PAIA manual
The manual of Ground Africa Group (Pty) Ltd under section 51 of the Promotion of Access to Information Act 2 of 2000 (PAIA). Version 1.0, 22 October 2026.
01This manual
PULLUPZA is operated by Ground Africa Group (Pty) Ltd. This manual says what records we keep, which you can see without asking, and how to request the others under PAIA. It also describes how we process personal information under POPIA.
02Business details
- Registered name
- Ground Africa Group (Pty) Ltd
- Registration number
- 2014/055684/07
- VAT number
- 4870325760
- Place of registration
- South Africa
- Main business
- Online marketplace for beauty and grooming services
- Physical and postal address
- To be added
- [email protected]
- Website
- pullupza.co.za
- Office bearers
- Themba Nkosi (Director)
- Information Officer
- Themba Nkosi (registered with the Information Regulator, 2026-070029, 22 October 2026)
- Deputy Information Officer
- Reitumetsi Radebe
03The Regulator's guide
The Information Regulator publishes the “Guide on how to use the Promotion of Access to Information Act 2 of 2000, as amended”, in every official language. It explains how to use PAIA and POPIA to get information. Download it from inforegulator.org.za, or ask our Information Officer at [email protected] for a copy.
The Information Regulator:
Address
Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191
Phone
010 023 5200 (toll-free 0800 017 160)
Enquiries
PAIA complaints
POPIA complaints
Website
inforegulator.org.za
04Open records
Our Terms (pullupza.co.za/terms)
Our Privacy & POPIA notice (pullupza.co.za/privacy)
This PAIA manual (pullupza.co.za/paia)
Published service information: the services, prices, service areas and pro profiles shown on our website and in our apps
05Other laws
We keep records under these laws, where they apply to us:
Companies Act 71 of 2008
Tax Administration Act 28 of 2011
Income Tax Act 58 of 1962
Value-Added Tax Act 89 of 1991
Consumer Protection Act 68 of 2008
Electronic Communications and Transactions Act 25 of 2002
Protection of Personal Information Act 4 of 2013
Promotion of Access to Information Act 2 of 2000
06Our records
Company and statutory records
Registration documents, records of directors and office bearers, and statutory filings. Why: To run the company and meet company law.
Financial records
Accounts, invoices, booking payments, refunds, pros' earnings and payouts, and tax records. Why: To take payments, refund customers, pay pros, and meet accounting and tax law.
Customer accounts and bookings
Name, South African mobile number, profile photo if added, saved addresses with directions, preferred payment method, bookings (service, address, times, price, payment method and status, notes, cancellations), messages with the pro, and ratings and reviews. Why: To sign customers in with a code by SMS, match each booking with a pro, show the exact address only to the pro who accepts it, take payment, and handle cancellations and reviews.
Provider applications and vetting results
Name, mobile number, profile, photos, services, prices, hours, base area and service radius, location while working, shop staff names and photos, identity documents, proof of address, a selfie with ID, qualifications, consent to the checks, and the police clearance and NRSO results: the outcome, the certificate's date, reference and expiry, and who confirmed it. Never offence details. Certificate files are deleted 30 days after the result is confirmed; if a pro leaves, the results are deleted 12 months later. Why: To check and approve pros before they receive bookings, keep the checks current, show approved profiles, and pay pros.
Waitlist sign-ups
An email address or WhatsApp number, customer or pro, municipality, suburb if given, the consent version, when the person joined, whether the email was confirmed, and a campaign code if the link had one. Why: To tell people when the apps are ready, and to count interest by area. We delete the waitlist within 6 months after the apps launch.
Safety and support reports
Reports about a booking (payment, safety, no-show, quality, conduct, app issues), what was said, and how each was resolved. Why: To help when something goes wrong, and to act on safety reports.
Audit logs
Which staff member took which action in our admin tools, on what, and when. Why: Security and accountability: every admin action is recorded.
07Personal information
Whose information
Customers
As under “Customer accounts and bookings” above.
Providers (pros and shops, and shop staff)
As under “Provider applications and vetting results” above.
Waitlist sign-ups
As under “Waitlist sign-ups” above.
Staff
Name, email address, mobile number, role, sign-in security settings, and the audit log of their admin actions.
Suppliers
Company name, contact people and their contact details, contracts and invoices.
Who we share it with
Supabase
Hosts the apps' database, sign-in, file storage and server functions.
Cloudflare
Hosts this website and the waitlist database, checks sign-ups for bots (Turnstile), and protects our admin view (Access).
Resend
Sends our emails, such as the waitlist confirmation.
SMSPortal
Sends sign-in codes by SMS.
A payment provider
To take card and instant EFT payments, once one is chosen. We name it here when it is.
Pros and customers
Only what a booking needs: a pro sees a customer's exact address only after accepting the booking.
Outside South Africa
The apps' database, sign-in and files (Supabase): the EU (Ireland).
The waitlist (Cloudflare): stored in the EU.
Emails (Resend): sent from the EU (Ireland).
Each of these is in the European Union, under data protection law at least as strong as POPIA (POPIA section 72), and each provider processes the information only to provide its service to us.
How we protect it
Access control: people see only what their role needs; row-level security in the database enforces this for every table.
Encryption in transit: the website, apps and services talk only over HTTPS.
Multi-factor sign-in (an authenticator app) for staff, and Cloudflare Access in front of the admin view.
Audit logs of every admin action.
Keeping as little as we can, for as short as we can: for example, certificate files are deleted 30 days after the result is confirmed.
08Requesting access
Fill in PAIA Form 2, “Request for Access to Record” (download it from the Regulator’s forms page), and email it to our Information Officer at [email protected], with proof of your identity. Say which record you want and in what form.
The fees are those prescribed in the current PAIA regulations, set out on the Regulator’s fees page. Asking for your own personal information carries no request fee.
We decide within 30 days, and tell you in writing. We may extend this once, by up to 30 days, and tell you why. If we refuse, we say why, under one of the grounds PAIA allows a private body:
To protect another person's privacy: their personal information (section 63)
To protect another party's commercial information, or information given to us in confidence (sections 64 and 65)
To protect the safety of a person or property (section 66)
Records privileged from production in legal proceedings (section 67)
Our own trade secrets and commercial information whose release could harm us (section 68)
Research information that, if released, could seriously disadvantage the researcher or the research (section 69)
If you aren’t satisfied with our decision, you can complain to the Information Regulator ([email protected], on PAIA Form 5 from the forms page) or apply to a court.
09POPIA requests
Under POPIA you can ask us to correct or delete your personal information, or object to how we process it. Use the forms in the POPIA regulations, from the Regulator’s POPIA forms page, and email them to [email protected]:
To object to processing
POPIA Form 1, “Objection to the Processing of Personal Information”
To correct or delete
POPIA Form 2, “Request for Correction or Deletion of Personal Information or Destroying or Deletion of Record of Personal Information”
You can also complain to the Information Regulator about how we handle your personal information: [email protected].
10Availability
This manual is on our website at pullupza.co.za/paia. We email a free copy to anyone who asks at [email protected]. We update it when our records or processing change, with a new version number and date.