ENOCH FOR MAC AND WINDOWS · LEGAL
PAIA and POPIA Manual
Enoch for Windows — Coming Early 2027.
Prepared by Sipumzo Trueman Lucwaba under section 51 of the Promotion of Access to Information Act 2 of 2000, as amended by the Protection of Personal Information Act 4 of 2013.
The short version
South African law gives you the right to ask for records a business holds, where you need them to exercise or protect a right, and to know how that business handles personal information. This manual tells you what records Enoch's publisher keeps, how to ask for them, what it may cost, and what you can do if you are refused.
Enoch is published by one person, so the records are few. In particular, we hold no copies of anyone's scores: Enoch runs on your own Mac or Windows PC and sends nothing to us. The personal information we do hold comes from selling Enoch, answering support email, running a beta, and keeping the accounts the law requires.
About this manual
The Promotion of Access to Information Act 2 of 2000 (PAIA) gives everyone a right of access to records held by a private body where the record is required for the exercise or protection of a right. A natural person who carries on a trade, business or profession is a private body in that capacity, so PAIA applies to Sipumzo Trueman Lucwaba as the publisher of Enoch.
Section 51 of PAIA requires every private body to compile a manual explaining how to ask for its records. Since the Protection of Personal Information Act 4 of 2013 (POPIA), the manual must also describe how the body processes personal information. This is that manual. It does not create any right that PAIA or POPIA does not give you, and it does not take any away.
How Enoch handles personal information is set out in full in our Privacy Policy; clause 7 summarises it for the purposes of the law.
Contact details
Enoch is published by an individual, so the head of the private body and the Information Officer are the same person, registered with the Information Regulator as POPIA requires.
- Head of the private body
- Sipumzo Trueman Lucwaba, a natural person trading as Enoch
- Information Officer
- Sipumzo Trueman Lucwaba
- Street address
- 222 Smit Street, Braamfontein, Johannesburg, 2001, Gauteng, South Africa
- Postal address
- 222 Smit Street, Braamfontein, Johannesburg, 2001, Gauteng, South Africa
- Telephone
- +27 76 605 9137
- Email for PAIA and POPIA requests
- [email protected]
- General enquiries
- [email protected]
- Website
- enochmusic.co.za
The Information Regulator's guide
The Information Regulator has compiled a guide, in each official language, on how to use PAIA and POPIA to exercise your rights. It is available from the Regulator's website and offices, and we will send you a copy on request.
- Regulator
- The Information Regulator (South Africa)
- Address
- Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191
- Telephone
- +27 10 023 5200 (toll-free 0800 017 160)
- General enquiries
- [email protected]
- Website
- inforegulator.org.za
Records available without a request
The following are published on our website, free of charge, and you do not need to make a PAIA request for them:
- this manual, the Privacy Policy and the Terms of Use;
- the product, pricing, system-requirement and support information on the website; and
- the release notes and licence acknowledgements shipped with Enoch itself (Preferences → Acknowledgements).
Records kept under other laws
Where they apply to us, we keep records in terms of the following legislation. Some of these records may be available to you under the law that requires them, as well as under PAIA:
- Income Tax Act 58 of 1962
- Tax Administration Act 28 of 2011
- Value-Added Tax Act 89 of 1991, if we are registered for VAT
- Electronic Communications and Transactions Act 25 of 2002
- Consumer Protection Act 68 of 2008
- Protection of Personal Information Act 4 of 2013
- Promotion of Access to Information Act 2 of 2000
- Copyright Act 98 of 1978
This list is not exhaustive. A record we keep under a law not named here is still covered by this manual.
The records we hold
These are the subjects on which we hold records, and the categories of record in each. A category being listed does not mean every record in it will be released; clause 10 sets out when a request may be refused.
| Subject | Categories of record |
|---|---|
| Business administration | Trading records; agreements with Apple, Microsoft, service providers and professional advisers; general correspondence |
| Finance and tax | Invoices; bank statements; Mac App Store and Microsoft Store sales and payment reports; tax returns and supporting records |
| The Enoch software | Source code; design and planning documents; test records; release builds and notes; third-party licence notices |
| Customers and users | Support correspondence and anything attached to it; Beta-tester records (TestFlight, and Microsoft Store test groups) while a beta or test runs |
| Website | The website's pages and published content. Server logs are kept by our website host, not by us |
| Legal and compliance | Information Officer registration; this manual and its earlier versions; privacy requests and complaints, and our replies |
We do not hold users' scores, recordings or other work made with Enoch, their Enoch settings, or any record of how they use the application: Enoch keeps all of that on the user's own computer and transmits none of it.
How we process personal information
(a) Purposes
We process personal information to:
- sell Enoch and deliver it through the Mac App Store and the Microsoft Store;
- answer support requests and fix the faults they report;
- run beta and test releases through TestFlight and the Microsoft Store;
- keep the accounting and tax records the law requires;
- run the website; and
- send product news to people who asked for it.
(b) Data subjects and the information we hold about them
| Data subjects | Personal information |
|---|---|
| Customers | None that identifies them. Apple and Microsoft give us aggregate sales figures, not customer details |
| People who contact support | Name, email address, the message, and any files, logs or scores they choose to attach |
| Beta testers | The email address used to accept a TestFlight invitation, or the Microsoft account email address added to a Microsoft Store test group; installation status; and feedback they submit |
| Website visitors | None held by us. Our website host keeps ordinary server logs (IP address, browser, pages viewed) under its own terms |
| Suppliers and advisers | Names, contact details and contract records |
We hold no special personal information and no personal information of children, and we do not ask for either.
(c) Recipients
We share personal information only with the operators who perform a service for us under a written contract, and only as far as they need it: Apple Inc. (distribution, payment and beta testing); Microsoft Corporation (distribution, payment and test releases of Enoch for Windows); Cloudflare, Inc. (Cloudflare Pages) (the website); Google (Google Analytics, website usage measurement); Google (Google Workspace) (email); and our accountants, auditors and lawyers. We disclose it to a court, regulator or law-enforcement body only where the law requires it.
(d) Transfers outside South Africa
Some of these operators store information outside South Africa — commonly in the United States, the European Union, the United Kingdom or Ireland. We transfer personal information across borders only on a basis POPIA section 72 permits: the recipient is bound by law, binding corporate rules or an agreement giving adequate protection, the transfer is needed to perform our contract with you, or you have consented.
(e) Security
We protect personal information with reasonable technical and organisational measures, as POPIA section 19 requires: encryption in transit, multi-factor authentication on the accounts that hold it, access limited to the Information Officer, reputable operators, and keeping as little as we can. If personal information is compromised we will notify the Information Regulator and the people affected, as section 22 requires.
How to request a record
- Complete the request form prescribed for private bodies in the Regulations relating to PAIA (Form 2), available from the Information Regulator's website or from us.
- Send it to the Information Officer at [email protected], or by post to the address in clause 2.
- Identify the record you want, the form in which you want access, and — as section 53 of PAIA requires — the right you are exercising or protecting and why the record is needed for it.
- Include proof of your identity. If you ask on someone else's behalf, include proof of your authority to do so.
We will decide on your request within 30 days of receiving it and tell you our decision in writing. PAIA allows that period to be extended once, by up to 30 days, in the circumstances section 57 sets out; if we need to do that we will tell you why before the first period ends.
Your own personal information. You do not need a PAIA request to ask whether we hold personal information about you or to ask for a copy — write to the Information Officer. To ask us to correct or delete it, or to object to how it is processed, you may use the forms prescribed under POPIA (Form 2 for correction or deletion, Form 1 for an objection), which we will send you on request. The Privacy Policy sets out these rights in full.
Fees
PAIA allows a private body to charge the fees prescribed in the Regulations relating to PAIA: a request fee, payable before a request is processed, and an access fee for finding, preparing and reproducing the record. If finding and preparing the record will take longer than the Regulations allow without charge, we may ask for a deposit first, and we will tell you in writing before any work is done. The fee schedule is published by the Information Regulator.
No fee is charged to ask whether we hold personal information about you.
Grounds on which a request may be refused
PAIA requires or permits a private body to refuse access to a record in the circumstances set out in Chapter 4 of Part 3 of the Act, including where access would:
- unreasonably disclose personal information about a third party (section 63);
- disclose a third party's trade secrets or confidential commercial information (section 64), or breach a duty of confidence owed to a third party (section 65);
- endanger the life or safety of an individual, or the security of property (section 66);
- disclose a record privileged from production in legal proceedings (section 67); or
- disclose our own trade secrets or confidential commercial information — which includes Enoch's source code, designs and unreleased plans (section 68).
Section 70 overrides these grounds where disclosure would reveal a serious breach of the law or an imminent risk to public safety or the environment, and the public interest in disclosure clearly outweighs the harm. If we refuse a request, we will tell you the reasons and the provisions relied on.
If you are not satisfied
There is no internal appeal against a private body's decision. If we refuse your request, charge a fee you dispute, extend the period for deciding, or fail to decide in time, you may lodge a complaint with the Information Regulator, or apply to court, within the periods PAIA prescribes. We would still like you to write to us first — most disagreements can be settled by a conversation.
Where this manual is available
This manual is published at enochmusic.co.za/paia, is available for inspection at the address in clause 2, and can be sent to you by email free of charge on request. A copy is provided to the Information Regulator on request. We update the manual when our records or our processing change; the version and date at the top of the page always show the current edition.