Privacy & POPIA Notice

This notice explains how Propzo processes personal information under South Africa’s Protection of Personal Information Act, 2013 (“POPIA”). It applies to visitors, account users and information processed through the Propzo service.

1. Our roles

Propzo is the responsible party for account, website, billing, security and support information that we determine how to use. When a property manager or landlord uploads information about tenants, applicants, payments, rentals or properties, that Customer ordinarily acts as the responsible party and Propzo acts as its operator. Requests about Customer-managed rental records should first be directed to that Customer.

2. Information we process

• Identity and account details, including name, email, role, organisation, password credentials in protected form, login and consent records.
• Property and rental data, tenant contact and identification details, agreements, drawn electronic signatures, charges, payments, expenses, documents and maintenance records.
• Billing information and Paystack transaction, customer and subscription references. Propzo does not need to store complete payment-card details.
• Communication information, including configured WhatsApp destination numbers, message content, status, delivery and retry logs.
• Technical and security data, such as IP address, browser or device information, timestamps, audit logs, error logs and identifiers.
• Support messages and any information voluntarily supplied to us.

3. Sources

We collect information directly from users; from their organisation or authorised team members; from configured services such as Paystack and WhatsApp providers; and automatically when the service is used. Customers decide what tenant and portfolio information to enter and must collect it lawfully.

4. Purposes and lawful justification

We process information to register and authenticate users; provide rental-management functions; calculate and record charges and payments; deliver requested communications; process subscriptions; prevent fraud and duplicate transactions; maintain audit trails; secure, support and improve the service; comply with law; and establish or defend legal claims. Depending on the context, processing is justified by contract, consent, legal obligation, protection of legitimate interests, or the Customer’s documented instructions. Consent may be withdrawn where consent is the applicable basis, without affecting earlier lawful processing.

5. Mandatory information and consequences

Fields marked as required are needed to create an account or perform a requested function. Without them we may be unable to provide that function. Customers should not upload optional personal information unless it is relevant, adequate and not excessive for rental administration.

6. Sharing and operators

We do not sell personal information. We may disclose it to authorised members of the Customer’s organisation; infrastructure, hosting, email, monitoring, backup and support providers; Paystack for subscription payments; configured WhatsApp or communications providers; professional advisers; regulators or law-enforcement bodies where lawfully required; and a successor in a legitimate business transfer. Providers receive only information reasonably needed for their function and are subject to appropriate contractual or legal duties.

7. Cross-border transfers

Some service providers may process information outside South Africa. Where this occurs, we use a basis permitted by section 72 of POPIA, such as an adequate legal framework, binding agreement providing an adequate level of protection, necessity for performance of a contract, or informed consent where appropriate. Contact us for current information about material operator locations.

8. Retention and deletion

Account and Customer data is retained while the account is active. After closure, data is deleted or de-identified within a reasonable operational period, ordinarily 90 days, subject to backups cycling out and longer retention required for tax, accounting, fraud prevention, security, dispute or legal obligations. Consent, billing and security evidence may be retained for the applicable legal prescription period. Customers can export records before closure and should define their own lawful tenant-record retention schedule.

9. Security and incidents

We use organisation-level access controls, role permissions, transaction safeguards, audit records, encrypted transport where deployed correctly, backups and operational monitoring. Customers are responsible for user access, endpoint security and secure configuration. If we reasonably believe personal information has been accessed or acquired by an unauthorised person, we will follow POPIA’s notification requirements and, when acting as operator, notify the responsible Customer without undue delay.

10. Your POPIA rights

Subject to POPIA, a data subject may ask whether personal information is held; request access; request correction, deletion or destruction of inaccurate, irrelevant, excessive, outdated, incomplete, misleading or unlawfully obtained information; object to certain processing; withdraw consent; and complain to the Information Regulator. We may need to verify identity and may retain information where law permits or requires it.

For data controlled by a Propzo Customer, contact that landlord or property manager first. For Propzo-controlled information, email hello@propzo.co.za with “POPIA Request” in the subject. We will acknowledge and handle a valid request within the periods required by law.

11. Direct marketing and WhatsApp

Customers must have an appropriate lawful basis before sending rent notices or marketing communications. Service messages about an existing rental relationship are configured by the Customer. Marketing messages must meet POPIA and Electronic Communications and Transactions Act requirements, identify the sender and provide an effective opt-out. Recipients may ask the relevant Customer to stop communications.

12. Cookies and local storage

Propzo uses essential session and security technologies needed for login, preferences and application operation. If non-essential analytics or advertising technologies are introduced, this notice and the consent experience must be updated before use.

13. Automated processing

Propzo may automatically calculate balances, create recurring charges or expenses and schedule reminders according to Customer settings. These tools support administration and are not intended to make solely automated decisions that produce legal or similarly significant effects about a person. Customers must review outputs and decisions.

14. Children

Propzo is intended for business users and is not directed to children. Customers must not add a child’s information unless they have lawful authority and it is necessary for legitimate rental administration.

15. Changes and complaints

We may update this notice and will publish the version and effective date. Material changes will be communicated through the service or email. Questions or complaints may be sent to hello@propzo.co.za. You may also complain to the Information Regulator using the contact details published at inforegulator.org.za.