My Local Hero
PAIA Manual
Access To Information
Pilot PAIA Manual
Prepared under section 51 of the Promotion of Access to Information Act 2 of 2000, as amended. Compiled and last revised: 14 October 2026.
This manual covers the current pilot. Live payments and separate identity or criminal checks are not enabled. Provider safeguards and remaining retention schedules are being finalised.
On This Page
Information Officer
My Local Hero (Pty) Ltd, company number 2026/651964/07. Information Officer and head of the company: Nicholas Ryan de Souza, Managing Director. Information Regulator registration: 2026-069293, dated 14 October 2026. Appointment date: 17 August 2026. No Deputy Information Officer is currently registered.
Write to info@mylocalheroes.co.za, marked “Information Officer: PAIA Request”. Business contact: 082 200 1992. Postal and registered-office address: 74 Liverpool Street, Hout Bay, Cape Town, Western Cape, 7806. Website: book.mylocalheroes.co.za. Contact us to arrange physical inspection or collection.
Official Guide And Forms
The Information Regulator’s PAIA guide and forms explain access rights and the request process, with guides in South African languages. The Regulator can be contacted at enquiries@inforegulator.org.za or 010 023 5200. Ask our Information Officer for help locating the guide or completing a request.
Public Records
This manual, our Privacy Notice, Customer Terms, Contractor Terms, Refund Policy and published service/application information can be read on the website without a PAIA request. Private booking links, applicant details and internal review notes are not public records. No separate section 52 notice has been published.
Records We Hold
The following categories help you identify a record. Listing a category does not guarantee that a particular record exists or that access will be granted.
Company Administration
Registration and tax documents, business correspondence, policies, contracts and Information Officer registration.
Contractor Applications
Contact and business details, services, areas, availability, experience, qualifications described by applicants, optional references, review notes and status history.
Booking And Support
Where held: booking requests, service descriptions, location, dates, offers, attendance and verification events, messages, complaints, supplied evidence and outcomes. Fictional test records are distinguished from real bookings.
Payments And Accounts
Company accounting and tax records and provider correspondence. Live call-out payment integration is not enabled; fictional payment events are not evidence of a real payment.
Website Operations
Source and configuration records, limited operational logs, access controls and security or incident records where held. Secret credentials and security-sensitive details are not publicly available.
Other Legislation
Records may be retained under the Companies Act 71 of 2008, Income Tax Act 58 of 1962, Tax Administration Act 28 of 2011, Electronic Communications and Transactions Act 25 of 2002, Consumer Protection Act 68 of 2008, PAIA and the Protection of Personal Information Act 4 of 2013, where applicable to our activities. Access under another statute remains subject to that statute’s requirements; this list is not a claim that every category of statutory record is held.
Request A Record
For a formal PAIA request, complete the Regulator’s Form 2: Request For Access To Record and send it to the Information Officer above. Identify the record and any known reference, the right you seek to exercise or protect, why the record is needed, your preferred access format and reply details. Include the form’s required identity evidence and, if acting for another person, proof of authority. Contact us to arrange a secure method for sensitive evidence; do not send banking passwords, PINs or one-time codes.
To ask whether we hold your own personal information, or request correction, deletion or an objection under POPIA, email the same address. We will explain identity checks and any applicable procedure. A request does not authorise disclosure of someone else’s personal information.
Decisions And Fees
We will communicate the decision within the period required by PAIA, ordinarily 30 days. A lawful extension will be explained in writing. Our response will explain access arrangements or the statutory reasons for refusing all or part of the request. Where possible, protected portions will be separated from disclosable information.
Applicable fees follow the Regulator’s current fee schedule. A private-body request fee is currently R140 where payable; copying, preparation, delivery or a prescribed deposit may also apply. We will explain the amount, legal basis and any applicable exemption before requiring payment. These are information-access fees, not the MLH call-out fee. A POPIA request simply to confirm whether we hold your personal information is free.
If You Disagree
MLH is a private body, so PAIA’s public-body internal appeal process does not apply. A requester may complain to the Information Regulator using Form 5, ordinarily within 180 days of the relevant refusal or non-response, or seek relief from a court under PAIA. See the official guide for deadlines and requirements. You may contact us to resolve an issue without giving up those rights.
Personal Information
We process information to consider applications, arrange requested services, support bookings, communicate, prevent fraud, handle complaints and meet company, accounting and legal duties. Applicants and customers provide information directly; references come from applicants. Company and officer details may be verified against CIPC and Information Regulator records. Any later identity or criminal-check process needs its own lawful arrangements and notice; it is not performed automatically by the pilot application.
Applicants And Contractors
Identity/contact and business details supplied, work experience, qualifications, areas, hours, prices and review records. The pilot form does not collect ID documents, bank details or criminal records.
Customers And Enquirers
Contact details, service requests, location, timing, offers selected, messages and support information where provided.
Work References
Optional name, relationship and contact information supplied by an applicant with the reference’s permission.
Service Providers And Business Contacts
Business contact details, agreements, invoices and related correspondence.
Recipients And Overseas Processing
Pilot applications are stored in the Cloudflare-hosted database and reviewed in the owner-only Action Centre. Website hosting uses Sites/Cloudflare; booking records may use Supabase. Google location services and WhatsApp process information when used. Before assignment, contractors receive the customer’s area rather than the precise address; necessary attendance details are shared after confirmed payment and assignment. Advisers, authorities and support providers receive information only where necessary and lawful.
These international providers may process information outside South Africa. Processing locations, applicable terms and section 72 transfer safeguards must be confirmed for the actual account and service configuration. We do not claim that every provider is a processor or that all transfer arrangements have already been verified. TradeSafe/Ozow payments and WhatChimp/Make automation remain dependent on enabling the relevant integration; this manual does not imply that they currently receive live booking data.
Security And Retention
Current controls include restricted administrative access, private booking links, server-side service credentials and sharing only the information needed at each stage. Application review notes are not public. Bot protection applies where configured. Keep private links confidential; possession may provide access to a booking. Security incidents are assessed and notified as required.
Pilot applications, contractor drafts and associated review records have a 90-day retention period from submission. Expired entries are excluded from review and deleted on the next application submission or review. Approval does not activate a contractor. Fictional demo cards expire after seven days and are cleaned from the active demo database when a new test starts or an authorised administrator runs cleanup. Backup retention depends on the provider and configured plan; active-record deletion is not a promise of immediate backup erasure. Expired records must be excluded and cleaned after a restore. Other records are retained only for their operational and applicable legal purposes; the final category-specific live-service schedule and provider arrangements are outstanding. Legal holds and statutory retention duties must be assessed before deletion.
Availability And Updates
This English pilot manual is available free to read online. Contact the Information Officer for a copy, assistance, physical inspection arrangements or an accessible format. Any lawful reproduction fee will be explained. The Information Officer will review the manual when systems, contacts, records or processing practices change, and before live activation.