Legal
The PAIA manual.
Section 51 of the Promotion of Access to Information Act 2 of 2000 requires every private body to publish this manual. It explains what records we hold and how to request access to them.
1.The private body
This is the manual of Strand Hair and Beauty (Pty) Ltd (Reg. 2026/555939/07), a private company incorporated in South Africa, of Durbanville, Cape Town, South Africa, operating the Strand app and the website at https://strand.style.
2.Contact details of the information officer
The head of the private body is the chief executive officer, who serves as information officer. Requests under PAIA and POPIA go to:
- Email: data@strand.style (the information officer), privacy@strand.style (privacy and access requests) or hello@strand.style (general)
- Address: Durbanville, Cape Town, South Africa; the street address for service is available on request
- Website: https://strand.style
3.The Regulator's section 10 guide
The Information Regulator publishes a guide, in all official languages, on how to use PAIA - how to identify a body, complete the request form, and what to do if a request is refused. It is available from the Information Regulator (South Africa) at https://inforegulator.org.za, by email from enquiries@inforegulator.org.za, or at the Regulator’s offices: Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191.
4.Records we hold
| Category | Examples |
|---|---|
| Statutory and corporate | Incorporation documents, share register, statutory returns |
| Financial | Accounting records, invoices, tax records, bank records |
| Personnel | Employment contracts, payroll, contractor agreements |
| Customers and users | Accounts, subscriptions, consent records, support correspondence, waitlist entries |
| Client records held for stylists | Studio-memory records processed as operator on stylists' instructions |
| Operational and technical | Software, infrastructure and security documentation, audit logs |
| Marketing | Website content, campaign records, marketing consent registers |
Records available in terms of other legislation include those held under the Companies Act 71 of 2008, the Income Tax Act 58 of 1962, the Value-Added Tax Act 89 of 1991 where applicable, labour legislation, POPIA, and the Electronic Communications and Transactions Act 25 of 2002. Listing a record here does not mean access will be granted - every request is assessed under PAIA’s grounds of access and refusal.
5.Processing of personal information (POPIA)
Purposes: providing the Strand service; account administration and identity assurance; communication and support; marketing with consent; product analytics on de-identified data; compliance with legal obligations.
Categories of data subjects: stylists and salon staff who hold accounts; stylists’ clients whose records we process as operator; waitlist subscribers; suppliers and service providers; employees and contractors.
Recipients: the operators listed in the register below and on POPIA and your data, and public bodies where the law requires disclosure.
| Provider | What for | Where |
|---|---|---|
| Clerk | Sign-in and account security | United States |
| Didit | Identity verification; holds verification artefacts | EU |
| Meta Platforms | WhatsApp Business Platform and Instagram messaging, when you connect them | United States / Ireland |
| Twilio | Messaging infrastructure, where used as our WhatsApp provider | United States |
| ElevenLabs | Voice transcription and the voice assistant | United States |
| Anthropic | AI answers and drafting (Claude models) | United States |
| Google Cloud | Hosting and infrastructure, South African region preferred for identity data | South Africa / global |
| Resend | Waitlist and transactional email | United States |
Transborder flows: some operators process personal information outside South Africa, including cloud infrastructure and messaging platforms in the United States and the EU, under section 72 of POPIA - written operator contracts imposing comparable safeguards, or the data subject’s consent. Our standing preference is to host identity data in the South African cloud region.
Security measures: encryption in transit, purpose-bound access controls, separation of identity and analytics systems, managed secret storage, audited access to audit trails, and breach notification under section 22. The privacy policy describes these in full.
6.How to request a record
Complete the prescribed request form (Form 2 of the PAIA Regulations, available from https://inforegulator.org.za) and send it to privacy@strand.style. Identify the record, the right you seek to exercise or protect where the record is held by us as a private body, and how you would like access. The prescribed request fee applies except where you request your own personal information, which is free. We respond within 30 days as PAIA requires.
If a request is refused, the response will state the grounds. You may then apply to a court, or complain to the Information Regulator (South Africa) at PAIAComplaints@inforegulator.org.za. Data subjects exercising POPIA rights do not need this procedure at all - POPIA and your data covers the in-app route.
7.Availability of this manual
This manual is published at https://strand.style/paia, is available for inspection at our principal place of business during business hours, and is provided to the Regulator or any person on request. It is reviewed when our processing changes materially; the date at the top is the version you are reading.