PAIA Manual

Prepared under section 51 of the Promotion of Access to Information Act 2 of 2000 (PAIA), as amended.

Date compiled and last updated: 20 October 2026

This manual explains how to request access to records held by Diedre Riedlinger, a sole proprietor trading as Bitten Cookies. It also describes the personal information processed in running our cookie business.

1. Our business and contact details

Bitten Cookies makes and sells cookies in South Africa. The business is operated by Diedre Riedlinger as a sole proprietor.

Address requests for access to records to the Information Officer. For an ordinary order enquiry, delivery question or refund request, contact us directly using the same email address or telephone number.

2. The PAIA guide

The Information Regulator publishes a guide explaining PAIA and the Protection of Personal Information Act 4 of 2013 (POPIA). It covers access requests, assistance, fees and remedies when access is refused.

You can read the official English PAIA guide (PDF) or find guides in other official languages and the current forms. Ask our Information Officer for help obtaining the guide or inspecting a copy during normal business hours.

The Information Regulator can be contacted at enquiries@inforegulator.org.za, 010 023 5200, or its toll-free number 0800 017 160. Its physical address is Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191. Current details are on the Regulator’s contact page.

3. Records available without a formal request

The following published information is freely available on our website without submitting a PAIA form:

• Product descriptions, current prices and publicly advertised offers.
• Published ordering, baking, dispatch and delivery information.
• Our Returns Policy, business contact details and this manual.

You can also contact us for routine assistance with your own order or invoice. We may need to verify your identity before sharing account or order information. Other customers’ records are not publicly available.

4. Records held by Bitten Cookies

These categories describe the records used in operating the business. A category being listed does not mean that every record exists or that access will automatically be granted. Requests are assessed under PAIA, including the protections for other people’s privacy and confidential information.

Subject	Categories of records
Customers and sales	Customer contact and account details; orders, quotations, invoices, payment references and status; refunds, cancellations and related correspondence.
Order fulfilment	Cookie quantities and packing information; collection or delivery instructions; selected Pudo locker details, backup delivery addresses, dispatch information and fulfilment notes.
Finance and suppliers	Expense records, receipts, supplier invoices, supplier contact details and payment-related business records.
Customer service and marketing	Enquiries, complaints, correspondence, offers, marketing consent and channel preferences, and opt-out requests.
Website and business systems	Product and website content, account-access records, website usage and technical logs, system settings and backups.
Access to information	This manual, access and correction requests, identity or representative-authority checks where needed, decisions and related correspondence.

5. Records under other legislation

Records may also be kept or made available under the following legislation, to the extent that it applies to the business and the particular record:

Legislation	Relevant records
PAIA, Act 2 of 2000	The manual, access requests, notices and decisions.
POPIA, Act 4 of 2013	Personal-information processing records, marketing preferences, and access, correction or objection requests.
Consumer Protection Act 68 of 2008	Sales and transaction records, product information, complaints, returns and refunds.
Electronic Communications and Transactions Act 25 of 2002	Electronic orders, transaction communications and online supplier disclosures.
Income Tax Act 58 of 1962 and Tax Administration Act 28 of 2011	Applicable accounting, income, expense and supporting tax records.

Listing legislation does not make confidential records available to everyone. Any separate statutory access procedure and lawful restriction still apply.

6. How to request access

Under section 50 of PAIA, access to a private body’s record depends on the record being required to exercise or protect a right, compliance with the prescribed procedure, and the absence of an applicable ground for refusal.

1. Complete Form 2: Request for Access to Record (PDF).
2. Identify the records as clearly as possible. Dates, an order or invoice number, or a description of the correspondence can help us locate them.
3. Identify the right you seek to exercise or protect and explain why you need the records for that purpose.
4. Provide the contact and address details requested in the form, the form of access you require, and how you would like to receive the decision.
5. If acting for another person, provide evidence of your authority. We may request reasonable proof of identity to protect personal information.
6. Send the completed form to dee@bittencookies.co.za, or deliver or post it to the Information Officer at the address in section 1. Using “PAIA request” in an email subject helps us identify it.

If you need assistance with the form or an accessible way to make your request, contact the Information Officer.

7. Fees, decisions and response times

We will notify you of any prescribed request or access fee, any lawful deposit and the basis for it. Applicable exemptions must be taken into account. Do not send payment until you receive a fee notice. Fees are governed by PAIA and its regulations, rather than a separate Bitten Cookies price list.

We will decide and respond as soon as reasonably possible, normally within 30 days after receiving the request and the particulars required by section 53. PAIA permits one extension of up to a further 30 days in specified circumstances. Where an extension is used, we will notify you within the original period, explain the reason and give the revised period. Requests involving third-party notification follow the applicable PAIA procedure.

If access is granted, the response will explain the form of access and any payable fee. If access is refused, the response will give reasons, identify the relevant legal provisions and explain the available remedies. Where protected information can reasonably be separated from the rest of a record, access to the remaining portion will be considered as required by PAIA.

PAIA contains grounds protecting matters such as another person’s personal information, confidential commercial information, legally privileged material and the safety of people or property, subject to the Act’s exceptions and public-interest provisions. If a requested record cannot be found or does not exist after reasonable searches, the Information Officer will provide the affidavit or affirmation required by section 55.

8. Complaints and other remedies

There is no PAIA internal appeal procedure for this private business. You may ask us to clarify a decision, but this does not suspend a statutory deadline.

If you are dissatisfied with a refusal, a failure to respond within the applicable period, or a decision about fees, an extension or the form of access, you may complain to the Information Regulator. PAIA generally allows 180 days from the relevant decision for a complaint; a failure to respond within the statutory period is treated as a refusal.

Use Form 5: Complaint Form (PDF) and follow the Regulator’s complaint procedure. PAIA complaints can be sent to PAIAComplaints@inforegulator.org.za. A court remedy may also be available under PAIA, subject to its procedures and time limits.

9. Processing personal information

Why we process information

We process personal information to take and fulfil orders, arrange payment and delivery, manage customer accounts, issue business documents, handle enquiries and complaints, manage suppliers and expenses, protect and maintain our systems, understand website usage, and meet legal and accounting obligations. Marketing preferences are used to manage communications requested by customers.

Whose information we process

People or organisations	Information categories
Customers and account holders	Names, email addresses, telephone numbers, account details, order history, billing or delivery addresses, chosen lockers, payment references and status, correspondence and marketing preferences.
Delivery recipients	Recipient names, contact details, delivery or collection information and instructions supplied for fulfilling an order.
Enquirers and records requesters	Contact details, the enquiry or request, relevant correspondence and identity or representative-authority information where needed.
Suppliers and service-provider contacts	Business and contact details, invoices, receipts and transaction information.
Website visitors and authorised system users	IP addresses, browser or device information, website interactions, session information and access or security logs, depending on the service used.

Recipients and service providers

Information may be supplied to the proprietor and authorised people assisting the business; payment providers such as Payfast; delivery providers such as Pudo/The Courier Guy; website hosting, email, analytics, software-support and backup providers; and professional advisers where needed. Regulators, courts or public authorities may receive information where the law requires or permits it. The information shared depends on the service or lawful purpose.

Order and customer information is also used in Bitten Cookies’ internal order, fulfilment and accounting systems. These records are not a public customer directory.

Processing outside South Africa

Our email and website services include Google and Automattic/Jetpack. Customer correspondence, email-routing data and website usage or technical information may be processed on their international infrastructure, including in the United States and other countries where these providers operate. The location depends on the provider and service.

Any transfer of personal information outside South Africa must meet an applicable condition in section 72 of POPIA, such as adequate legal or contractual protection, consent, or a qualifying contractual necessity. Contact the Information Officer for information about a particular service or transfer.

Information security

Our safeguards include password-protected administrative and business-system access, access limited to authorised people, HTTPS connections to the website and business application, and backups to support recovery. Security measures are intended to protect information from unauthorised access, loss and alteration. Access and safeguards must be reviewed as systems and risks change.

Your information and marketing choices

You may contact the Information Officer to ask whether we hold personal information about you, request access, seek correction or deletion where the law permits, or object to processing as provided by POPIA. We may verify your identity. Legal record-keeping duties can limit deletion.

Our optional early-offer preference allows customers to choose email or WhatsApp, with no more than one marketing message per month by the chosen channel. You can withdraw that preference at any time by contacting us. Necessary order and delivery communications serve a separate purpose.

For a complaint about the handling of personal information, contact the Information Regulator using its current POPIA complaint procedure.

10. Availability and updates

This manual is available free of charge on this website and for public inspection at the principal place of business listed in section 1 during normal business hours. Contact the Information Officer for an electronic copy, help arranging an inspection or a printed copy. A reasonable prescribed reproduction or delivery charge may apply to a supplied paper copy; any charge will be explained beforehand. A copy will be provided to the Information Regulator on request.

Diedre Riedlinger is responsible for reviewing and updating this manual when the business, its records or relevant requirements change.

Issued by: Diedre Riedlinger, sole proprietor trading as Bitten Cookies.