PAIA manual of Sinosa Trading (Pty) Ltd
Version 2026-10-16.1
1. Abbreviations
- PAIA: Promotion of Access to Information Act 2 of 2000
- POPIA: Protection of Personal Information Act 4 of 2013
- Regulator: the Information Regulator of South Africa
- IO: Information Officer; DIO: Deputy Information Officer
- Sinosa: Sinosa Trading (Pty) Ltd, trading as Blueticked
2. Purpose of this manual
This manual tells anyone who wants a record held by Sinosa what records it holds, how to ask for them, and how Sinosa processes personal information, as PAIA section 51 requires.
3. Contact details
| Company | Sinosa Trading (Pty) Ltd, registration number 2013/053370/07, trading as Blueticked |
| Head of the body and Information Officer | Shaun Schoeman, Chief Executive Officer and sole director (registered with the Regulator on 12 November 2026) |
| Deputy Information Officer(s) | None |
| Email for access requests | privacy@blueticked.com |
| Physical address | Unit 58 Eden on the Bay, Big Bay, Cape Town, 7441 |
| Postal address | The same as the physical address |
| Telephone | None published: write to privacy@blueticked.com or to the postal address |
| Fax | None |
| Website | https://blueticked.com |
These details are the same as those registered for the Information Officer on the Regulator's eServices portal, and are refreshed at least once a year.
4. The Regulator's guide to PAIA
The Regulator publishes a guide on how to use PAIA to obtain access to records. It is available from the Regulator's PAIA page (https://inforegulator.org.za/paia/). Sinosa keeps a copy of the guide in at least two official languages at its head office for public inspection during office hours (Monday to Friday, 08:00 to 16:00, by appointment), free of charge (PAIA Regulations 2021, regulation 3).
5. Records available without a request
Sinosa has not published a description under section 52(1). The following are available on blueticked.com without a request: the Terms of Service, the Privacy Policy, the Operator Agreement, pricing, and the developer documentation. A customer or user who is signed in can also download their own information without asking Sinosa: in the Blueticked app, under Settings, Data & privacy, "Export my data".
6. Records held under other legislation
Sinosa keeps records as required by, among others, the following laws:
- the Companies Act 71 of 2008 (company records);
- the Income Tax Act 58 of 1962, the Value-Added Tax Act 89 of 1991 and the Tax Administration Act 28 of 2011 (tax and accounting records);
- the Protection of Personal Information Act 4 of 2013 (records of processing, consent and objections, security compromises);
- the Consumer Protection Act 68 of 2008 (direct-marketing records);
- employment laws, should Sinosa employ staff (it employs none at present).
7. Subjects on which Sinosa holds records
| Subject | Categories of record |
|---|---|
| Company | Registration documents, director records, resolutions, share register (held by the director) |
| Finance and tax | Accounting records, invoices, credit notes, bank and payment records, tax returns |
| Customers | Account and workspace records, billing profiles, signed operator agreements, invoices, support correspondence |
| Customer Data (held as operator) | Contacts, messages and other data that customers process through Blueticked. Sinosa holds these for its customers; a request for them is referred to the customer concerned, who is the responsible party |
| Suppliers and service providers | Contracts, data processing terms, invoices |
| Website and product | Visitor and usage analytics, security and audit logs |
| Staff and contractors | None: Sinosa employs no staff |
A request is made on Form 2 of the PAIA Regulations 2021 (regulation 7), sent to the email or address in section 3. The fees are those in Annexure B of those Regulations. Sinosa waives them: a request costs the requester nothing.
8. Processing of personal information
8.1 Purpose
To provide the Blueticked messaging platform to business customers; to bill them; to secure and support the service; to market Blueticked to businesses; and to meet Sinosa's legal duties.
8.2 Data subjects and their information
| Data subjects | Information |
|---|---|
| Customers and their users | Names, email addresses, phone numbers, business details, billing details, sign-in and security records, usage of the service |
| Customers' contacts (Sinosa is the customers' operator) | Names, phone numbers, email addresses, messages and media, form answers, consent and opt-out records, and other details a customer puts into the service |
| Website visitors | Page views, IP addresses, information entered in forms |
| Suppliers | Contact details (Sinosa keeps no supplier banking details on file) |
| Staff and contractors | None: Sinosa employs no staff |
8.3 Recipients
The service providers listed in Annex C of the Operator Agreement (hosting, database, messaging channels, email, AI, payments, monitoring and analytics); the South African Revenue Service and other authorities where the law requires; and Sinosa's professional advisers.
8.4 Planned transborder flows
Personal information is stored and processed outside South Africa by the providers named in Annex C of the Operator Agreement:
- European Union: Ireland (the database, sign-in, file storage, the web application's servers, queues, email sending and product analytics), the Netherlands (background processing of queued messages), and error monitoring.
- United States: AI features (when a customer turns them on).
- Global infrastructure: WhatsApp (Meta), the web host's delivery network and build machines, bot checks at sign-in, address lookup, and photo and font delivery.
SMS is processed in South Africa. Each transfer rests on POPIA section 72(1)(a): the data processing terms each provider publishes for its service, which apply to Sinosa's accounts with it (the providers are listed in Annex C).
8.5 Security measures
Each customer's data is separated from every other customer's by row-level security in the database, checked by automated tests on every change. Credentials are encrypted at rest, and data travels over TLS. Access is controlled by role, with multi-factor authentication for sensitive actions, and privacy actions are audited. The database is backed up daily. Releases are checked for malicious code and known weaknesses, and errors are monitored. Section 19 of POPIA is applied through Annex B of the Operator Agreement.
9. Availability of this manual
This manual is available at https://blueticked.com/paia, at Sinosa's principal place of business for inspection during office hours, to anyone on request free of charge, and to the Regulator on request (PAIA section 51(3)).
10. Updates
Sinosa updates this manual whenever its details or processing change, and reviews it at least once a year.
Issued by: Shaun Schoeman, Chief Executive Officer and Information Officer, Sinosa Trading (Pty) Ltd. Date: 12 November 2026.