PAIA manual

1. About the body and contacts

This manual applies to the private body identified below and to records under its possession or control in carrying out its activities. The website presents STEM programmes, educational technology, teacher development and member services. A brand name does not by itself identify a separate responsible party.

PAIA Guide

The Information Regulator publishes a section 10 Guide explaining PAIA and POPIA, access procedures, fees, assistance and remedies. It is available through the Regulator's PAIA resources. Regulation 3 requires the body to make the Guide available for inspection at its head office in at least two official languages. Copies can be requested from the Information Officer for inspection during the hours above. The official Guide is available electronically in English and Afrikaans.

Abbreviations: PAIA - Promotion of Access to Information Act; POPIA - Protection of Personal Information Act; IO - Information Officer; DIO - Deputy Information Officer.

2. Public and statutory records

2.1 Records available without a formal PAIA request

The following published material is freely available from the website. Public availability does not extend to private accounts, unpublished teaching submissions, personal information or confidential business records.

2.2 Records kept or accessible under other legislation

Where the body and its activities fall within the legislation below, relevant records may be held. A duty to keep a record does not make it open to everyone. Access follows that legislation and, where appropriate, PAIA.

3. Subjects and categories of records

The categories below cover the body's operations where records are held. A category describes a type of record; it does not confirm that a particular record exists or confer automatic access. Requests are assessed individually under PAIA.

The body is a STEM technology and training provider. This manual does not present it as a registered school or claim that it keeps school examination, medical or disciplinary files. A request may identify an additional record not expressly listed here.

4. Requests and applicable fees

4.1 Submit a request

Use the current prescribed PAIA Form 2, linked on page 10. Send it to the Information Officer by email, post or delivery using the contacts on page 2. Identify the record, yourself, your preferred access/response format, the right you seek to exercise or protect, and why the record is needed for that right. If acting for someone else, attach evidence of authority. Supply the identity evidence required by the form; contact the officer if you need a secure delivery method.

PAIA concerns existing recorded information, including electronic records. It does not generally require the body to answer a questionnaire or create a new report. General enquiries may be sent to hello@domino4.com without submitting Form 2. Contact the officer if disability or another barrier prevents completion of the form, so appropriate assistance can be arranged.

4.2 Fees

The officer will notify you of applicable fees, any deposit and how to pay before payment is required. Prescribed exemptions apply. Confirming under POPIA section 23 whether the body holds your personal information is free; copies may attract a prescribed fee. The table summarises the private-body tariff in Annexure B of the 2021 PAIA Regulations. The legally applicable tariff prevails if amended.

If access is refused, a deposit must be repaid. A record may be withheld pending payment of applicable access fees. Fee/deposit decisions can be challenged through the remedies on page 6. Downloading this manual and viewing the listed public website records is free.

5. Decisions and remedies

5.1 Response and timing

Subject to PAIA's third-party procedures, the officer will decide and notify you as soon as reasonably possible and within 30 calendar days after receipt of the request or the required particulars under section 53(2). Section 57 permits one extension of no more than 30 days on specified grounds, or with written consent. An extension notice must state the period, reasons and challenge procedure. Failure to decide within the applicable period is a deemed refusal.

If a record cannot be found or does not exist, the officer will provide the affidavit or affirmation required by section 55 describing the steps taken. Where required, third parties will be notified and given an opportunity to make representations. Their objections do not replace the statutory assessment.

5.2 Access, partial disclosure and refusal

Access to a private-body record depends on section 50: the record must be needed to exercise or protect a right, the procedural requirements must be met, and no applicable refusal ground may justify withholding it. The officer considers third-party privacy, commercial/confidential information, safety and property, legal privilege, commercial information of the body and research information under sections 63 to 69.

Accessible portions must be separated from protected material where reasonably possible. The mandatory public-interest override in section 70 must be considered where its tests are satisfied. A refusal notice gives adequate reasons, the statutory provisions relied on and the available remedies, without revealing protected contents. A grant notice explains the access format and fees.

5.3 Complaints and court remedies

There is no statutory internal appeal for this private body. You may ask the officer to clarify a decision, but that does not suspend statutory time limits. An aggrieved requester or third party may lodge a written complaint with the Information Regulator under section 77A, generally within 180 days of the relevant decision, including a deemed refusal. Use PAIA Form 5 and attach the request and correspondence.

Complaints: PAIAComplaints@inforegulator.org.za or the Regulator's eServices portal. Court relief is available under sections 78 to 82, subject to section 78(1), including exhaustion of the applicable complaints procedure, and the relevant 180-day period. Seek advice promptly on the appropriate remedy and deadline.

The Regulator: 010 023 5200; enquiries@inforegulator.org.za. Physical address: Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191. Verify current contact channels at inforegulator.org.za/contact-us.

6. Personal information and purposes

6.1 Purposes of processing

The body processes information to respond to enquiries, establish and administer accounts and school access, provide STEM products/resources and teacher-development programmes, manage support and contractual relationships, assess and certify participation where offered, and meet applicable legal obligations. Employment, supplier and transaction administration apply where those activities occur.

Security and access information supports authentication, permission management and protection of the service. Promotional communications and public use of identifiable images require an appropriate lawful basis and, where required, specific permission. A course enquiry or account registration does not itself authorise unrelated marketing.

6.2 Data subjects and information categories

Children's information is subject to POPIA sections 34 and 35. Processing requires an applicable statutory exception, commonly prior consent from a competent person. This manual does not grant permission to collect a child's information or replace any required school/guardian arrangements. Special personal information is subject to its additional statutory conditions.

7. Recipients and international processing

7.1 Recipients or categories of recipients

Personal information may be supplied only as necessary for an authorised purpose and on a lawful basis. Access by staff or school users must be limited to their responsibilities. The following categories apply where the associated service or relationship is used.

7.2 Planned transborder flows

The website/member infrastructure uses AWS services configured in the Cape Town region. Public website delivery uses a global content-delivery network; this is not a statement that all personal-information processing occurs only in South Africa. The website also links to Google Forms and external Shopify/MaxIQ shops.

AWS is the processing supplier identified by the body. Account and member services are configured in AWS Cape Town, South Africa. CloudFront uses a global edge network: connection and request information, such as IP addresses, may be processed at international edge locations outside South Africa. No additional planned international recipient has been identified by the body for this manual. External links to third-party form or shop destinations do not by themselves authorise MEDO to transfer personal information to those destinations.

Before personal information is transferred to a recipient outside South Africa, an applicable basis under POPIA section 72 must be established. This may include adequate protection through law, binding rules or an agreement, valid consent, or another applicable contractual/statutory basis. Additional prior-authorisation requirements may apply to certain transfers of children's or special personal information. The applicable notice must describe the actual transfer.

8. Safeguards, rights and availability

8.1 General security measures

The website configuration provides HTTPS-only access to member APIs, redirection from HTTP, a TLS 1.2 minimum and HSTS. Member services use secure session cookies, input validation, origin checking, permission checks and request-rate controls. Account authentication and school-role controls restrict access to member functions.

Measures to be implemented and maintained across the body include proportionate staff access, secure storage of paper/electronic records, confidentiality obligations and operator contracts, retention and secure disposal, backup/recovery arrangements, staff awareness, regular safeguard reviews and incident response. These descriptions are not a guarantee of absolute security or a claim that all operational measures have already been verified.

Where the POPIA section 22 threshold is met, the responsible party must notify the Regulator and affected data subjects as soon as reasonably possible, subject to the Act. Operators must immediately inform the responsible party of a qualifying compromise.

8.2 Personal-information rights

After appropriate identity verification, you may ask whether the body holds your personal information, request access, or seek correction/deletion or destruction where statutory grounds apply. You may object to processing on applicable grounds and withdraw consent where processing depends on consent. Withdrawal does not retrospectively invalidate lawful processing; deletion may be limited by lawful retention requirements.

Send requests to the officer on page 2. POPIA Forms 1 and 2 and complaint channels are available from the Regulator. This manual describes records and access procedures; the website privacy notice must provide the notices applicable to specific collection activities.

8.3 Availability and updating

This manual is available free in English and Afrikaans on domino4.com through Policies and terms, without a member login. It is also available for public inspection at the principal place of business during the hours on page 2, to any person upon request for a reasonable reproduction amount where applicable, and to the Information Regulator upon request.

The head of the body is responsible for regular updates, particularly when contact details, record categories, processing or legislation changes. The compilation/revision dates and version on the cover identify the current document.

Issued by: Judith Norah Sandrock | Managing Director | Information Officer
Issue status: Issued public manual.

9. Official forms and references

Use the current official forms. The links below are clickable in the electronic manual. Request forms are submitted to the body; complaint forms are submitted to the Information Regulator.

PAIA and POPIA prevail if this manual is inconsistent with them. Publication is an access-to-information measure and does not certify compliance with all legislation.