PAIA manual

1. The body and its Information Officer

2. The Regulator's guide on how to use PAIA

The Information Regulator has published a guide, in terms of section 10 of PAIA, on how to exercise the rights the Act gives you. It explains what you may ask for, from whom, and what to do if you are refused. It is available from the Regulator free of charge, in each official language, at inforegulator.org.za or on request from the Regulator at enquiries@inforegulator.org.za. We are not the publisher of that guide and cannot amend it.

3. Notice under section 52(2)

No notice has been published for this body describing categories of records that are automatically available without a request. The records listed in section 4 below are nonetheless published on this website and need no request.

4. Records already available, without a request

These are on the website and may be read, saved or printed by anyone at any time:

• the auction rules and terms of use;
• the privacy notice, which says what personal information we hold and why;
• the operator's identifying particulars on Who runs Aviara;
• lots offered on an auction, their descriptions, photographs and results, and the public profiles and ratings of members who have concluded a sale;
• this manual.

5. Records held, by category

Listing a category here does not mean a record in it will be given out. It means it exists and can be asked for, and the request will be decided under PAIA. Most of these contain another person's personal information, which is a ground for refusal under section 63.

6. Personal information we process

Why we process it. To operate the auction a member has asked to take part in; to run the Trades board, where a member asks for birds and other members offer them; to introduce a buyer and a seller once a sale is concluded so they can complete it; to invoice and collect our commission; to maintain the seller reputation the platform depends on; to send auction reminders to members who have asked for them; and to meet our obligations under tax, company and conservation law.

Whose information. Members of the platform, in their capacity as sellers, bidders and buyers. We do not knowingly collect information about children, and the platform is for adults.

Who it is given to. The other party to a concluded sale, who receives the contact details needed to arrange payment and collection; our email delivery provider; our payment processor, for commission invoices paid online; our cloud backup provider; our business email provider; and any authority acting within its powers where the law requires disclosure. We do not sell, rent or trade personal information.

Information that leaves South Africa. The database is backed up nightly, encrypted, to cloud storage in the Netherlands, which is subject to data protection law the Act treats as comparable to our own. Our email providers handle the messages we send, and are bound by their agreements with us to protect what we send them. Everything else is held on a server in South Africa.

How it is kept safe. The site is served only over HTTPS. Passwords are stored as one-way hashes that nobody here can read, and changing a password signs every other device out. Administrative functions are separated from member functions and are available only to the auctioneer. Sign-in and other sensitive endpoints are rate limited. The server is firewalled to the ports the site needs. Backups are encrypted at rest and held off the server. While a lot is being sold, members are not identified to one another, which limits what any one member can learn about another.

7. How to request a record

1. Use the request form prescribed in the PAIA Regulations, which is available from the Information Regulator at inforegulator.org.za. A letter that contains the same information will also be accepted.
2. Send it to the Information Officer at the address or email address in section 1 above.
3. Give enough detail to identify the record and to let us find you: what you want, the form you want it in, and how to reach you.
4. Say which right you are seeking to exercise or protect, and why the record is required for it. The Act requires this, and a request that does not say it must be refused.
5. Pay the fees prescribed in the Regulations. A request fee may be payable before the request is considered, and an access fee for the time spent searching, copying and sending the record. The amounts are set by regulation and change from time to time; we will tell you what is payable, and the current schedule is published by the Regulator. A request for your own personal information carries no request fee.

We will decide within 30 days of receiving a complete request, and tell you in writing. That period may be extended in the circumstances the Act allows, and we will tell you if it is.

8. When a request may be refused

PAIA sets out the grounds, and a private body must refuse on some of them. The ones most likely to arise here:

• the record contains someone else's personal information — which covers most of what this platform holds, because almost every record is about a member;
• it would reveal another person's confidential commercial information, including a reserve price or trading history;
• it is protected by legal privilege, or its disclosure would prejudice legal proceedings;
• the request is manifestly frivolous or vexatious.

9. If we refuse

There is no internal appeal against the decision of a private body. You may complain to the Information Regulator, or apply to a court, within the periods the Act allows. Our refusal will say which ground we relied on and tell you this. The Regulator's details are at inforegulator.org.za.

10. This manual

It is available on this page, free of charge; at our address in section 1, for inspection during business hours; and to the Information Regulator on request. It is reviewed when what we hold or how we hold it changes, and the version on this page is always the current one.