PAIA manual

Last updated 12 October 2026

This manual is published under section 51 of the Promotion of Access to Information Act 2 of 2000 (“PAIA”), as amended by the Protection of Personal Information Act 4 of 2013 (“POPIA”). It explains what records Suncast holds and how to ask for access to them.

1. About Suncast

Suncast provides online solar design, system modelling and proposal software to solar installation businesses in South Africa. It is a private body operated by Nicolas Pasco-Marx, a sole proprietor trading as Suncast (not a registered company), with no employees at the date of this manual.

2. Contact details (section 51(1)(a))

Head of the private body: Nicolas Pasco-Marx (owner)
Information Officer: Nicolas Pasco-Marx (registered with the Information Regulator)
Street address: Kragga Kamma Rd, Lorraine, Gqeberha, 6070, South Africa
Postal address: Kragga Kamma Rd, Lorraine, Gqeberha, 6070, South Africa
Telephone: 063 482 8516
Email: suncastsupport@gmail.com
Website: suncast.co.za

3. The Information Regulator's guide (section 10)

The Information Regulator has published a guide on how to use PAIA and POPIA, including the rights of requesters and how to request records. It is available in all official languages from the Regulator's website and offices:

Website: inforegulator.org.za
Physical address: JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001
Postal address: P.O. Box 31533, Braamfontein, Johannesburg, 2017
General enquiries: enquiries@inforegulator.org.za
PAIA complaints: PAIAComplaints@inforegulator.org.za

Please check the Regulator's website for its latest contact details and forms.

4. Records available without a request (section 52)

Suncast has not published a notice under section 52(2). The following are freely available on suncast.co.za without a request: this PAIA manual, the privacy policy, the terms of use, product and pricing information, and the pilot programme details.

5. Records kept in terms of other laws (section 51(1)(b)(iii))

Suncast keeps records as required by, among others, the following laws, where they apply to it:

Protection of Personal Information Act 4 of 2013
Promotion of Access to Information Act 2 of 2000
Consumer Protection Act 68 of 2008
Electronic Communications and Transactions Act 25 of 2002
Income Tax Act 58 of 1962
Tax Administration Act 28 of 2011
Value-Added Tax Act 89 of 1991 (Suncast is not currently registered for VAT)

Records kept under these laws may also be requested from the bodies that administer them, where those laws allow.

6. Subjects and categories of records held (section 51(1)(b)(iv))

Business administration: Business registration and tax documents, agreements with service providers, insurance, policies (privacy policy, terms of use, this manual).
Financial: Invoices, receipts, bank statements, accounting records, tax returns, payment records (once paid plans start).
Installer accounts: User accounts and profiles, company details and branding, team members and roles, pilot applications, accepted versions of the terms and privacy policy, marketing preferences.
Installers' project data (held as operator): Customers, projects, roof designs, site photos, equipment and price lists, tariffs, proposals and customer responses. These records are entered and controlled by each installer, who is the responsible party.
Product and technical: Software source code, system documentation, security and access logs, backups.
Communications: Emails, WhatsApp messages and call notes with installers, suppliers and others.
Marketing: Website content, marketing material, contact lists of people who agreed to receive marketing.

7. Processing of personal information (section 51(1)(c) and POPIA)

Purposes

To provide and secure the Suncast service, manage accounts, companies and pilot applications, produce designs, estimates and proposals, provide support, communicate with users, manage payments, meet legal, tax and accounting obligations, and send marketing where permitted. Details are in the privacy policy.

Categories of data subjects and their information

Installers and their staff: Names, work email addresses, mobile numbers, profile photos, company details, roles, login and security records, marketing preferences.
Pilot applicants: Names, company, contact details, province, installation volumes, messages and consent choices.
Installers' customers (homeowners and businesses): Names, contact details, site addresses and coordinates, electricity bills and usage, project notes, designs, proposals, and responses to proposals.
Suppliers and service providers: Contact persons' names and contact details, agreements and invoices.

Recipients of personal information

Service providers that host and run Suncast (Supabase, Netlify, Resend, Google/Gmail, WhatsApp/Meta when a user contacts us through it), mapping and solar-data services that receive locations but not names (OpenStreetMap, PVGIS, Esri), a payment provider once paid plans start, professional advisers, and authorities where the law requires it. Installers' proposals are shared with their own customers by the installer.

Planned transfers outside South Africa

Personal information is stored in the United Kingdom (Supabase, London region) and processed by providers in the United States, European Union and elsewhere (Netlify, Resend, PVGIS, Esri). Transfers take place only as section 72 of POPIA allows, as described in section 7 of the privacy policy.

Security measures

Encryption in transit (HTTPS), provider-managed encryption at rest, sign-in and access controls, database row-level security that separates each company's data, restricted administrative access, security logging, private storage for site photos, and browser security headers. Security compromises are handled as POPIA section 22 requires.

8. How to request access to a record

Complete the prescribed request form, Form 2 of the PAIA Regulations (2021), available from the Information Regulator's website, and send it to the Information Officer at suncastsupport@gmail.com or the address above.
Give enough detail to identify the record and yourself, say how you want access (for example a copy by email), and how you want to be told of the decision.
If you need the record to protect or exercise a right, say which right and why the record is needed (section 53).
If you ask on behalf of someone else, include proof that you may act for them.
For your own personal information, you may also simply ask under POPIA (section 23) by emailing suncastsupport@gmail.com; see the privacy policy.
Records held for an installer (section 6 above) belong to that installer's business. We may refer you to the installer, and where a request concerns a third party's information, we must give that third party notice and an opportunity to respond (sections 71 to 73) before deciding.

9. Fees

Fees are those prescribed in Annexure B of the PAIA Regulations. A request fee (currently R140 for private bodies) is payable when a request is made. Asking whether we hold personal information about you is free under POPIA (section 23). An access fee may apply for reproducing, searching for and preparing a record, and for postage; where the search and preparation is expected to take more than six hours, a deposit of up to one third of the access fee may be asked for first. We will tell you the fees before going ahead, and refund the deposit if access is refused. Suncast is not registered for VAT.

10. Timelines, refusal and remedies

We decide on a request within 30 days of receiving it, and may extend this once by up to 30 days where PAIA allows, telling you why (sections 56 and 57).
If we do not decide in time, the request is regarded as refused (section 58).
We may refuse access only on the grounds set out in Chapter 4 of Part 3 of PAIA, for example to protect another person's privacy, commercial information of a third party or Suncast, confidential information, or legal privilege. We will give reasons.
If you are unhappy with a decision, you may complain to the Information Regulator within 180 days (sections 77A and 77B) or apply to court (section 78).

11. Availability and updates

This manual is available on suncast.co.za/paia and at the address above, and a copy is available from the Information Officer on request (a reasonable copying fee may apply for a printed copy). It is reviewed at least once a year and updated whenever Suncast's records, providers or structure change.