Legal
PAIA manual and requests about your information
Effective date: 10 October 2026. Version 0.6.
This page has three parts. Part A is our manual under the Promotion of Access to Information Act 2 of 2000 (PAIA), which private bodies are required to have. Part B is how you exercise a right over your personal information under POPIA or the GDPR. Part C is how we handle your request on our side. We publish all three, because there is no reason to hide how we handle your request.
PART A. PAIA MANUAL
A1. About this manual
This manual is published in terms of section 51 of PAIA. It tells you what records we hold, how to request access to them, and what happens when you do.
A2. Who we are
| Item | Detail |
|---|---|
| Name | Robert Russell, a sole proprietor trading as QuantumThrive Hub |
| Registration number | None. A sole proprietor is not a registered company |
| Registered address | None. A sole proprietor has no registered address. See the physical address |
| Physical address | U37 Stonewood Estate, 3 Macbeth Avenue, Fourways, 2191, South Africa |
| Postal address | U37 Stonewood Estate, 3 Macbeth Avenue, Fourways, 2191, South Africa |
| Telephone | +27 73 502 3363. Support is by email only: support@quantumthrivehub.com. |
| support@quantumthrivehub.com | |
| Website | quantumthrivehub.com |
| Information Officer | Robert Russell, registered with the Information Regulator of South Africa |
| Deputy Information Officer | None appointed |
A3. The PAIA Guide
The Information Regulator has published a guide on how to use PAIA, in terms of section 10. It is available from the Information Regulator at inforegulator.org.za, or by contacting the Regulator at JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001, or PAIAcomplaints@inforegulator.org.za.
A4. Records we hold
| Category | Contents | Available |
|---|---|---|
| Client records | Intake responses, artefacts produced, correspondence, notes we keep about our work with you, order and delivery records | On request under PAIA, subject to the grounds for refusal |
| Financial records | Invoices, payment records, bank records, tax records | Not generally available. Third-party and confidential business information |
| Employment and contractor records | Agreements, correspondence | Not generally available |
| Marketing and content records | Subscriber lists, campaign records, published content | Published content is public. Subscriber records are not available |
| Compliance records | This pack, consent records, quality control logs, incident records | Available on request to the Information Regulator. Otherwise assessed on request |
| Supplier and processor records | Agreements with our service providers | Not generally available. Confidential business information |
A5. Records available without a formal request
Our published legal documents, our published content, our product descriptions and our pricing are on our website and need no request.
If you are a client and you want a copy of your own artefact, your own intake responses, or your own correspondence, you do not need to use PAIA. Just email support@quantumthrivehub.com and we will send it. Part B is the faster route and it is free.
A6. Records held in terms of other legislation
We hold records in terms of, among others: the Income Tax Act 58 of 1962, the Tax Administration Act 28 of 2011, the Value Added Tax Act 89 of 1991 if we become registered, the Consumer Protection Act 68 of 2008, the Electronic Communications and Transactions Act 25 of 2002, and the Protection of Personal Information Act 4 of 2013.
A7. How to make a PAIA request
1. Complete the prescribed request form (Form 2 of the PAIA Regulations), available from inforegulator.org.za, or write to us setting out the same information.
2. Send it to Robert Russell at support@quantumthrivehub.com, marked “PAIA request”, or by post to the address in A2.
3. Give enough detail to identify the record and to identify you, state the right you are seeking to exercise or protect and how the record will help, and give a contact address.
4. If you are asking on behalf of someone else, include proof of your authority.
A8. Fees
The prescribed PAIA fees apply, as published by the Minister. In summary: a request fee may be payable before we process the request, and an access fee covering reproduction, search and preparation may be payable before we release the record.
We do not charge for a request for your own personal information. That is handled free under Part B.
We will tell you what is payable, and why, before you incur it.
A9. Our decision
We decide within 30 days and tell you in writing. We may extend by a further 30 days where the request is for a large number of records or requires a search through records held elsewhere, and we will tell you if we do.
If we refuse, we will tell you which section of PAIA we rely on and give you adequate reasons, and we will tell you how to appeal.
A10. Grounds for refusal
PAIA requires or permits refusal in defined circumstances, including: unreasonable disclosure of another person’s personal information (section 63), commercial information of a third party (section 64), information supplied in confidence (section 65), information that would endanger a person (section 66), privileged records (section 67), our own commercial information including trade secrets (section 68), and research information (section 69).
Our method, our prompts, our question sets and our templates are trade secrets and commercial information and will generally be refused on that basis.
A11. Remedies
If we refuse, or fail to respond in time, you may lodge a complaint with the Information Regulator, or apply to a court. The Regulator’s contact details are in A3.
PART B. YOUR RIGHTS OVER YOUR PERSONAL INFORMATION
B1. What you can ask for
| Request | What it does | Applies to |
|---|---|---|
| Access | A copy of the personal information we hold about you, and information about how we process it | Everyone |
| Correction | Correction of anything inaccurate, misleading, out of date or incomplete | Everyone |
| Deletion | Deletion of your personal information | Everyone |
| Objection | Objection to processing based on legitimate interest, and to direct marketing at any time | Everyone |
| Withdrawal of consent | Withdrawal of any consent you gave | Everyone |
| Restriction | Pausing processing while a dispute is resolved | United Kingdom and European Union |
| Portability | Your information in a machine-readable format, or sent to another provider | United Kingdom and European Union |
| Human review | A person to look again at anything produced with AI assistance | Everyone |
B2. How to make a request
Email support@quantumthrivehub.com. Put “Data request” in the subject line and tell us:
-
What you want (access, correction, deletion, objection, withdrawal, restriction, portability, or human review).
-
Enough for us to find you: the email address you used, and the approximate date of your order if you had one.
-
For a correction request, what is wrong and what it should say.
You do not need a form and you do not need a reason.
B3. Verifying you
We will confirm your identity before we act, because sending your information to the wrong person is worse than a delay. Usually replying from the email address on your record is enough. If your request is unusual or high risk, we may ask for more.
If you ask on behalf of someone else, send proof that you are authorised.
B4. Time and cost
Free. We do not charge for these requests.
30 days. We respond within 30 days of a verified request. If a request is complex and we need longer, we will tell you inside the 30 days, explain why, and give you a date. We will not use an extension to avoid answering.
We may refuse a request that is manifestly unfounded or excessive, particularly where it repeats a request we have already answered. If we do, we will explain why and tell you how to complain.
B5. What we can and cannot delete
We will delete: your intake responses, your demographic fields, your artefact, your account, your marketing subscription, your correspondence, and the notes we keep about our work with you.
We cannot delete, and we will tell you why: records the law requires us to keep. In practice that is the transaction and financial record, retained for five years from the date we file the tax return that covers it, because tax law requires it, and a minimal suppression record so we do not email you again after you unsubscribe.
Where we must keep something, we restrict it so it is used only for that purpose, and we delete it when the period expires.
B6. If you are not satisfied
Reply and tell us. If that does not resolve it, complain to a regulator. Contact details are in our Privacy notice, section 12. Complaining to a regulator costs nothing and you do not need our permission.
PART C. INTERNAL HANDLING PROCEDURE
C1. Ownership
The Information Officer owns every request. If the Information Officer is unavailable for more than three business days, the request waits until they return. We tell the requester so and give a date, and the statutory time limits still apply.
C2. Steps and timings
| Day | Step |
|---|---|
| 0 | Request arrives at support@. Logged in the request register with a reference, date, requester and type. Acknowledgement sent the same or next business day |
| 0 to 3 | Identity verified. If more information is needed, requested in one message rather than several |
| 3 to 10 | Records located across every system on the checklist in C3 |
| 10 to 20 | Response prepared. Third-party information redacted. Trade secrets withheld with reasons |
| 20 to 30 | Response reviewed by the Information Officer and sent. Register updated and closed |
| 30 | If not closed, the extension letter must already have gone out. A silent overrun is a failure |
C3. Where to look: every place we keep personal information.
If you miss one of these places, your answer is incomplete, which is itself a breach. Go through every item on the list, every time. Search each place for this person’s name, email address and phone number. Note in the request register what you find in each place, or that you found nothing.
1. The accounts on our website, where people sign up and log in.
2. The email service (Brevo), including mailing lists and the list of people who have unsubscribed.
3. The support@quantumthrivehub.com mailbox, including sent items and archived mail.
4. Robert Russell’s personal mailboxes, for correspondence with this person.
5. Paystack, our payment provider, for this person’s payments and refunds.
6. The quality control log.
7. WhatsApp, text messages or other messaging apps used to contact this person.
8. Anywhere else you know of that holds this person’s details.
C4. Deletion means deletion
Deleting from the interface is not enough where a system keeps a recycle bin, an export or a backup. For each system, delete the record, empty the bin, and record the date. Where a backup cannot be selectively purged, record that fact, note the backup cycle, and confirm the record will drop out at the end of it.
C5. The register
Every request is recorded, whether or not it was granted: reference, date received, requester, type, verification method, systems searched, outcome, date closed, and who handled it. The register is the evidence that we do this properly, and it is the first thing a regulator asks for.
C6. Escalation
The Information Officer deals with these on the day they arrive, where: the request comes from a regulator, the request follows a complaint, the request relates to a suspected breach, the request is from a lawyer, or the request cannot be met within 30 days.
C7. Revision history
| Version | Date | Change | Approved by |
|---|---|---|---|
| 0.1 | 31 July 2026 | First draft for review. Not published | Pending |
| 0.2 | 25 September 2026 | Supplier details filled for a sole proprietor, retention and refund rulings applied, Path and Sky described by how they work | Robert Russell |
| 0.3 | 8 October 2026 | Client notes added to the client records and to what we delete on request | Robert Russell |
| 0.4 | 9 October 2026 | The Information Officer is registered with the Information Regulator of South Africa. Registered on 9 October 2026, number 2026-068770 | Robert Russell |
| 0.5 | 11 October 2026 | The opening says plainly what each of the three parts is, and that all three are published. Other documents are called by their page headings | Robert Russell, 15 October 2026 |
| 0.6 | 15 October 2026 | Part C3 no longer lists Google Drive, because nothing about a person is kept there. The later items move up one place | Awaiting sign-off by Robert Russell |