PAIA Manual
Prepared in terms of section 51 of the Promotion of Access to Information Act 2 of 2000, as amended
Date of compilation: 10 June 2026
Date of revision: 10 June 2026
TABLE OF CONTENTS
- List of Acronyms and Abbreviations
- Purpose of PAIA Manual
- Key Contact Details for Access to Information
- Guide on How to Use PAIA and How to Obtain Access to the Guide
- Categories of Records Available Without a Formal Request
- Records Available in Accordance with Other Legislation
- Subjects on Which the Body Holds Records and Categories of Records
- Processing of Personal Information
- Availability of the Manual
- Updating of the Manual
1. LIST OF ACRONYMS AND ABBREVIATIONS
1.1 CIPC — Companies and Intellectual Property Commission
1.2 DIO — Deputy Information Officer
1.3 IO — Information Officer
1.4 PAIA — Promotion of Access to Information Act 2 of 2000, as amended
1.5 POPIA — Protection of Personal Information Act 4 of 2013
1.6 Regulator — Information Regulator (South Africa)
1.7 Republic — Republic of South Africa
1.8 SARS — South African Revenue Service
1.9 VAT — Value-Added Tax
2. PURPOSE OF PAIA MANUAL
This Manual is intended to enable members of the public to:
2.1 identify categories of records held by Morz Group (Pty) Ltd. that are available without a formal PAIA request;
2.2 understand the subjects on which the company holds records and the categories of records held on each subject;
2.3 identify records created or held in accordance with other South African legislation;
2.4 obtain the contact details of the Information Officer responsible for assisting with access to records;
2.5 understand the Guide on how to use PAIA and POPIA issued by the Information Regulator and how to obtain it;
2.6 understand the purposes for which Morz Group processes personal information and the categories of data subjects and personal information concerned;
2.7 identify recipients or categories of recipients to whom personal information may be supplied;
2.8 identify planned cross-border processing or transfers of personal information; and
2.9 understand the general security measures used to protect personal information.
3. KEY CONTACT DETAILS FOR ACCESS TO INFORMATION
3.1 Information Officer
Email: privacy@morzgroup.com
3.2 General access-to-information contact
Email: privacy@morzgroup.com
4. GUIDE ON HOW TO USE PAIA AND HOW TO OBTAIN ACCESS TO THE GUIDE
4.1 The Information Regulator has made available a revised Guide on how to use PAIA. The Guide is intended to assist any person who wishes to exercise rights under PAIA or POPIA.
4.2 The Guide addresses, among other things:
- the objects of PAIA and POPIA;
- contact details for Information Officers and Deputy Information Officers;
- the manner and form of requests for access to records;
- assistance available from Information Officers and the Regulator;
- remedies available for an act or failure to act under PAIA or POPIA;
- PAIA manuals and voluntarily available records;
- prescribed fees; and
- the applicable regulations.
4.3 The Guide is available from the Information Regulator in the official languages and in Braille in the formats provided by the Regulator. It can be obtained through the Regulator’s PAIA resources or requested from the Regulator.
4.4 Requests for access to a record of Morz Group must be made using the prescribed Form 2 — Request for Access to Record, submitted to the Information Officer. For a private body, the requester must identify the right that the requested record is required to exercise or protect and explain why access to the record is required for that purpose, subject to PAIA.
4.5 If a PAIA request is refused or is not responded to within the applicable period, the requester may use the remedies provided by PAIA, including a complaint to the Information Regulator and, where applicable, court proceedings. A private body does not have the statutory internal-appeal process that applies to certain public bodies.
5. CATEGORIES OF RECORDS AVAILABLE WITHOUT A FORMAL REQUEST
The following records are generally intended to be available without a formal PAIA request, subject to confidentiality, personal-information and legal restrictions:
| Category | Examples | How available |
|---|---|---|
| Corporate information | Legal name, registration number, VAT number, address and contact details | Website / on request |
| Public legal documents | Terms of Use, Privacy Policies, Legal Notice | Product websites / applications |
| Product information | Public descriptions of Ground School, Flight Briefing, Flight Tools and No Bad Surprises | Product websites / applications |
| Support information | Public support and privacy contact details | Websites / applications |
| PAIA Manual | Current PAIA Manual | Website / on request |
The availability of a record in a category does not make confidential, proprietary, personal or third-party information contained in other records automatically available.
6. RECORDS AVAILABLE IN ACCORDANCE WITH OTHER LEGISLATION
Morz Group may create or hold records in accordance with legislation including:
| Category of records | Applicable legislation |
|---|---|
| Corporate records, Memorandum of Incorporation, director/shareholder records | Companies Act 71 of 2008 |
| Accounting, tax and VAT records | Income Tax Act 58 of 1962; Value-Added Tax Act 89 of 1991; Tax Administration Act 28 of 2011; Companies Act 71 of 2008, as applicable |
| Employment and payroll records, where applicable | Basic Conditions of Employment Act 75 of 1997; Labour Relations Act 66 of 1995; Employment Equity Act 55 of 1998; Unemployment Insurance legislation, as applicable |
| Occupational health and safety records, where applicable | Occupational Health and Safety Act 85 of 1993 |
| Personal-information and privacy-compliance records | Protection of Personal Information Act 4 of 2013 |
| Access-to-information records and this Manual | Promotion of Access to Information Act 2 of 2000 |
| Electronic transaction records, where Morz Group is the electronic supplier | Electronic Communications and Transactions Act 25 of 2002 |
| Consumer-service records, where applicable | Consumer Protection Act 68 of 2008 |
Access remains subject to PAIA and any other applicable confidentiality or statutory restrictions.
7. SUBJECTS ON WHICH MORZ GROUP HOLDS RECORDS AND CATEGORIES OF RECORDS
| Subject | Categories of records |
|---|---|
| Corporate governance | CIPC records; Memorandum of Incorporation; director/shareholder records; resolutions; statutory registers; policies |
| Finance and accounting | Invoices; receipts; accounting records; budgets; payout records; transaction records; tax and VAT records |
| Legal and compliance | Contracts; terms; privacy policies; PAIA/POPIA records; complaints; legal correspondence; compliance assessments |
| Human resources, where applicable | Recruitment records; employment agreements; payroll; leave; performance and disciplinary records |
| Customers and users | Account/contact details; entitlements; support communications; service usage and progress data, depending on the product |
| Ground School | Accounts; entitlements and subscription information; School Account customer, administrator, quotation, order, invoice and user-allocation records; course access; progress; mock-exam results; question submissions; support records |
| Flight Briefing | Technical/support records; analytics/performance records where enabled; records relating to the configuration of aviation-data queries |
| Flight Tools | Technical/support records; analytics/performance records where enabled; product configuration records |
| No Bad Surprises | Accounts; wish-list content; sharing/claim information; support records; technical/analytics records |
| Suppliers and service providers | Contracts; contact details; invoices; tax/VAT information; security and service records |
| Information technology and security | Access logs; security logs; incident records; error/performance records; administrative records |
| Marketing and communications | Website content; communications preferences; campaign records where applicable |
| Intellectual property | Software; source materials; designs; branding; educational content; licences and related records |
8. PROCESSING OF PERSONAL INFORMATION
8.1 Purpose of processing
Morz Group processes personal information for purposes including:
- providing and administering products and services;
- creating and managing user accounts;
- verifying purchase entitlements and administering access;
- providing customer and technical support;
- maintaining service security, reliability and performance;
- providing progress and performance functionality;
- improving products and educational content;
- administering question submissions and related programmes;
- handling enquiries and communications;
- complying with tax, accounting, corporate and regulatory obligations;
- preventing fraud, abuse and unauthorised access; and
- establishing, exercising or defending legal rights.
8.2 Categories of data subjects and information
| Data subject | Personal information that may be processed |
|---|---|
| Ground School users | Name; email; account/authentication data; entitlement and subscription references; progress; mock-exam results; question submissions; support data; technical data |
| Ground School School Account customers and administrators | Organisation and business details; administrator names/contact details; quotations; orders; invoices; payment status; user-allocation and entitlement information |
| No Bad Surprises users | Name; email; account/authentication data; wish-list content; sharing and claim information; support data; technical data |
| Flight Briefing users | Device/technical information; analytics data where enabled; support data; location/query information where the relevant feature is used |
| Flight Tools users | Device/technical information; analytics data where enabled; support data |
| Website visitors | IP address; device/browser information; session and analytics information where applicable |
| Support requesters | Name; email; enquiry content; support history; relevant technical information |
| Suppliers/service providers | Names; business contact details; company/registration/VAT details; payment/banking details where required |
| Employees/prospective employees, where applicable | Identification/contact information; employment information; qualifications; payroll and statutory information |
| Directors/officers | Identification and corporate information required for governance and regulatory purposes |
Special personal information and information of children will be processed only where POPIA permits the relevant processing.
8.3 Recipients or categories of recipients
| Category of personal information | Recipients / categories of recipients |
|---|---|
| Ground School purchase, payment and entitlement information | PayFast where used for payment processing; FastSpring where used as Merchant of Record; relevant internal service systems; accounting/professional advisers where necessary |
| Account, application and technical information | Microsoft Azure and other infrastructure providers; New Relic where used |
| Analytics information | Google Analytics where enabled |
| Support/contact information | Zoho and relevant support personnel |
| Flight Briefing query information | aviationweather.gov when the user invokes the relevant feature |
| Corporate, tax and accounting information | SARS, CIPC, auditors/accountants and professional advisers where required |
| Information required by law | Courts, regulators, law-enforcement or other authorities where disclosure is authorised or required |
FastSpring acts as Merchant of Record for transactions routed through it and may act independently for processing it determines for that role. PayFast provides payment-processing services and may process information both as a service provider to Morz Group and for its own security, fraud-prevention, legal and regulatory purposes. Other service providers may act as operators for Morz Group.
8.4 Planned transborder flows
Morz Group uses service providers that may process information outside South Africa. Current known flows include:
| Provider / category | Country or region | Information categories potentially involved |
|---|---|---|
| PayFast / relevant group or service-provider arrangements | South Africa and other locations as applicable to PayFast’s group/service-provider processing | Payment and transaction information |
| FastSpring | United States and/or other provider locations | Purchase, customer, order, entitlement and transaction information |
| Google Analytics | Outside South Africa, including United States infrastructure depending on configuration | Device, identifier and usage/analytics information |
| New Relic | Outside South Africa, including United States infrastructure depending on configuration | Technical, performance and error information |
| Zoho | India, EU and/or other configured provider regions | Contact, CRM and support information |
| Microsoft Azure | Depends on the current configured region(s) and may include processing outside South Africa | Account, application, database and technical information depending on system configuration |
| aviationweather.gov | United States | Device IP address and weather/NOTAM query parameters when used |
Where Morz Group transfers personal information to a third party outside South Africa, the transfer is managed in accordance with section 72 of POPIA.
8.5 Information-security measures
Morz Group uses reasonable technical and organisational safeguards appropriate to the systems concerned. Measures in current product documentation include:
- HTTPS/TLS encryption for data in transit;
- hashed storage of account passwords;
- authentication and access controls;
- restriction of access on a need-to-know basis;
- security, error and operational logging where appropriate;
- cloud-provider security controls;
- backups and recovery arrangements where appropriate;
- incident-response procedures; and
- review of third-party processing and security arrangements.
The exact controls differ by system and must be verified against production configuration before publication of this Manual.
9. AVAILABILITY OF THE MANUAL
9.1 A copy of this Manual will be available:
9.1.1 on the Morz Group website: https://morzgroup.com/paia-manual/
9.1.2 to any person on request, subject to any prescribed fee permitted by PAIA and the Regulations; and
9.1.3 to the Information Regulator upon request.
9.2 Any fee for copying or access will be dealt with in accordance with the fees prescribed under PAIA and the applicable Regulations.
10. UPDATING OF THE MANUAL
Morz Group (Pty) Ltd. will review this Manual regularly and update it when necessary, including when there is a material change to its records, processing activities, contact details or legal obligations.
ISSUED BY
Information Officer
Morz Group (Pty) Ltd.