PAIA manual

1. Acronyms used

2. Purpose of this manual

This manual helps you to:

• see what categories of records we hold;
• understand how to ask for access to a record;
• know which records you can get without a formal request;
• see how we process personal information, why, and who receives it;
• find the contact details of our Information Officer.

3. About us

The Studio Hub Systems (Pty) Ltd (registration 2026/813997/07), trading as The Studio Hub, is a South African software company based in Centurion. We sell member management software to clubs. Our products are the Dojo Hub (martial arts) and the PT Hub (personal trainers). The Dance Hub and Gymnastics Hub are coming.

Important for club members. When you are a member of a club that uses our Hub, the club decides what is done with your data. The club is the responsible party. We process that data on the club's behalf as its operator (POPIA section 21). If you want access to your membership records, ask your club first, or use "Download my data" in your club's member app. We will help the club answer.

If you send us a PAIA request for records we hold only for a club, we tell you that within the normal time limits. With your agreement, we pass the request to the club, because the club decides about its own members' records. If you want us to decide it ourselves, we will. We then treat the club as a third party and consult it before we decide (PAIA section 71).

4. Key contact details

Information Officer: Brett Clarke, Director
Email: [email protected]
Phone and WhatsApp: 082 226 0215 (+27 82 226 0215)

Deputy Information Officer: none designated.

Head of the Company: Brett Clarke, Director

Information Regulator registration number of our Information Officer: pending.

Street and postal address: 120 Edison Crescent, Hennopspark, Centurion, 0172, South Africa
Phone: 082 226 0215
Email: [email protected]
Websites: thestudiohub.co.za, dojohub.co.za and pthub.co.za

5. The Regulator's Guide on how to use PAIA

The Regulator has updated and made available the revised Guide on how to use PAIA (the "Guide"), in an easily understandable form, as section 10 of PAIA requires. The Guide is meant to help anyone who wants to exercise a right under PAIA and POPIA.

The Guide explains, among other things:

• the objects of PAIA and POPIA;
• the postal and street address, phone number and email of the Information Officer of every public body, and every Deputy Information Officer of every public body;
• how to make a request for access to a record of a public or private body;
• the help available from the Information Officer and from the Regulator;
• the remedies available, including how to lodge a complaint with the Regulator and how to apply to court;
• the provisions of sections 14 and 51 that require public and private bodies to make manuals available, and how to get one;
• the notices issued under sections 22 and 54 about fees;
• the regulations made under section 92.

You can inspect or copy the Guide at our offices during normal working hours, or get a copy from the Regulator. You can also ask our Information Officer for a copy (PAIA Form 1, request for a copy of the Guide from an Information Officer).

The Guide is on the Regulator's website in English and the other official languages, at inforegulator.org.za/paia-guidelines. Direct link to the English version: PAIA Guide (English, PDF).

Information Regulator contact details (as at 4 November 2026):

• Website: inforegulator.org.za
• eServices portal: eservices.inforegulator.org.za
• General enquiries: [email protected]
• PAIA complaints: [email protected]
• POPIA complaints: [email protected]
• Phone: 010 023 5200. Toll free: 0800 017 160
• Physical address: Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191
• Postal address: P.O. Box 31533, Braamfontein, Johannesburg, 2017

6. Records you can get without asking (section 52)

We have not published a notice under section 52(2) of PAIA. These are available without a formal request, free of charge:

7. Records held under other laws

We keep records as required by the laws below, where they apply to us. This is not a complete list. Where a law gives a right of access, you can use it.

8. Records we hold

Being listed here does not mean a record will be released. Access is subject to the grounds of refusal in PAIA.

9. How we process personal information

Why we use it, for our own data (we are the responsible party):

• to sell our software and respond to enquiries and demo requests;
• to sign up, set up and support clubs;
• to bill clubs and keep financial records;
• to run and secure our websites, including bot checks and, only where you agree, advertising measurement (Meta pixel and Conversions API);
• to send direct marketing to people who agreed or who are existing customers, in line with POPIA section 69 and the 2025 amended Regulations (opt-out never counts as consent);
• to meet our legal duties (tax, company law, POPIA, PAIA);
• to employ and pay staff and contractors, where we have them.

Our lawful grounds are contract, legal duty, consent (marketing, the Meta pixel and advertising cookies) and legitimate interest under POPIA section 11(1)(f) (answering enquiries, keeping the service safe, and the demo builder, which uses a prospect club's public information). Where we rely on legitimate interest, we tell you and you may object.

Why we use it, for club data (we are the club's operator):

• to provide the Hub to each club: memberships, sign-ups and contracts, billing and debit orders, card and online payments, attendance and bookings, gradings, messaging (WhatsApp, email, push), member app, shop, the "Ask Dojo" AI office assistant, AI club onboarding, and club websites;
• to keep the Hub secure, backed up and working;
• to help clubs answer their members' requests and meet their own legal duties.

We only process club data on the club's instructions, under our Data Processing Agreement (Version 2026-11-04 (v1.0)). The club accepts it by ticking a box on the onboarding page. That acceptance is binding under the Electronic Communications and Transactions Act 25 of 2002 (sections 11, 13 and 22), so it is a written contract for POPIA section 21.

Whose information, and what

Who receives it

We share personal information only with the following, and only as needed:

Before we add or replace a sub-processor that processes club data, we email the club 30 days ahead and the club may object. The current list is on our sub-processors page.

Transfers across borders

• Our main database, file storage and sign-in run on Supabase in the AWS Paris region (France, European Union). Personal information of South African clubs and their members is therefore stored outside South Africa, in the EU.
• Some suppliers process data in the United States or globally (Twilio, Resend, Anthropic, Meta, GitHub, Cloudflare, push services).
• Backups: a daily encrypted (AES-256) database dump is kept for 30 days on the Company's own computer in South Africa. The newest 7 copies are also kept in a private GitHub repository (GitHub, United States), and they cannot be read without our key. Supabase keeps 7 days of its own backups in the EU.
• Cross-border transfers are governed by Data Processing Agreements with our US sub-processors that give an adequate level of data protection under section 72 of POPIA. Our EU database provider is bound by its own Data Processing Agreement in the same way. Because these binding agreements give adequate protection, no prior authorisation from the Regulator is needed for children's or health information (POPIA section 57(1)(d)). We also keep health notes away from the AI, and send each supplier only what a feature needs.
• South Africa has no EU adequacy decision. For a club in the EU, the EU Standard Contractual Clauses apply: Module 2 between the club and us, and Module 3 between us and our US providers. For the UK, the UK International Data Transfer Addendum applies. Before the first EU or UK club's data is loaded, we do the transfer impact assessment and appoint an EU and UK representative. There is no EU or UK club today.
• For clubs outside South Africa (for example Vietnam), data also moves to South Africa when we access it to support the club, and to the EU for storage. For member data, the Vietnamese club files the cross-border transfer dossier as controller, and we help. We file our own dossier for Vietnamese leads and club owners.

How we keep it safe

• Row Level Security on every database table, so each club sees only its own data. A security check is run after every database change.
• Secrets (keys for suppliers) are held in an encrypted vault.
• Bank accounts: only the last 4 digits are stored. Card details are never stored; providers give us a token.
• Data is encrypted in transit (HTTPS) and at rest by our hosting provider.
• Daily encrypted backups (AES-256), kept 30 days, with a tested restore.
• Sign-in by email code; bot checks on sign-in; staff roles limit what each staff member can see.
• Two-step sign-in for club owners and admins is being built. It is not live yet.
• Written data processing agreements with suppliers.
• A breach response plan and a breach register.
• A retention clean-up that deletes old leads and ex-member details on a schedule once a club switches it on.

10. How to ask for a record

1. Use the prescribed form. Complete Form 2 (Request for access to record) under regulation 7 of the PAIA Regulations, 2021. It is on the Regulator's PAIA forms page.
2. Send it to the Information Officer by email to [email protected], or deliver or post it to 120 Edison Crescent, Hennopspark, Centurion, 0172.
3. Give enough detail so we can find the record, say which form of access you want (copy, inspection, electronic), and how you want to be told of our decision.
4. Prove who you are. Include a copy of your ID. If you ask on behalf of someone else, include proof of your authority.
5. Say which right you are exercising or protecting and why you need the record (PAIA section 53).
6. Pay the fees in the table below. A request fee is payable before we process a request, unless you ask for your own personal information. An access fee may be payable for search, preparation and copies. We may ask for a deposit if the search will take long.
7. Our answer. We decide within 30 days of receiving a complete request. We may extend this once by up to 30 more days and will tell you why (PAIA sections 56 and 57).
8. Refusal. We may refuse on the grounds in Chapter 4 of Part 3 of PAIA (for example, to protect another person's privacy, commercial information of a third party, confidential information, or our own commercial information). If part of a record can be released, we will release that part. We will tell you the reasons.
9. Third parties. If a record contains a third party's information, we must tell them and give them a chance to object before we decide (PAIA section 71).
10. Remedies. There is no internal appeal against a private body. If you are not happy with our decision, you may lodge a complaint with the Regulator within 180 days of our decision (PAIA sections 77A and 77B), or apply to court (PAIA section 78). Complaints go through the eServices portal or to [email protected].

Fees

The prescribed fees for private bodies under the PAIA Regulations, 2021, as listed by the Regulator as at 4 November 2026 (source):

You may apply to court to set aside a fee or deposit.

Your own personal information

You may ask us, free of charge, to confirm whether we hold personal information about you (POPIA section 23). To get a copy of it, use Form 2 of the PAIA Regulations; no request fee applies, but an access fee may. To ask us to correct or delete it, use Form 2 of the POPIA Regulations (Request for correction or deletion of personal information), or simply email the Information Officer (POPIA section 24). We answer within 30 days. If you are a club member, ask your club or use the member app first (see section 3).

Objection to processing. You may object at any time to processing based on legitimate interest, and to direct marketing (POPIA section 11(3)). Use Form 1 of the POPIA Regulations (Objection to the processing of personal information), or email the Information Officer. The POPIA forms are on the Regulator's POPIA forms page.

Complaints to the Regulator. You may complain to the Regulator about how we process your personal information (POPIA section 74), on the eServices portal or to [email protected].

11. Where this manual is available

• on our websites at thestudiohub.co.za/paia and dojohub.co.za/paia;
• at our main place of business, 120 Edison Crescent, Hennopspark, Centurion, for public inspection during normal working hours;
• to the Regulator on request.

We email a copy free of charge. If you ask for a printed copy, we may charge the prescribed fee of R2.00 per A4 page.

12. Updating this manual

Our Information Officer reviews this manual at least once a year, and whenever our processing changes (for example a new supplier, a new country or a new product). Last reviewed: 4 November 2026.

Brett Clarke, Information Officer and Director, 4 November 2026.