PAIA Manual
Prepared under section 51 of the Promotion of Access to Information Act 2 of 2000 (PAIA), and to address the requirements of the Protection of Personal Information Act 4 of 2013 (POPIA).
Version 2026-10-01 · Effective 1 October 2026
1. Purpose of this manual
This manual explains what records GymBear holds, how to ask for access to them, and how GymBear processes personal information. It helps anyone who wants to exercise their right of access to information held by a private body.
2. Contact details
| Detail | Value |
|---|---|
| Name of private body | Luigi Lottino, trading as GymBear |
| Type | Sole proprietorship |
| Information Officer (head of the body) | Luigi Lottino |
| Information Regulator registration | 2026-067687 |
| privacy@gymbear.app | |
| Website | https://gymbear.app |
| Physical and postal address | Available on request from privacy@gymbear.app |
3. Guide on how to use PAIA
The Information Regulator has published a guide explaining how to use PAIA and POPIA to request access to records. It is available in all official languages from the Regulator at inforegulator.org.za/paia, or by contacting the Regulator directly. A copy can also be requested from us at privacy@gymbear.app.
4. Records available without a formal request
- Privacy Policy
- Terms of Service and Operator Agreement
- This PAIA manual
- A person’s own account information, which they can see in the app or request by email
5. Records kept under other laws
GymBear keeps records where these laws require them, to the extent they apply:
- Protection of Personal Information Act 4 of 2013
- Promotion of Access to Information Act 2 of 2000
- Electronic Communications and Transactions Act 25 of 2002
- Consumer Protection Act 68 of 2008
- Income Tax Act 58 of 1962 and Tax Administration Act 28 of 2011
6. Subjects and categories of records held
| Subject | Records |
|---|---|
| Accounts | Login accounts of trainers and clients, trainer business profiles, team members and roles |
| Client records held for trainers (as operator) | Client contact details, goals, measurements, programmes, workouts, sessions, schedules, invoices, notes, health and injury information, client logs, feed posts |
| Consent | Records of what users agreed to, which version, and when |
| Operations | Usage events, error reports, security and rate-limit records |
| Suppliers | Agreements and data processing agreements with service providers |
| Business | Correspondence, and tax and financial records of GymBear |
Client records held for trainers belong to the trainer, who is the responsible party. Requests for those records should normally go to the trainer. We will help them respond.
7. How we process personal information
Purposes: providing the GymBear service to trainers and their clients, keeping it secure, fixing problems, improving the product, and meeting legal obligations.
Categories of data subjects and information: trainers and their team members (name, email, business details), and clients (contact details, training records, and health information with consent).
Recipients: the client’s own trainer’s business, other clients of the same trainer only for feed posts a client chose to share, and GymBear’s service providers: Supabase, Resend, Sentry, Vercel and Cloudflare.
Transfers outside South Africa: data is stored in the European Union (Sweden, with error reports in Germany). Supabase, Sentry, Resend and Cloudflare are bound by data processing agreements, as allowed by section 72 of POPIA. Vercel only delivers the app’s pages, under its standard terms, and does not receive client data.
Security: encryption in transit and at rest, database row-level security separating each trainer’s data, trainer-only health notes, rate limiting, and regular security reviews. See the Privacy Policy for full details.
8. How to request access to a record
- Use Form 2 (Request for Access to Record of a Private Body), available from the Information Regulator’s website, and send it to privacy@gymbear.app.
- Give enough detail to identify the record and yourself, say how you want to receive it, and explain which right the record is needed to exercise or protect.
- If you are asking on behalf of someone else, include proof that you may act for them.
- Fees, where applicable, are those prescribed in the PAIA Regulations. You will be told of any fee before the record is processed.
- We will respond within 30 days, which may be extended by up to 30 days in the circumstances PAIA allows. Access may be refused only on the grounds set out in PAIA.
For requests about your own personal information (to see, correct or delete it), you can simply email privacy@gymbear.app. No form or fee is needed.
9. Complaints
If you are unhappy with a decision on your request, you may complain to the Information Regulator at inforegulator.org.za or apply to court, as provided in PAIA.
10. Availability and updates
This manual is available at https://gymbear.app/paia and on request by email. It is reviewed at least once a year and whenever GymBear’s records or processing change.