PAIA / POPIA Manual
Prepared in terms of section 51 of the Promotion of Access to Information Act 2 of 2000 (as amended). Draft version 2026-08-17.
Contents
- List of acronyms and abbreviations
- Purpose of this Manual
- Key contact details
- Guide on how to use PAIA
- Records available without a request
- Records available under other legislation
- Subjects and categories of records held
- Processing of personal information
- Availability of this Manual
- Updating this Manual
1. List of acronyms and abbreviations
- CEO — Chief Executive Officer
- DIO — Deputy Information Officer
- IO — Information Officer
- PAIA — Promotion of Access to Information Act 2 of 2000 (as amended)
- POPIA — Protection of Personal Information Act 4 of 2013
- Regulator — the Information Regulator (South Africa)
- Organization — a school, academy, or club that subscribes to Vantic and enters its own players' and staff's data (the "Responsible Party" under POPIA for that data)
- Republic — the Republic of South Africa
2. Purpose of this Manual
This Manual is provided so that members of the public and Vantic's Organizations can:
- check what categories of records Vantic holds without needing to submit a formal request;
- understand how to request access to a record Vantic holds;
- find the contact details of Vantic's Information Officer and Deputy Information Officer(s), if any;
- understand why Vantic processes personal information, who it's processed about, and what categories of information are involved;
- know who personal information may be shared with, whether it's transferred outside South Africa, and what security measures protect it.
3. Key contact details
3.1 Information Officer
Name: Diederik Jurgens Vos Maartens — under POPIA section 55, the head of a private body is its Information Officer by default; formal effect follows the company's registration (scheduled 20 Aug 2026)
Title: Founder & Chief Executive Officer
Tel: [contact number]
Email: [[email protected] or equivalent]
3.2 Deputy Information Officer
Not yet designated — Vantic is currently a single-founder company. [Update once/if staff are hired and a Deputy Information Officer is designated under PAIA section 17(1)/POPIA section 56.]
3.3 General contact
Email: [email protected]
3.4 Registered office
Postal address: 68-82 Steenloper Street, Monumentpark, Pretoria, Gauteng, South Africa
Physical address: 68-82 Steenloper Street, Monumentpark, Pretoria, Gauteng, South Africa
Website: vantic.co.za [confirm final domain]
Company legal name and registration number will be added here once Pty Ltd registration is complete.
4. Guide on how to use PAIA
The Information Regulator has published a Guide, in terms of section 10(1) of PAIA, explaining the objects of PAIA and POPIA, how to request access to a record, and what remedies (internal appeal, complaint to the Regulator, or court application) are available. The Guide is available in each official language and in braille.
The Guide can be obtained by request to Vantic's Information Officer (contact details above), or directly from the Regulator:
- Email: [email protected]
- Website: justice.gov.za/inforeg
[Confirm these Regulator contact details are still current before publishing — verify directly on the Information Regulator's website.]
5. Records available without a request
The following are publicly available on vantic.co.za without needing a formal PAIA request:
| Category of record | Type | Available on website |
|---|---|---|
| This Manual | PAIA/POPIA Manual | Yes |
| Terms of Service | Legal terms | Yes |
| Privacy Policy | Legal policy | Yes |
| Pricing | Product/pricing information | Yes |
6. Records available under other legislation
| Category of record | Applicable legislation |
|---|---|
| Memorandum of Incorporation | Companies Act 71 of 2008 [once registered Thursday] |
| This PAIA Manual | Promotion of Access to Information Act 2 of 2000 |
| Tax records | Tax Administration Act 28 of 2011 [once applicable] |
7. Subjects on which Vantic holds records, and categories of records held
| Subject | Categories of records |
|---|---|
| Organization accounts | Organization name, subscription/plan status, billing records (once PayFast is live) |
| Staff (coaches/S&C) | Name, email, role, assigned teams |
| Players | Name, date of birth, gender, age group, team/sport, position |
| Performance data | Physical test results across speed/power/strength/endurance/body composition/sport-specific batteries |
| Wellness data | Daily sleep, fatigue, soreness, stress, and mood scores |
| Injury/recovery data | Injury description, dates, return-to-training/return-to-play timelines, rehab guidance and notes |
| Financial | Company financial and tax records [once applicable] |
8. Processing of personal information
8.1 Purpose of processing
Vantic processes personal information to operate the platform for its Organizations: performance testing, scoring and benchmarking, wellness monitoring, injury/return-to-play tracking, and automatic training program generation. Vantic processes this information as an Operator under POPIA, on the instructions of each Organization, which is the Responsible Party for its own players' and staff's data. See the Privacy Policy for the full explanation of this relationship.
8.2 Categories of data subjects and personal information processed
| Category of data subject | Personal information processed |
|---|---|
| Organization staff (coaches, S&C) | Name, email, role, assigned teams |
| Players (predominantly minors) | Name, date of birth, gender, age group, team/position, physical test results, wellness scores, injury/recovery records — see section 4 of the Privacy Policy on how consent for this is obtained via the Organization |
8.3 Recipients of personal information
| Category of personal information | Recipient |
|---|---|
| All platform data (database, authentication, file storage) | Supabase (sub-processor, hosting infrastructure) |
| Billing information only — never player data | PayFast (payment processor, once billing is live) |
Personal information is never sold, and never shared between different Organizations using Vantic.
8.4 Planned transborder flows of personal information
[To be confirmed: state the actual region of the Supabase project hosting Vantic's data (Project Settings → General → Region) and whether this constitutes a transfer of personal information outside the Republic of South Africa. A Cloudflare routing check during this draft suggested traffic is served near Johannesburg, but this is not confirmation of the database's actual hosting region — verify directly in the Supabase dashboard.]
8.5 Information security measures
Real measures in place as of this draft, verified 2026-08-12:
- Row-level security enforced at the database level across every table holding player/organization data (31 tables, 88 policies) — one Organization's staff cannot access another Organization's data.
- All server-side functions performing privileged actions verify the caller's identity first.
- Data encrypted in transit (HTTPS/TLS).
- No passwords or API keys stored in application source code.
[Not yet checked, should be before publishing: multi-factor authentication availability for staff accounts, formal encryption-at-rest confirmation from Supabase's documentation.]
9. Availability of this Manual
A copy of this Manual is available:
- on vantic.co.za;
- at Vantic's registered office (68-82 Steenloper Street, Monumentpark, Pretoria, Gauteng, South Africa), for inspection during normal business hours;
- to any person on request, subject to a reasonable prescribed fee for photocopies, per the PAIA Regulations; and
- to the Information Regulator on request.
10. Updating this Manual
Vantic's Information Officer will review and update this Manual on a regular basis, and whenever the categories of personal information processed or the purposes of processing materially change.
Issued by: Diederik Jurgens Vos Maartens, Founder & Chief Executive Officer