PAIA Manual

PAIA Manual — Alder-Ash

Prepared in terms of section 51 of the Promotion of Access to Information Act 2 of 2000 (PAIA), as amended

Last updated: August 2026

Part A — Introduction

The Promotion of Access to Information Act 2 of 2000 (PAIA) gives effect to the constitutional right of access to information held by private bodies where that information is required for the exercise or protection of any right.

This Manual is published in accordance with section 51 of PAIA and the Information Regulator's guidance for private bodies.

Part B — Contact and Entity Details

Name of private body: Shaun Janse van Vuuren trading as Alder-Ash
Legal status: Natural person / sole proprietor
Registration number: Not applicable
Physical address: 317 Albertus Street, Pretoria, Gauteng, 0184, South Africa
Address for service of legal documents: 317 Albertus Street, Pretoria, Gauteng, 0184, South Africa
Postal address: Same as physical address
Telephone: 061 864 8944
Email: support@alderash.co.za
Website: https://alderash.co.za
VAT registered: No

Part C — Information Officer

As the head of the private body, Shaun Janse van Vuuren is the Information Officer of Alder-Ash by virtue of his position, for the purposes of PAIA and POPIA.

Shaun Janse van Vuuren is registered with the Information Regulator as Alder-Ash's Information Officer.

Information Officer: Shaun Janse van Vuuren
Email: support@alderash.co.za
Telephone: 061 864 8944
Deputy Information Officer: Not applicable

The Information Officer is responsible for:

  • Encouraging compliance with PAIA and POPIA within Alder-Ash
  • Dealing with requests for access to records
  • Working with the Information Regulator in relation to investigations

Part D — Access to Records — How to Submit a Request

Any person wishing to request access to records held by Alder-Ash must submit a completed Form 2 — Request for Access to Record [Regulation 7] to the Information Officer at the address or email above.

The current prescribed Form 2 is available from the Information Regulator at www.inforegulator.org.za.

The prescribed request fee (if any) and access fee must be paid as required under the PAIA Regulations. Current prescribed fees are set by the Information Regulator and are available at www.inforegulator.org.za.

Alder-Ash will respond to a valid PAIA request within 30 days of receipt, unless an extension is granted in accordance with PAIA.

Part E — Records Available Without Formal PAIA Request

The following information is available on our website without a formal PAIA request:

Part F — Categories of Records Held

Alder-Ash holds records in the following categories, to the extent applicable to its operations:

Customer and order records

  • Customer contact and delivery details
  • Order history and transaction records
  • Customer communications and support enquiries

Financial records

  • Invoices, receipts and payment records
  • Supplier and procurement records
  • Tax and accounting records

Operational records

  • Supplier agreements and correspondence
  • Courier and logistics records
  • Inventory records

Employee records

  • Alder-Ash currently has no employees. The business is operated personally by the sole proprietor.

Website and marketing records

  • Website analytics data (via Shopify)
  • Email marketing records and consent logs
  • Abandoned cart and transactional email records

Compliance records

  • This PAIA Manual
  • POPIA compliance documentation
  • Information Officer registration records

Part G — Applicable Legislation

Alder-Ash's operations are subject to, among others, the following legislation:

  • Promotion of Access to Information Act 2 of 2000 (PAIA)
  • Protection of Personal Information Act 4 of 2013 (POPIA)
  • Electronic Communications and Transactions Act 25 of 2002 (ECTA)
  • Consumer Protection Act 68 of 2008 (CPA)
  • Income Tax Act 58 of 1962

Part H — POPIA Processing Details

Categories of data subjects whose personal information is processed:

  • Customers and prospective customers
  • Website visitors
  • Suppliers and service providers

Categories of personal information processed:

  • Contact details (name, email, telephone, address)
  • Transaction and order information
  • Browsing and device data (via cookies and Shopify analytics)
  • Payment-related information (processed by Yoco)
  • Communication records

Purpose of processing:

  • Order fulfilment and delivery
  • Customer communication and support
  • Marketing (in accordance with POPIA section 69 and consent requirements)
  • Legal compliance
  • Business operations and record-keeping

Recipients / categories of recipients:

  • Shopify International Limited and relevant Shopify affiliates and service providers — ecommerce platform, hosting and related services
  • Yoco — payment processing
  • Aramex — courier/logistics services where used
  • The Courier Guy — courier/logistics services where used
  • Relevant customer communication providers where applicable

Part I — Cross-Border Information Flows

Alder-Ash sells and delivers products only within South Africa and does not offer international shipping.

Certain technology and other service providers used by Alder-Ash may process or store personal information outside South Africa as part of providing their services. Shopify may process customer personal information internationally, including in Singapore and Canada, and Alder-Ash's Shopify contracting entity is based in Ireland.

Where personal information is transferred outside South Africa, Alder-Ash will handle such transfers in accordance with section 72 of POPIA and applicable safeguards.

This cross-border processing relates solely to data infrastructure and service-provider operations and does not mean that Alder-Ash conducts cross-border sales or customer fulfilment.

Part J — Security Measures

Alder-Ash takes reasonable technical and organisational measures to protect personal information against loss, damage, unauthorised access, interference, modification, or disclosure. These include:

  • Hosting on Shopify's platform, which maintains industry-standard security
  • Access to customer data is limited to the proprietor
  • Use of Yoco for payment processing so that full card details are not received or stored by Alder-Ash directly

No security measure is infallible. In the event of a security compromise that is likely to affect data subjects, Alder-Ash will notify the Information Regulator and affected data subjects as required by POPIA.

Part K — PAIA Request Forms

The prescribed Form 2 — Request for Access to Record [Regulation 7] for PAIA access requests is available from the Information Regulator at www.inforegulator.org.za.

Completed forms should be submitted to the Information Officer at:
Email: support@alderash.co.za
Address: 317 Albertus Street, Pretoria, Gauteng, 0184, South Africa

Part L — Updates to This Manual

This Manual will be updated as required by law or when material changes occur to Alder-Ash's operations or processing activities. The current version will be made available on our website.