PAIA & access to information
A clear route
to ask for information.
Read Greymatter's PAIA manual, find the official forms, or ask the Information Officer for help with a record request.
Read or keep the manual
Approved by Earle Hilton Drury, head and Information Officer, on 4 October 2026. The manual is provided below as ordinary website text and as a matching download.
Read the PAIA manual on this page · Download the PAIA manual (PDF)
Contact the Information Officer
Information Officer: Earle Hilton Drury
Email: earle@greymattercollective.org
Telephone: 082 554 7704
Fax: 082 554 7704. No deputy Information Officer is appointed.
Business and postal address: 39 Pebble Creek, Sugarbush Estate, Mogale City, Gauteng, 1739, South Africa.
Manual inspection and request assistance: Monday to Friday, 09:00-12:00 South African Standard Time (SAST, UTC+2). Contact Earle to arrange access.
Current PAIA forms · Official Guide and language options
PAIA private-body manual
Version 1.0. Approved by Earle Hilton Drury, head and Information Officer, on 4 October 2026. Effective date: 4 October 2026. Next annual review: October 2027; material changes will be addressed sooner.
1. Purpose and organisation
This manual describes how to identify and request records held by The Greymatter Collective (Pty) Ltd, company registration 2020/139827/07. The public brand is Greymatter and The Greymatter Collective.
Greymatter is a learning partner and boutique consultancy working across education, skills development, training and youth empowerment. Its current learning ecosystem contains 14 experiences for reflection, practice and planning. Completion of a free tool does not establish competence or confer an accredited qualification. The company uses contractors and currently has no employees.
PAIA means the Promotion of Access to Information Act 2 of 2000; POPIA means the Protection of Personal Information Act 4 of 2013; the Regulator means South Africa's Information Regulator. Making this manual available does not guarantee access to every record or certify organisation-wide legal compliance.
2. Contacts and accountability
| Detail | Information |
|---|---|
| Legal entity and registration | The Greymatter Collective (Pty) Ltd; 2020/139827/07 |
| Website | https://www.greymattercollective.org/ |
| General business email | info@greymattercollective.org |
| Head and Information Officer | Earle Hilton Drury |
| Officer registration | 2026-068311; registered 2 October 2026 |
| Officer email | earle@greymattercollective.org |
| Telephone and fax | 082 554 7704 |
| Business and postal address | 39 Pebble Creek, Sugarbush Estate, Mogale City, Gauteng, 1739, South Africa |
| Deputy Information Officer | No deputy is appointed. |
| Manual inspection and assistance hours | Monday to Friday, 09:00-12:00 South African Standard Time (SAST, UTC+2). Contact the officer to arrange access. |
| Request handler and manual reviewer | Earle Hilton Drury; manual reviewed annually and when material changes occur. |
Officer registration confirms registration; it does not establish organisation-wide POPIA compliance. Greymatter does not use POPIA or PAIA compliance as a marketing badge.
3. Guide and current resources
The Regulator's PAIA Guide explains access procedures and remedies. Obtain it from the official guidance catalogue or ask the Information Officer for assistance. The English Guide is linked in that catalogue. The catalogue provides other available languages and formats; tell the officer if a form or format creates a barrier.
The official forms catalogue provides Form 02 for record requests, Form 03 for outcomes and fees, and Form 05 for complaints. Use current forms and instructions. This manual uses these forms instead of the older Form C terminology.
Regulator enquiries: enquiries@inforegulator.org.za; 010 023 5200. The Regulator's current contacts and eServices portal provide further assistance.
4. Public records available without a formal request
Public website material is readable without an account or PAIA request. This includes organisation and services information, Learning & Tools and product learning content, Guides, Evidence & approach, Quality, Privacy, Saved Work, Data Protection, and this manual. Download the manual at the PAIA page or request an electronic copy from the officer.
Underlying customer, contractor, client or learner records are not made public simply because the website describes the services. Any further disclosure must follow the applicable access requirements. This manual is not a section 52 notice declaring private operating records automatically available.
5. Records held and applicable legislation
Operating records are kept electronically only; no physical business records are stored. Information is limited to what is needed to deliver services. The following descriptions cover the generic supplier and client record categories accepted by the head; examples apply only where a record is actually kept.
| Subject | Record and information categories |
|---|---|
| Customers and clients | Contact and customer-account details; service enquiries and correspondence; engagement agreements; invoices and associated transaction records where kept. |
| Contractors and suppliers | Contact and supplier/contractor details; supplier documents and service agreements; invoices and associated service/payment records where kept. Contractors are not described as employees. |
| Learners | Minimal contact, participation and service-delivery records and related correspondence where collected. Browser-local tool reflections are not automatically organisation-held records. |
| Company and information governance | Company registration and officer documentation; this manual and information-request correspondence. Statutory company/accounting records are retained as applicable to the entity and its operations. |
The relevant legal framework includes PAIA, POPIA and the Companies Act 71 of 2008. Record categories are descriptions, not a guarantee that every example exists or will be disclosed. An access decision is made for the actual record and request.
Relationship records are normally kept for five years after the relationship concludes. Longer statutory requirements and lawful retention obligations take precedence. Certain company and accounting records have longer requirements under Companies Act section 24, including seven-year requirements. The five-year practice does not shorten those periods.
After the applicable period, records are removed from active organisational storage and placed in temporary deletion for approximately 30 days before removal from the organisation's recoverable account storage, as described by the head. OneDrive Personal normally removes recycle-bin items after 30 days. This is not a promise that every provider backup, technical log or legally retained copy is erased within 30 days. Provider-level deletion follows the applicable service terms; Google's published process can take longer. Retention is reconsidered if a record remains required by law or for an unresolved lawful request.
6. Requesting a record
Send Form 02 to Earle Hilton Drury using the officer contacts in section 2. Identify the requester and record, preferred access format and reply details. Explain the right involved and why the record is needed. Provide identity or representative-authority evidence proportionate to the request and the form's requirements; an identity-document copy is not needed for an initial general enquiry.
The officer handles receipt, clarification, record search, the access decision and communication of the outcome. Requests are considered under PAIA's private-body access and refusal provisions. A request does not guarantee access, including where another person's protected information is involved.
Ordinarily a decision is due within 30 days of receiving the request or required particulars; third-party provisions can affect timing. One extension of up to 30 days is permitted on statutory grounds, with notice. Form 03 is used for the outcome and applicable fees. Search, reproduction, access fees and deposits follow the current prescribed rules and written notice; any payment details will be supplied with the relevant notice, not invented in this manual.
There is no PAIA internal appeal for this private body. An eligible complaint about refusal, fees, an extension or access format may be submitted to the Regulator within 180 days of the decision using Form 05. Court remedies follow PAIA. Consult the current Guide and forms for the applicable procedure and time limits.
The officer can help with forms, available formats and electronic copies during the hours in section 2. Requests for access, correction, deletion or objection concerning personal information may also be directed to the officer and are considered under the applicable law.
7. Personal information, providers and security
Business information is used to deliver services and administer the associated customer, client, contractor, supplier and learner relationships. It is not sold or used for an independent data-sharing purpose. The data subjects and information categories are described in section 5. Earle Hilton Drury is the sole person currently authorised to access Greymatter's organisational records.
Microsoft OneDrive Personal and Google Workspace are the cloud services identified by the head. These providers process information to deliver storage and business services under their applicable terms and privacy arrangements. Provider processing is distinct from sale or independent commercial sharing. Records may also be disclosed where authorised or required by applicable law, subject to the relevant access and privacy safeguards.
Provider arrangements and international processing: cloud, communications and website-hosting services use distributed infrastructure. Information may be stored or processed outside South Africa, including in the United States and other countries where the providers or their service providers maintain facilities, subject to applicable service commitments. Microsoft describes storage in the user's region, the United States and other jurisdictions; Google's Workspace terms allow processing at its or its subprocessors' facilities. No exclusive South Africa/Middle East location, account-specific residency arrangement or fixed technical-log retention period is claimed. The provider sources in section 10 explain the published arrangements; an engagement-specific arrangement should be clarified with the officer before sending confidential records.
The head confirms two-factor authentication and the cloud encryption offered by the service providers. These are the described organisational safeguards; no claim is made that unconfirmed additional device, backup or account controls have been independently audited. Sole organisational access does not mean the providers have no processing or support role.
The website is hosted through OpenAI Sites with Cloudflare delivery. Hosting providers receive technical page and asset requests and may process IP addresses and traffic metadata. The reviewed application code adds no advertising pixels or behavioural analytics and has no automatic learner-response submission endpoint or connected learner database. Technical requests and provider logs are distinct from learner reflections.
The 14 current experiences retain learner work in the participant's browser or active page according to their own saving controls. Leadership Mirror keeps assessment responses/results in active-page memory; refresh or leaving clears them. The presentation tools use current-tab memory unless device saving is enabled. See Privacy and Saved Work for the implementation-verified per-product behaviour. Browser-local work is not automatically uploaded to OneDrive, Google Workspace, Greymatter or a manager, tutor, coach or employer.
Copying, downloading, printing, explicit transfer between compatible career-tool addresses and sending an export are participant-controlled actions. Separately sent learner/client material becomes organisational correspondence subject to the relevant service arrangements. For TNA and other people-related reflections: avoid names and unnecessary identifying, confidential or sensitive information. Describe the situation rather than documenting private personal details.
8. Availability and updating
This manual is available as website text and a matching PDF at Greymatter's PAIA page, by request to the Information Officer, for inspection at the business premises during the hours in section 2, and to the Regulator on request. Contact the officer to arrange inspection of the electronic manual. Website access and an emailed electronic manual copy are available without a manual-copy charge. Any charge for other reproduction follows the applicable prescribed rules and notice.
Earle Hilton Drury handles requests and reviews the manual annually. Changes to contacts, operations or information handling trigger an earlier update. The website copy and downloadable copy should remain aligned.
9. Approval record
Approved and issued by Earle Hilton Drury, head of the private body and registered Information Officer, on 4 October 2026. The head supplied and confirmed the operating facts and accepted generic supplier/client record descriptions and qualified provider wording.
This manual provides access procedures and a transparent description of the confirmed information practices. It does not certify organisation-wide POPIA/PAIA compliance or independently attest exact provider data countries, infrastructure deletion timing or every account security setting.
10. Sources and published provider arrangements
Official resources checked on 4 October 2026:
- PAIA Act, especially private-body access procedures, complaints and remedies.
- Information Regulator private-body template, with historical form references checked against the current catalogue.
- PAIA Guide and language options and current forms.
- Companies Act, section 24 record-retention obligations.
- Microsoft privacy statement, international storage and processing.
- Microsoft OneDrive deletion guidance, personal-account recycle-bin period.
- Google Workspace data-processing terms, facilities, security and provider-level deletion; applicable account terms govern.
- Cloudflare static-asset documentation and privacy policy, hosting/caching and end-user technical processing.
Operating facts are supplied by the head. Learner-tool privacy is supported by the reviewed application code, website configuration and storage/transmission inventory. Provider documentation describes published service arrangements; it is not an account-specific residency or deletion audit.