Manual in terms of Section 51 of the Promotion of Access to Information Act 2 of 2000 (PAIA), read together with the Protection of Personal Information Act 4 of 2013 (POPIA)
1.1 This Manual is published by Moonlighter Group (Pty) Ltd ("Moonlighter Group", "the Company", "we" or "us") in accordance with section 51 of the Promotion of Access to Information Act 2 of 2000 ("PAIA"), which requires every private body to compile a manual describing the records it holds and how a person may request access to those records.
1.2 PAIA gives effect to the constitutional right of access to information held by another person, entrenched in section 32 of the Constitution of the Republic of South Africa, 1996, which provides that everyone has the right of access to any information held by another person that is required for the exercise or protection of any rights.
1.3 This Manual also addresses, where relevant, the disclosure obligations under the Protection of Personal Information Act 4 of 2013 ("POPIA"), which amended PAIA to align South Africa's access-to-information and data-protection frameworks, including the requirement in POPIA section 51 read with PAIA section 51 to describe the categories of Personal Information processed by the Company.
1.4 This Manual applies to Moonlighter Group and to the digital platforms it operates, including HealthGrid Africa, Alternivite, and SME Business OS.
2.1 The South African Human Rights Commission ("SAHRC") has, in terms of section 10 of PAIA, published a guide containing information reasonably required by a person wishing to exercise a right of access to information contemplated in PAIA, including the manner and form in which a request for access should be made.
2.2 The SAHRC guide is available from the South African Human Rights Commission at:
| Physical Address | Braampark Forum 3, 33 Hoofd Street, Braamfontein, Johannesburg, 2001 |
| Postal Address | Private Bag 2700, Houghton, 2041 |
| Telephone | (011) 877 3600 |
| Website | www.sahrc.org.za |
3.1 In accordance with section 51(1)(a) of PAIA, the details of the head of the private body (the Information Officer) are as follows:
| Private Body | Moonlighter Group (Pty) Ltd, Registration No. 2013/139783/07 |
| Head of the Private Body / Information Officer | Nompumelelo Maseko |
| Postal Address | 158 Vlas Street, Doornpoort, Pretoria, Gauteng, South Africa |
| Physical Address | 158 Vlas Street, Doornpoort, Pretoria, Gauteng, South Africa |
| Telephone | 081 481 6068 or 081 298 3194 |
| mpumi@moonlightergroup.co.za |
4.1 PAIA affords any requester the right to request access to records held by Moonlighter Group, subject to the grounds for refusal set out in Chapter 4 of Part 3 of PAIA (in respect of private bodies).
4.2 A distinction is drawn between a request for a requester's own Personal Information (which is generally facilitated in accordance with POPIA's access provisions in section 23, in addition to PAIA), and a request for other records, which follows the formal PAIA request process described in section 8 of this Manual.
5.1 Certain records held by Moonlighter Group are also available to specific requesters under other legislation without the need for a formal PAIA request, including:
6.1 In accordance with section 51(1)(d) of PAIA, the table below describes the general subjects on which Moonlighter Group holds records, and the general categories of records held on each subject. Not all categories of records listed are available automatically; access is subject to the grounds for refusal in PAIA and, where applicable, POPIA.
| Subject | Categories of Records |
|---|---|
| Corporate and governance records | Certificate of incorporation, MOI, shareholder and directors' resolutions, company policies, register of members |
| Financial records | Annual financial statements, management accounts, tax returns, VAT records, banking records, audit reports |
| Human resources records | Employee contracts, payroll records, leave and disciplinary records, recruitment records, employment equity records |
| Client and contractual records | Client agreements, service level agreements, tender and bid submissions, correspondence with clients including government and parastatal entities |
| Platform user records | Account registration data, authentication logs, subscription and billing history, support correspondence, usage and analytics data |
| Special Personal Information (health) | Patient and clinical records processed within HealthGrid Africa on behalf of healthcare provider clients, held as operator under data processing agreements |
| Compliance and regulatory records | FICA client due-diligence documentation, POPIA compliance documentation, data processing agreements, security policies, breach registers |
| Intellectual property records | Software source code, technical architecture documentation, joint IP and commercialisation agreements (including the Moonlighter Group / Infinity End Concepts arrangement), trademarks |
| Marketing and communications records | Website content, marketing materials, podcast-related content, social media records |
7.1 In accordance with the amendments made to PAIA by POPIA, and read together with our Privacy Policy, Moonlighter Group processes the categories of Personal Information described in the table below.
| Category of Data Subject | Categories of Personal Information | Purpose |
|---|---|---|
| Platform users / clients | Name, contact details, billing information, authentication data, usage data | Account administration, service delivery, billing, support |
| Employees and job applicants | Identity, contact, financial, employment history, performance and disciplinary records | Employment administration and statutory compliance |
| Patients (via healthcare provider clients on HealthGrid Africa) | Clinical, diagnostic, demographic, and identifying health information (Special Personal Information) | Enabling health interoperability and clinical decision-support on behalf of healthcare provider clients, as operator |
| Suppliers and service providers | Contact and banking details, contractual information | Procurement and payment administration |
| Website and marketing contacts | Name, email, engagement data | Communications and, where consented, direct marketing |
7.2 Further detail regarding the purpose, legal basis, retention, and cross-border transfer of Personal Information is set out in Moonlighter Group's Privacy Policy, available on the relevant Platform.
8.1 A requester wishing to obtain access to a record held by Moonlighter Group must complete the prescribed request form (Form 2 under the PAIA Regulations, or such other form as prescribed by the Information Regulator from time to time), and submit it, together with any prescribed fee, to the Information Officer using the contact details in clause 3.
8.2 The request must provide sufficient detail to enable the Information Officer to identify the record and the requester, the form of access required, and, if the request is made on behalf of another person, proof of the requester's authority to act on that person's behalf.
8.3 In accordance with section 56 of PAIA and the applicable Regulations, a requester may be required to pay a prescribed request fee, and, if the request is granted, an access fee reflecting the reasonable cost of reproduction and search and preparation time. A requester seeking access to their own Personal Information for the exercise or protection of a right may qualify for a reduced or waived fee in appropriate circumstances.
8.4 Moonlighter Group will respond to a request within 30 days of receipt, as required by section 56 of PAIA, unless this period is extended in accordance with section 57 of PAIA (for example, where the request requires a search through a large volume of records, or consultation with a third party is necessary), in which case the requester will be notified in writing of the extension and the reasons for it.
8.5 Where a request for access is refused, in whole or in part, the Information Officer will provide adequate reasons for the refusal, including the relevant provision of PAIA relied upon, in accordance with section 56(3) of PAIA.
9.1 Access to a record may be refused where a mandatory or discretionary ground for refusal set out in Chapter 4 of Part 3 of PAIA applies, including, among others, protection of the Personal Information of a third party (section 63), protection of certain confidential commercial information of a third party (section 68), protection of records privileged from production in legal proceedings (section 67), protection of the safety of individuals and property (section 71), protection of research information (section 70), and mandatory protection of the commercial information of the private body itself where disclosure would likely cause harm (section 68), among other grounds.
9.2 Where a ground for refusal applies only to part of a record, Moonlighter Group will, wherever reasonably practicable, sever that part and grant access to the remainder of the record, in accordance with section 61 of PAIA.
10.1 A requester who is dissatisfied with a decision of the Information Officer, including a refusal of access, a decision on fees, or an extension of the time period for response, may lodge an internal appeal (where applicable) or apply to the Information Regulator or a court for appropriate relief, in accordance with Part 4 (sections 74 to 78) of PAIA, within the time periods prescribed.
10.2 The contact details of the Information Regulator are set out in clause 11 below.
11.1 The Information Regulator of South Africa oversees compliance with both PAIA and POPIA and may be contacted as follows:
| Website | www.justice.gov.za/inforeg |
| General Enquiries | inforeg@justice.gov.za |
| PAIA-related Enquiries | PAIAComplaints@inforegulator.org.za |
| POPIA Complaints | complaints.IR@justice.gov.za |
| Physical Address | JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001 |
12.1 In accordance with section 51 of PAIA, this Manual is made available on Moonlighter Group's website(s) and relevant Platforms, and a copy may be requested free of charge from the Information Officer using the contact details in clause 3.
12.2 This Manual will be reviewed periodically and updated to reflect changes in Moonlighter Group's operations, record-holding practices, or applicable law.