BEVA Direct Services CC · Prepared under section 51 of the Promotion of Access to Information Act, 2000 · Last updated: 5 November 2026
The Promotion of Access to Information Act, 2000 (“PAIA”) gives everyone the right to request access to records held by a private body when the record is required to exercise or protect a right. This manual explains which records BEVA Direct Services CC (trading as TravelFlow) holds, how to ask for them, and how we process personal information under the Protection of Personal Information Act, 2013 (“POPIA”).
Private body: BEVA Direct Services CC, a close corporation, registration number 2002/004277/23, trading as TravelFlow
Head of the private body and Information Officer: Lynette Biyela
Street and postal address: 24 Chief Mgiyeni Khumalo Drive, White River, 1240, Mpumalanga, South Africa
Telephone: +27 13 750 0329
E-mail: admin@travelflow.co.za
Website: https://www.travelflow.co.za
The Information Regulator has published a Guide, in each official language, on how to use PAIA and POPIA to exercise your rights (PAIA s10). It is available on the Regulator's website and from the Regulator:
Information Regulator (South Africa)
Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191
Telephone: 010 023 5200 · E-mail: enquiries@inforegulator.org.za
Website: https://inforegulator.org.za
A copy of the Guide can also be inspected at our offices during business hours.
We have not published a notice under section 52 of PAIA. The information on our website, including our Privacy Policy, Terms of Service and this manual, is freely available. Users can see their own bookings, documents and profile in their account.
We keep records in terms of the following legislation, where it applies to our business:
| Subject | Categories of records |
|---|---|
| Statutory and corporate | Founding statement and amendments, members’ records and resolutions, registrations with CIPC and SARS. |
| Financial and tax | Accounting records, annual financial statements, invoices, credit notes, receipts, bank statements, tax and VAT returns and their supporting records. |
| Clients and travellers | Client and traveller profiles, travel requests and approvals, bookings, quotations, vouchers, itineraries, invoices, payment records, signed quotation acceptances, correspondence and support tickets. |
| Organisations using the platform | Organisation details, users and roles, travel policies, budgets and approval settings, agreements and correspondence. |
| Suppliers | Supplier details and contact people, account terms, supplier payment requests and payments, agreements and correspondence. |
| Employees | Employment contracts, personnel records, payroll and tax records, leave and benefit records. |
| Platform and security | User accounts, audit trails, security and session logs, system configuration. |
| Marketing | Marketing consent records and marketing material. |
| Legal | Agreements, policies, licences, correspondence with authorities, and records of disputes. |
We process personal information to arrange and manage travel bookings, run organisations' travel programmes, take payments and keep accounting and tax records, provide support, keep the platform secure, comply with the law, and, with consent, send marketing.
| Data subjects | Personal information |
|---|---|
| Private travellers and travellers booked by others | Names, contact details, dates of birth, nationality, identity or passport numbers, frequent-traveller numbers, emergency contacts, booking and payment history, special requests (which may reveal religious belief or health), signatures on accepted quotations, messages. |
| Children travelling | Names, dates of birth or ages, and identity or passport details, given by a parent, guardian or other authorised person. |
| Employees and travel arrangers of organisations | Names, contact details, job title and department, travel requests and approvals, and, where an organisation uses the accounting module, payroll information. |
| Suppliers and their contact people | Names, contact details, account terms and bank details. |
| Our own employees | Identity and contact details, employment, payroll, tax and benefit records. |
| Website and platform users | Account details, sign-in and security records (device, times, and IP address of failed sign-ins). |
Travel suppliers (our accommodation supplier RateHawk, hotels, airlines and other providers), our payment processor PayU, our service providers (Google for database, storage, sign-in and maps; Vercel for hosting; Twilio SendGrid for e-mail), the organisation a traveller travels for, and authorities such as SARS where the law requires.
Our database and file storage are in South Africa. Personal information is transferred abroad to the travel suppliers that provide a booking, and to service providers that operate internationally (Google, Vercel, Twilio SendGrid, PayU and RateHawk), as our Privacy Policy describes.
Encrypted connections; encryption of bank account details at rest; role-based access with each organisation's records kept apart, enforced by database rules as well as the application; two-step sign-in, password policies, account lock-out after failed sign-ins and session controls; an audit trail of important actions; and data stored with established cloud providers.
The fees are those prescribed by the PAIA Regulations, 2021: currently a request fee of R140, plus fees for searching for, preparing and reproducing the record, as set out in the Information Regulator's fee schedule. Before we proceed, we will tell you (on Form 03) of any fee and deposit payable. Confirming whether we hold personal information about you is free of charge (POPIA s23).
We will decide on your request within 30 days, and may extend this once, by up to 30 days, in the circumstances PAIA s57 allows, telling you why. We may refuse access only on the grounds in Chapter 4 of Part 3 of PAIA, for example to protect another person's privacy, commercial information or confidential information, or legally privileged records. Where a request concerns a third party's information, we will notify them as PAIA requires.
You may complain to the Information Regulator (PAIAComplaints@inforegulator.org.za) or apply to court, within 180 days of our decision.
This manual is published on our website at https://www.travelflow.co.za/paia, can be inspected at our offices during business hours, and a copy will be provided to anyone, or to the Information Regulator, on request. We review it regularly and update it when our records or processing change.
© 2026 TravelFlow, a BEVA Direct Services Company. BEVA Direct Services CC (Reg. 2002/004277/23).