PAIA Manual

This is the manual of RMexpertise Consultants (Pty) Ltd, which runs Karii, under section 51 of the Promotion of Access to Information Act, 2000 (PAIA). It says how to reach us, what records we hold, how to ask for them, and how we process personal information under the Protection of Personal Information Act, 2013 (POPIA). It applies to records of the company, including Karii.

• Company: RMexpertise Consultants (Pty) Ltd, registration number 2011/002770/07
• Head of the company and Information Officer: Arend Cornelius de Waal (Director), registered with the Information Regulator, number 2026-068995
• Deputy Information Officer: Maryna Magdalena de Waal
• Street address: D'Stellen Estate No. 20, Bredell Rd, Cape Town, 7130
• Postal address: D'Stellen Estate No. 20, Bredell Rd, Cape Town, 7130
• Phone: 067 081 0180
• Fax: none
• Email: privacy@karii.ai
• Website: karii.ai

The Information Regulator has published a guide on how to use PAIA, under section 10 of PAIA. It is available in every official language from the Regulator’s website, inforegulator.org.za/paia, and from our Information Officer on request. A copy in English and Afrikaans is available for inspection, free of charge, at our street address during normal office hours. You can also ask the Regulator for it:

• Information Regulator (South Africa)
• Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg 2191
• P.O. Box 31533, Braamfontein, Johannesburg 2017
• Phone: 010 023 5200
• Enquiries: enquiries@inforegulator.org.za
• PAIA complaints: PAIAComplaints@inforegulator.org.za
• POPIA complaints: POPIAComplaints@inforegulator.org.za

Our latest notice of the categories of records you can have without a request, under section 52(1) of PAIA, is dated 16 October 2026: karii.ai/paia/notice. These records are on this website for anyone to read, with no request needed: our Privacy Policy, our Terms of Use, this manual, the notice and the public pages of karii.ai. If you use Karii, Settings → Export everything gives you your own personal information at any time, free of charge.

• Companies Act 71 of 2008: Memorandum of incorporation, registers of directors and shareholders, minutes and resolutions, annual financial statements
• Basic Conditions of Employment Act 75 of 1997 and Labour Relations Act 66 of 1995: Employment contracts, records of time worked and pay, and leave records
• Income Tax Act 58 of 1962 and Tax Administration Act 28 of 2011: Accounting records, invoices, payment records and tax returns
• Value-Added Tax Act 89 of 1991: Tax invoices and VAT records
• Electronic Communications and Transactions Act 25 of 2002: Records of electronic transactions with users
• Consumer Protection Act 68 of 2008: Records of purchases by consumers
• Protection of Personal Information Act 4 of 2013: Records of consent, requests from data subjects, operator agreements and security compromises
• Promotion of Access to Information Act 2 of 2000: This manual and records of requests for access

• The company: Incorporation documents, registers of directors and shareholders, minutes and resolutions, and agreements the company has entered into.
• Finance and tax: Accounting records, bank statements, invoices, payment records and tax returns.
• Employees: Employment contracts, pay and tax records, and leave records.
• Karii users: Account and profile details, CVs, jobs and applications, documents Karii writes for users, mock-interview recordings, transcripts and scores, conversations with Kāi, payment records, records of consent and age confirmation, problem reports, and records of exports, sign-in email change requests and account deletions.
• Programmes that pay for users’ access: Agreements, the codes issued, and the reports given to each programme.
• Service providers and suppliers: Agreements, including data processing agreements, invoices and correspondence.
• People named in interview briefs: The published information about their professional role that the privacy policy describes, and, if they object to being named, their name, and the company if they give one, on our objection list.
• Systems and security: Usage logs, error reports, records of exports, account deletions and sign-in email change requests, and records of any security compromise.

Why we process it. To run Karii for its users: reviewing and improving CVs, tailoring applications, researching companies, running mock interviews, Kāi’s conversations, payments, keeping the free tools free and stopping abuse, reporting to a programme that pays for a user’s access, answering problem reports and requests, and keeping Karii secure and working. Our Privacy Policy gives the legal basis for each. We also process our employees’ information to employ and pay them and to meet our duties as an employer, including tax; their employment agreements cover it.

Whose information, and what kind. Karii users: contact and profile details, CVs (which can hold special personal information, processed with the user’s consent), job and application records, recordings and transcripts of mock interviews, conversations with Kāi, payment records, and technical and usage records. People named in what users add, such as referees and recruiters: names, job titles and contact details. People named in interview briefs: published information about their professional role, and, if they object to being named, their name, and the company if they give one, on our objection list. Contacts at programmes and suppliers: names and business contact details. Our employees: contact details, employment contracts, and pay, tax and leave records.

Who receives it. Our service providers, each only for the job the Privacy Policy names: Anthropic, Deepgram, Twilio, Supabase, Vercel, Resend, Paystack, Sentry, Xneelo, Google. A programme that pays for a user’s access receives that user’s name and one status, and totals for the group. Otherwise, users’ information goes to anyone else only where a law requires it or the user asks us to.

Information sent outside South Africa. We send personal information to service providers that process it outside South Africa: Anthropic, United States; Deepgram, United States; Twilio, United States; Supabase, European Union (Germany); Vercel, United States; Resend, European Union (Ireland) and United States; Paystack, South Africa and European Union (Ireland); Sentry, European Union (Germany); Google, any country where Google or the providers it uses have facilities. The Privacy Policy gives the basis for each transfer under section 72 of POPIA.

How we keep it secure. Encryption in transit (TLS) and at rest; row-level security, so each account can read only its own data; column-level permissions on what an account can change; private file storage, where each account reaches only its own folder; restricted access to production systems; keyed one-way hashes instead of network addresses, and of email addresses and cellphone numbers where a record must outlive an account; scheduled deletion of what we no longer need; and no card details held. If a security compromise affects personal information, we tell the Information Regulator and the people affected as soon as reasonably possible, as section 22 of POPIA requires.

Send a request for access on the form prescribed in the PAIA Regulations, which you can get from the Regulator’s website or from us, to our Information Officer by email to privacy@karii.ai or by post to D'Stellen Estate No. 20, Bredell Rd, Cape Town, 7130. Describe the record well enough for us to find it, say how you would like to receive it, and, if you are asking on someone else’s behalf, show that you may.

A request for your own personal information carries no request fee. For other records, the fees prescribed in the PAIA Regulations may apply, and we tell you the amount before we do the work. We decide within 30 days of receiving the request, or tell you within that time if PAIA allows us to extend it, and why. If we refuse, we give the reasons. If you disagree with our decision, you may complain to the Information Regulator or apply to a court, as the Regulator’s guide explains.

On this page, free of charge; at our street address during business hours; from our Information Officer on request; and to the Information Regulator on request. We review it at least once a year and whenever what it describes changes.