PAIA manual
Version 1.0 · 25 October 2026. Prepared under section 51 of South Africa's Promotion of Access to Information Act 2 of 2000 ("PAIA"), as amended by the Protection of Personal Information Act 4 of 2013 ("POPIA").
1. What this manual is for
PAIA gives everyone the right to ask for records held by a private body when they need them to exercise or protect a right. This manual explains what records Clickety Bricks holds, how to ask for them and what it may cost. It also describes how we process personal information, as POPIA requires. Our privacy page gives the same information in more detail.
2. Our details
| Private body | Clickety Bricks (Pty) Ltd (registration with CIPC in progress) |
|---|---|
| Head of the private body and Information Officer | The director of Clickety Bricks (Pty) Ltd |
| Deputy Information Officer | None appointed |
| Postal address | Available on request from [email protected] |
| Street address | Durbanville, Western Cape, South Africa (full address on request from [email protected]) |
| Phone | Available on request from [email protected] |
| [email protected] | |
| Website | clicketybricks.com |
3. The Information Regulator's PAIA guide
The Information Regulator has published a guide on how to use PAIA and POPIA (section 10 of PAIA). It explains, in plain language, how to make a request, the help available, the fees, and what you can do if a request is refused. It is available in South Africa's official languages from the Regulator's website, inforegulator.org.za, or from the Regulator directly. You can also ask us and we'll send you a copy free of charge.
4. Records available without a request
We have not published a notice under section 52 of PAIA. These records are freely available on our website, with no request needed:
- this PAIA manual;
- our privacy page and kids' privacy page;
- our beta Terms of Use;
- information about Clickety Bricks on the website and our public video channels.
5. Records kept under other laws
Where they apply, we keep records required by these laws (this list may not be complete):
- Income Tax Act 58 of 1962 and Tax Administration Act 28 of 2011 (business income and expenses);
- Value-Added Tax Act 89 of 1991 (only if we register for VAT);
- Protection of Personal Information Act 4 of 2013;
- Promotion of Access to Information Act 2 of 2000;
- Electronic Communications and Transactions Act 25 of 2002;
- Consumer Protection Act 68 of 2008 (once we sell anything).
6. Subjects and categories of records we hold
| Subject | Categories of records |
|---|---|
| Business administration | Tax records, receipts and invoices for hosting and tools, bank records, accounting records. |
| Suppliers and service providers | Account records, terms of service and data processing agreements (Supabase, Cloudflare, Resend, Sentry and others), correspondence. |
| Waitlist | Email addresses, age group and parent or guardian confirmation (13 to 17), invite and referral codes, traffic source, sign-up dates, email consent records, unsubscribe ("do not email") list. |
| Beta users (when sign-in starts) | Account records (email, account ID, sign-in history), bug reports (descriptions, screenshots, model files, browser details), crash reports. |
| Communications | Emails sent to and from [email protected], email delivery logs. |
| Privacy and compliance | Privacy and PAIA requests and responses, complaints, record of processing, impact assessments, security incident log, Information Officer registration. |
| Product and intellectual property | App and website source code, designs, videos and marketing material, third-party licence records (LDraw, LDCad Shadow Library, Rebrickable, open-source software). |
7. How we process personal information (POPIA)
Purposes
- running the beta waitlist and sending beta invites;
- sending update emails to people who opted in;
- protecting the website from bots and abuse;
- providing beta sign-in and accounts;
- finding and fixing bugs and crashes;
- counting visitors in total, without identifying anyone;
- answering messages and privacy requests;
- keeping business, tax and legal records.
Categories of data subjects and their information
| Data subjects | Personal information |
|---|---|
| Waitlist members (adults, and 13 to 17 year olds with a parent's or guardian's consent) | Email address, age group, parent or guardian confirmation, invite and referral codes, traffic source, sign-up date and time, email consent record. |
| Parents and guardians | Email address (when they sign up for a child), the fact that they gave consent, correspondence. |
| Beta users | Email address, account ID, sign-in times and IP addresses, bug reports, crash reports (browser and device type, random browser ID). |
| Website visitors | Technical signals and IP address used by the bot check; no personal information in visitor counts. |
| People who contact us | Name and email address if given, message content. |
| Suppliers | Contact names, email addresses, account and billing details. |
We don't knowingly collect personal information from children under 13, and we don't collect special personal information (such as health, religion or biometrics).
Recipients
Our service providers (operators) process personal information for us under written agreements: Supabase (database), Cloudflare (website hosting, bot check, email forwarding, visitor counts), Resend (email sending), Sentry (crash reports) and our email inbox provider. We may also disclose information where the law requires it, for example to the Information Regulator, SARS or a court. We don't sell personal information.
Planned cross-border flows
Personal information is stored in the European Union (Supabase, Frankfurt, Germany) and may be processed in the United States and other countries where our service providers operate. We transfer it only under section 72 of POPIA: to providers bound by agreements, or by laws such as the EU GDPR, that give protection substantially similar to POPIA. Details are on our privacy page.
Security measures
In general terms: encrypted connections; database access rules that stop the public reading the waitlist; secret keys kept out of code and web pages; least-privilege access keys; two-step sign-in on every provider account; collecting as little as possible and deleting it on schedule; an incident response plan; and regular review of these measures.
8. How to ask for a record
- Use the official form. Fill in Form 2 ("Request for access to record") of the PAIA Regulations, 2021. It's available from the Information Regulator's website, or ask us and we'll email it to you.
- Send it to our Information Officer by email to [email protected] or by post (ask us by email for the address).
- Give enough detail for us to find the record, say how you'd like access (for example a copy by email), and say which right you want to exercise or protect and why you need the record for it.
- Prove who you are. We'll ask for a copy of your ID. If you ask on behalf of someone else, include proof that you may act for them.
We'll decide within 30 days and tell you in writing. In some cases the law lets us extend this once, by up to 30 more days; we'll tell you if we need to. If we refuse, we'll give our reasons. PAIA lists the only grounds on which a private body may refuse, for example to protect another person's privacy.
Your own personal information: you can ask to see, correct or delete it by simply emailing us (see the privacy page); there's no charge. You may also use the POPIA Regulations' forms: Form 1 to object to processing, and Form 2 to ask for correction or deletion.
9. Fees
Fees for requests to private bodies are set by the PAIA Regulations, 2021: a request fee, and an access fee for searching for, preparing and copying records, and a deposit may be asked for when a request takes a long time. The Regulator's guide lists the current amounts. We'll tell you the exact amount (using the Form 3 notice) before we do any work you'd have to pay for. You don't pay a request fee when you ask for your own personal information. We'll often waive small fees.
10. If you're not happy with our decision
You can complain to the Information Regulator (inforegulator.org.za), usually within 180 days of our decision, or apply to a court.
11. Where to find this manual
This manual is on our website at clicketybricks.com/paia.html. You can ask for a copy free of charge by email or post, and a copy is available for inspection at our principal place of business by arrangement. We'll give a copy to the Information Regulator on request. We'll update it whenever our records or processing change.
About LEGO®
LEGO® is a trademark of the LEGO Group of companies which does not sponsor, authorize or endorse this site. Clickety Bricks is an independent, unofficial fan project.