POPIA & PAIA Manual

1. Introduction to Data Sanctuary

Data Sanctuary provides enterprise-grade, isolated offsite backup and storage infrastructure strictly within the borders of South Africa. This manual is published to assist requesters in understanding the records held by our organization and the procedures to follow when requesting access to such records.

2. Company Contact Details

• Registered Address: Western Cape, South Africa
• Email Address: hello@datasanctuary.co.za
• Website: https://datasanctuary.co.za

3. The Information Regulator

The Information Regulator has updated the guide on how to use PAIA. Any queries regarding this guide should be directed to the Information Regulator:

• Address: JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001
• Email: inforeg@justice.gov.za / enquiries@inforegulator.org.za
• Website: https://inforegulator.org.za

4. Records Held by Data Sanctuary

We maintain the following categories of records in accordance with South African law. Please note that recording a category does not imply that a request for access will automatically be granted.

4.1. Corporate & Administrative Records

• Company registration and statutory documents
• Service Level Agreements (SLAs) and Privacy Contracts
• Financial and accounting records

4.2. Client Infrastructure Records

CRITICAL NOTE: Data Sanctuary operates strictly on a zero-knowledge or isolated-access architecture. We provision the underlying Virtual Machines, LXC containers, and storage blocks (S3/NextCloud/UrBackup). We do not have application-level or encryption-key access to the contents of the data our clients choose to back up.

• Client contact and billing information
• Infrastructure provisioning logs (Storage size, VPN configurations)
• Support and lead-generation correspondence

5. Processing of Personal Information (POPIA)

Data Sanctuary processes personal information solely for the provisioning of IT infrastructure, security maintenance, and client communication. We strictly prohibit the unauthorized transborder flow of personal information. All primary storage nodes and backup instances remain within South Africa.

6. Information Security Measures

To ensure the confidentiality and integrity of data, we employ:

• Encrypted VPN tunnels for all client data transit.
• Strict isolation of client environments (no shared storage pools).
• Role-based access controls to the hypervisor and bare-metal management layers.

7. Request Procedure

To request access to a record, the requester must complete the prescribed Form C (available from the Information Regulator) and submit it to the Information Officer via email. The requester must provide sufficient detail to enable the Information Officer to identify the record and the requester. Prescribed fees as regulated by PAIA may apply.