MaH Quests Enterprises (Pty) Ltd · Manual prepared in terms of section 51 of the Promotion of Access to Information Act 2 of 2000 (PAIA) and the Protection of Personal Information Act 4 of 2013 (POPIA) · Version 1.0, October 2026
1. Purpose of this manual
PAIA gives everyone the right to request records held by a private body where the record is needed to exercise or protect a right. This manual tells you what records MaH Quests Enterprises (Pty) Ltd (“MaH Quests”, “we”) holds, how to ask for them, what it costs and what you can do if a request is refused. It also describes how we process personal information under POPIA.
2. Company and Information Officer details
| Item | Details |
|---|---|
| Company | MaH Quests Enterprises (Pty) Ltd, a private company |
| Head of the private body | Nomfazwe Mohono, Managing Director |
| Information Officer | Thato Mohono |
| Physical address | Times Square Building, Building 1, Floor 1, 11 Pieter Street, Highveld Techno Park, Centurion, 0169 |
| Telephone | +27 12 844 0021 / +27 87 153 5183 |
| info@mahquests.co.za (mark the subject “PAIA request”) | |
| Website | https://mahquests.co.za |
3. Guide on how to use PAIA and POPIA
The Information Regulator has published a Guide on how to use PAIA and POPIA, as required by section 10 of PAIA. It explains your rights and the remedies available. You can get it from the Information Regulator, or ask our Information Officer for a copy (Form 01) in any official language. The Guide is available for inspection at our offices during business hours.
| Information Regulator | |
|---|---|
| Physical address | Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191 |
| Postal address | P.O. Box 31533, Braamfontein, Johannesburg, 2017 |
| Telephone | +27 10 023 5200 · toll-free 0800 017 160 |
| General enquiries | enquiries@inforegulator.org.za |
| PAIA complaints | PAIAComplaints@inforegulator.org.za |
| Website | https://inforegulator.org.za |
4. Records available without a formal request
The following records are freely available and do not need a PAIA request (section 52 of PAIA):
- Information published on this website, including our services, case studies, partner credentials, privacy notice and this manual.
- Product brochures, company profiles and marketing material we publish.
- Press releases and public announcements.
5. Records kept in terms of other legislation
We keep records as required by, among others, the following laws. Where a law makes a record available to the public, it can be requested under that law or under PAIA.
- Basic Conditions of Employment Act 75 of 1997
- Broad-Based Black Economic Empowerment Act 53 of 2003
- Companies Act 71 of 2008
- Compensation for Occupational Injuries and Diseases Act 130 of 1993
- Electronic Communications and Transactions Act 25 of 2002
- Employment Equity Act 55 of 1998
- Income Tax Act 58 of 1962 and Tax Administration Act 28 of 2011
- Labour Relations Act 66 of 1995
- Occupational Health and Safety Act 85 of 1993
- Promotion of Access to Information Act 2 of 2000
- Protection of Personal Information Act 4 of 2013
- Skills Development Act 97 of 1998 and Skills Development Levies Act 9 of 1999
- Unemployment Insurance Act 63 of 2001 and Unemployment Insurance Contributions Act 4 of 2002
- Value-Added Tax Act 89 of 1991
6. Subjects and categories of records we hold
| Subject | Categories of records |
|---|---|
| Company and governance | Incorporation documents, memorandum of incorporation, share register, directors’ records, minutes and resolutions, B-BBEE certificates, statutory returns |
| Finance and tax | Annual financial statements, accounting records, invoices, bank records, tax and VAT returns, tax compliance status |
| Human resources | Employment contracts, personnel files, payroll and leave records, skills development and training records, employment equity reports, disciplinary records |
| Clients and projects | Proposals, contracts, statements of work, project documentation, support tickets, correspondence, client account records |
| Training and learners | Enrolment records, attendance registers, assessments, portfolios of evidence, certificates, accreditation records |
| Suppliers and partners | Supplier and partner agreements, partner programme records, purchase orders, supplier due-diligence records |
| Information technology | System and security logs, IT policies, software licences, architecture and configuration documentation, backup records |
| Marketing and website | Website enquiries, marketing consents, event registrations, published content |
7. Processing of personal information (POPIA)
7.1 Purpose of processing
- Delivering our services: cloud engineering, software development, managed support, training and the CloudPOE platform.
- Entering into and managing contracts with clients, suppliers and partners.
- Employment, payroll and staff development.
- Enrolling, training, assessing and certifying learners, and reporting to accreditation and funding bodies where required.
- Responding to enquiries and, with consent, sending relevant information about our services.
- Meeting legal, tax, regulatory and audit obligations.
- Keeping our systems, premises and information secure.
7.2 Categories of data subjects and their personal information
| Data subjects | Personal information processed |
|---|---|
| Clients and prospective clients (individuals and contact people at organisations) | Names, job titles, contact details, organisation details, correspondence, contract and billing information |
| Employees, contractors and job applicants | Identity number, contact details, qualifications, employment history, banking and tax details, remuneration, leave, performance and, where the law requires, demographic information for employment equity |
| Learners and training candidates | Identity number, contact details, qualifications, attendance, assessment results, portfolio of evidence, demographic information required by accreditation and funding bodies |
| Suppliers, partners and service providers | Company details, contact people, banking details, B-BBEE and tax information, contracts |
| Website visitors | Information submitted through the contact form; IP address and browser information recorded by our web server for security |
7.3 Recipients of personal information
- Our employees and contractors who need it to do their work, under confidentiality obligations.
- Service providers who host our systems, email and website, and our professional advisers and auditors.
- Accreditation, quality assurance and funding bodies (such as QCTO, SETAs and professional bodies) for learner records, where required.
- SARS, regulators, courts and law enforcement where the law requires it.
- Clients, where a project requires us to share team or delivery information, and only to the extent needed.
7.4 Transborder flows
Some of our cloud service providers, such as Amazon Web Services and Microsoft, may store or process information outside South Africa. We transfer personal information across borders only where section 72 of POPIA allows it, for example where the recipient is bound by laws, binding corporate rules or an agreement that gives an adequate level of protection, or with the data subject’s consent. Where possible we host client workloads in the AWS Africa (Cape Town) Region.
7.5 Security measures
- Access control based on role and least privilege, with multi-factor authentication on key systems.
- Encryption of data in transit and, where supported, at rest.
- Regular backups, patching and monitoring of our systems.
- Confidentiality obligations in employment and supplier contracts.
- Security architecture aligned with the AWS Well-Architected Framework.
- A process for managing and reporting security compromises to the Information Regulator and affected data subjects, as required by section 22 of POPIA.
8. How to request access to a record
- Complete Form 02: Request for Access to Record, available from the Information Regulator’s PAIA forms page or from our Information Officer.
- Send it to our Information Officer by email to info@mahquests.co.za or by hand to our physical address.
- Give enough detail to identify the record, say how you want to receive it, and explain which right you want to exercise or protect and why the record is needed.
- If you are asking on behalf of someone else, include proof of your authority to act for them.
- Pay the request fee, unless you are asking for your own personal information.
- We will decide within 30 days and tell you the outcome on Form 03. We may extend this once by up to 30 days and will tell you why. If a third party is affected, we will notify them and consider their representations first.
If you want to access or correct your own personal information, you can also use the POPIA forms published by the Information Regulator. There is no charge for confirming whether we hold your personal information.
9. Fees
Fees are set by the regulations under PAIA. Access fees are payable only if access is granted. If the search and preparation is expected to take more than six hours, we may ask for a deposit of one third of the access fee, which is refunded if access is refused.
| Item | Fee |
|---|---|
| Request fee (not payable by a personal requester) | R140.00 |
| Photocopy or printed copy of an A4 page | R2.00 per page |
| Copy on a flash drive supplied by the requester | R40.00 |
| Copy on a compact disc supplied by the requester / supplied by us | R40.00 / R60.00 |
| Transcription of an audio record | R24.00 per A4 page |
| Copy or transcription of visual images | As quoted by the service provider |
| Search and preparation, per hour or part of an hour after the first hour | R145.00, up to R435.00 in total |
| Postage, email or other electronic transfer | Actual cost |
10. Grounds for refusal
PAIA requires or allows us to refuse access in certain cases, including to protect:
- the privacy of a third party who is a natural person (section 63);
- the commercial information of a third party or of MaH Quests (sections 64 and 68);
- confidential information of a third party (section 65);
- the safety of individuals and the protection of property (section 66);
- records privileged from production in legal proceedings (section 67);
- research information (section 69).
We will grant access despite these grounds where the record would reveal a serious contravention of the law or an imminent and serious public safety or environmental risk, and the public interest clearly outweighs the harm (section 70).
11. Remedies
MaH Quests has no internal appeal procedure. If your request is refused, or you are unhappy with the fees, an extension or the form of access, you may within 180 days lodge a complaint with the Information Regulator (Form 05) or apply to a court with jurisdiction.
12. Availability and updating of this manual
This manual is available on our website and for inspection at our offices during business hours, free of charge. A copy will be given to the Information Regulator on request. We review it at least once a year and whenever our records or processing change.
Approved by Nomfazwe Mohono, Managing Director, MaH Quests Enterprises (Pty) Ltd. Version 1.0, October 2026.