Privacy Policy

1. 1. Who we are and what this policy covers

   PropertyPA (Pty) Ltd (registration number 2024/476468/07) is a South African private company with its registered office at WeWork — The Link, 173 Oxford Road, Rosebank, Johannesburg, Gauteng, 2196 ("PropertyPA", "we", "us"). We operate the PropertyPA rental platform at www.propertypa.co.za.

   This policy explains how we handle personal information as the "responsible party" under the Protection of Personal Information Act, 4 of 2013 ("POPIA"). It covers the website, the platform, the pre-launch waitlist and our emails. Our Information Officer can be reached at info@propertypa.co.za.

2. 2. The information we collect

   • Account and profile information — name, email address, phone number, role (landlord or tenant), and profile details you add.
   • Identity and screening information — when you request or consent to screening: your South African ID number, identity verification results (including the Home Affairs photo used for matching), credit report data, and bank-transaction-based affordability results.
   • Property and tenancy information — property details, listings, photos, applications, viewings, lease agreements and signatures, inspection and maintenance records.
   • Financial information — rent amounts, deposits, payment references and reconciliation records, and subscription billing history. We do not store card numbers; our payment processor handles those.
   • Messages and support — messages you exchange with other users on the platform and correspondence with us.
   • Waitlist information — name, email address, self-declared interest (landlord/tenant) and province.
   • Technical information — log, device and usage data, and analytics events (only after you accept cookies — see section 11).

3. 3. Where it comes from

   Most personal information comes directly from you — when you register, list a property, apply for one, sign a lease or contact us. Screening results come from third-party verification providers acting on a check you consented to. Some technical information is generated by your use of the platform itself.

4. 4. Why we process it, and on what basis

   We process personal information only for these purposes:

   • To provide the platform (POPIA basis: performing our contract with you) — accounts, listings, applications, leases, payments, inspections, maintenance and messaging.
   • To run screening you or an applicant consented to (basis: consent) — identity verification, credit checks and affordability assessment.
   • To keep the platform secure and improve it (basis: our legitimate interests) — fraud prevention, rate limiting, error monitoring, and consented analytics.
   • To meet legal obligations (basis: compliance with law) — tax and accounting records, lawful requests from authorities.
   • To send marketing and launch email you signed up for (basis: consent) — every message includes an unsubscribe link.

   We collect the minimum needed for each purpose and do not use personal information for unrelated purposes without telling you first.

5. 5. Tenant screening: consent and safeguards

   • No screening check runs without the explicit consent of the person being screened, given per check — not blanket consent buried in sign-up.
   • South African ID numbers are encrypted at field level in our database. They are never stored in plain text and are decrypted only to perform a check you consented to.
   • Screening results are shown to the landlord you chose to share them with, as decision support. Consent can be revoked, and revocation is communicated to the landlord.
   • Disputes about the content of a credit report must be raised with the credit bureau that produced it; we will tell you which provider was used.

6. 6. Who we share it with

   We do not sell personal information — to anyone, for any purpose. We share it only as needed to operate the platform:

   • Other platform users, to the extent the rental relationship requires — a landlord sees the applications and screening results shared with them; a tenant sees their lease and landlord contact details.
   • Verification providers, to perform checks you consented to — identity, credit and bank-transaction checks (for example Home Affairs identity verification and TransUnion credit data via our verification partner, Gathr).
   • Service providers who process data on our behalf — hosting and database infrastructure, file storage, payment processing, email delivery, error monitoring and analytics. Each is bound to process personal information only on our instructions.
   • Authorities, where the law requires it — under a valid legal obligation or court order.

7. 7. Cross-border transfers

   Some of our service providers (for example hosting, email delivery and error monitoring) store data outside South Africa. Where personal information leaves the country, we rely on POPIA section 72: the recipient is subject to contractual protections that uphold principles substantially similar to POPIA. We do not transfer personal information to providers who cannot give that assurance.

8. 8. How we secure it

   • Encryption in transit (HTTPS everywhere) and field-level encryption of South African ID numbers at rest.
   • Row-level security on the database and role-based access control in the application — users see only what belongs to them.
   • Rate limiting on sensitive endpoints, and continuous error monitoring.
   • Access to production data is restricted to the small team that operates the platform.

   If a security compromise affecting your personal information ever occurs, we will notify the Information Regulator and affected users as POPIA section 22 requires.

9. 9. How long we keep it

   • Account data is kept while your account is active.
   • Lease agreements, payment and financial records are kept as long as tax, accounting and rental legislation require, even after an account closes.
   • Screening results are tied to the application they were run for and are not reused for later applications without fresh consent.
   • Waitlist entries are kept until launch communications end or you unsubscribe.
   • When you request erasure, a 30-day grace period runs first (so an accidental request can be reversed), after which personal information is deleted except where law requires retention.

10. 10. Your rights

    Under POPIA you can, at any time:

    • Access and export the personal information we hold about you — self-service, from your account settings.
    • Ask us to correct information that is wrong or incomplete.
    • Object to processing based on our legitimate interests.
    • Withdraw consent you previously gave (this stops future processing; it does not undo processing already done).
    • Request deletion of your account and personal information (see the grace period above).
    • Complain to the Information Regulator (see section 15).

    Exercising any of these rights is free. We respond to requests we cannot fulfil self-service within a reasonable time, and never later than the periods POPIA and PAIA prescribe.

11. 11. Cookies and analytics

    The platform uses essential cookies for signing in and keeping your session secure — these are required for the site to work. Analytics run only after you accept cookies in the consent banner. If you decline, no analytics tracking is initialised at all. You can change your choice at any time by clearing cookies for the site.

12. 12. Marketing email and unsubscribing

    We send marketing and launch email only to people who joined the waitlist or opted in. Every message carries an unsubscribe link that works without signing in; unsubscribing removes you from our mailing lists immediately. Service email about your account or an active lease (for example a screening result or signature request) is not marketing and is sent as part of operating the platform.

13. 13. Children

    The platform is for adults concluding rental agreements. We do not knowingly collect personal information from anyone under 18, except where a lease you upload or conclude necessarily mentions household members. If you believe a child’s information has been given to us in error, contact us and we will delete it.

14. 14. Changes to this policy

    When we change this policy materially — new processing purposes, new categories of recipients — we will notify registered users by email or in-app notice before the change takes effect, and update the date at the top of this page. Continuing to use the platform after the effective date is acceptance of the updated policy.

15. 15. Complaints and contact

    Questions, requests and complaints about personal information: the Information Officer, PropertyPA (Pty) Ltd, at info@propertypa.co.za or WeWork — The Link, 173 Oxford Road, Rosebank, Johannesburg, Gauteng, 2196. We would appreciate the chance to resolve any concern first.

    You can also complain directly to the Information Regulator (South Africa): JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001; enquiries@inforegulator.org.za; inforegulator.org.za.

See also our PAIA & POPIA Manual (the formal section 51 disclosures) and Terms of Service. Questions about your data? Email info@propertypa.co.za.