PAIA Manual
Effective date: 12 November 2026
1. Particulars of the private body
| Registered name | Varona (Pty) Ltd |
| Trading name | Hareloom |
| Registration number | 2026/088657/07 |
| Physical and postal address | 8 Central Lane, Riverglen, Midrand, Gauteng, 2191 |
| Website | hareloom.co.za |
| hello@hareloom.co.za | |
| Telephone | +27 71 085 7819 |
2. Information Officer
2.1 Information Officer: [full legal name], Director.
2.2 Contact: hello@hareloom.co.za.
2.3 No Deputy Information Officers have been designated.
3. Guide in terms of section 10
3.1 The Information Regulator has compiled a guide, in each official language, containing information reasonably required by a person wishing to exercise a right under PAIA.
3.2 The guide is available free of charge from the Information Regulator at the details in clause 8, or at inforegulator.org.za.
4. Records held
| Category | Description |
| Customer records | Orders, delivery records, correspondence, returns and refunds |
| Financial records | Invoices, payment records, bank statements, tax returns, annual financial statements |
| Statutory records | Registration documents, memorandum of incorporation, resolutions, securities register |
| Supplier and service provider records | Contracts and correspondence with the printer, carrier, payment provider and platform provider |
| Marketing records | Subscriber database, consent records, campaign records |
| Product records | Specifications, artwork, print files, photography |
5. Records held in terms of other legislation
Records are held in terms of, among others, the Companies Act 71 of 2008, the Tax Administration Act 28 of 2011, the Income Tax Act 58 of 1962, the Consumer Protection Act 68 of 2008, the Electronic Communications and Transactions Act 25 of 2002 and POPIA.
6. Records available without a request
6.1 The Terms and Conditions of Sale, Returns and Refunds Policy, Shipping and Delivery Policy and Privacy Policy are published on the Website and are available without a request in terms of PAIA.
6.2 Registration particulars of the company are publicly available from the Companies and Intellectual Property Commission.
7. Request procedure
7.1 A request for access to a record must be made on Form 2 (Request for Access to Record), prescribed by regulation 7 of the Regulations Relating to the Promotion of Access to Information, 2021, and delivered to the Information Officer at the address or email in clause 1. The form is available from the Information Regulator at inforegulator.org.za.
7.2 The request must provide sufficient particulars to enable the Information Officer to identify the record and the requester, and must specify the form of access required and the manner in which the requester is to be informed of the decision.
7.3 Where access is sought in order to exercise or protect a right, the right concerned and the manner in which the record is required for that purpose must be stated.
7.4 The fees prescribed by Annexure B to the Regulations Relating to the Promotion of Access to Information, 2021 are payable. They comprise a request fee payable by every requester; reproduction fees charged per page or per item of media; a search and preparation fee charged per hour, excluding the first hour and subject to a maximum; the actual cost of postage or electronic transmission; and, where the search is likely to exceed six hours, a deposit calculated on the reproduction fees. The current schedule of amounts is published by the Information Regulator at inforegulator.org.za, and that published schedule prevails. The requester will be notified of the exact amount payable before the request is processed. Hareloom is not registered for VAT, so no VAT is added to these amounts.
7.5 The Information Officer will decide the request within 30 days of receipt and notify the requester of the outcome, and of any fees payable, on Form 3, prescribed by regulation 8 of those Regulations. That period may be extended once, by a further period not exceeding 30 days, in the circumstances contemplated in section 57 of PAIA.
8. Grounds for refusal, and remedies
8.1 Access may be refused on the grounds set out in Chapter 4 of Part 3 of PAIA, including the mandatory protection of the privacy of a third party, the commercial information of a third party or of the private body, information supplied in confidence, and records privileged from production in legal proceedings.
8.2 Where a request is refused, the requester will be notified in writing of the decision, the reasons for it, and the right to lodge a complaint or apply to court.
8.3 A complaint may be lodged with the Information Regulator on the prescribed Form 5, or an application may be made to a court having jurisdiction.
Information Regulator (South Africa)
Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191
Telephone: 010 023 5200
Toll-free: 0800 017 160
Email: enquiries@inforegulator.org.za
PAIA complaints: PAIAComplaints@inforegulator.org.za
9. Processing of personal information in terms of POPIA
9.1 Purpose of processing: acceptance, fulfilment and delivery of Orders; communication with customers; compliance with tax, company law and consumer law obligations; security of the Website; and, where consent has been obtained, direct marketing.
9.2 Categories of data subjects and of personal information:
| Data subjects | Categories of personal information |
| Customers and subscribers | Name, email address, telephone number, delivery address, order and payment records, correspondence, marketing consent records |
| Suppliers and service providers | Contact particulars, contracts, banking details, correspondence |
9.3 Recipients: Shopify Inc. (platform), Payfast (payment processing), Pargo (delivery), the company's accountant, and regulatory or revenue authorities where required by law.
9.4 Planned trans-border flows: personal information is processed by Shopify Inc. on servers outside the Republic of South Africa, in terms of section 72 of POPIA.
9.5 Security measures: encrypted transmission of all Website traffic; restriction of access to personal information to persons requiring it; engagement of a PCI-DSS compliant payment provider; no storage of payment card data by the private body; and written undertakings from operators in terms of sections 20 and 21 of POPIA.
10. Availability and review
10.1 This Manual is published at hareloom.co.za/pages/paia-manual and is available on request at hello@hareloom.co.za.
10.2 This Manual is reviewed at least annually and whenever a material change occurs.
Approved by [full legal name], Information Officer · [DATE]