PAIA Manual
Prepared under section 51 of the Promotion of Access to Information Act 2 of 2000, as amended · Version 2 · compiled 4 November 2026
1. Acronyms
| DIO | Deputy Information Officer |
| FIC Act | Financial Intelligence Centre Act 38 of 2001 |
| Inves | Inves Capital (Pty) Ltd, registration number 2016/437415/07 |
| IO | Information Officer |
| PAIA | Promotion of Access to Information Act 2 of 2000, as amended |
| POPIA | Protection of Personal Information Act 4 of 2013 |
| Regulator | Information Regulator |
2. What this manual is for
This manual helps you:
- find the records Inves makes available without a request (section 5);
- make a request for a record Inves holds, knowing the subjects it holds records on (sections 7 and 9);
- find the records Inves holds under other laws (section 6);
- reach Inves's Information Officer and Deputy Information Officer (section 3);
- find the Regulator's guide on how to use PAIA (section 4); and
- know how Inves processes personal information: why, about whom, who receives it, whether it leaves South Africa, and how it is protected (section 8).
3. Contact details
Inves is a private company. It issues and redeems ZARP, a rand stablecoin, and issues ZARPY, both to institutional partners. ZARP Stablecoin (Pty) Ltd and Venox IO (Pty) Ltd are its juristic representatives; each publishes its own manual.
| Information Officer | The Managing Director of Inves Capital (Pty) Ltd |
| Deputy Information Officer | The Compliance Officer of Inves Capital (Pty) Ltd |
| Email, for requests under PAIA and POPIA | compliance@inv.es |
| Telephone | +27 64 874 1021 |
| Physical address | 31 Parliament Street, Speakers Corner, Cape Town, 8000 |
| Postal address | 31 Parliament Street, Speakers Corner, Cape Town, 8000 |
| General email | hello@inv.es |
| Websites | inv.es and zarpstablecoin.com |
4. The Regulator's guide on how to use PAIA
4.1 The Regulator has updated and made available the Guide on how to use PAIA under section 10(1) of PAIA. It is for anyone who wishes to exercise a right under PAIA or POPIA.
4.2 The Guide is available in each official language and in braille. It describes the objects of PAIA and POPIA; how to reach information officers; how to request a record of a public or private body; the help available from the Regulator; every remedy, including a complaint to the Regulator and an application to court; the manuals bodies must compile; the voluntary disclosure of records; the fees; and the regulations made under PAIA.
4.3 You can get the Guide:
- from the Regulator's website, inforegulator.org.za;
- from the Regulator's office, during normal office hours; or
- on request to Inves's Information Officer.
4.4 A copy of the Guide in English and Afrikaans is available for inspection at Inves's office, at the address in section 3, during normal business hours.
5. Records available without a request
These records are available to anyone, without a request under PAIA (section 52).
| Category | Records | On the website | On request |
|---|---|---|---|
| Terms | The ZARP Terms of Service | zarpstablecoin.com/terms | ✓ |
| Disclosures | The FAIS disclosure; the compliance page | inv.es/fais-disclosure.html; zarpstablecoin.com/fais-disclosure; zarpstablecoin.com/compliance | ✓ |
| Reserves | The independent reserve attestation reports for ZARP | zarpstablecoin.com/transparency | ✓ |
| Data protection | The privacy policy; this manual | zarpstablecoin.com/privacy; inv.es/privacy.html; inv.es/paia-manual.html | ✓ |
| Company | Inves's name, registration number and registered address | inv.es | ✓ |
6. Records held under other laws
Inves keeps records under these laws. A record held under a law may be available under that law, or by a request under PAIA.
| Law | Records |
|---|---|
| Companies Act 71 of 2008 | Memorandum of incorporation, registers of directors and securities, minutes and resolutions, annual financial statements |
| Financial Intelligence Centre Act 38 of 2001 | Client due-diligence and transaction records; the Risk Management and Compliance Programme |
| Financial Advisory and Intermediary Services Act 37 of 2002 | Records of the financial services Inves renders and its application for authorisation |
| Financial Sector Regulation Act 9 of 2017 | Records the Financial Sector Conduct Authority may require |
| Income Tax Act 58 of 1962; Tax Administration Act 28 of 2011; Value-Added Tax Act 89 of 1991 | Tax records and returns; Crypto-Asset Reporting Framework and Common Reporting Standard records |
| Currency and Exchanges Act 9 of 1933, and the Exchange Control Regulations, 1961 | Records of cross-border transactions |
| Electronic Communications and Transactions Act 25 of 2002 | Electronic records and signatures |
| Protection of Personal Information Act 4 of 2013 | Records of the processing of personal information |
| Promotion of Access to Information Act 2 of 2000 | This manual; records of requests |
| Basic Conditions of Employment Act 75 of 1997; Labour Relations Act 66 of 1995; Employment Equity Act 55 of 1998; Skills Development Levies Act 9 of 1999; Unemployment Insurance Act 63 of 2001; Unemployment Insurance Contributions Act 4 of 2002; Compensation for Occupational Injuries and Diseases Act 130 of 1993 | Employment records |
7. Subjects on which Inves holds records
| Subject | Categories of records | Inves |
|---|---|---|
| Company and governance | Incorporation documents, statutory registers, board and shareholder resolutions, minutes | ✓ |
| Regulatory | Risk Management and Compliance Programme and risk assessment; correspondence with the Financial Intelligence Centre, the Financial Sector Conduct Authority and other regulators; registrations and filings; reports to the Financial Intelligence Centre | ✓ |
| Partners | Applications; due-diligence records of each partner, its directors, shareholders, beneficial owners and representatives; screening results; agreements; verified and approved wallet addresses; correspondence | ✓ |
| Transactions | Issuances and redemptions of ZARP; ZARPY holdings and claims; bank statements and records of money received and paid; on-chain transaction records | ✓ |
| Reserves and finance | Reserve holdings and their attestation reports; financial statements; accounting records; tax records | ✓ |
| Platform and security | Audit records of actions in the platform; system logs; agreements with technology providers, including the operator agreement with Totemiq Limited | ✓ |
| Personnel | Employment and contractor records | ✓ |
| Suppliers and advisers | Agreements, invoices and correspondence | ✓ |
8. Processing of personal information
8.1 Purpose
Inves processes personal information to:
- identify and verify its partners and the people who own, control or represent them, screen them, keep records and report to the Financial Intelligence Centre, as the FIC Act requires;
- report tax information to the South African Revenue Service;
- perform its agreements with partners: issue and redeem ZARP, verify and approve wallet addresses, pay redemptions and send notices;
- match money paid into its bank account to the partner it belongs to;
- run the partner portal securely and keep a record of who did what;
- answer enquiries;
- keep evidence of where ZARPY's daily rate came from; and
- employ its staff and pay its suppliers.
8.2 Data subjects and their information
| Data subjects | Personal information |
|---|---|
| Partners and applicants (companies) | Names, registration number, country, business activity, tax number and tax residence, bank account details, wallet addresses |
| Partners' representatives and contact persons | Names, email address, phone number, whether they hold a prominent public position and its details |
| Partners' directors, shareholders, beneficial owners and controlling persons | Names, share of ownership, identification and tax-residence information, screening results (special personal information) |
| Portal users | Name, email address, sign-in and two-factor credentials, notification choice, audit record of their actions |
| People who pay money into Inves's bank account | Name as their bank sends it, payment reference, part of the account number |
| People who contact Inves, and website visitors | Name, email address, company, message; IP address and browser details |
| Staff of the fund administrator who send the daily rate | Name, email address, email signature |
| Clients of Venox IO (Pty) Ltd, and their beneficial owners and controlling persons | The due-diligence, tax and transaction information Venox passes to Inves |
| Employees, directors and contractors | Names, contact details, identity and tax numbers, bank details, employment records |
| Suppliers and advisers | Names, contact details, registration and VAT numbers, bank details |
8.3 Recipients
| Personal information | Recipients |
|---|---|
| Partner and due-diligence information, transactions and portal records | Totemiq Limited, Inves's technology provider and operator under POPIA, only when Inves grants it access for an incident; Amazon Web Services, which hosts the platform |
| Due-diligence and transaction records, and reports | The Financial Intelligence Centre and the Financial Sector Conduct Authority, as the law requires |
| Tax information | The South African Revenue Service |
| Bank account details for payments | First National Bank, Inves's bank |
| Email and documents | Google (Google Workspace) |
| Website enquiries and CARF self-certifications | Formspree, which forwards the partner and CARF self-certification forms on zarpstablecoin.com |
| Internal reporting dashboard users' email addresses | Fly.io and Resend |
| Deposit amounts and payment references | Discord, for alerts to Inves's operations team |
| Wallet addresses | Alchemy and Safe, blockchain data services |
| Website visitors' IP addresses and browser details | GitHub, DreamHost, Google Fonts and CoinGecko |
| Whatever their work needs | Inves's auditors and legal advisers; the police or a court, when the law requires |
Screening results are held by Inves alone and are not supplied to Totemiq.
8.4 Transborder flows
The platform's data is stored by Amazon Web Services in Cape Town. Personal information leaves South Africa as follows:
| To | Country | Information | Basis |
|---|---|---|---|
| Totemiq Limited | United Arab Emirates (access from) | Platform information, only when Inves grants access for an incident; system logs and metrics designed to exclude personal information | POPIA section 72(1)(a): a binding agreement with terms substantially similar to POPIA's |
| Amazon Web Services | United States | The partner portal's access logs: IP address, page address, browser details, for 30 days | The provider's terms |
| Several countries | Email and documents | The provider's terms | |
| Formspree, Resend, Discord, GitHub, DreamHost, Google Fonts, CoinGecko, Alchemy, Safe | United States and other countries | As listed in section 8.3 | The providers' terms |
8.5 Security measures
- Data stored in Cape Town, encrypted at rest and in transit.
- Two-factor authentication for every portal user.
- An audit record of every change in the platform that the platform's own software cannot change or delete.
- Access for named people only; Totemiq's access limited to incidents Inves grants.
- Screening results held by Inves alone.
- A written operator agreement with Totemiq under POPIA section 21, which requires Totemiq to tell Inves immediately of any unauthorised access.
Today the platform runs in a transitional Amazon Web Services account that ZARP Stablecoin (Pty) Ltd holds for Inves, and one person administers it for both Inves and Totemiq. Inves is moving the platform to accounts it owns, with its own administrators.
8.6 Retention
Records the FIC Act requires are kept for at least five years from the end of the business relationship or from the transaction, then de-identified. Inves does not yet de-identify records automatically when their period ends; it is building the means to. The privacy policy lists every period.
9. How to request a record
9.1 Who may ask. Anyone may ask for a record of Inves that they need to exercise or protect a right (PAIA section 50). You may also ask for your own personal information under POPIA section 23, by the same procedure.
9.2 How. Send Form 2 of the PAIA Regulations, 2021 to the Information Officer at the email or address in section 3. The form is in the Regulations and in the Regulator's Guide. State the record, the right you need it for, and how you want to receive it. If you ask for someone else, include proof that you may.
9.3 Fees. The fees are those prescribed for private bodies in Annexure B of the PAIA Regulations, 2021. A request fee is payable before a request is processed, except by a person asking for their own personal information. Inves may also charge for searching for and preparing a record, and for copies. If the search will take more than six hours, Inves may ask for a deposit of up to one third of the access fee. Inves tells you the fees on Form 3 before it processes the request.
9.4 Answer. Inves answers within 30 days of receiving the request. It may extend that once, by up to 30 days, and tells you why (PAIA sections 56 and 57). If it does not answer in time, the request is regarded as refused.
9.5 Third parties. If a record concerns another person, Inves tells that person and considers what they say before deciding (PAIA section 71).
9.6 Grounds for refusal. Inves must or may refuse access on the grounds in Chapter 4 of Part 3 of PAIA, including to protect another person's privacy, a third party's commercial or confidential information, the safety of people or property, records privileged in legal proceedings, and Inves's own commercial information. Inves may not disclose that it has reported a matter to the Financial Intelligence Centre (FIC Act section 29), and answers every request subject to that rule.
9.7 Correction, deletion and objection. To ask Inves to correct or delete personal information, use Form 2 of the POPIA Regulations, 2018. To object to its processing, use Form 1 of those Regulations.
9.8 Remedies. If you disagree with Inves's decision, you may complain to the Regulator within 180 days (PAIA sections 77A and 77B), or apply to a court (section 78). The Regulator: Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191; PAIAComplaints@inforegulator.org.za for access requests and POPIAComplaints@inforegulator.org.za for personal information; 010 023 5200; inforegulator.org.za.
10. Availability and updating of this manual
10.1 This manual is available:
- on inv.es/paia-manual.html;
- at Inves's office, at the address in section 3, for inspection during normal business hours;
- to anyone on request, for the copying fee in Annexure B of the PAIA Regulations, 2021; and
- to the Regulator, on request.
10.2 The Information Officer reviews this manual at least once a year, and whenever what it describes changes.
Issued by the Information Officer, Inves Capital (Pty) Ltd