Access to information and your rights

Updated 13 October 2026. Review draft.

Prepared in terms of section 51 of the Promotion of Access to Information Act 2 of 2000 as amended

This Manual describes how to request access to records held by ANCODE (PTY) LTD, the company that creates and operates Tabi Family Rides. It covers the main categories of records and personal information associated with the app, website, support and related services. Company details are confirmed. Information Officer registration, unresolved fields and final legal approval remain pending.

Date of compilation: 18 September 2026

Date of revision: 13 October 2026

Version: 0.2 review draft

Prepared for owner and legal completion. Bracketed TBD fields must be confirmed before public signature or publication.

Contents

Acronyms and definitions

Purpose of this Manual

Private body and contact details

Guide on how to use PAIA

Records available without a formal PAIA request

Records available under other legislation

Subjects and categories of records held

Processing of personal information

How to request access to a record

Decisions refusal grounds and remedies

POPIA data subject requests

Retention and deletion

Availability of this Manual

Updating and approval

Official sources

1 Acronyms and definitions

1.1 Acronyms

1.2 Definitions

In this Manual:

• Head means the head of the private body for purposes of PAIA.

• Manual means this PAIA Manual.

• Operator means ANCODE (PTY) LTD, registration number 2021/315476/07, which creates and operates Tabi Family Rides.

• Personal information, processing, responsible party and data subject have the meanings given in POPIA.

• Record has the meaning given in PAIA and includes recorded information in the possession or under the control of the Operator, regardless of form or medium.

• Tabi means the Tabi Family Rides mobile application and associated website, support and cloud services operated by the Operator.

2 Purpose of this Manual

Tabi is described in the reviewed materials as a digital coordination and safety-support tool for family-arranged rides. It is not itself the driver or passenger, does not own or operate the participating vehicle, and is not presented as a taxi, e-hailing, rideshare, transport, emergency-response or insurance service. Drivers, parents, guardians and other responsible adults remain responsible for their own decisions, legal duties, conduct, vehicles, passengers and arrangements. This operational description identifies the context in which records are created; it is not a waiver of any non-excludable right or liability and must remain consistent with the app's actual operation, marketing, payments and level of control.

This Manual enables members of the public to:

• understand the categories of records held by the Operator;

• identify records that are available without a formal PAIA request;

• understand how to request a record under PAIA;

• obtain the contact details of the Head, IO and any DIO;

• understand which records may be available under other legislation;

• understand the principal purposes for which Tabi processes personal information;

• identify the main categories of data subjects, personal information and recipients;

• understand the current position on transborder processing and security measures; and

• find the prescribed forms, fee information and remedies relating to a PAIA request.

In terms of section 50 of PAIA, access to a record of a private body may be granted where the record is required for the exercise or protection of a right, the procedural requirements have been met, and no ground of refusal applies.

3 Private body and contact details

3.1 Legal identity

3.2 Information Officer

Requests may be addressed to the Information Officer or Head of ANCODE (PTY) LTD at the company address or support mailbox below. The individual officeholder, any authorisation and registration with the Information Regulator have not yet been confirmed. Corporate contact details do not establish registration or appointment.

3.3 Deputy Information Officer

No Deputy Information Officer designation has been confirmed. General requests may use the company contact in section 3.4.

3.4 General contacts

4 Guide on how to use PAIA

The Regulator has published a Guide under section 10 of PAIA. The Guide explains the objects of PAIA and POPIA, the process for requesting records, the assistance available, the applicable forms and fees, and available remedies.

The Guide is available in the official languages and in braille through the Regulator. It may be obtained from:

• the Information Regulator PAIA page at https://inforegulator.org.za/paia/;

• the Regulator's offices and official contact channels; or

• the Operator's IO once the contact details in section 3 have been confirmed.

Regulator contact details should be checked against the Regulator's website before publication or submission because contact channels may change.

5 Records available without a formal PAIA request

The records below are intended to be available without a formal PAIA request once they have been approved and published. Their inclusion does not make private account, child, ride, location, safety or support records automatically available.

On 13 October 2026 the website home page responded over valid HTTPS, but the privacy, terms, support, account-deletion and PAIA routes returned 404. The prepared website package must be uploaded and these routes checked before their public availability is claimed.

6 Records available under other legislation

ANCODE (PTY) LTD may create, retain or make records available where required or authorised by applicable legislation. The final legal register must reflect its actual operations.

This is not a complete statement of all legislation that may apply. The Operator must approve the final legal register before publication.

7 Subjects and categories of records held

The categories below reflect the reviewed application code and legal or Play documentation. A category does not mean that every possible record exists for every user, that a record must be disclosed, or that access cannot be refused under PAIA.

The repository contains a cloud-storage path for child photographs, but no active child-photo upload flow was established in the reviewed app. It is therefore not listed as a current user-facing collection feature. The position must be reassessed if that functionality is enabled.

8 Processing of personal information

8.1 Purposes of processing

Tabi may process personal information to:

• create, authenticate and secure adult and linked child-device accounts;

• administer families, roles, child profiles, drivers and vehicles;

• coordinate ride requests, offers, matching, participation and trip history;

• provide maps, routing, live tracking, notifications and safety features;

• enable child-device pairing, SOS and trip-safety monitoring;

• verify an eligible adult's identity through a hosted Bitventure process when enabled;

• process reviews, trust information, post-ride confirmations and missing-item reports;

• provide support, investigate incidents, prevent abuse and enforce applicable terms;

• process account-deletion and other data-subject requests; and

• comply with legal obligations and respond to lawful requests.

The intended beta adds general-area profile storage, separate beta acknowledgment, voluntary feedback and an account-linked survey, minimal survey invitation timing, support-led shuttle enquiries with explicit provider-sharing consent, and support coordination of missing-item returns. These features do not automatically send survey answers to email or shuttle requests directly to a provider.

The lawful basis for each purpose, including the processing of children's information, health-related notes, identity numbers and hosted facial or liveness information, remains [TBD - LEGAL REVIEW REQUIRED].

8.2 Categories of data subjects and personal information

8.3 Information stored by Tabi and processed by Bitventure

When hosted identity verification is enabled, an eligible adult enters a South African identity number. Tabi's authenticated backend transmits that number to Bitventure to start a hosted facial and liveness check. The reviewed implementation does not persist the full identity number or its last four digits.

Tabi stores limited verification records, including consent and audit timestamps, an internal verification identifier, provider request references, the hosted-session link while active, normalised status and outcome fields, and a reduced user-facing status. The hosted-session link is removed from the private record when the attempt reaches a terminal state.

Bitventure, rather than Tabi, hosts the page that captures and processes the face or liveness scan and compares it with an available reference image. The reviewed Tabi implementation does not store Bitventure selfie or face images, source or target images, biometric templates or vectors, or facial or liveness scores.

Bitventure's retention, deletion, data-subject request process, operator terms and international-processing position remain [TBD - PROVIDER/LEGAL CONFIRMATION REQUIRED]. Hosted verification is restricted to allowlisted UAT testing and is not an approved verification service for ordinary public-beta users. Any alternative document or video-call process permitted by the Terms requires a separate approved operating procedure and privacy notice before it is offered.

8.4 Child information

Tabi includes child profiles and a linked Child Mode. Depending on the feature used, the platform may process a child's name, family relationship, school, grade, pickup or guardian notes, medical notes, ride participation, device identifier, precise location during an authorised trip, SOS information and safety events.

The app's design allows a parent or authorised guardian to create and manage the child relationship and to pair or revoke a child device. The approved legal basis, age rules, parental-authority standard, consent wording, minimisation requirements and retention periods remain [TBD - LEGAL REVIEW REQUIRED].

8.5 Recipients and categories of recipients

The exact legal names, contractual roles, subprocessors and data locations of the SMTP provider, Google services and Bitventure require final provider and legal confirmation.

8.6 Planned transborder flows

Firebase resources are configured in the africa-south1 region where supported. Certain scheduled backend jobs run from me-central1. Google, Firebase, Maps, authentication, messaging, website, email and Bitventure infrastructure may involve processing outside South Africa or access from other countries.

The exact countries, provider entities, transfer mechanisms, contractual safeguards and onward recipients remain [TBD - PROVIDER/LEGAL CONFIRMATION REQUIRED]. No statement in this Manual should be read as confirming that all personal information remains in South Africa.

8.7 Information security measures

The reviewed implementation uses or is designed to use the following high-level safeguards:

• Firebase Authentication and authenticated service access;

• Firestore and Cloud Storage access rules based on account, family, ride and device roles;

• backend-only processing for sensitive provider integrations and protected record projections;

• HTTPS or TLS for network and email transport;

• Google Secret Manager for provider credentials;

• restricted private verification records and reduced user-facing status records;

• user-initiated live tracking with trip-scoped access and a persistent Android notification;

• rate limits and attempt controls for child pairing and identity verification; and

• operational logging that is designed to exclude identity numbers, credentials, tokens, hosted links and raw biometric payloads.

App Check is integrated but was not confirmed as enforced. No independent security certification was established. These measures reduce risk but do not guarantee security.

9 How to request access to a record

9.1 Prescribed form

A requester must complete the current PAIA Form 2 Request for Access to Record prescribed under regulation 7. The current form is available from the Regulator at https://inforegulator.org.za/paia-forms/.

The requester should provide:

• sufficient details to identify the requester and the requested record;

• proof of identity and, where applicable, proof of authority to act for another person;

• the form of access required;

• contact details and the preferred method for receiving the decision;

• the right to be exercised or protected; and

• an explanation of why the record is required for the exercise or protection of that right.

Send completed requests addressed to the Information Officer or Head of ANCODE (PTY) LTD to support@tabifamilyrides.co.za or the company postal address in section 3. The responsible officeholder and formal registration remain pending confirmation.

9.2 Assistance and verification

The Operator may provide reasonable assistance with the prescribed process and may ask for information reasonably necessary to confirm identity, authority and the requested record. A requester should not send passwords, one-time codes, biometric images, detailed medical information or unrelated children's information.

9.3 Fees

Fees are governed by PAIA and the current prescribed schedule. The Regulator's fee schedule available at https://inforegulator.org.za/paia-fees-structure/ lists a private-body request fee of R140, reproduction charges, a search and preparation charge after the first hour, and a possible deposit where the search exceeds six hours. The current schedule and any applicable exemption must be checked when a request is processed.

If fees are payable, the requester will be notified using PAIA Form 3 Outcome of Request and of Fees Payable before access is provided. The Operator may withhold access until the applicable prescribed fees have been paid.

9.4 Decision period

Subject to PAIA, the Head must decide the request and notify the requester as soon as reasonably possible and ordinarily within 30 days after receiving a procedurally complete request. PAIA permits a limited extension of up to a further 30 days in specified circumstances. The requester must receive notice of any extension and the reasons for it.

9.5 Third-party notice and form of access

PAIA's third-party notification and representation procedures may apply where disclosure could affect another person. If access is granted, the decision will state the applicable fee and the form in which access will be provided. Access may be given in another reasonable form if the requested form would unreasonably interfere with operations, damage the record or infringe copyright.

10 Decisions refusal grounds and remedies

10.1 Decision and refusal

Access may be refused only on a ground recognised by PAIA. Depending on the record, grounds may include protection of another person's privacy, confidential or commercial information, safety, privileged material, research information, or records whose disclosure is prohibited by law. Mandatory-disclosure provisions may override certain refusal grounds where PAIA requires it.

If a record cannot be found or does not exist, the Operator will follow the procedure required by section 55 of PAIA. If access is refused, the decision must give adequate reasons and explain the available remedy.

10.2 Remedies for a private-body request

A private body does not have PAIA's internal appeal procedure applicable to specified public bodies. A requester or affected third party may, subject to PAIA:

• submit PAIA Form 5 Complaint Form to the Information Regulator after first giving the private body an opportunity to respond;

• lodge the complaint within the prescribed period, currently described by the Regulator as 180 days from the refusal, non-response or other reviewable decision; or

• apply to a competent court for appropriate relief as permitted by PAIA.

Current complaint guidance and Form 5 are available at https://inforegulator.org.za/complaints/ and https://inforegulator.org.za/paia-forms/.

11 POPIA data subject requests

A person may use the applicable POPIA process to request access to personal information or, where the legal requirements are met, object to processing or request correction, deletion or destruction. POPIA's prescribed correction and deletion form is separate from PAIA Form 2, even though both regimes use numbered forms.

Privacy and data-subject requests may be addressed to the Information Officer or Head of ANCODE (PTY) LTD through support@tabifamilyrides.co.za. The Operator may verify the requester's identity and authority. The officer registration, process, lawful bases, retention exceptions and provider escalation steps remain [TBD - LEGAL AND OPERATIONAL CONFIRMATION REQUIRED].

12 Retention and deletion

The reviewed implementation does not establish a complete approved retention schedule for all records. The Operator should retain records only for a lawful purpose and for no longer than permitted, subject to operational, safety, fraud-prevention, dispute and legal requirements.

The account-deletion implementation targets the authentication account, primary user profile including area and beta acknowledgment, specified subcollections and storage paths, public driver profile and local identity-verification records. The updated beta backend also targets feedback and screenshots, submission controls, survey answers and invitation state, and shuttle enquiries and controls. Deployment and both deletion paths must be verified for the released candidate. Some shared ride, trip and family records are cancelled or marked deleted rather than erased. Support mailbox copies, provider-forwarded enquiries and Crashlytics reports are separate stores; deleting an account does not automatically erase them. Comprehensive deletion of child location history, trip tracking, safety records, reviews, missing-item records, notification outbox records, logs and backups was not established.

Firebase states that Crashlytics keeps crash stack traces, extracted minidump data and associated identifiers for 90 days before beginning removal. Account deletion does not initiate deletion of these provider reports, and Tabi does not attach a Tabi account ID for matching them to an account. Other retention decisions remain subject to the approved schedule and lawful exceptions.

No fixed period is promised in this Manual. The final retention schedule, deletion exceptions, backup lifecycle and provider deletion procedures remain [TBD - RETENTION POLICY AND LEGAL REVIEW REQUIRED].

13 Availability of this Manual

Once approved, a copy of this Manual is intended to be available:

• on the Tabi website at https://tabifamilyrides.co.za/paia;

• for inspection at the Operator's confirmed physical office during normal business hours;

• to a person upon request, subject to any prescribed reproduction fee; and

• to the Information Regulator upon request or as required by law.

The proposed website page must not be described as live until it has been published and tested over valid HTTPS.

14 Updating and approval

The Head will review this Manual when material records, processing activities, providers, contact details or legal requirements change and otherwise at reasonable intervals.

Issued by:

Prepared for ANCODE (PTY) LTD. Issuance by the confirmed Information Officer or Head and final approval remain pending.

15 Official sources

• Information Regulator PAIA resources, Guide, forms and templates: https://inforegulator.org.za/paia/

• Information Regulator private-body PAIA Manual template: https://www.inforegulator.org.za/wp-content/uploads/2020/07/PAIA-Manual-Template-Private-Body.pdf

• Information Regulator PAIA forms: https://inforegulator.org.za/paia-forms/

• Information Regulator current fee structure: https://inforegulator.org.za/paia-fees-structure/

• Promotion of Access to Information Act 2 of 2000: https://www.justice.gov.za/legislation/acts/2000-002.pdf

• Regulations relating to the Promotion of Access to Information 2021: https://www.justice.gov.za/legislation/notices/2021/20210827-gg45057gon757-PAIAregulations.pdf

• Protection of Personal Information Act 4 of 2013: https://www.gov.za/documents/protection-personal-information-act

• Information Regulator Guidance Note on Information Officers and Deputy Information Officers: https://inforegulator.org.za/wp-content/uploads/2025/07/Guidance_Note_on_Information_Officers_.pdf