PAIA and POPIA manual of Correntum (Pty) Ltd
Prepared under section 51 of the Promotion of Access to Information Act 2 of 2000, as amended.
Date of compilation: 21 October 2026. Date of last revision: the same.
1. Acronyms
"IO" means Information Officer; "Minister" means the Minister of Justice and Correctional Services; "PAIA" means the Promotion of Access to Information Act 2 of 2000; "POPIA" means the Protection of Personal Information Act 4 of 2013; "Regulator" means the Information Regulator; "Republic" means the Republic of South Africa.
2. Purpose of this manual
This manual helps you to:
- see which of our records are available without a request;
- understand how to request a record from us;
- find the records we keep under other laws;
- contact our Information Officer;
- find the Regulator's Guide on how to use PAIA;
- know how we process personal information: for what purpose, about whom, who receives it, whether it leaves the Republic, and how we protect it.
3. Key contact details
| Company | Correntum (Pty) Ltd, registration number 2026/683805/07. It makes Timeslot Business |
|---|---|
| Head | Daniel Volschenk, chief executive officer |
| Information Officer | Daniel Volschenk, chief executive officer |
| Directors | Daniel Volschenk (chief executive officer), Marcel Zur (chief operating officer), Tom Papesch (chief technology officer) |
| privacy@timeslotbusiness.com | |
| Phone | +27 72 388 0408 |
| Fax | We do not use a fax |
| Street address | 1236 Val de Vie Boulevard, Paarl, Western Cape, 7646 |
| Postal address | The same as the street address |
| Website | timeslotbusiness.com |
4. The Regulator's Guide on how to use PAIA
4.1 The Regulator has updated and made available the Guide on how to use PAIA, under section 10(1) of PAIA. The English Guide is at https://inforegulator.org.za/wp-content/uploads/2020/07/PAIA-Guide-English_20210905.pdf, and the Regulator's PAIA page is https://inforegulator.org.za/paia/.
4.2 The Guide explains, among other things, the objects of PAIA and POPIA, how to make a request, the help the Regulator offers, and the remedies available, including a complaint to the Regulator and an application to court.
4.3 You may inspect a copy of the Guide at our office during normal business hours, in English and Afrikaans.
5. Records available without a request
Correntum has not published a notice under section 52(2) of PAIA. These records are on our website, and you do not need to make a request for them:
- our privacy policy, at timeslotbusiness.com/privacy;
- how to delete your information, at timeslotbusiness.com/data-deletion;
- this manual, at timeslotbusiness.com/paia.
6. Records available under other legislation
We keep records under these laws, where they apply to us:
- the Companies Act 71 of 2008;
- the Income Tax Act 58 of 1962 and the Tax Administration Act 28 of 2011;
- the Value-Added Tax Act 89 of 1991, if we register for VAT;
- the Consumer Protection Act 68 of 2008;
- the Electronic Communications and Transactions Act 25 of 2002;
- the Protection of Personal Information Act 4 of 2013;
- the Promotion of Access to Information Act 2 of 2000.
7. Subjects on which we hold records, and the categories of records
| Subject | Categories of records |
|---|---|
| Company | Incorporation and CIPC records; Memorandum of Incorporation; directors' records and resolutions; the appointment and registration of our Information Officer |
| Finance | Accounting records; invoices to our customers; bank and tax records |
| Customers | The accounts and business profiles of businesses that use Timeslot Business; their services, hours and bookings; our correspondence with them; agreements with them |
| Customers' clients (held as operator) | Clients' names, phone numbers and bookings, held on behalf of each business, which controls them |
| Suppliers | Our accounts with, and the terms of, Vercel, Supabase, Postmark and Zoho |
| Compliance | Versions of our privacy policy; PAIA and POPIA requests and our replies; security incident records; records of account erasures |
| Product | System logs, encrypted backups and the change history of our software |
8. How we process personal information
8.1 Purposes
- To provide the Timeslot Business app to businesses: accounts, sign-in, business profiles, services, working hours and bookings.
- To send account emails: email confirmation, password resets and the notice that an account has been deleted.
- To protect the service: limits on repeated sign-in attempts, checks of new passwords against lists of leaked passwords, and server logs.
- To erase accounts on request, and keep proof that we did.
- To invoice our customers. We make invoices by hand and email them.
- To handle clients' information on behalf of the businesses that use the app, as their operator, only on their instructions.
- To answer emails and requests.
8.2 Data subjects and their personal information
| Data subjects | Personal information |
|---|---|
| Businesses that use Timeslot Business, and their owners | Name, email address and password (stored only as a hash); business name, type, town, province, address, description and specialties; services, prices, working hours and booking rules; records of email confirmation, password resets and deletion requests; a hashed network address and email address for sign-in limits; invoices and payments; emails they send us |
| Clients of those businesses | Name and phone number, and bookings (service, date, time, status and changes), as the business enters them. For a health practice, this can be information about a person's health. For a client under 18, it is a child's information |
| Parents and guardians of clients under 18 | Name and contact details, as the booking contact |
| People who email us | Email address, name and what they write |
| Visitors to our website | Network address, in our hosting company's short-lived request records |
| Directors | Names, contact details and identity numbers in company records |
| People whose accounts were erased | Internal ID numbers and dates |
8.3 Recipients
- Vercel: runs our servers and our website.
- Supabase: hosts our database. It contracts with us through Supabase Pte. Ltd. in Singapore.
- Postmark: sends our emails to businesses. It receives the owner's email address, name and the text of the email, never clients' information.
- Zoho Mail: holds our support and privacy mailboxes, including requests from clients, and the invoices we email. Zoho's group companies in India also process this information.
- The business that added a client: that client's information.
- A court, the police or a regulator, when a law requires it.
When a password is chosen, the Pwned Passwords service of Have I Been Pwned receives the first 5 characters of a scrambled form of it, and nothing that identifies the person.
8.4 Planned transborder flows
- United Kingdom: our servers (Vercel, London) and our database (Supabase, London).
- United States: Vercel is a United States company, and its terms allow it to process information in the United States and other countries where it operates. Postmark and Zoho Mail store information in the United States. Supabase's contracting company is in Singapore, and Zoho's group companies in India also process information.
- Worldwide: our website's pages are delivered from Vercel's network around the world.
- Our backups stay in South Africa.
We update this manual before we use any new recipient or country.
8.5 General description of our security measures
- Passwords are stored only as a strong one-way hash. They must be at least 15 characters and are checked against lists of common and leaked passwords.
- Sign-in sessions are signed and can be revoked. One-time links are stored only as hashes and expire quickly.
- Repeated sign-in, sign-up, password reset and email confirmation attempts are limited.
- Each business can reach only its own information in the app. Features not used in the pilot are switched off.
- Database access is restricted: the database's public data interface is switched off, and row level security is on for every table.
- Information travels over encrypted connections.
- Backups are encrypted, and access to the key is limited to authorised people.
- Access to our hosting and database accounts is limited to our directors.
9. How to request access to a record
9.1 Use a form that corresponds substantially with Form 2 of Annexure A to the PAIA Regulations, addressed to our Information Officer, and send it to privacy@timeslotbusiness.com or to our street address.
9.2 We will decide on your request and tell you as soon as reasonably possible, and in any event within 30 days (PAIA section 56(1)). PAIA allows us to extend this once, by up to 30 days, in the cases section 57 sets out. We will tell you if we do.
9.3 We charge only the fees the PAIA Regulations prescribe. We charge nothing for a request about your own personal information, as our privacy policy says.
9.4 We may refuse access only on the grounds in Chapter 4 of Part 3 of PAIA, for example to protect another person's privacy or confidential commercial information. If you disagree with our decision, you may complain to the Regulator within 180 days of it, or apply to a court (PAIA sections 77A and 78).
9.5 If you ask for a client's records that we hold for a business as its operator, the business is responsible for them. We pass your request to the business promptly, normally within 2 business days, and help it answer.
9.6 Where a record about a person's physical or mental health was provided by a health practitioner, PAIA section 61 may apply.
9.7 You can also use your rights under POPIA, as our privacy policy explains.
10. Availability and updating of this manual
10.1 This manual is available on our website at timeslotbusiness.com/paia; at our office for inspection during normal business hours; to anyone on request, for the fee the PAIA Regulations prescribe for a copy; and to the Regulator on request.
10.2 Our head updates this manual regularly, and before we switch on WhatsApp, the booking assistant or push notifications.
Issued by Daniel Volschenk, chief executive officer, Correntum (Pty) Ltd. Date: 21 October 2026.