PAIA manual
The manual the Promotion of Access to Information Act 2 of 2000 requires of BC Mobile Technologies (Pty) Ltd, which operates Ledgr: what records we hold, how to ask for them, and who answers.
Introduction
This manual is published by BC Mobile Technologies (Pty) Ltd (registration number 2026/115023/07), trading as Ledgr ("we"), under section 51 of PAIA. It tells you what records we hold, how to ask for them, and how we process personal information under POPIA.
Date of this manual: 27 September 2026 · Next review: 27 September 2027
Contact details (section 51(1)(a))
Scroll the table sideways to see every column.
| Head of the private body | Andrew Ian Cameron, Director |
|---|---|
| Information Officer | Andrew Ian Cameron — andrew@bcmobiletech.co.za — +27 60 525 9508 |
| Deputy Information Officer(s) | None designated |
| Postal address | 46A Hillside Crescent, Capri, Western Cape, 7959 |
| Street address | 46A Hillside Crescent, Willowwood Estate, Capri, Western Cape, 7959 |
| Website | www.ledgrsa.com |
The Regulator's guide (section 51(1)(b))
The Information Regulator publishes a guide on how to use PAIA. It is available from the Regulator at inforegulator.org.za, in every official language, and on request from our Information Officer.
Records available without a request (section 51(1)(c))
- Our Terms (www.ledgrsa.com/terms/), Privacy notice (/privacy/), Security & POPIA page
(/security/), prices (/pricing/) and product documentation (/docs/).
Records kept under other legislation (section 51(1)(d))
The company keeps records in terms of, among others: the Companies Act 71 of 2008; the Income Tax Act 58 of 1962; the Value-Added Tax Act 89 of 1991; the Tax Administration Act 28 of 2011; the Basic Conditions of Employment Act 75 of 1997; the Labour Relations Act 66 of 1995; the Unemployment Insurance Act 63 of 2001; the Compensation for Occupational Injuries and Diseases Act 130 of 1993; the Electronic Communications and Transactions Act 25 of 2002; and the Protection of Personal Information Act 4 of 2013.
Categories of records we hold (section 51(1)(e))
Scroll the table sideways to see every column.
| Subject | Records |
|---|---|
| Company | Incorporation documents, statutory registers, minutes |
| Finance and tax | Our own accounting records, invoices, VAT and income-tax records |
| Personnel | Employment contracts, payroll, leave, tax certificates |
| Customers | Account and subscription records; licence orders; support correspondence |
| Customers' own books | The records each customer keeps in Ledgr (their invoices, contacts, employees, ledger, uploaded files). We hold these as the customer's operator, not as their owner — a request for them is usually one to make to that customer. |
| Suppliers and operators | Contracts and correspondence with the operators listed in section 7 below |
| IT and security | Access and audit logs, backups |
Processing of personal information (section 51(1)(c) as amended by POPIA)
Purpose. To provide the Ledgr service a customer subscribes to; to bill for it; to support customers; to meet our own legal obligations; to secure the service.
Categories of data subjects and information.
- Customers' users: name, email address, password (stored as a salted hash), role, sign-in and
audit events.
- People in a customer's books (the customer's own customers, suppliers and employees): whatever
the customer records — which can include ID numbers, bank details, salaries and tax numbers. We process these on the customer's instruction.
- Prospects: what they submit through forms on the website (e.g. the accountant partner
application: practice name, contact name, email, phone, professional body and membership number).
Recipients (operators). Google Cloud (hosting, database, file storage and backups — South Africa, Johannesburg); Mailjet (email — European Union); Yoco (our checkout; and a customer's own card payments where they connect it — South Africa); PayFast (a customer's own card payments where connected — South Africa); Investec (bank feed, where a customer connects it — South Africa); Firebase Cloud Messaging (push notifications, where enabled — outside South Africa); WhatsApp Business Platform / Meta (messages, where enabled — outside South Africa); Google Maps (map tiles for the logistics module, fetched through our server — outside South Africa).
Cross-border transfers. Email (Mailjet, EU), push notifications and WhatsApp messages leave South Africa as described above, under section 72 of POPIA: the recipients are bound by law or agreement to protection substantially similar to POPIA's (for the European Union, the GDPR), and each transfer is necessary to perform our agreement with the customer.
Security measures. Described on www.ledgrsa.com/security/ — encryption in transit, tenant isolation enforced in the application and by the database, two-factor authentication, an audit trail, and backups. No third-party certification is claimed.
Retention. When a subscription ends and is not renewed, the account becomes read-only; once closed, uploaded files and in-app backups are deleted and every user's name, email and password are erased; the records typed into the books are retained, closed off from use but not erased, for at least the five years the Tax Administration Act 28 of 2011 requires for records behind a return, and after that until the customer asks for the personal information in them to be destroyed (as our privacy notice describes).
How to request access (section 51(1)(e)–(f))
- Complete Form 2 (Request for access to a record of a private body), available from the Regulator's website or from our Information Officer.
- Send it to the Information Officer at andrew@bcmobiletech.co.za, with proof of identity and, where you act for someone else, proof of authority.
- Pay the prescribed request fee of R140.00 (PAIA Regulations, 2021, Annexure B); an access fee may follow if the request is granted.
- We respond within 30 days (extendable once by up to 30 days, with reasons).
Requests for a customer's own books are referred to that customer, who controls them.
Grounds for refusal
As set out in Chapter 4 of Part 3 of PAIA (e.g. protection of third parties' personal information, commercial information, confidential information, safety of individuals and property, privileged records).
Remedies
If a request is refused, you may complain to the Information Regulator within 180 days, or apply to a court. Information Regulator: Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191 · enquiries@inforegulator.org.za · PAIA complaints: PAIAComplaints@inforegulator.org.za · 010 023 5200 · inforegulator.org.za/ (verified against the Regulator's contact page on 27 September 2026).
Availability of this manual
Published at www.ledgrsa.com/paia/ and available free of charge from the Information Officer.