PAIA Manual
Manual in terms of section 51 of PAIA
Promotion of Access to Information Act 2 of 2000 · Last updated: 6 October 2026
1. The body
Naartjie is operated by an independent individual (a private body as defined in PAIA). It is not a registered South African company.
2. Information Officer
The operator is the Information Officer — POPIA section 1 makes the head of a private body its Information Officer. All requests and enquiries go to privacy@naartjie.co.za.
Name: Naartjie (operated by an independent individual)
Physical address: A Cape Town service address is being registered and will be published here. Until then, write to support@naartjie.co.za — we reply within 2 working days.
Telephone: A South African contact number is being registered and will be published here. Until then, email is the only channel: support@naartjie.co.za.
Email: privacy@naartjie.co.za
3. Guide by the Information Regulator
The Information Regulator has published a guide under section 10 of PAIA on how to use the Act. It is available from the Regulator at inforegulator.org.za or by contacting the Regulator directly.
4. Records held, by category
We hold records on these subjects:
- Account and profile records
- Listings, including expired, sold and removed listings
- Chat conversations and messages
- Community posts, comments and neighbourhood alerts
- Ratings and trade history
- Reports, moderation actions and appeals
- Consent records and cookie preferences
- Analytics events
- Notifications and email delivery preferences
- Administrator audit logs
How long we keep each kind of record is set out below — the same table published in our Privacy Policy.
| Information | How long we keep it | Why |
|---|---|---|
| Your account and profile | While your account is open, then 30 days after you ask us to delete it | The 30 days let you change your mind — sign back in to cancel |
| Dormant accounts — updated terms not accepted within 90 days | Erased 12 months after the account becomes dormant. We email you 30 days before | We don't keep an account forever once its owner no longer accepts our terms |
| Listings you delete | 90 days, then permanently deleted | In case of a dispute or a police investigation |
| Expired listings | 12 months, then deleted like a listing you delete. We email you 30 days before | So you can relist within the year |
| Listings a moderator removed | 5 years, then permanently deleted | Kept as long as the report behind it, so an appeal can still be reviewed |
| Sold listings | 3 years, then permanently deleted | The same as chats — a payment dispute needs both |
| Your email address on the waitlist for an area that isn't open yet | 30 days after we tell you the area has opened, or 12 months if it doesn't open | It is used only to tell you once, when your area opens |
| The list of erased account IDs | Permanent | Keeps an erased person's ID hidden in our audit log, which can't be edited |
| Voicemail left on our contact number, and the copy emailed to us | 7 days | We reply by email, so the recording isn't needed after that |
| Reservation history | 3 years | To settle disputes about a trade |
| Your recent searches and recently viewed listings | 90 days, or until you clear them | Only to show them back to you |
| Community posts you delete | 90 days, then permanently deleted | So reports about them can still be checked |
| Chat messages | 3 years from the last message in the conversation | Disputes and police investigations |
| Ratings | Permanent — kept without your name after your account is erased | Other people's reputation rests on them |
| Reports | 5 years | To spot repeat behaviour and answer lawful requests |
| Administrator audit log — who opened or changed what, and when | Permanent | Accountability. The log is sealed: no entry can be edited or removed |
| Records of what you agreed to (terms, privacy, cookies) | While your account is open, and 3 years after it is erased | To prove what was agreed, and when |
| Analytics events | 13 months | Measuring how the app is used, only with your consent. Your identifier is removed if you withdraw consent or delete your account |
| Photos | Deleted together with the listing, post, chat or report they belong to | A photo is never kept longer than its record |
| The copy of reported messages kept with a report | 5 years, the same as the report | So a report can still be judged if the chat is deleted |
| Identity documents | We don't collect them | We never ask for ID |
| In-app notifications | 90 days | They are only reminders |
| Notices about content (copyright, defamation, illegal content) and what we did about them | Permanent | A complete record of every notice and every action |
| Error reports (Sentry) | 90 days | Finding and fixing bugs |
| Anything under a preservation hold in a criminal case | Every period in this table stops until the police confirm they have what they need | So evidence isn't destroyed during an investigation |
| Child sexual abuse material | Not kept as a record: isolated, handed to the police, then destroyed once they confirm receipt | Holding it is itself a crime; it is kept only as evidence for the police |
| A one-way coded (hashed) copy of the email address of an account suspended for safety reasons | 5 years | To stop the same person signing up again |
| Accounts closed because the holder is under 18 | Not kept — erased within 7 days, email hash included | A child's information isn't kept longer than it has to be |
| Access logs, including your IP address (kept by our hosting and database providers) | 30 days | Security |
| Network groups — a hashed, shortened form of IP addresses — used to spot coordinated reports | 90 days | Preventing abuse. Your full IP address is never stored in our database |
| The link between your analytics identifier and your account | 13 months, or until you withdraw consent | The same as analytics events |
| Moderation decisions about you or your content, and your appeals | 5 years. A suspension that is still in force is kept until it ends | So an appeal or a repeat problem can still be checked |
| Meetup times and places proposed in a chat | 3 years from the last message, deleted with the chat | They are part of the trade's record, like the chat itself |
| A daily record that a listing was opened, used only to count its views | 7 days | So a view is counted once a day, not every time the page reloads |
| Our queue of photo deletions and image updates still to run | 90 days. A photo deletion that keeps failing stays queued until it succeeds | So no photo is forgotten when deleting it fails |
| Links we email to confirm a privacy request | Until the link expires after 24 hours, then deleted in our daily clean-up | To check the request came from you. The request itself stays in our admin audit log |
5. Records available without a request
Your listings, posts, chats and profile are in the app whenever you are signed in. For a copy of your personal information, email privacy@naartjie.co.za from the email address registered to your account — you don't need a PAIA form for that. We respond to access requests within 7 calendar days.
6. How to request access
- Complete Form 2 (Request for Access to Record of Private Body), prescribed by the Regulator and available from inforegulator.org.za.
- Email it to privacy@naartjie.co.za. If the request is about your own account, send it from the email address registered to that account — we confirm it is you with a one-time link sent there, and we never ask for ID documents. If someone asks on your behalf, we need your written authority and the same confirmation from your registered email address.
- We respond to access requests within 7 calendar days. The time starts when you click the confirmation link. If we need more time, we will tell you why and by when.
7. Fees
No fees are payable for requests under this manual. Both the request fee and the access fee are waived — for your own personal information (which is free under POPIA in any case) and for every other request.
Repeated or frivolous requests are handled under PAIA itself, not with a price: from the fourth request by the same requester in any twelve months, we may refuse and will tell you that this is the reason.
8. Grounds on which we may refuse
We refuse only where PAIA requires or permits it, and we always tell you which section we relied on:
- Messages another person wrote — section 63(1), the privacy of a third party. You can still read them in the app; they are left out of the exported copy only.
- Reports made about you — section 63(1) (the reporter's identity) and section 67 (protection of a person's safety). We always tell you that a report was made and what the outcome was; we do not give you the reporter's identity or the wording of the report.
- Administrator audit logs — section 63(1) (staff identity) and section 67 (disclosing detection criteria would let them be evaded). Every action taken on your account and its reason category is disclosed to you, and so is every view of your information recorded in that log — such as opening a reported chat or revealing your email address — by role and purpose, for example “one backup administrator, investigating a report”. We don't say who it was or how we detect abuse.
A refusal is never the end of it. Every refusal reply includes the complaint route to the Information Regulator.
9. If we refuse
You may complain to the Information Regulator or apply to a court. You can reach the Regulator at:
Information Regulator (South Africa)
Address: Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191
Complaints about a refused request: PAIAComplaints@inforegulator.org.za
General enquiries: enquiries@inforegulator.org.za
Website: inforegulator.org.za
If the action was a moderation decision, you can also appeal it in-app at Appeals.
Related: Privacy Policy · Terms of Use