PAIA Manual
Timm Roark Garde, trading as Candlewren Games
Prepared in terms of section 51 of the Promotion of Access to Information Act 2 of 2000 (as amended), following the Information Regulator’s PAIA Manual Template for a private body.
Date of compilation: 6 October 2026
Date of revision: 6 October 2026
1. Acronyms and abbreviations
- “Candlewren Games”, “we”, “us”: Timm Roark Garde, a natural person carrying on business as a sole proprietor under the unregistered trade name Candlewren Games. Under PAIA this is a private body, and its head is Timm Roark Garde himself.
- “IO”: Information Officer.
- “PAIA”: Promotion of Access to Information Act 2 of 2000 (as amended).
- “POPIA”: Protection of Personal Information Act 4 of 2013.
- “Regulations”: Regulations relating to the Promotion of Access to Information, 2021 (Government Notice R757, Government Gazette 45057, 27 August 2021).
- “Regulator”: Information Regulator (South Africa).
- “Republic”: Republic of South Africa.
2. Purpose of this manual
Candlewren Games is a one-person studio that makes Glimmerhop, a mobile game for Android and iOS, and runs the website candlewren.com. It has no employees.
This manual helps the public to:
- check the categories of records we hold that are available without a formal PAIA request;
- understand how to request access to a record, by describing the subjects on which we hold records and the categories of records held on each subject;
- know which of our records are available in accordance with other legislation;
- find the contact details of our Information Officer, who will help with any request;
- know about the Regulator’s Guide on how to use PAIA and how to get it;
- know whether we process personal information, why, about whom, and what kinds of information;
- know to whom that personal information may be supplied;
- know whether we transfer or process personal information outside the Republic, and to whom; and
- know what security measures protect the confidentiality, integrity and availability of the personal information we process.
3. Contact details
3.1 Head of the private body and Information Officer
As a sole proprietor, Timm Roark Garde is the head of the private body and also its Information Officer. No Deputy Information Officer has been designated, because the business is one person.
- Name: Timm Roark Garde
- Telephone: +27 61 294 8761
- Email: support@candlewren.com
- Fax: none
3.2 Access to information: general contact
- Email: support@candlewren.com (please use the subject line “PAIA request”)
3.3 Principal place of business
- Physical address: 68 Symmonds Lane, Howick, 3290, KwaZulu-Natal, South Africa
- Postal address: 68 Symmonds Lane, Howick, 3290, KwaZulu-Natal, South Africa. Postal delivery to this address is slow and unreliable, so please send requests by email; a request sent by post is still valid, but the 30-day period only starts when it reaches us.
- Telephone: +27 61 294 8761
- Email: support@candlewren.com
- Website: https://candlewren.com/
The business is run from a private residence. Please email first to arrange any visit or inspection.
4. The Regulator’s Guide on how to use PAIA
4.1 The Regulator has, in terms of section 10(1) of PAIA, updated and made available the revised Guide on how to use PAIA (the “Guide”), in an easily understandable form, as may reasonably be needed by anyone who wishes to exercise a right under PAIA or POPIA.
4.2 The Guide is available in each of the official languages and in braille.
4.3 The Guide describes:
- the objects of PAIA and POPIA;
- the postal and street address, phone and fax number and, if available, email address of the Information Officer of every public body, and of every Deputy Information Officer of every public and private body designated under section 17(1) of PAIA and section 56 of POPIA;
- the manner and form of a request for access to a record of a public body (section 11) and of a private body (section 50);
- the assistance available from the Information Officer of a public body, and from the Regulator, under PAIA and POPIA;
- all remedies in law for an act or failure to act in respect of a right or duty under PAIA and POPIA, including how to lodge an internal appeal, a complaint to the Regulator, and an application to court against a decision of the information officer of a public body, a decision on internal appeal, a decision of the Regulator or a decision of the head of a private body;
- the provisions of sections 14 and 51, which require public and private bodies to compile a manual, and how to get access to a manual;
- the provisions of sections 15 and 52, on the voluntary disclosure of categories of records by public and private bodies;
- the notices under sections 22 and 54 on the fees payable for requests; and
- the regulations made under section 92.
4.4 The Guide can be inspected or copied during normal working hours at the Regulator’s office, and at ours by appointment.
4.5 The Guide can also be obtained:
- on request from our Information Officer (by email, free of charge); or
- from the Regulator’s website: https://inforegulator.org.za/paia-guidelines/ (English: https://inforegulator.org.za/wp-content/uploads/2020/07/PAIA-Guide-English_20210905.pdf).
4.6 Copies of the Guide in English and isiZulu are available from us for inspection, by appointment, or by email on request.
4.7 Information Regulator (South Africa)
Physical and postal address: Woodmead North Office Park, 54 Maxwell Drive,
Woodmead, Johannesburg, 2191
Telephone: 010 023 5200 (toll free: 0800 017 160)
General enquiries: enquiries@inforegulator.org.za
PAIA complaints: PAIAComplaints@inforegulator.org.za
POPIA complaints: POPIAComplaints@inforegulator.org.za
Website: https://inforegulator.org.za/
5. Records available without a formal request
The following records are available without a PAIA request (section 52 of PAIA). No Form 2 or fee is needed.
| Category of records | Types of record | On the website | On request |
|---|---|---|---|
| Legal notices | Privacy Policy, Terms of Use, this PAIA manual | Yes (/privacy/, /terms/, /paia/) | Yes, by email |
| Player support | Support and FAQ page | Yes (/support/) | Yes, by email |
| Press and product information | Fact sheet, descriptions, screenshots, logos, press-kit archive | Yes (/press/) | Yes, by email |
| Advertising disclosures | app-ads.txt | Yes (/app-ads.txt) | Yes, by email |
| Your own personal information | A copy of the personal information we hold about you (POPIA section 23) | No | Yes, free of charge, by email to the Information Officer |
6. Records available in accordance with other legislation
We keep records as required by the following legislation, where it applies to a sole proprietor. Some of these records are available only to the persons or authorities named in that legislation.
| Category of records | Applicable legislation |
|---|---|
| PAIA manual | Promotion of Access to Information Act 2 of 2000 |
| Records of personal information processed, consents to direct marketing, security compromise records | Protection of Personal Information Act 4 of 2013 |
| Income and expense records, sales reports, invoices, bank statements, income tax returns and assessments | Income Tax Act 58 of 1962 |
| Records supporting tax returns, kept for five years from submission | Tax Administration Act 28 of 2011 |
| VAT records, invoices and returns (if and while registered as a VAT vendor) | Value-Added Tax Act 89 of 1991 |
| Information disclosed to consumers for electronic transactions; consumer correspondence | Electronic Communications and Transactions Act 25 of 2002 |
| Consumer agreements, terms, refund and complaint records | Consumer Protection Act 68 of 2008 |
The Companies Act 71 of 2008 does not apply: Candlewren Games is not a company and has no memorandum of incorporation, share register or company records. As there are no employees, no records are kept under labour legislation (such as the Basic Conditions of Employment Act or the Unemployment Insurance Act).
7. Subjects on which we hold records, and categories of records
| Subject | Categories of records |
|---|---|
| Business identity | Records of the trade name Candlewren Games; the candlewren.com domain registration; developer accounts with Google Play and Apple (App Store Connect); trade-mark searches and advice |
| Finance and tax | Bank statements; payout and sales reports from Google Play and Apple; AdMob earnings reports (aggregated); supplier invoices and receipts; income tax (and, if registered, VAT) returns and assessments; correspondence with SARS and with an accountant |
| Store purchases | Sales reports and order or transaction records from Google Play and Apple (product, price, currency, country or region, date, refund status; no name or email address) |
| Mailing list | Subscriber email addresses, optional interest choices, signup and confirmation dates and times, signup technical data and unsubscribe records, held in Kit |
| Player support | Emails received at support@candlewren.com and our replies, including any screenshots or purchase details a player chose to send |
| Website | Website source and content; hosting and security logs held by Cloudflare (we see aggregates only) |
| Contracts and service providers | Agreements and terms with Google (Play, AdMob, Workspace/Gmail), Apple, Cloudflare, Kit and tool and content providers; related invoices and correspondence |
| Game development | Game source code, art, audio, design documents and build records; crash reports and statistics from Google and Apple (no names or contact details) |
| Legal and compliance | Privacy Policy, Terms of Use, this manual and earlier versions; records of PAIA and POPIA requests and how they were handled |
Game save data is not held by us. A player’s progress, settings and purchases-in-game state are stored only on the player’s own device (and in the device’s own backups run by Google or Apple). It is never sent to us, so we have no record of it and cannot give access to it.
8. How to request access to a record
8.1 Who may request access
Under section 50 of PAIA, a requester must be given access to a record of a private body if the record is required for the exercise or protection of any rights, the requester complies with PAIA’s procedural requirements, and no ground for refusal applies.
8.2 The request form
- Use Form 2 (“Request for Access to Record”, Regulation 7), available from https://inforegulator.org.za/paia-forms/ or from us by email.
- Send the completed form to the Information Officer by email to support@candlewren.com, or by post or hand delivery to the address in section 3 (by appointment).
- Attach proof of identity. If you request on behalf of someone else, attach proof of your authority to do so.
- Describe the record in enough detail for us to find it, say in what form and in which language you want access, and, as section 53 requires, identify the right you want to exercise or protect and explain why the record is needed for it.
- If you want to be told the decision in some other way as well, say so and give the details.
- If you cannot read or write, or have a disability that makes the form hard to complete, contact the Information Officer, who will help you complete Form 2.
8.3 Fees
Fees are set by Annexure B of the Regulations (fees for private bodies), as published by the Regulator. If any fee applies, we will tell you on Form 3 (“Outcome of Request and of Fees Payable”, Regulation 8) before we process the request further.
- Request fee: R140.00. This is not payable by a personal requester, meaning someone asking for a record that contains their own personal information (section 54(1)). Please pay it before we process the request.
- Access fees, payable only if access is granted:
| Item | Fee |
|---|---|
| Photocopy of an A4-size page | R2.00 per page or part of a page |
| Printed copy of an A4-size page | R2.00 per page or part of a page |
| Copy in computer-readable form on a flash drive (provided by the requester) | R40.00 |
| Copy on a compact disc provided by the requester / provided to the requester | R40.00 / R60.00 |
| Transcription of visual images, per A4-size page | Outsourced: cost as quoted by the service provider |
| Copy of visual images | Outsourced: cost as quoted by the service provider |
| Transcription of an audio record, per A4-size page | R24.00 |
| Copy of an audio record on a flash drive (provided by the requester) | R40.00 |
| Copy of an audio record on a compact disc provided by the requester / provided to the requester | R40.00 / R60.00 |
| Search for and preparation of the record, for each hour or part of an hour, excluding the first hour | R145.00, to a maximum of R435.00 |
| Postage, email or other electronic transfer | Actual cost |
- Deposit: if the search and preparation will take more than six hours, we may ask for a deposit of one third of the access fee before searching. If access is then refused, the deposit is refunded.
- Records are released only after the full access fee is paid.
- Inspecting a record in person, by appointment, is free; copies are charged as above.
- Emailing a record to you in electronic form is charged at the actual cost of transfer, which for us is normally nil.
8.4 Time limits
We will decide on a request and notify you within 30 days of receiving it (section 56). We may extend this once, by up to 30 more days, in the circumstances section 57 allows (for example a large number of records or a search that cannot reasonably be finished in time); we will tell you why before the first 30 days end. If we do not reply in time, the request is regarded as refused (section 58).
If a request concerns information about a third party, we must first inform that third party and give them the chance to make representations (sections 71 to 73), which follows its own time limits.
8.5 Grounds for refusal
We may refuse access only on the grounds in Chapter 4 of Part 3 of PAIA. These are:
- protecting the privacy of a third party who is a natural person, including a deceased person (section 63);
- protecting a third party’s commercial information, such as trade secrets or financial, commercial, scientific or technical information (section 64);
- protecting information supplied in confidence by a third party, where disclosure would breach a duty of confidence (section 65);
- protecting the safety of individuals and the security of property (section 66);
- protecting records privileged from production in legal proceedings (section 67);
- protecting our own commercial information, such as trade secrets, unreleased game designs, source code, and financial, commercial or technical information whose disclosure would be likely to cause us harm (section 68); and
- protecting research information of a third party or of ours (section 69).
Even where one of these grounds applies, access must be granted if the public interest override in section 70 applies. Where only part of a record is protected, we will give access to the rest of it (section 59). If we refuse, we will give adequate reasons and tell you how to challenge the decision.
8.6 Remedies
- Internal appeal: not available. PAIA’s internal appeal (section 74) applies only to public bodies.
- Complaint to the Regulator: if you are unhappy with our decision (including a refusal, a deemed refusal, the fees, an extension of time or the form of access), you may complain to the Information Regulator in writing, using Form 5 (Complaint Form, Regulation 10), within 180 days of the decision (sections 77A and 77B). Details are in section 4.7.
- Court: after the complaints procedure with the Regulator has been exhausted or withdrawn, you may apply to a court with jurisdiction (a Magistrate’s Court or the High Court) for appropriate relief within 180 days (sections 78 and 82).
9. Processing of personal information
This section summarises our Privacy Policy (https://candlewren.com/privacy/), which has the full detail.
9.1 Purpose of processing personal information
We process personal information only to:
- deliver and restore in-game purchases and keep accounts and tax records;
- fund the game through optional rewarded ads (Google AdMob), with ads non-personalised unless the player accepts personalised ads where that choice is offered;
- fix bugs, using crash reports from Google and Apple;
- deliver and protect the website;
- send news and, if requested, beta-test invitations to people who confirmed their signup to the mailing list;
- answer emails and support requests; and
- meet our legal obligations, including PAIA and POPIA requests.
We do not sell personal information and do not build profiles of players. The game has no accounts, login, chat or user-generated content, and does not ask for a player’s name, email, age or other contact details.
9.2 Categories of data subjects and personal information
| Category of data subjects | Personal information that may be processed |
|---|---|
| Players of Glimmerhop | Held by us: none that identifies a player. Received by Google through the ads SDK (as its own responsible party): IP address, Android advertising ID and app set ID or iOS IDFV (not the IDFA), ad interactions, diagnostics. Crash reports from Google and Apple: device model, operating-system version, crash data |
| Buyers of in-game items | From Google Play and Apple sales reports: order or transaction number, product, price, currency, country or region, date, refund status (no name, email or card details) |
| Mailing-list subscribers (adults 18+) | Email address, optional interest choices, signup source tag, signup and confirmation dates and times, technical signup data such as IP address (held by Kit) |
| People who email us | Email address, name if given, message content and attachments, purchase details they choose to send |
| Website visitors | IP address, browser type, pages requested and time, processed by Cloudflare to deliver and secure the site |
| Service providers and business contacts | Names, business contact details, invoices and payment details |
| PAIA and POPIA requesters | Name, contact details, proof of identity, the request and our response |
9.3 Recipients of personal information
| Category of personal information | Recipients or categories of recipients |
|---|---|
| Device identifiers, IP address and ad interactions (ads) | Google (AdMob), as an independent responsible party |
| Purchase and payment information | Google (Google Play) and Apple (App Store), as independent responsible parties |
| Mailing-list records | Kit (Kit.com), as our operator |
| Website traffic and email routing | Cloudflare, Inc., as our operator |
| Support emails | Google (Gmail), as our operator |
| Financial and tax records | Our accountant, if one is engaged, and the South African Revenue Service |
| Any of the above, where the law requires it | Courts, regulators and law-enforcement authorities |
| Any of the above, if the business is sold | A buyer of Glimmerhop or Candlewren Games, bound by the Privacy Policy |
9.4 Planned transborder flows of personal information
Yes. Google, Apple, Cloudflare and Kit process information in the United States and other countries, mainly for ads, store purchases, website hosting, email routing and the mailing list. These transfers rely on section 72 of POPIA: our providers are bound by data processing terms giving protection substantially similar to POPIA’s, and some transfers are needed to perform what the data subject asked for (for example delivering a purchase or answering an email). Personal information received from the UK, the EEA and Switzerland is protected as the Privacy Policy and POPIA require.
9.5 Security measures
- Minimisation: we hold as little personal information as possible; game progress stays on the player’s device.
- Encryption in transit: the website is served only over HTTPS; purchase information passes between the device and the store over encrypted connections; Google states that its ads SDK encrypts data in transit.
- Access control: our accounts with Google, Apple, Kit and Cloudflare are protected with strong passwords and two-factor authentication, and only the owner has access.
- Reputable operators: providers are bound by their data processing terms and their own security programmes.
- Retention limits: records are deleted at the end of the periods in section 9 of the Privacy Policy.
- Breach response: if a security compromise affects personal information, we will notify the Information Regulator and the data subjects as section 22 of POPIA requires.
10. Availability of this manual
10.1 This manual is available:
- on our website at https://candlewren.com/paia/;
- at our principal place of business (section 3) for inspection, by appointment, during normal business hours;
- to any person on request: by email free of charge, or as a printed copy at R2.00 per A4-size page (Annexure B of the Regulations); and
- to the Information Regulator on request.
11. Updating of this manual
The head of Candlewren Games will review and update this manual regularly, and whenever our records, processing or contact details change. The current version is always the one on the website.
Issued by Timm Roark Garde, head of the private body and Information Officer, trading as Candlewren Games.