. On the Taal Rooster website at taalrooster.co.za/paia-manual.
2. To any person upon written request to the Information Officer at contact@taalrooster.co.za. A reasonable fee, as contemplated in the PAIA Regulations, may be charged for a printed copy.
3. To the Information Regulator upon request.

10. Updating of This Manual

Responsive Design Agency (Pty) will update this PAIA Manual on a regular basis to reflect changes in its records, processing activities, or applicable legislation. The current version will always be available at the address set out in section 9.