PAIA manual
Download the PAIA manual (PDF)
Indico Group (Pty) Ltd. • Registration 2020/020444/07 • Trading as Atlas UI
Prepared under section 51 of the Promotion of Access to Information Act 2 of 2000 (PAIA). Version 1.0, issued 15 October 2026. This manual explains how to request records; it does not make all company records publicly accessible.
1. About the company and this manual
Indico Group (Pty) Ltd. is a South African private company that creates and manages websites and develops software, including Atlas UI. Atlas is a personalisable desktop interface for supported AI connections. This manual covers records held by Indico in these activities, including Atlas website enquiries, marketing subscriptions, customer access and support. It also describes the purposes and categories of personal-information processing required by PAIA and the Protection of Personal Information Act 4 of 2013 (POPIA).
PAIA gives a requester access to a private body's records where required to exercise or protect a right, subject to the Act's procedures and lawful grounds for refusal. POPIA provides additional rights concerning a person's own personal information. A record category listed here does not imply that every listed record exists for every person or that it will be disclosed without assessment.
2. Head of the company and Information Officer
Sole director, head and Information Officer: Jean-Jaques Martin Nel.
Information Officer registration: 2026-069409, registered with the Information Regulator on 15 October 2026. Registration is not a certification of every processing practice.
Privacy and PAIA email: info@atlas-ui.com. Put “PAIA request” or “Personal information request” in the subject to help route it; an omitted label does not invalidate an otherwise valid request.
Telephone: +27 83 605 0658.
Physical business office: Unit 51 Fernel Park Ridge, Olympus, Pretoria, Gauteng, 0081, South Africa.
Correspondence and address for legal notices: 659 Fenwick St, Moreletapark, Pretoria, Gauteng, 0181, South Africa.
Website: https://atlas-ui.com. Customer support: support@atlas-ui.com.
No Deputy Information Officer is currently designated for this manual. The Information Officer handles requests and assistance. Please arrange an appointment for inspection or delivery at the office so that the correct person and records are available. This does not replace lawful service at the stated legal-notices address.
3. The Information Regulator's guide
The Information Regulator publishes a guide explaining PAIA, POPIA access rights, how to obtain assistance, request procedures, fees, remedies and the functions of Information Officers. It is available through the Regulator's PAIA website and can be requested from the Regulator or our Information Officer. We will assist you to locate an appropriate language version or accessible format.
Regulator contact: enquiries@inforegulator.org.za; telephone 010 023 5200 or toll-free 0800 017 160. Website: https://inforegulator.org.za.
Physical address: Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191. Postal address: P.O. Box 31533, Braamfontein, 2017. Check the Regulator's contact page for current details before travelling or posting a document.
4. Records available without a formal PAIA request
The following published records are ordinarily available free on atlas-ui.com without proving a right or submitting Form 2:
- This PAIA manual and the website's privacy and cookie notices.
- Public product descriptions, features, pricing, promotional terms and launch information.
- Published terms of service/software licence, refund, cancellation and digital-delivery policies.
- Public company/contact information, support guidance, FAQs and published tutorials or updates.
- Marketing material that Indico has made public.
Customers may request ordinary assistance with their own orders, access links or support cases through support@atlas-ui.com. Reasonable identity checks may be needed. This service route does not replace PAIA or POPIA rights. Information that is not public is not automatically obtainable through an informal request. No claim is made that a section 52 voluntary-disclosure notice has been gazetted.
5. Subjects and categories of records held
| Subject | Examples of records, where held |
|---|---|
| Corporate governance | Incorporation and registration documents, company registers, director details, resolutions, statutory returns and governance correspondence |
| Finance and tax | Accounting records, invoices, banking and payment references, receipts, reconciliations, tax records and refund records |
| Customers and licences | Orders, purchase emails, accepted terms records, entitlement/device records, activation and download-request records, customer correspondence |
| Marketing and website | Waitlist and interest-list records, consent and unsubscribe records, limited campaign attribution, aggregate analytics, public content and advertising records |
| Support and communications | Enquiries, emails, submitted diagnostic information, attachments provided by correspondents, support notes and dispute records |
| Suppliers and clients | Service agreements, processor arrangements, project instructions, invoices, contact details and website-management records |
| Software and security | Product specifications, source code, design assets, release records, access-control records, incident records and appropriate system logs |
| People and administration | Director and contractor records; employment, payroll and related records if and when applicable |
| Legal and compliance | Contracts, complaints, privacy/access requests, regulatory correspondence and records subject to legal privilege |
Atlas desktop content retained only on a customer's computer is not automatically a record held by Indico. We will explain what we actually hold or control when responding. A customer connecting an external AI service does not mean that Indico possesses every conversation or file in that service. Client data managed under a service agreement may be processed on the client's instructions; we will consider our role and any lawful request to the relevant responsible party without using that arrangement to evade obligations.
6. Records held under other legislation
Depending on the activity and the records concerned, Indico holds records required by the Companies Act 71 of 2008; Income Tax Act 58 of 1962; Tax Administration Act 28 of 2011; Electronic Communications and Transactions Act 25 of 2002; Consumer Protection Act 68 of 2008; POPIA; and PAIA. Copyright, trade-mark and other intellectual-property records may also be held under applicable legislation.
Where employment or the relevant tax obligation applies, legislation such as the Basic Conditions of Employment Act 75 of 1997, Labour Relations Act 66 of 1995, Employment Equity Act 55 of 1998, unemployment insurance, compensation for occupational injuries and diseases, and skills-development legislation may require additional records. These references do not represent that Indico has employees or every listed statutory registration. Indico is not currently registered as a South African VAT vendor.
Listing legislation or a record does not override its confidentiality rules, PAIA's grounds for refusal or lawful access procedures. Statutory retention periods apply to the relevant record type.
7. Personal-information processing
Purposes
We process information to operate and secure websites; respond to enquiries; provide requested launch and availability communications; manage client and supplier relationships; deliver, license and support software; administer orders, refunds and accounting; prevent abuse; meet legal obligations; and manage complaints and legal claims. Optional advertising measurement is subject to the website choice described in the Cookie Notice. Marketing choices are separate from purchase acceptance.
Data subjects and information categories
| Data subjects | Information categories |
|---|---|
| Website visitors and subscribers | Browser/security and limited activity data, approximate country, campaign labels, email, selected list, consent and unsubscribe records |
| Purchasers and beta testers | Contact/order identifiers, optional names, payment status/references, licence and device identifiers, access-link and download records |
| People requesting support or records | Contact details, correspondence, relevant diagnostic or order data, submitted attachments and proportionate verification material |
| Client and supplier representatives | Business contact details, service instructions, contracts and financial/administrative records |
| Directors, contractors and staff where applicable | Identity, contact, contractual, statutory, financial and employment-related information relevant to the relationship |
| Individuals mentioned in submitted content | Information actually provided to us for the authorised purpose; unnecessary sensitive information should not be submitted |
Recipients and disclosures
Access is limited to authorised persons and service providers needing the information for the stated purpose. Categories include website/cloud hosting and storage providers; mailbox and email-delivery providers; payment providers, banks and accounting advisers; IT/security support; professional advisers; and regulators or courts where disclosure is lawfully required. Current services include Sites hosting using Cloudflare infrastructure, GoDaddy/Titan email and Paystack for payments when checkout is enabled. Optional advertising measurement uses Meta.
Customer-selected AI, voice and tool providers receive the material relevant to the functions the customer uses. Where Atlas support personnel use an approved assistance tool, only the information relevant to the support purpose should be supplied, subject to appropriate confidentiality and processing controls. We do not sell customer personal information as a contact list. Our Privacy Notice explains the differences between the public website, customer records and the desktop app.
Cross-border processing
Cloud, email, payment, advertising and connected AI providers may process information outside South Africa. Destinations depend on the service, its infrastructure and the customer's selected connection; this manual does not represent that all information stays in South Africa. Transfers must meet POPIA section 72, for example through adequate legal or binding contractual protection or another applicable statutory basis. We assess providers and transfer arrangements for the relevant processing and will provide available recipient and transfer information in response to a reasonable privacy request, subject to lawful restrictions. A customer's independent provider account also has that provider's terms and privacy settings.
General security measures
Measures appropriate to the processing include restricted administrative access, secure transport, protected credentials, hashed access/licence tokens, access expiry and verification, backups and recovery controls, proportionate abuse prevention and review of security incidents. Where operators process information for us, appropriate confidentiality and security obligations apply. Security is not a guarantee against every incident. We assess incidents and make notifications to the Regulator and affected persons where POPIA requires them. Do not send passwords, API keys or full card details with a request.
Retention and personal-information rights
We retain information only for its lawful purpose and required periods, with restrictions for legal holds, accounting and disputes. The Privacy Notice provides the operating retention approach. You may ask whether we hold your personal information, request access, correction or deletion, object where permitted and withdraw optional consent. POPIA requests do not always require the same proof of a separate right as a private-body PAIA request. Contact the Information Officer for assistance. Prescribed POPIA forms are available on the Regulator's website.
8. How to request access under PAIA
Use the prescribed Form 2 — Request for access to record and send it to the Information Officer by email or deliver/post it to the contact address above. A request should identify the requester and any person represented, provide a reply address, describe the records sufficiently to locate them, specify the desired form of access, identify the right to be exercised or protected and explain why the record is required for that right. If acting for another person, provide appropriate evidence of that authority.
We may ask for proportionate proof of identity or clarification necessary to locate the record or apply the law. Do not routinely send a full identity document or unrelated private records before we explain what is needed. If a disability, inability to read or write, or another accessibility barrier prevents a written form, contact us for assistance; an oral request can be reduced to writing with appropriate assistance. We will explain a material procedural deficiency and give reasonable assistance where required.
Submitting a request does not guarantee access. We assess whether PAIA's requirements are met, whether we hold the record, third-party notification requirements and any applicable grounds for refusal. Where only part is protected, we consider access to the remainder by severing the protected material. Applicable public-interest disclosure provisions are considered.
9. Fees, decisions and access
Fees are governed by the current PAIA regulations, not an arbitrary company tariff. A prescribed private-body request fee may apply to a requester other than a personal requester, subject to applicable exemptions. Confirming whether we hold your personal information under POPIA is free. Lawful access, reproduction, search or preparation fees may apply to supplying records; we will explain any applicable fee, estimate or deposit before requiring payment and explain the right to challenge it. No fee is demanded where the law provides an exemption.
The applicable schedule and forms can be obtained from the Information Regulator or our Information Officer. Form 3 is used for the outcome of a request and fees payable. Do not pay a fee to an unverified bank account supplied in a suspicious message.
We ordinarily notify you of the decision within 30 days of receiving the request in accordance with PAIA. A single extension of up to a further 30 days is permitted only on the Act's grounds; we must notify you within the original period with reasons and information about remedies. A failure to decide within the applicable period is treated as a refusal under PAIA; it is not an indefinite extension.
If access is granted, we explain the access form, applicable fees and arrangements. If refused, we give adequate reasons and the relevant provision, without revealing protected information, and explain remedies. Grounds can include protected third-party privacy, confidential commercial information, privilege and security, but are not blanket exemptions for every company record. If a record cannot be found or does not exist after reasonable searching, the applicable section 55 notice/affidavit procedure is followed. We do not claim records are absent merely to avoid assessment.
10. Remedies and complaints
Indico is a private body; PAIA's public-body internal-appeal process is not a prerequisite here. You may ask the Information Officer to reconsider or clarify a decision, but that does not suspend statutory complaint or court deadlines.
You may complain to the Information Regulator about a refusal, deemed refusal, fees, extension or form of access using Form 5, ordinarily within 180 days of the relevant decision or deemed refusal, subject to the Act and any permitted condonation. You may also seek the applicable court remedy within the prescribed period. The PAIA guide explains the available routes; obtain advice if a deadline is uncertain.
- PAIA complaints: PAIAComplaints@inforegulator.org.za.
- POPIA complaints: POPIAComplaints@inforegulator.org.za.
11. Availability and updates
This manual is available free at https://atlas-ui.com/paia as a webpage and downloadable PDF. A copy is available for inspection at the physical office during ordinary business hours by arrangement, and we will provide it to a person who requests it and to the Regulator as required. A lawful reproduction charge may apply to requested physical copies; free online inspection remains available. Assistance with an accessible format is available from the Information Officer.
The head of the company will review the manual at least annually and when material changes require it. This version is dated 15 October 2026. It should be read with the current Privacy Notice, without limiting any statutory right.
Email support@atlas-ui.com for purchase or product help. Privacy and records: info@atlas-ui.com.