PAIA & POPIA Manual

Last updated: 17 July 2026

This manual is published in terms of section 51 of the Promotion of Access to Information Act, 2000 (“PAIA”) and incorporates the processing information required by the Protection of Personal Information Act, 2013 (“POPIA”). It explains how to request access to records held by Experience Creator (Pty) Ltd, trading as EventStack ZA (“EventStack”), and how personal information is processed.

The private body

• Registered name: Experience Creator (Pty) Ltd
• Trading name: EventStack ZA
• Head of the private body / Information Officer: the director of Experience Creator (Pty) Ltd
• Location: Somerset West, Western Cape, South Africa
• Email: admin@eventstack.co.za
• Website: https://eventstack.co.za

The Information Regulator’s guide

A guide on how to use PAIA (section 10 of PAIA) is available from the Information Regulator (South Africa) at inforegulator.org.za in all official languages. Enquiries may be directed to the Regulator at enquiries@inforegulator.org.za.

Records we hold

• Company and financial records: incorporation and ownership records, accounting and tax records, bank records, invoices and statements.
• Customer and subscription records: customer company accounts, plans and add-ons, billing events and PayFast payment references.
• Platform records processed as operator: data that customer companies hold in the platform about their own clients and contacts: events, inventory, quotes, invoices, e-signature acceptance evidence, storefront enquiries and purchases, and CrossHire listings and requests.
• Marketing records: waitlist sign-ups (name, company, email, WhatsApp number, source).
• IT records: system logs, backups and security records.

Records automatically available without a PAIA request: this website, the Privacy Policy and the Terms of Service.

Records held under other legislation

Where applicable, records are kept in terms of the Companies Act 71 of 2008, the Income Tax Act 58 of 1962, the Value-Added Tax Act 89 of 1991, the Electronic Communications and Transactions Act 25 of 2002, the Consumer Protection Act 68 of 2008 and POPIA.

How to request access to a record

• Complete Form 2 (Request for Access to Record) available from the Information Regulator’s website, and send it to the Information Officer at admin@eventstack.co.za.
• Identify the record and, where required by PAIA, the right you seek to exercise or protect and why the record is needed for it, together with proof of identity.
• The prescribed request and access fees (Annexure B to the PAIA Regulations) may apply.
• Requests are decided within 30 days as required by PAIA. If access is refused, the grounds under Chapter 4 of Part 3 of PAIA will be given.

POPIA processing information

• Purpose of processing: providing the EventStack platform (inventory, events, quoting, invoicing, payments, storefront, CrossHire), billing, support, waitlist communications and legal compliance.
• Categories of data subjects and information: as set out in the Privacy Policy.
• Recipients: the sub-processors listed in the Privacy Policy (Supabase, Vercel, Resend, PayFast, Anthropic) and, where a company opts in, CrossHire network participants.
• Cross-border flows: some sub-processors process data outside South Africa, subject to the safeguards in section 72 of POPIA.
• Security measures: encryption in transit, tenant-isolated access via row-level security and restricted production access, as described in the Privacy Policy.

Availability of this manual

This manual is available free of charge at https://eventstack.co.za/paia and on request from the Information Officer at admin@eventstack.co.za.