TapAPITAPAPI (Pty) Ltd
Manual prepared in terms of section 51 of the Promotion of Access to Information Act, 2000 (Act No. 2 of 2000).
Download PDF PAIA Request Form (PDF)1. Introduction
The Promotion of Access to Information Act, 2000 (Act No. 2 of 2000) (“PAIA”) gives effect to section 32 of the Constitution, which provides for the right of access to information held by the State and to information held by another person that is required for the exercise or protection of any rights.
Section 51 of PAIA requires every private body to compile a manual explaining how a member of the public may access information held by that body. This manual is compiled by TAPAPI (Pty) Ltd (“TapAPI”, “the Company”) in compliance with that requirement.
TapAPI operates a closed-loop record-keeping service under the trading name TapAPI™. The Company does not itself hold, receive, or transmit customer funds; customer funds are held by Netcash (Pty) Ltd, an authorised payment institution regulated under the National Payment System Act 78 of 1998.
2. Particulars of the Company
| Name of the Company | TAPAPI (Pty) Ltd |
| Trading name | TapAPI™ |
| CIPC registration number | 2026/529514/07 |
| Date of incorporation | 06 July 2026 |
| Information Regulator registration | 2026-061457 |
| Registered office | 17 Bishops Court, 4 Augrabies Street, Mooikloof Ridge, Pretoria, Gauteng, 0081 |
| Postal address | As above |
| Website | https://tapapi.co.za |
| General enquiries email | help@tapapi.co.za |
| Financial year end | 31 March |
| Nature of business | Closed-loop record-keeping service for prepaid credit purchased and spent within a defined vendor network. TapAPI operates as a closed-loop payment system under paragraph 3.15 of the draft Directive on Payment Activities (14 November 2025) published by the South African Reserve Bank. |
3. Information Officer
The Information Officer for TapAPI, as contemplated in section 1 of PAIA, is the head of the Company. No Deputy Information Officer has been appointed at the date of this manual; Deputy Information Officers may be appointed in future in terms of section 17 of PAIA read with section 55(1)(a) of the Protection of Personal Information Act, 2013 (“POPIA”).
| Full name | William Matthews |
| Capacity | Information Officer |
| IR registration | 2026-061457 (appointed 08 July 2026) |
| Postal address | c/o TAPAPI (Pty) Ltd, 17 Bishops Court, 4 Augrabies Street, Mooikloof Ridge, Pretoria, Gauteng, 0081 |
| help@tapapi.co.za |
4. Guide by the Information Regulator
In terms of section 10 of PAIA, the Information Regulator has published the Guide on how to use PAIA. The Guide is available in each of the official languages and may be obtained from the Information Regulator at:
| Postal address | P.O. Box 31533, Braamfontein, Johannesburg, 2017 |
| Physical address | Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg |
| Website | https://www.inforegulator.org.za |
| inforeg@justice.gov.za | |
| PAIA enquiries | PAIAEnquiries@inforegulator.org.za |
5. Categories of records held by TapAPI
This section lists the categories of records held by the Company. It does not follow that all records described are automatically available on request. Requests are considered against the grounds for refusal set out in Part 3 of Chapter 4 of PAIA (see section 9 below).
5.1 Company records
- Certificate of incorporation and CIPC registration documents
- Memorandum of Incorporation (MOI)
- Share register and records of shareholders
- Records of directors, including appointments, resignations, and remuneration
- Minutes of directors’ and shareholders’ meetings
- Company resolutions and beneficial ownership records
5.2 Financial records
- Books of account and general ledger
- Annual financial statements and management accounts
- Tax records (income tax, VAT if applicable, PAYE if applicable)
- Bank statements for accounts held in the name of the Company
- Sub-account statements at Netcash (Pty) Ltd for the TapAPI sub-account 52656316239
- Records of any capital contributions, loans, and inter-company transactions with related parties
5.3 Customer records
- Identity verification data collected during onboarding (PDF417 barcode from the SA Smart ID, front-of-card image, liveness biometric match result)
- ID photographs stored for the merchant photo-check on tap-to-pay transactions
- Personal Identification Numbers (PINs) stored only as Argon2id hashes with per-record salt
- Wallet balances and closed-loop transaction history
- Tag and wristband records (aliases, balances, PIN hashes, HMAC signatures)
- Session logs and device-binding records
- Geo-location audit logs for merchant-side transactions
- Consent records (POPIA consent version, date, timestamp, IP)
- Support correspondence and dispute records
5.4 Vendor records
- Business name, trading address, and description of goods or services sold
- Records of the natural person operating each vendor (identity verification data)
- Bank account or Netcash sub-account details for payout purposes
- Vendor-mode activation and deactivation logs
- Terminal-key issuance records and device fingerprints
- Sales history and transaction records recorded against the vendor
5.5 Contractual records
- Services agreement and sub-account arrangement with Netcash (Pty) Ltd
- VAS distribution arrangement with Umbai (or successor VAS aggregator)
- Hosting and infrastructure agreements (Afrihost)
- Any professional services engagement (legal, accounting, audit)
- Employment or contractor agreements
- Non-disclosure agreements
5.6 Operational and security records
- System access logs, authentication logs, and audit trails
- Fraud detection logs and manual review records
- Incident reports and post-incident reviews
- Backup and restoration records
- Change management records
- Third-party penetration test reports (where applicable)
5.7 Regulatory and compliance records
- Correspondence with the South African Reserve Bank (SARB), including the closed-loop registration package under paragraph 42.3 of the draft Directive on Payment Activities (14 November 2025)
- Correspondence with the Information Regulator (South Africa)
- Correspondence with the Financial Intelligence Centre (FIC), where lawfully required
- Records maintained in terms of POPIA (Act No. 4 of 2013)
- Records maintained in terms of the Consumer Protection Act, 2008
6. Records automatically available
The following records are available to any member of the public without the need to submit a formal PAIA request:
- The Company’s public website: https://tapapi.co.za
- The Consumer Consent, published at /legal/consumer-consent.php
- The Privacy Notice, published at /legal/privacy.php
- The Terms of Use, published at /legal/terms.php
- This PAIA Manual, published at /legal/paia-manual.pdf
- Public compliance disclosures in the footer of the Company’s website
In addition, a customer holding a TapAPI record may access their own personal information held by the Company through the in-app data export functionality, in terms of section 23 of POPIA. No PAIA request or fee is required to exercise this right in respect of the customer’s own personal information (section 22(1) of PAIA).
7. Records available in terms of other legislation
The Company also makes certain records available or accessible in terms of other legislation, including:
- The Companies Act, 2008 — public company records accessible through the CIPC
- The Tax Administration Act, 2011 — access by SARS
- The Financial Intelligence Centre Act, 2001 — access by the FIC on lawful request
- The Protection of Personal Information Act, 2013 — data subject access rights (section 23) and correction rights (section 24)
- The National Payment System Act, 1998 — records accessible to the South African Reserve Bank
- The Consumer Protection Act, 2008 — consumer-facing disclosures
- The Criminal Procedure Act, 1977 — records subject to lawful warrant
8. Procedure for requesting access to a record
8.1 Form of request
A request for access to a record held by the Company must be made on the Company’s PAIA Request Form (“Form 2”), which is available at /legal/paia-request.pdf and on request from the Information Officer. A request submitted using the standard Form 2 prescribed by the Information Regulator in the Regulations Relating to PAIA is also acceptable.
8.2 Contents of the request
The requester must:
- Complete the request form in full
- Provide sufficient particulars to enable the Information Officer to identify the record and the requester
- Indicate the form of access required
- Specify a postal address, email address, or fax number in the Republic
- Where the request is made on behalf of another person, provide proof of the requester’s authority
- Where the request is for the exercise or protection of a right, identify the right and explain why the record is required
8.3 Submission
Completed request forms may be submitted to the Information Officer at help@tapapi.co.za or by post to the Company’s registered address as set out in section 2 above.
8.4 Response time
The Information Officer must respond to a request as soon as reasonably possible and within 30 days of receiving the request, in accordance with section 56 of PAIA. This period may be extended by a further 30 days in the circumstances contemplated in section 57 of PAIA. The requester will be notified of any extension.
9. Grounds for refusal of access
Access to a record may or must be refused in the circumstances set out in Chapter 4 of Part 3 of PAIA, including:
- Section 63 — mandatory protection of personal information of a third party
- Section 64 — mandatory protection of commercial information of a third party
- Section 65 — mandatory protection of confidential information of a third party
- Section 66 — mandatory protection of safety of individuals and property
- Section 67 — mandatory protection of records privileged from production in legal proceedings
- Section 68 — commercial information of the Company (trade secrets, financial and technical information)
- Section 69 — mandatory protection of research information
- Section 70 — mandatory disclosure in the public interest, notwithstanding other grounds
Where a refusal is issued, the Information Officer will provide reasons in writing and inform the requester of the internal remedies and rights of appeal available.
10. Fees
The Regulator has prescribed a fee structure for PAIA requests to private bodies. The fees applicable at the date of this manual are set out in Annexure A below. Fees are updated by the Regulator from time to time and the current fees will apply to any request.
Key points:
- A request for a requester’s own personal information carries no request fee (section 22(1) of PAIA).
- The request fee must be paid before the request is processed.
- Access fees may be charged for the time reasonably required to search for and prepare the record.
- Proof of payment must accompany the request or be provided on demand.
11. Remedies available to a requester
A requester who is dissatisfied with a decision of the Information Officer may:
- Lodge a complaint with the Information Regulator in terms of section 77A of PAIA;
- Apply to a court in terms of section 78 of PAIA for appropriate relief.
A third party who is dissatisfied with a decision to grant access may exercise similar remedies.
12. Availability of this manual
This manual is available:
- On the Company’s website at /legal/paia-manual.pdf
- On request in writing from the Information Officer at help@tapapi.co.za
- At the offices of the Company during normal business hours, by prior appointment
- On the website of the Information Regulator, once submitted to the Regulator
13. Updates to this manual
This manual will be reviewed at least annually and updated whenever there are material changes to the Company’s structure, records held, or Information Officer. The version and date of the current manual appear at the top of this page.
Annexure A — Fee schedule
The fees set out below are those prescribed by the Regulator in Regulation 6 of the Regulations Relating to PAIA (as published from time to time). Fees are payable to TAPAPI (Pty) Ltd by electronic funds transfer to the banking details supplied by the Information Officer on request. Fees are exclusive of VAT.
| Item | Amount (ZAR) |
|---|---|
| Request fee (payable by every requester, except a personal requester) | R50.00 |
| Photocopy of A4 page or part thereof | R1.10 |
| Printed copy of A4 page from computer readable form | R0.75 |
| Copy in a computer readable form on stiffy disc | R7.50 |
| Copy in a computer readable form on CD | R70.00 |
| Transcription of visual images per A4 page | R40.00 |
| Copy of visual images | R60.00 |
| Transcription of an audio record per A4 page | R20.00 |
| Copy of an audio record | R30.00 |
| Search and preparation time in excess of six hours per hour | R30.00 |
| Deposit (where search will exceed six hours) | One third of access fee |
| Postage, email, or delivery of a record to the requester | At actual cost |