Skip to content
Sanctuary Mix

PAIA manual

How to ask Fonck (Pty) Ltd, the company behind Sanctuary Mix, for a record it holds, and what personal information it keeps and why. Prepared under section 51 of the Promotion of Access to Information Act.

Compiled on 30 September 2026.

This manual is also available as a PDF.

1. Acronyms

  • CIPC: Companies and Intellectual Property Commission.
  • PAIA: Promotion of Access to Information Act 2 of 2000.
  • POPIA: Protection of Personal Information Act 4 of 2013.
  • Regulator: the Information Regulator of South Africa.
  • SARS: South African Revenue Service.
  • We, us, our: Fonck (Pty) Ltd, registration number 2021/619083/07, trading as Sanctuary Mix.

2. What this manual is for

PAIA gives everyone the right to ask a private body for a record it holds, when the record is needed to exercise or protect a right. This manual helps you do that. It tells you:

  • which records you can get without making a formal request
  • which records we keep because other laws require them
  • the subjects we hold records on, and the kinds of records on each, so you can describe what you want
  • who to contact, and how to make a request
  • where to find the Regulator's guide to PAIA
  • what personal information we process and why, whose it is, who receives it, whether it leaves South Africa, and how we keep it secure

3. Contact details

We're a small company with one director and no employees. The director is the head of the company and its information officer, and he deals with every request.

Information officer

  • Name: Rikus Frederik Jonck, director
  • Street address: 15 Grieg Street, Van der Hoff Park, Potchefstroom, 2520, North West, South Africa
  • Postal address: the same as the street address
  • Phone: +27 81 325 8839
  • Fax: none
  • Email: support@sanctuarymix.com

Deputy information officer

None. Only an employee can be a deputy information officer, and we have no employees.

Head office

Our principal place of business is at the street address above, and the phone number and email address above are also our general contact details. Website: https://sanctuarymix.com

4. The Regulator's guide to PAIA

The Regulator publishes a guide on how to use PAIA (section 10 of PAIA). It explains what PAIA and POPIA are for, how to ask a public or private body for a record, the forms and fees, the help the Regulator gives, and what you can do if a request is refused, including complaining to the Regulator or going to court.

You can get the guide free:

5. Records you can get without a request

These are on our website, free, for anyone. You don't need to make a request: just open them.

  • Licence and terms of sale: what each licence allows, who you're buying from, prices, payment and delivery.
  • Refund policy.
  • Privacy policy: what personal information we collect, why, and your rights.
  • This PAIA manual.
  • Information about our guides and Sanctuary Mix Training, and our free handouts.

6. Records we keep under other laws

  • Companies Act 71 of 2008: our memorandum of incorporation, registration documents, register of directors, securities register, directors' decisions, annual financial statements, accounting records and annual returns.
  • Income Tax Act 58 of 1962 and Tax Administration Act 28 of 2011: tax returns (including provisional tax), assessments, correspondence with SARS and the records behind them.
  • Consumer Protection Act 68 of 2008: our terms of sale, refund policy and sales records.
  • Electronic Communications and Transactions Act 25 of 2002: the information section 43 requires for online sales, on our licence and terms page.
  • POPIA: our privacy policy, section 8 of this manual, which records how we process personal information (section 17 of POPIA), and church leaders' confirmations that a parent or guardian has agreed to an under-18 volunteer using the training.
  • PAIA: this manual.

We keep order and accounting records until seven years after the end of the financial year they belong to (our financial year ends in February), as the Companies Act (sections 24 and 28) asks, and then delete them.

7. Subjects and categories of records we hold

  • The company: the records the Companies Act requires (see section 6) and correspondence with CIPC.
  • Tax and accounting: annual financial statements (our financial year ends at the end of February), accounting records, bank statements, invoices and receipts, PayFast statements and payouts, tax returns, and correspondence with SARS and our accountant.
  • Orders and gifts: orders for our guides and team licences, gift orders ("Give a copy"), payment notices from PayFast, download records and refunds.
  • Sanctuary Mix Training: training accounts, church teams, progress, quiz scores, practical sign-offs, and confirmations of a parent's or guardian's agreement for volunteers under 18.
  • Correspondence: emails to and from support@sanctuarymix.com, and any letters.
  • Suppliers: our agreements with, and invoices from, Netlify, PayFast, Resend, GoDaddy and our accountant.
  • Our guides and website: the guides, handouts and training content, and the website's code.

Some of these records contain other people's personal information or commercial information. PAIA may require or allow us to refuse access to them, or to parts of them (see section 9).

8. How we process personal information

8.1 Why we process it

  • To sell and deliver our guides: to take your order, print the licensee's name on the PDF, email your download link, send fresh links when you ask, and count downloads so links can expire.
  • To run Sanctuary Mix Training: to sign you in, save your progress, let your church's leader see the team's progress and sign-offs, and set up a church's training when it buys a team licence.
  • To protect children: to know when a volunteer is under 18, and to wait for their church leader to confirm a parent's or guardian's agreement before we save their progress.
  • To answer your emails and handle refunds.
  • To email you once when orders open, if you ask us to.
  • To keep our accounting and tax records, and meet our other legal duties.
  • To show prices in rand or dollars, and record which country each sale was made to, for our tax records.
  • To keep the site and your account secure.

8.2 Whose information we hold, and what

  • Buyers, including people who give a copy: name, email address, what they bought, the amount, the PayFast payment reference, their country (from our website host's location lookup) and when they ordered. For a guide, we also keep which version of our terms they accepted and how many times their download link has been used.
  • Licensees and churches: the name a copy is licensed to and, for a team licence, the church's name and town, as typed at checkout. They're printed on every page of the PDF. For a team licence, we also record how many times, and when, the church's copy is downloaded.
  • People whose payment we couldn't check yet: the payment notice as PayFast sent it (which can include their name, email address, what they bought, the amount, the payment reference, their country and the licence details given at checkout), kept until we match it to an order.
  • Training users (church leaders and volunteers): name, email address, church, team membership and role, progress (lessons, tasks, "Check yourself" answers and quiz scores), practical sign-offs with the name and church of the person who signed them off, sign-in links and six-digit codes (which expire after 30 minutes), and a sign-in cookie that lasts 30 days. We keep a training account while it's open. Anyone can leave their church, or delete their account, at any time from their account page.
  • Volunteers under 18: the same, plus the fact that they're under 18 and whether their church leader has confirmed a parent's or guardian's agreement, with that leader's name and when they confirmed it. Until the leader confirms it, the volunteer can read the lessons, but we don't save their progress and nothing is signed off.
  • People who email us: their name, email address and whatever they write to us.
  • Site visitors: our host uses their approximate country (from their internet address) to show prices in rand or dollars, and keeps short-lived server logs for security.
  • Suppliers: the names and contact details of the people we deal with, and our agreements and invoices.
  • Our director: the details company and tax law require.

We never receive card or bank details: PayFast handles them. We don't have an email list at the moment.

8.3 Who receives it

  • Netlify hosts the website and stores orders and training records.
  • PayFast processes payments. We pass it what you're buying, your country and, for a guide, your email address, the licence details and the version of our terms you accepted. When you give a copy, you type your details on PayFast's page instead. PayFast tells us when you've paid.
  • Resend sends our emails: download links, sign-in links and codes, team notices, and order notes to our support mailbox.
  • GoDaddy hosts our support mailbox.
  • Our accountant keeps our accounting records.
  • SARS receives our tax returns and anything else tax law requires.
  • Your church: your church's leader, and anyone in your church who holds Level 3, see your name and training progress, whether you're under 18 and, if so, whether your parent or guardian has agreed, but not your email address. Everyone in your church sees who its leaders are. Leaders get an email when someone joins their team, and when a member says they're under 18.
  • Courts, the Regulator or other authorities, when the law requires us to give them information.

We don't sell personal information.

8.4 Information sent outside South Africa

Netlify, Resend and GoDaddy are in the United States, so our website's records (orders and training), the emails we send and the emails in our support mailbox are stored in, and sent through, the United States. PayFast and our accountant are in South Africa.

Netlify, Resend and GoDaddy each have a data processing agreement with us, which is part of their terms: they may use your information only on our instructions, to provide their service to us, and must keep it secure.

8.5 How we keep it secure

  • The whole site uses HTTPS, with HSTS, so browsers always connect securely.
  • A strict content security policy stops unapproved scripts running on our pages.
  • Sign-in links and six-digit codes work once and expire after 30 minutes. Sign-in cookies are signed, so they can't be faked or changed.
  • Download links expire, and every download is counted.
  • Orders and training records are kept in private storage (Netlify Blobs), never at a public web address.
  • There are limits on how often sign-in emails and fresh download links can be requested.
  • The admin dashboard opens only for the listed admin email address, or with a secret admin token.
  • Backups are kept on the director's computer, which is encrypted (FileVault).
  • Card and bank details never reach us: PayFast handles them.

9. How to ask for a record

Information about you

To find out whether we hold personal information about you, to ask us to correct or delete it, or to object to how we use it, email support@sanctuarymix.com. You don't need a PAIA form for these, and they're free. We may ask you to prove who you are first. To get a copy of the information itself, use the request process below (section 25 of POPIA). We'll tell you any fee in writing before we start.

Making a request

  1. Fill in Form 2 of the PAIA Regulations, 2021, "Request for access to record". Download it from the Regulator (Form 2, PDF) or ask us for a copy.
  2. Describe the record you want clearly enough for us to find it, and say how you'd like to receive it. Explain which right you want to exercise or protect, and why you need the record for it.
  3. Attach proof of your identity. If you're asking for someone else, attach proof that you may act for them.
  4. Email the form to support@sanctuarymix.com, or post or deliver it to 15 Grieg Street, Van der Hoff Park, Potchefstroom, 2520.

We'll help you with the form, free. If you can't fill it in because of a disability, or because you can't read or write, phone us and we'll fill it in for you and send you a copy.

What happens next

  • We'll ask you to pay the request fee of R140.00 before we deal with the request.
  • We'll decide within 30 days of receiving your request and tell you in writing. We may extend this once, by up to 30 days, for example if the request is large or needs a long search, or if you agree. If we do, we'll tell you why.
  • If searching for and preparing the record will take more than six hours, we'll ask for a deposit of no more than a third of the access fee first. If we then refuse the request, we'll repay the deposit.
  • If we grant the request, we'll tell you the access fee and how you'll receive the record. We may hold the record until the fees are paid.
  • If we refuse, we'll give our reasons and the sections of PAIA we rely on. We may refuse only on the grounds PAIA sets out, for example to protect another person's privacy or commercial information.
  • If a record involves someone else's information, PAIA may require us to tell them first and give them a chance to respond, which takes longer.
  • If we don't decide in time, PAIA treats the request as refused.

If you're unhappy with our decision

You may complain to the Regulator within 180 days of our decision, on the Regulator's Form 5 (section 77A of PAIA). After that, you may apply to a court within 180 days (section 78 of PAIA).

Fees

These are the fees for private bodies set in Annexure B of the PAIA Regulations, 2021 (Government Notice R757, Government Gazette 45057, 27 August 2021).

  • Request fee, paid by every requester: R140.00.
  • Photocopy or printout: R2.00 per A4 page or part of a page.
  • Copy in computer-readable form: on a flash drive you provide, R40.00; on a CD you provide, R40.00; on a CD we provide, R60.00.
  • Transcribing or copying pictures or video: done by an outside service, at the price it quotes.
  • Transcription of an audio record, per A4 page: R24.00.
  • Copy of an audio record: on a flash drive you provide, R40.00; on a CD you provide, R40.00; on a CD we provide, R60.00.
  • Search and preparation: R145.00 for each hour or part of an hour after the first hour, up to R435.00 in total.
  • Deposit, if the search takes more than six hours: up to one third of the access fee.
  • Postage, email or other electronic transfer: the actual cost, if any.

10. Where to find this manual

The manual is free.

11. Updating this manual

We review this manual every year, and update it when anything in it changes.

Issued by Rikus Frederik Jonck, director and information officer, Fonck (Pty) Ltd. Last updated: 30 September 2026.