Manual in terms of section 51 of the Promotion of Access to Information Act, 2 of 2000.
This manual is published by Lebon Consulting (Pty) Ltd, operator of the xverified platform, as a private body in terms of section 51 of PAIA, as amended by the Protection of Personal Information Act 4 of 2013. It explains what records we hold, how to request access to them, the fees that apply and the remedies available if a request is refused.
The private body and its Information Officer.
- Name of private body
- Lebon Consulting (Pty) Ltd (registration number 2021/570343/07), an authorised Financial Services Provider, FSP 52013, trading as and operating the xverified platform.
- Information Officer
- Isaiah Mphaloane, Managing Director.
- Deputy Information Officer
- Requests may also be addressed to the Information Officer's office at the contact details below; a deputy is designated internally and acts in the Information Officer's absence.
- Physical address
- 5th Floor, Bloukrans Building, 4 Daventry Street, Lynnwood Manor, Pretoria, 0081
- Postal address
- 5th Floor, Bloukrans Building, 4 Daventry Street, Lynnwood Manor, Pretoria, 0081
- Telephone
- 012 745 8100
- info@lebonconsulting.co.za
- Website
- https://xverified.co.za
The Information Regulator's guide.
The Information Regulator has compiled a guide in terms of section 10 of PAIA, in each official language, explaining how to exercise the rights the Act confers. The guide is available from the Regulator at the details below and on its website.
- Regulator
- Information Regulator (South Africa)
- Physical address
- JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001
- Postal address
- P.O. Box 31533, Braamfontein, Johannesburg, 2017
- inforeg@justice.gov.za (general) · PAIAComplaints@inforegulator.org.za (PAIA complaints)
- Website
- https://inforegulator.org.za
Records held by the private body.
Records automatically available without a PAIA request: the content of this website, including the privacy policy, terms of service, security and compliance page, pricing page, sub-processors list and this manual; marketing material; and the FSCA licence details published on the regulator’s register.
Records available on request under PAIA, subject to the grounds for refusal in Chapter 4 of Part 3 of the Act:
- Company records: incorporation documents, statutory registers, minutes and resolutions, shareholder records.
- Financial records: financial statements, tax records, banking and accounting records, invoices.
- Regulatory records: FSCA licensing records, FAIS and FICA compliance records, Risk Management and Compliance Programme.
- Human resources records: employment contracts, personnel files, payroll, leave and disciplinary records.
- Client records: engagement letters, processing agreements, correspondence, invoices and statements of account.
- Operational records: tracing case files, verification results, claim packs and journals held as operator on behalf of clients; policies and procedures.
- Supplier and sub-processor records: contracts, service agreements, correspondence.
- Information technology records: system documentation, access logs, security records.
Records available in terms of other legislation may be requested under that legislation rather than PAIA, including the Companies Act 71 of 2008, the Financial Advisory and Intermediary Services Act 37 of 2002, the Financial Intelligence Centre Act 38 of 2001, the Income Tax Act 58 of 1962, the Basic Conditions of Employment Act 75 of 1997, the Labour Relations Act 66 of 1995 and the Protection of Personal Information Act 4 of 2013.
Processing of personal information (POPIA section 51(1)(c)–(e)).
- Purpose of processing
- Tracing, identifying and verifying beneficiaries, members, policyholders, account holders, shareholders and heirs on the instruction of the institution that owes them a benefit; providing financial and compliance services; employment; supplier management; and complying with the law.
- Categories of data subjects
- Beneficiaries, dependants and heirs traced on behalf of clients; members, policyholders and account holders; client personnel; employees, tracers and contractors; suppliers; website visitors and enquirers.
- Categories of information
- Identity numbers and names; dates of birth and death; family relationships; contact details; employment details; bank account details; certified identity documents and signed forms; verification results and case journals; and the special personal information strictly necessary for a trace, such as a dependant's minority or a customary marriage.
- Recipients
- The client institution that instructed the trace (responsible party); sub-processors listed at /sub-processors; regulators and courts where the law requires; auditors under confidentiality.
- Cross-border flows
- Client and case data is processed in South Africa. Any transfer to a sub-processor outside South Africa is made only under section 72 of POPIA, with the client's written agreement, and is listed on the sub-processors page.
- Security measures
- Encryption at rest and in transit, tenant isolation, role-based access with multi-factor authentication, append-only journals, masking of identity numbers in logs, and the controls described on the security and compliance page.
How to request access to a record.
- Complete the prescribed request form (Form 2 under the PAIA Regulations, 2021), available from the Information Regulator’s website, and send it to the Information Officer by email or post at the details in Part 1.
- Provide enough detail to identify the record, state which right you are exercising or protecting and why the record is required for it (section 50), state the form of access you want, and give an address or email for the response. If you act for someone else, provide proof of your authority.
- Pay the prescribed request fee when asked, unless you are requesting personal information about yourself. A deposit may be required where search and preparation will take more than six hours. The access fees for reproduction, searching and preparation are those prescribed in the PAIA Regulations.
- The Information Officer will decide within 30 days of receiving a complete request, extendable once by up to 30 days where the Act permits, and will notify you of the decision, the fees payable and, on refusal, the reasons and the grounds relied on.
Grounds for refusal
Access may or must be refused on the grounds in Chapter 4 of Part 3 of PAIA, including the protection of the privacy of a third party, commercial information of a third party or of the private body, information given in confidence, the safety of persons and property, records privileged from production in legal proceedings, and research information. A tracing case file is held on behalf of a client institution and concerns third parties, so most of its contents fall under these grounds.
Remedies
A private body has no internal appeal. If a request is refused, or not decided in time, the requester may lodge a complaint with the Information Regulator at PAIAComplaints@inforegulator.org.za within 180 days, or apply to a court with jurisdiction.
Availability of this manual.
This manual is available on this website, at our offices during business hours, and from the Information Regulator. It is reviewed at least annually and whenever the records we hold or the way we process personal information changes. Last reviewed on 2026-10-09.