PAIA & POPIA Manual

1. Purpose of this manual

PAIA gives effect to the constitutional right of access to information. Section 51 requires every private body to publish a manual explaining what records it holds and how to request access to them. POPIA additionally requires this manual to describe how the body processes personal information. This manual does both for PropertyPA (Pty) Ltd (“PropertyPA”, “we”, “us”), the operator of the PropertyPA rental management platform at www.propertypa.co.za.

2. Contact details (section 51(1)(a))

• Private body: PropertyPA (Pty) Ltd, a private company incorporated in the Republic of South Africa
• Registration number: 2024/476468/07
• Head of the private body & Information Officer: The Director, PropertyPA (Pty) Ltd
• Registered office & postal address: WeWork — The Link, 173 Oxford Road, Rosebank, Johannesburg, Gauteng, 2196
• Email (all PAIA and POPIA matters): info@propertypa.co.za
• Website: www.propertypa.co.za

3. The Information Regulator's guide (section 51(1)(b))

The Information Regulator has published a guide, in each official language, on how to use PAIA (the section 10 Guide). It explains the objects of PAIA, how to make a request, the assistance available from the Regulator, and the remedies available when access is refused. The Guide is available from:

• The Information Regulator (South Africa), JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001
• Website: inforegulator.org.za
• Email: enquiries@inforegulator.org.za

4. Records available without a PAIA request

The following information is publicly available and does not require a formal request: the content of the www.propertypa.co.za website, including product and pricing information, the Terms of Service, the Privacy Policy and this manual. Registered users can additionally access and export their own personal information directly from their account (see section 9).

5. Records held in terms of other legislation

Records are kept, where applicable, in accordance with legislation including:

• Companies Act 71 of 2008 (statutory and governance records)
• Income Tax Act 58 of 1962 and Value-Added Tax Act 89 of 1991 (financial and tax records)
• Electronic Communications and Transactions Act 25 of 2002 (electronic records and transactions)
• Protection of Personal Information Act 4 of 2013 (personal information records)
• Consumer Protection Act 68 of 2008 (consumer and transaction records)
• Rental Housing Act 50 of 1999 (lease-related records processed on behalf of platform users)

6. Categories of records we hold (section 51(1)(d))

Company records:

• Statutory, governance and financial records
• Contracts with suppliers and service providers
• Marketing records, including the pre-launch waitlist

Platform records (held for or about platform users):

• Account and profile information (name, contact details, role)
• Property, listing and viewing records
• Rental applications and tenant screening records, including identity verification, credit report and affordability results obtained with the data subject’s consent
• Lease agreements, signatures and cancellation records
• Payment, deposit and reconciliation records
• Inspection, maintenance and utility records
• Messages sent between platform users, and support correspondence

7. How to request access to a record (section 51(1)(e))

A requester must complete the prescribed request form (Form 2 in the PAIA Regulations, 2021, available from the Information Regulator’s website) and send it to info@propertypa.co.za. The request must:

• Identify the record(s) requested with enough detail for us to find them
• State which right the requester is exercising or protecting, and why the record is required for that purpose
• Provide the requester’s identity and contact details, and the preferred form of access
• If made on another person’s behalf, include proof of the capacity in which the request is made

Fees. PAIA prescribes the fees a private body may charge (Annexure 2 to the PAIA Regulations, 2021). A request fee (currently R140.00) is payable on submission, except by a personal requester — someone requesting records about themselves — who pays no request fee. Access and reproduction fees (for example R2.00 per A4 page) and postage may also be charged as prescribed. We will notify the requester of the applicable fees before processing.

Timing. We will decide a request within 30 days of receiving it, or notify the requester if an extension of up to a further 30 days is required as permitted by PAIA.

8. Grounds for refusal and remedies

Access may or must be refused on the grounds set out in Chapter 4 of Part 3 of PAIA — for example to protect the privacy of a third party, commercial confidence, or legally privileged records. If a request is refused, the requester will be given written reasons. A requester who disagrees with a refusal may apply to the Information Regulator or a court with jurisdiction, as set out in PAIA and the section 10 Guide.

9. Processing of personal information (POPIA)

Purpose of processing. We process personal information to operate the PropertyPA platform: creating and managing accounts, publishing property listings, processing rental applications, performing tenant screening that the data subject has consented to (identity verification, credit checks and affordability assessment), generating and managing lease agreements, tracking rental payments, facilitating maintenance and inspections, providing support, and sending service and — with consent — marketing communications.

Categories of data subjects and information. Landlords and tenants (identity and contact details, South African ID numbers, screening and financial information, lease and payment records); prospective users on the waitlist (name, email address, self-declared interest and province); and suppliers or service providers (business contact details).

Recipients. Personal information is shared only with the operators who process it on our behalf or the providers who perform the checks a data subject requests: our hosting and database providers, verification providers (identity, credit and bank-transaction checks — for example Home Affairs identity verification and TransUnion credit reports via Gathr), payment processors, email delivery providers, and error-monitoring and analytics services. We do not sell personal information.

Cross-border transfers.Some service providers (for example hosting, email delivery and error monitoring) store data outside South Africa. We only use providers whose contractual safeguards provide a level of protection consistent with POPIA’s conditions for transborder information flows.

Security measures. Reasonable, appropriate technical and organisational measures protect personal information, including encryption in transit, field-level encryption of South African ID numbers at rest, role-based access control, row-level security on the database, rate limiting, and error monitoring. Consent is obtained at registration before processing begins, and analytics only run after cookie consent.

Data subject rights. Data subjects may access and export the personal information we hold about them (self-service from their account), request correction, object to processing, withdraw consent, and request erasure. Erasure requests enter a 30-day grace period, after which personal information is deleted. Complaints may be lodged with the Information Regulator using the contact details in section 3.

10. Availability of this manual

This manual is available free of charge on www.propertypa.co.za/paia and by email request to info@propertypa.co.za. It is updated whenever the way we hold or process records changes materially.

See also our Privacy Policy and Terms of Service.